Function at 0x14000cb44
Capabilities:
Set registry value

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xa90
mov qword [rsp + 0x240], 0xfffffffffffffffe
mov rax, qword [0x14002a520]
xor rax, rsp
mov qword [rsp + 0xa80], rax
mov qword [rsp + 0x60], r9
mov r10, r8
mov qword [rsp + 0xa0], r8
mov qword [rsp + 0x98], rdx
mov r11, rcx
mov qword [rsp + 0x80], rcx
mov qword [rsp + 0x188], rcx
mov qword [rsp + 0x198], rdx
mov qword [rsp + 0x190], r8
mov qword [rsp + 0x1b8], r9
mov rax, qword [rsp + 0xad0]
mov qword [rsp + 0x160], rax
mov rax, qword [rsp + 0xad8]
mov qword [rsp + 0x158], rax
xor edi, edi
mov esi, edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x70], edi
mov qword [rsp + 0x78], rdi
mov dword [rsp + 0x44], edi
mov byte [rsp + 0x4c], dil
mov dword [rsp + 0x168], edi
mov ebx, edi
mov qword [rsp + 0x50], rbx
mov rax, qword [r8]
mov edx, dword [rax]
mov eax, edx
shr eax, 0x1c
mov dword [rsp + 0x90], eax
mov r8d, edx
shr r8d, 0xe
and r8d, 0x3fff
mov dword [rsp + 0x48], r8d
and edx, 0x3fff
jmp 0x14000c1b7
mov eax, dword [rsp + 0x90]
lea rcx, [0x140000000]
cmp eax, 6
je 0x14000d92e
cmp eax, 0xb
ja case.default.0x14000c1dd
mov ecx, dword [rcx + rax*4 + 0xd98c]
lea rax, [0x140000000]
add rcx, rax
jmp rcx
test rbx, rbx
je 0x14000c1fa
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rsp + 0x50], rbx
call qword [sym.imp.MSVCR120.dll_free]
test rbx, rbx
jne 0x14000c1e4
test rsi, rsi
je 0x14000c20d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x68], rdi
xor eax, eax
jmp 0x14000d96d
mov byte [rsp + 0x4c], 1
cmp dword [rsp + 0xae0], 0
je 0x14000d8fb
mov qword [rsp + 0x20], r9
mov r9d, r8d
lea r8, [rsp + 0x68]
mov rdx, qword [rsp + 0x98]
mov rcx, r11
call fcn.1400037a0
mov dword [rsp + 0x44], eax
test eax, eax
jns 0x14000c27a
test rbx, rbx
je 0x14000c267
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rsp + 0x50], rbx
call qword [sym.imp.MSVCR120.dll_free]
test rbx, rbx
jne 0x14000c251
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000d969
jmp 0x14000d95e
mov rsi, qword [rsp + 0x68]
mov qword [rsp + 0x58], rsi
jmp 0x14000d8e6
cmp dword [rsp + 0xae0], 0
je 0x14000c315
mov rdx, qword [rsp + 0x98]
mov rcx, r11
call fcn.140005d70
mov dword [rsp + 0x88], eax
test eax, eax
jns 0x14000c2f5
test rbx, rbx
je 0x14000c2d6
nop word [rax + rax]
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rsp + 0x50], rbx
call qword [sym.imp.MSVCR120.dll_free]
test rbx, rbx
jne 0x14000c2c0
test rsi, rsi
je 0x14000c2e9
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x68], rdi
mov eax, dword [rsp + 0x88]
jmp 0x14000d96d
mov r8d, dword [rsp + 0x48]
mov r11, qword [rsp + 0x80]
mov r9, qword [rsp + 0x60]
cmp dword [rsp + 0xae0], 0
jne 0x14000c4a2
mov qword [rsp + 0x1a0], rdi
mov qword [rsp + 0xd8], rdi
mov dword [rsp + 0xe0], edi
mov dword [rsp + 0xe4], edi
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd8]
