Function at 0x1400411f0
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x48]
sub rsp, 0x148
mov qword [rbp + 0x38], 0xfffffffffffffffe
mov r12, rdx
call fcn.14004aa80
mov rcx, rax
test rax, rax
je 0x140042507
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp - 0x78], rax
call fcn.14004aa80
mov rcx, rax
test rax, rax
je 0x140042512
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x70], rax
call fcn.14004aa80
mov rcx, rax
test rax, rax
je 0x14004251d
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x58], rax
call fcn.14004aa80
mov rcx, rax
test rax, rax
je 0x140042528
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp - 0x80], rax
call fcn.14004aa80
mov rcx, rax
test rax, rax
je 0x140042533
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x68], rax
call fcn.14004aa80
mov rcx, rax
test rax, rax
je 0x14004253e
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x50], rax
call fcn.14004aa80
mov rcx, rax
test rax, rax
je 0x140042549
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x78], rax
call fcn.14004aa80
mov rcx, rax
test rax, rax
je 0x140042554
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x60], rax
call fcn.14004aa80
mov rcx, rax
test rax, rax
je 0x14004255f
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x48], rax
call fcn.14004aa80
mov rcx, rax
test rax, rax
je 0x1400424fc
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov qword [rbp - 0x70], 0
mov dword [rbp - 0x68], 0
mov qword [rbp - 0x60], 0
mov r9d, 0x2001f
lea r8, str.SOFTWARERealtekSpkProtection
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x70]
call fcn.14000ddf0
test eax, eax
je 0x14004154b
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.SOFTWARERealtekSpkProtection
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x70]
call fcn.1400147b0
test eax, eax
je 0x14004154b
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x1400413eb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140041411
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140041430
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004144f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004146e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004148d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400414ac
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400414ca
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400414e9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140041508
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140041526
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r12]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140041541
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 2
jmp 0x1400424e8
mov dword [rbp + 0xa8], 0x3b
mov qword [rbp + 0x18], 0
xor esi, esi
mov dword [rbp + 0x90], esi
mov rax, qword [r12]
cmp dword [rax - 8], 1
jle 0x14004157a
mov edx, dword [rax - 0x10]
mov rcx, r12
call fcn.1400052d0
lea r8, [rbp + 0x18]
lea rdx, [rbp + 0xa8]
mov rcx, qword [r12]
call fcn.1401f0ad0
mov rbx, rax
xor r15d, r15d
mov dword [rbp + 0xa0], r15d
lea rdi, [r15 - 1]
mov r14, qword [rbp - 0x70]
test rax, rax
je 0x1400422c3
lea r13, [0x140000000]
lea r12d, [r15 + 1]
nop word [rax + rax]
lea rdx, [0x140289c50]
mov rcx, rbx
call fcn.1401f0884
test eax, eax
je case.default.0x140041606
lea rdx, [0x140289c54]
mov rcx, rbx
call fcn.1401f0884
test eax, eax
je case.default.0x140041606
cmp r15d, 6
ja case.default.0x140041606
movsxd rax, r15d
mov ecx, dword [r13 + rax*4 + 0x4256c]
add rcx, r13
jmp rcx
test rbx, rbx
jne 0x140041611
xor eax, eax
jmp 0x14004161e
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x140041614
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x78]
call fcn.1400054e0
mov rbx, qword [rbp - 0x78]
movsxd r13, dword [rbx - 0x10]
cmp r13d, 4
jle 0x1400417dc
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x140041653
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x140041661
call fcn.14004aa80
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
lea rcx, [rbx - 8]
lea rdx, [rcx + r13*2]
mov r9, rax
mov r8d, 4
lea rcx, [rbp + 0x20]
call fcn.14000db20
nop
mov rdx, qword [rbp + 0x20]
lea r14, [rdx - 0x18]
mov rsi, qword [rsp + 0x58]
add rsi, 0xffffffffffffffe8
cmp r14, rsi