mov rdx, qword [rsp + 0x60]
mov rcx, r11
call fcn.140009080
mov dword [rsp + 0x44], eax
test eax, eax
jns 0x14000c3ab
mov rcx, qword [rsp + 0xd8]
test rcx, rcx
je 0x14000c378
call qword [sym.imp.MSVCR120.dll_free]
mov qword [rsp + 0xd8], rdi
mov dword [rsp + 0xe0], edi
mov dword [rsp + 0xe4], edi
test rbx, rbx
je 0x14000d956
nop
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rsp + 0x50], rbx
call qword [sym.imp.MSVCR120.dll_free]
test rbx, rbx
jne 0x14000c390
jmp 0x14000d956
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x14000c460
mov r8, qword [rsp + 0xd8]
mov rax, qword [rsp + 0x1a0]
test rax, rax
cmovne r8, rax
mov r9d, 0x2001f
mov rdx, rcx
lea rcx, [rsp + 0x68]
call fcn.14000a3f0
test eax, 0xfffffffd
je 0x14000c456
mov ecx, eax
call fcn.140004720
mov esi, eax
mov rcx, qword [rsp + 0xd8]
test rcx, rcx
je 0x14000c411
call qword [sym.imp.MSVCR120.dll_free]
mov qword [rsp + 0xd8], rdi
mov dword [rsp + 0xe0], edi
mov dword [rsp + 0xe4], edi
test rbx, rbx
je 0x14000c43a
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rsp + 0x50], rbx
call qword [sym.imp.MSVCR120.dll_free]
test rbx, rbx
jne 0x14000c424
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000c44f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x68], rdi
mov eax, esi
jmp 0x14000d96d
mov rsi, qword [rsp + 0x68]
mov qword [rsp + 0x58], rsi
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax]
mov ecx, dword [rax]
mov dword [rsp + 0x168], ecx
mov rcx, qword [rsp + 0xd8]
test rcx, rcx
je 0x14000c48f
call qword [sym.imp.MSVCR120.dll_free]
mov qword [rsp + 0xd8], rdi
mov dword [rsp + 0xe0], edi
mov dword [rsp + 0xe4], edi
jmp 0x14000d8e6
mov qword [rsp + 0x20], r9
mov r9d, r8d
lea r8, [rsp + 0x68]
mov rdx, qword [rsp + 0x98]
mov rcx, r11
call fcn.1400037a0
mov dword [rsp + 0x44], eax
test eax, eax
jns 0x14000c27a
test rbx, rbx
je 0x14000c4e6
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rsp + 0x50], rbx
call qword [sym.imp.MSVCR120.dll_free]
test rbx, rbx
jne 0x14000c4d0
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000d969
jmp 0x14000d95e
add qword [r10], 4
mov eax, dword [rsp + 0xae0]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x20], rax
mov r8, r10
mov rdx, rsi
mov rcx, r11
call fcn.14000c0c0
mov dword [rsp + 0x44], eax
test eax, eax
jns 0x14000c55c
test rbx, rbx
je 0x14000d956
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rsp + 0x50], rbx
call qword [sym.imp.MSVCR120.dll_free]
test rbx, rbx
jne 0x14000c541
jmp 0x14000d956
mov r10, qword [rsp + 0xa0]
mov rax, qword [r10]
mov edx, dword [rax]
mov eax, edx
shr eax, 0x1c
mov dword [rsp + 0x90], eax
mov r8d, edx
shr r8d, 0xe
and r8d, 0x3fff
mov dword [rsp + 0x48], r8d
and edx, 0x3fff
mov dword [rsp + 0x88], edx
cmp dword [rsp + 0xae0], 0
mov r11, qword [rsp + 0x80]
mov r9, qword [rsp + 0x60]
lea rcx, [0x140000000]
jne case.default.0x14000c1dd
cmp byte [rsp + 0x4c], 0
jne 0x14000c64b
mov r8d, dword [rsp + 0x168]
shr r8d, 0xe
and r8d, 0x3fff
mov rdx, qword [rsp + 0x98]
mov rcx, r11
call fcn.140005d70
mov dword [rsp + 0x44], eax
test eax, eax
mov eax, dword [rsp + 0x90]
mov edx, dword [rsp + 0x88]
mov r8d, dword [rsp + 0x48]
mov r10, qword [rsp + 0xa0]
mov r11, qword [rsp + 0x80]
mov r9, qword [rsp + 0x60]
lea rcx, [0x140000000]
jns case.default.0x14000c1dd
test rbx, rbx
je 0x14000d956
nop dword [rax]
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rsp + 0x50], rbx
call qword [sym.imp.MSVCR120.dll_free]
test rbx, rbx
jne 0x14000c630
jmp 0x14000d956
mov byte [rsp + 0x4c], 0
jmp 0x14000c1b7
test rbx, rbx
je 0x14000c676
nop word [rax + rax]
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rsp + 0x50], rbx
call qword [sym.imp.MSVCR120.dll_free]
test rbx, rbx
jne 0x14000c660
test rsi, rsi
je 0x14000c689
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x68], rdi
mov eax, 0x80004005
jmp 0x14000d96d
movsxd rdx, r8d
or rdx, 0xffffffff80000000
add qword [r10], 4
mov eax, dword [rsp + 0xae0]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x20], rax
mov r8, r10
mov rcx, r11
call fcn.14000c0c0
mov dword [rsp + 0x8c], eax
test rbx, rbx
je 0x14000c6f6
nop dword [rax]
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rsp + 0x50], rbx
call qword [sym.imp.MSVCR120.dll_free]
test rbx, rbx
jne 0x14000c6e0
test rsi, rsi
je 0x14000c709
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x68], rdi
mov eax, dword [rsp + 0x8c]
jmp 0x14000d96d
cmp dword [rsp + 0xae0], 0
je 0x14000d8fb
mov byte [rsp + 0x40], 0
test rsi, rsi
jne 0x14000c73f
mov rsi, qword [rsp + 0x98]
mov qword [rsp + 0x68], rsi
mov byte [rsp + 0x40], 1
mov qword [rsp + 0x138], rdi
mov dword [rsp + 0x140], edi
mov dword [rsp + 0x144], edi
mov qword [rsp + 0x148], rdi
mov dword [rsp + 0x150], edi
mov dword [rsp + 0x154], edi
mov qword [rsp + 0x1b0], rdi
mov qword [rsp + 0x1a8], rdi
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x138]
mov r8d, edx
mov rdx, qword [rsp + 0x60]
mov rcx, r11
call fcn.140009080
mov dword [rsp + 0x44], eax
test eax, eax
mov eax, dword [rsp + 0x48]
js 0x14000c7e2
test eax, eax
je 0x14000c7e2
lea rcx, [rsp + 0x1a8]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x148]
mov r8d, eax
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x80]
call fcn.140009080
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x48]
mov qword [rsp + 0x1e8], rdi
mov dword [rsp + 0x1f0], edi
mov qword [rsp + 0x1f8], rdi
test eax, eax
jne 0x14000c80d
mov r10, rsi
mov qword [rsp + 0x1e8], rsi
mov rdx, rdi
jmp 0x14000c834
mov r10, qword [rsp + 0x98]
mov qword [rsp + 0x1e8], r10
mov rdx, qword [rsp + 0x148]
mov rax, qword [rsp + 0x1a8]
test rax, rax
cmovne rdx, rax
mov rcx, qword [rsp + 0x138]
mov rax, qword [rsp + 0x1b0]
test rax, rax
cmovne rcx, rax