je 0x1400416e5
cmp dword [rsi + 0x10], 0
jl 0x1400416d6
mov rax, qword [rsi]
cmp qword [r14], rax
jne 0x1400416d6
mov rcx, r14
call fcn.140004c20
mov r15, rax
mov ecx, edi
lock xadd dword [rsi + 0x10], ecx
sub ecx, 1
jg 0x1400416c4
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r15 + 0x18]
mov qword [rsp + 0x58], rax
mov r15d, dword [rbp + 0xa0]
jmp 0x1400416e5
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.1400054e0
nop
mov eax, edi
lock xadd dword [r14 + 0x10], eax
sub eax, 1
jg 0x1400416fe
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r14
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea eax, [r13 - 4]
xor esi, esi
test eax, eax
cmovns esi, eax
cmp esi, dword [rbx - 0x10]
jl 0x140041721
lea rcx, [rbx - 0x18]
call fcn.140004c20
lea rdx, [rax + 0x18]
mov qword [rbp], rdx
jmp 0x14004175a
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x140041735
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x140041743
call fcn.14004aa80
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov r9, rax
mov r8d, esi
mov rdx, qword [rbp - 0x78]
lea rcx, [rbp]
call fcn.14000db20
mov rdx, qword [rbp]
lea rsi, [rdx - 0x18]
mov rbx, qword [rsp + 0x70]
add rbx, 0xffffffffffffffe8
cmp rsi, rbx
je 0x1400417b8
cmp dword [rbx + 0x10], 0
jl 0x1400417a9
mov rax, qword [rbx]
cmp qword [rsi], rax
jne 0x1400417a9
mov rcx, rsi
call fcn.140004c20
mov r14, rax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14004179e
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r14 + 0x18]
mov qword [rsp + 0x70], rax
jmp 0x1400417b8
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x70]
call fcn.1400054e0
nop
mov eax, edi
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x1400417d0
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r14, qword [rbp - 0x70]
mov r12d, 1
jmp 0x140041850
lea rcx, [rbx - 0x18]
mov rsi, qword [rsp + 0x58]
add rsi, 0xffffffffffffffe8
cmp rcx, rsi
je 0x14004183c
cmp dword [rsi + 0x10], 0
jl 0x14004182c
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x14004182c
call fcn.140004c20
mov rbx, rax
mov ecx, edi
lock xadd dword [rsi + 0x10], ecx
sub ecx, 1
jg 0x14004181d
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x58], rax
mov r14, qword [rbp - 0x70]
jmp 0x14004183c
mov r8d, r13d
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.1400054e0
mov r8d, r12d
lea rdx, [0x140283418]
lea rcx, [rsp + 0x70]
call fcn.1400054e0
mov rax, qword [rsp + 0x58]
cmp dword [rax - 8], 1
jle 0x140041868
mov edx, dword [rax - 0x10]
lea rcx, [rsp + 0x58]
call fcn.1400052d0
xor edx, edx
lea r8d, [rdx + 0x10]
mov rcx, qword [rsp + 0x58]
call fcn.1401ef854
mov esi, eax
mov rcx, qword [rsp + 0x70]
cmp dword [rcx - 8], 1
jle 0x140041897
mov edx, dword [rcx - 0x10]
lea rcx, [rsp + 0x70]
call fcn.1400052d0
mov rcx, qword [rsp + 0x70]
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.1401ef854
mov ebx, eax
mov dword [rbp - 0x58], eax
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [0x140289c58]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp - 0x50], esi
lea rax, [rbp - 0x50]
lea rdx, str.R0_L_LSB
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r13, [0x140000000]
test ebx, ebx
je 0x1400420d2
mov esi, r12d
mov dword [rbp + 0x90], r12d
jmp case.default.0x140041606
test rbx, rbx
jne 0x140041925
xor eax, eax
jmp 0x14004193a
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140041930
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x80]
call fcn.1400054e0
mov rbx, qword [rbp - 0x80]
movsxd r13, dword [rbx - 0x10]
cmp r13d, 4
jle 0x140041af8
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x14004196f
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x14004197d
call fcn.14004aa80
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
lea rcx, [rbx - 8]
lea rdx, [rcx + r13*2]
mov r9, rax
mov r8d, 4
lea rcx, [rbp + 0x28]
call fcn.14000db20
nop
mov rdx, qword [rbp + 0x28]
lea r14, [rdx - 0x18]
mov rsi, qword [rsp + 0x50]
add rsi, 0xffffffffffffffe8
cmp r14, rsi
je 0x140041a01
cmp dword [rsi + 0x10], 0
jl 0x1400419f2
mov rax, qword [rsi]
cmp qword [r14], rax
jne 0x1400419f2
mov rcx, r14
call fcn.140004c20
mov r15, rax
mov ecx, edi
lock xadd dword [rsi + 0x10], ecx
sub ecx, 1
jg 0x1400419e0
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r15 + 0x18]
mov qword [rsp + 0x50], rax
mov r15d, dword [rbp + 0xa0]
jmp 0x140041a01
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x50]
call fcn.1400054e0
nop
mov eax, edi
lock xadd dword [r14 + 0x10], eax
sub eax, 1
jg 0x140041a1a
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r14
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea eax, [r13 - 4]
xor esi, esi
test eax, eax
cmovns esi, eax
cmp esi, dword [rbx - 0x10]
jl 0x140041a3d
lea rcx, [rbx - 0x18]
call fcn.140004c20
lea rdx, [rax + 0x18]
mov qword [rbp + 8], rdx
jmp 0x140041a76
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x140041a51
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x140041a5f
call fcn.14004aa80
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov r9, rax
mov r8d, esi
mov rdx, qword [rbp - 0x80]
lea rcx, [rbp + 8]
call fcn.14000db20
mov rdx, qword [rbp + 8]
lea rsi, [rdx - 0x18]
mov rbx, qword [rsp + 0x68]
add rbx, 0xffffffffffffffe8
cmp rsi, rbx
je 0x140041ad4
cmp dword [rbx + 0x10], 0
jl 0x140041ac5
mov rax, qword [rbx]
cmp qword [rsi], rax
jne 0x140041ac5
mov rcx, rsi
call fcn.140004c20
mov r14, rax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140041aba
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r14 + 0x18]
mov qword [rsp + 0x68], rax
jmp 0x140041ad4
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x68]
call fcn.1400054e0
nop
mov eax, edi
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x140041aec
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r14, qword [rbp - 0x70]
mov r12d, 1
jmp 0x140041b6c
lea rcx, [rbx - 0x18]
mov rsi, qword [rsp + 0x50]
add rsi, 0xffffffffffffffe8
cmp rcx, rsi
je 0x140041b58
cmp dword [rsi + 0x10], 0
jl 0x140041b48
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x140041b48
call fcn.140004c20
mov rbx, rax
mov ecx, edi
lock xadd dword [rsi + 0x10], ecx
sub ecx, 1
jg 0x140041b39
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x50], rax
mov r14, qword [rbp - 0x70]
jmp 0x140041b58
mov r8d, r13d
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.1400054e0
mov r8d, r12d
lea rdx, [0x140283418]
lea rcx, [rsp + 0x68]
call fcn.1400054e0
mov rax, qword [rsp + 0x50]
cmp dword [rax - 8], 1
jle 0x140041b84
mov edx, dword [rax - 0x10]
lea rcx, [rsp + 0x50]
call fcn.1400052d0
xor edx, edx
lea r8d, [rdx + 0x10]
mov rcx, qword [rsp + 0x50]
call fcn.1401ef854
mov ebx, eax
mov rcx, qword [rsp + 0x68]
cmp dword [rcx - 8], 1
jle 0x140041bb3
mov edx, dword [rcx - 0x10]
lea rcx, [rsp + 0x68]
call fcn.1400052d0
mov rcx, qword [rsp + 0x68]
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.1401ef854
mov dword [rbp - 0x48], eax
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.R0_R_MSB
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp - 0x40], ebx
lea rax, [rbp - 0x40]
lea rdx, str.R0_R_LSB
jmp 0x1400418df
test rbx, rbx
jne 0x140041c07
xor eax, eax
jmp 0x140041c1a
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140041c10
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.1400054e0
mov rbx, qword [rsp + 0x78]
movsxd r13, dword [rbx - 0x10]
cmp r13d, 4
jle 0x140041ddb
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x140041c51
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x140041c5f
call fcn.14004aa80
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
lea rcx, [rbx - 8]
lea rdx, [rcx + r13*2]
mov r9, rax
mov r8d, 4
lea rcx, [rbp + 0x30]
call fcn.14000db20
nop
mov rdx, qword [rbp + 0x30]
lea r14, [rdx - 0x18]
mov rsi, qword [rsp + 0x48]
add rsi, 0xffffffffffffffe8
cmp r14, rsi
je 0x140041ce3
cmp dword [rsi + 0x10], 0
jl 0x140041cd4
mov rax, qword [rsi]
cmp qword [r14], rax
jne 0x140041cd4
mov rcx, r14
call fcn.140004c20
mov r15, rax
mov ecx, edi
lock xadd dword [rsi + 0x10], ecx
sub ecx, 1
jg 0x140041cc2
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r15 + 0x18]
mov qword [rsp + 0x48], rax
mov r15d, dword [rbp + 0xa0]
jmp 0x140041ce3
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x48]
call fcn.1400054e0
nop
mov eax, edi
lock xadd dword [r14 + 0x10], eax
sub eax, 1
jg 0x140041cfc
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r14
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea eax, [r13 - 4]
xor esi, esi
test eax, eax