mov eax, edi
test rcx, rcx
setne al
test eax, eax
jne 0x14000c866
mov eax, recv
mov qword [rsp + 0x1e8], rdi
jmp 0x14000c8a6
or rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x14000c870
inc eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov qword [rsp + 0x1e8], rdi
test eax, eax
je 0x14000c947
mov ecx, eax
call fcn.140004720
mov dword [rsp + 0x8c], eax
mov dword [rsp + 0x1f0], edi
mov rcx, qword [rsp + 0x148]
test rcx, rcx
je 0x14000c8d6
call qword [sym.imp.MSVCR120.dll_free]
mov qword [rsp + 0x148], rdi
mov dword [rsp + 0x150], edi
mov dword [rsp + 0x154], edi
mov rcx, qword [rsp + 0x138]
test rcx, rcx
je 0x14000c8ff
call qword [sym.imp.MSVCR120.dll_free]
mov qword [rsp + 0x138], rdi
mov dword [rsp + 0x140], edi
mov dword [rsp + 0x144], edi
test rbx, rbx
je 0x14000c928
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rsp + 0x50], rbx
call qword [sym.imp.MSVCR120.dll_free]
test rbx, rbx
jne 0x14000c912
test rsi, rsi
je 0x14000c93b
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x68], rdi
mov eax, dword [rsp + 0x8c]
jmp 0x14000d96d
cmp byte [rsp + 0x40], 0
cmovne rsi, rdi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x1f0], edi
mov rcx, qword [rsp + 0x148]
test rcx, rcx
je 0x14000c97c
call qword [sym.imp.MSVCR120.dll_free]
mov qword [rsp + 0x148], rdi
mov dword [rsp + 0x150], edi
mov dword [rsp + 0x154], edi
mov rcx, qword [rsp + 0x138]
test rcx, rcx
je 0x14000c9a5
call qword [sym.imp.MSVCR120.dll_free]
mov qword [rsp + 0x138], rdi
mov dword [rsp + 0x140], edi
mov dword [rsp + 0x144], edi
jmp 0x14000d8e6
cmp dword [rsp + 0xae0], 0
je 0x14000d8fb
mov byte [rsp + 0x40], 0
test rsi, rsi
jne 0x14000c9e2
mov rsi, qword [rsp + 0x98]
mov qword [rsp + 0x68], rsi
mov byte [rsp + 0x40], 1
mov qword [rsp + 0xf8], rdi
mov dword [rsp + 0x100], edi
mov dword [rsp + 0x104], edi
mov qword [rsp + 0xe8], rdi
mov dword [rsp + 0xf0], edi
mov dword [rsp + 0xf4], edi
mov qword [rsp + 0x1e0], rdi
mov qword [rsp + 0x180], rdi
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xf8]
mov r8d, edx
mov rdx, qword [rsp + 0x60]
mov rcx, r11
call fcn.140009080
mov edx, eax
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x90], eax
test eax, eax
js 0x14000ca91
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x14000ca91
lea rcx, [rsp + 0x180]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0xe8]
mov r8d, eax
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x80]
call fcn.140009080
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x90], eax
mov rcx, qword [rsp + 0xf8]
mov rax, qword [rsp + 0x1e0]
test rax, rax
cmovne rcx, rax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0xd0], rcx
or r11, 0xffffffffffffffff
mov rax, r11
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x14000cac0
add eax, 2
mov qword [rsp + 0x670], rdi
movsxd r8, eax
mov qword [rsp + 0x250], r8
test eax, eax
jne 0x14000caed
mov qword [rsp + 0x238], rdi
jmp 0x14000cb27
xor edx, edx
mov rax, r11
div r8
cmp rax, 1
jb 0x14000cb39
mov qword [rsp + 0x238], r8
cmp r8, 0x400
jbe 0x14000cb27
mov rdx, r8
lea rcx, [rsp + 0x670]
call fcn.1400040c0
mov rcx, qword [rsp + 0x58]
or r11, 0xffffffffffffffff
jmp 0x14000cb37
lea rax, [rsp + 0x678]
mov qword [rsp + 0x670], rax
jmp 0x14000cba9
mov ecx, 0x80070216
call fcn.140004920
nop
xor edi, edi
or r11, 0xffffffffffffffff
mov rsi, qword [rsp + 0x68]
mov eax, dword [rsp + 0x90]
mov dword [rsp + 0x44], eax
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xd0]
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x1b8]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x670]
test rax, rax
je 0x14000ce66
cmp byte [rcx], 0
je 0x14000cc3a
mov rbx, rax
call qword [sym.imp.USER32.dll_CharNextA]
mov rcx, rax
mov rax, qword [rsp + 0x58]
movzx edx, byte [rax]
cmp dl, 0x5c
jne 0x14000cbee
cmp byte [rcx], 0x30
jne 0x14000cbee
mov byte [rbx], 0
inc rbx
call qword [sym.imp.USER32.dll_CharNextA]
mov rcx, rax
jmp 0x14000cc17
mov byte [rbx], dl
movzx ecx, byte [rax]
call qword [sym.imp.KERNEL32.dll_IsDBCSLeadByte]
mov rcx, qword [rsp + 0x58]
test eax, eax
je 0x14000cc11
inc rbx
inc rcx
movzx eax, byte [rcx]
test al, al
je 0x14000cc21
mov byte [rbx], al
inc rbx
inc rcx
mov qword [rsp + 0x58], rcx
cmp byte [rcx], 0
jne 0x14000cbc2
mov qword [rsp + 0xa8], rbx
mov rbx, qword [rsp + 0x50]
mov rax, qword [rsp + 0xa8]
or r11, 0xffffffffffffffff
mov word [rax], 0
mov qword [rsp + 0x1c0], rdi
mov dword [rsp + 0x1c8], edi
mov qword [rsp + 0x1d0], rdi
cmp dword [rsp + 0x48], 0
jne 0x14000cc6d
mov rcx, rsi
mov qword [rsp + 0x1c0], rcx
mov rdx, rdi
jmp 0x14000cc94
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 0x1c0], rcx
mov rdx, qword [rsp + 0xe8]
mov rax, qword [rsp + 0x180]
test rax, rax
cmovne rdx, rax
mov eax, edi
mov r8, qword [rsp + 0x670]
test r8, r8
setne al
test eax, eax
jne 0x14000ccb7
mov eax, recv
mov qword [rsp + 0x1c0], rdi
jmp 0x14000cd0e
mov r10d, edi
mov r9, r8
nop dword [rax]
mov r8, r11
inc r8
cmp byte [r9 + r8], 0
jne 0x14000ccc3
inc r8d
mov eax, r8d
add r9, rax
add r10d, r8d
cmp r8d, 1
jne 0x14000ccc0
mov dword [rsp + 0x28], r10d
mov rax, qword [rsp + 0x670]
mov qword [rsp + 0x20], rax
lea r9d, [r8 + 6]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov qword [rsp + 0x1c0], rdi
test eax, eax
je 0x14000cdd5
mov ecx, eax
call fcn.140004720
mov dword [rsp + 0x8c], eax
mov dword [rsp + 0x1c8], edi
lea rax, [rsp + 0x678]
cmp qword [rsp + 0x670], rax
je 0x14000cd43
lea rcx, [rsp + 0x670]
call fcn.140015710
nop
mov rcx, qword [rsp + 0xe8]
test rcx, rcx
je 0x14000cd5e
call qword [sym.imp.MSVCR120.dll_free]
mov qword [rsp + 0xe8], rdi
mov dword [rsp + 0xf0], edi
mov dword [rsp + 0xf4], edi
mov rcx, qword [rsp + 0xf8]
test rcx, rcx
je 0x14000cd87
call qword [sym.imp.MSVCR120.dll_free]