cmovns esi, eax
cmp esi, dword [rbx - 0x10]
jl 0x140041d1f
lea rcx, [rbx - 0x18]
call fcn.140004c20
lea rdx, [rax + 0x18]
mov qword [rbp + 0x10], rdx
jmp 0x140041d59
mov rcx, qword [rbx - 0x18]
test rcx, rcx
je 0x140041d33
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x140041d41
call fcn.14004aa80
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov r9, rax
mov r8d, esi
mov rdx, qword [rsp + 0x78]
lea rcx, [rbp + 0x10]
call fcn.14000db20
mov rdx, qword [rbp + 0x10]
lea rsi, [rdx - 0x18]
mov rbx, qword [rsp + 0x60]
add rbx, 0xffffffffffffffe8
cmp rsi, rbx
je 0x140041db7
cmp dword [rbx + 0x10], 0
jl 0x140041da8
mov rax, qword [rbx]
cmp qword [rsi], rax
jne 0x140041da8
mov rcx, rsi
call fcn.140004c20
mov r14, rax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x140041d9d
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [r14 + 0x18]
mov qword [rsp + 0x60], rax
jmp 0x140041db7
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.1400054e0
nop
mov eax, edi
lock xadd dword [rsi + 0x10], eax
sub eax, 1
jg 0x140041dcf
mov rcx, qword [rsi]
mov rax, qword [rcx]
mov rdx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r14, qword [rbp - 0x70]
mov r12d, 1
jmp 0x140041e4f
lea rcx, [rbx - 0x18]
mov rsi, qword [rsp + 0x48]
add rsi, 0xffffffffffffffe8
cmp rcx, rsi
je 0x140041e3b
cmp dword [rsi + 0x10], 0
jl 0x140041e2b
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x140041e2b
call fcn.140004c20
mov rbx, rax
mov ecx, edi
lock xadd dword [rsi + 0x10], ecx
sub ecx, 1
jg 0x140041e1c
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rbx + 0x18]
mov qword [rsp + 0x48], rax
mov r14, qword [rbp - 0x70]
jmp 0x140041e3b
mov r8d, r13d
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.1400054e0
mov r8d, r12d
lea rdx, [0x140283418]
lea rcx, [rsp + 0x60]
call fcn.1400054e0
mov rax, qword [rsp + 0x48]
cmp dword [rax - 8], 1
jle 0x140041e67
mov edx, dword [rax - 0x10]
lea rcx, [rsp + 0x48]
call fcn.1400052d0
xor edx, edx
lea r8d, [rdx + 0x10]
mov rcx, qword [rsp + 0x48]
call fcn.1401ef854
mov ebx, eax
mov rcx, qword [rsp + 0x60]
cmp dword [rcx - 8], 1
jle 0x140041e96
mov edx, dword [rcx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.1400052d0
mov rcx, qword [rsp + 0x60]
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.1401ef854
mov dword [rbp - 0x38], eax
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.TS_MSB
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp - 0x30], ebx
lea rax, [rbp - 0x30]
lea rdx, str.TS_LSB
jmp 0x1400418df
test rbx, rbx
jne 0x140041eea
xor eax, eax
jmp 0x140041efa
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140041ef0
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1400054e0
mov rax, qword [rsp + 0x40]
cmp dword [rax - 8], 1
jle 0x140041f22
mov edx, dword [rax - 0x10]
lea rcx, [rsp + 0x40]
call fcn.1400052d0
xor edx, edx
lea r8d, [rdx + 0x10]
mov rcx, qword [rsp + 0x40]
call fcn.1401ef854
mov ebx, eax
mov dword [rbp - 0x28], eax
lea rax, [rbp - 0x28]
lea rdx, str.RSA0_R0_L
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test ebx, ebx
je case.default.0x140041606
mov esi, r12d
mov dword [rbp + 0x90], r12d
jmp case.default.0x140041606
test rbx, rbx
jne 0x140041f81
xor eax, eax
jmp 0x140041f8e
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x140041f84
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1400054e0
mov rax, qword [rsp + 0x40]
cmp dword [rax - 8], 1
jle 0x140041fb6
mov edx, dword [rax - 0x10]
lea rcx, [rsp + 0x40]
call fcn.1400052d0
xor edx, edx
lea r8d, [rdx + 0x10]
mov rcx, qword [rsp + 0x40]
call fcn.1401ef854
mov ebx, eax
mov dword [rbp - 0x20], eax
lea rax, [rbp - 0x20]
lea rdx, str.RSA0_R0_R
jmp 0x140041f42
test rbx, rbx
jne 0x140041fe4
xor eax, eax
jmp 0x140041ffa
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140041ff0
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1400054e0
mov rax, qword [rsp + 0x40]
cmp dword [rax - 8], 1
jle 0x140042022
mov edx, dword [rax - 0x10]
lea rcx, [rsp + 0x40]
call fcn.1400052d0
xor edx, edx
lea r8d, [rdx + 0x10]
mov rcx, qword [rsp + 0x40]
call fcn.1401ef854
mov ebx, eax
mov dword [rbp - 0x18], eax
lea rax, [rbp - 0x18]
lea rdx, str.RSA1_R0_L
jmp 0x140041f42
test rbx, rbx
jne 0x140042050
xor eax, eax
jmp 0x14004205d
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x140042053
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1400054e0
mov rax, qword [rsp + 0x40]
cmp dword [rax - 8], 1
jle 0x140042085
mov edx, dword [rax - 0x10]
lea rcx, [rsp + 0x40]
call fcn.1400052d0
xor edx, edx
lea r8d, [rdx + 0x10]
mov rcx, qword [rsp + 0x40]
call fcn.1401ef854
mov ebx, eax
mov dword [rbp - 0x10], eax
mov dword [rsp + 0x28], 4
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.RSA1_R0_R
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test ebx, ebx
cmovne esi, r12d
mov dword [rbp + 0x90], esi
jmp case.default.0x140041606
mov esi, dword [rbp + 0x90]
inc r15d
mov dword [rbp + 0xa0], r15d
lea r8, [rbp + 0x18]
lea rdx, [rbp + 0xa8]
xor ecx, ecx
call fcn.1401f0ad0
mov rbx, rax
test rax, rax
jne 0x1400415c0
cmp r15d, 7
jl 0x1400422bc
test esi, esi
je 0x14004213a
mov dword [rbp - 8], r12d
mov dword [rsp + 0x28], 4
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
lea r9d, [rbx + 4]
xor r8d, r8d
lea rdx, str.R0_FROM_WMI
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test r14, r14
je 0x14004214f
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r14d, r14d
mov qword [rbp - 0x70], r14
test r14, r14
je 0x14004215e
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004217d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004219c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400421bb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400421da
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400421f9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140042218
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140042236
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140042255
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140042274
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140042292
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x98]
mov rdx, qword [rdx]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400422b4
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, r12d
jmp 0x1400424e8
mov r12, qword [rbp + 0x98]
lea rdx, [0x140289c58]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.R0_L_LSB
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.R0_R_MSB
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.R0_R_LSB
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.TS_MSB
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.TS_LSB
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.RSA0_R0_L
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.RSA0_R0_R
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.RSA1_R0_L
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.RSA1_R0_R
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea rdx, str.R0_FROM_WMI
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test r14, r14
je 0x140042388
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r14d, r14d
mov qword [rbp - 0x70], r14
test r14, r14
je 0x140042397
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400423b6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400423d5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400423f4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140042413
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140042432
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140042451
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004246f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004248e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400424ad
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400424cb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r12]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400424e6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
add rsp, 0x148
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.140005680
nop
mov ecx, 0x80004005
call fcn.140005680
nop
mov ecx, 0x80004005
call fcn.140005680
nop
mov ecx, 0x80004005
call fcn.140005680
nop
mov ecx, 0x80004005
call fcn.140005680
nop
mov ecx, 0x80004005
call fcn.140005680
nop
mov ecx, 0x80004005
call fcn.140005680
nop
mov ecx, 0x80004005
call fcn.140005680
nop
mov ecx, 0x80004005
call fcn.140005680
nop
mov ecx, 0x80004005
call fcn.140005680
int3