mov qword [rsp + 0xf8], rdi
mov dword [rsp + 0x100], edi
mov dword [rsp + 0x104], edi
test rbx, rbx
je 0x14000cdb6
nop word [rax + rax]
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rsp + 0x50], rbx
call qword [sym.imp.MSVCR120.dll_free]
test rbx, rbx
jne 0x14000cda0
test rsi, rsi
je 0x14000cdc9
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x68], rdi
mov eax, dword [rsp + 0x8c]
jmp 0x14000d96d
cmp byte [rsp + 0x40], 0
cmovne rsi, rdi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x1c8], edi
lea rax, [rsp + 0x678]
cmp qword [rsp + 0x670], rax
je 0x14000ce0f
lea rcx, [rsp + 0x670]
call fcn.140015710
nop
mov rcx, qword [rsp + 0xe8]
test rcx, rcx
je 0x14000ce2a
call qword [sym.imp.MSVCR120.dll_free]
mov qword [rsp + 0xe8], rdi
mov dword [rsp + 0xf0], edi
mov dword [rsp + 0xf4], edi
mov rcx, qword [rsp + 0xf8]
test rcx, rcx
je 0x14000ce53
call qword [sym.imp.MSVCR120.dll_free]
mov qword [rsp + 0xf8], rdi
mov dword [rsp + 0x100], edi
mov dword [rsp + 0x104], edi
jmp 0x14000d8e6
lea rax, [rsp + 0x678]
cmp qword [rsp + 0x670], rax
je 0x14000ce86
lea rcx, [rsp + 0x670]
call fcn.140015710
nop
mov rcx, qword [rsp + 0xe8]
test rcx, rcx
je 0x14000cea1
call qword [sym.imp.MSVCR120.dll_free]
mov qword [rsp + 0xe8], rdi
mov dword [rsp + 0xf0], edi
mov dword [rsp + 0xf4], edi
mov rcx, qword [rsp + 0xf8]
test rcx, rcx
je 0x14000ceca
call qword [sym.imp.MSVCR120.dll_free]
mov qword [rsp + 0xf8], rdi
mov dword [rsp + 0x100], edi
mov dword [rsp + 0x104], edi
test rbx, rbx
je 0x14000cef6
nop dword [rax]
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rsp + 0x50], rbx
call qword [sym.imp.MSVCR120.dll_free]
test rbx, rbx
jne 0x14000cee0
test rsi, rsi
je 0x14000cf09
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x68], rdi
mov eax, 0x8007000e
jmp 0x14000d96d
cmp dword [rsp + 0xae0], 0
je 0x14000d8fb
mov byte [rsp + 0x40], 0
test rsi, rsi
jne 0x14000cf3d
mov rsi, qword [rsp + 0x98]
mov qword [rsp + 0x68], rsi
mov byte [rsp + 0x40], 1
mov qword [rsp + 0x108], rdi
mov dword [rsp + 0x110], edi
mov dword [rsp + 0x114], edi
mov qword [rsp + 0x118], rdi
mov dword [rsp + 0x120], edi
mov dword [rsp + 0x124], edi
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0x58], rdi
mov eax, edx
mov rdx, qword [rsp + 0x160]
mov ecx, dword [rdx + rax*8]
mov dword [rsp + 0x8c], ecx
mov r9d, edi
cmp byte [rdx + rax*8 + 4], 1
sete r9b
mov dword [rsp + 0x44], r9d
cmp r9d, 1
jne 0x14000d103
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x108]
mov r8d, ecx
mov rdx, qword [rsp + 0x60]
mov rcx, r11
call fcn.140009080
mov rdx, qword [rsp + 0x108]
mov rax, qword [rsp + 0xd0]
test rax, rax
cmovne rdx, rax
lea rcx, [rsp + 0x178]
call fcn.140001ec0
nop
lea r9, [rsp + 0x8c]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x178]
call qword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov r9d, eax
mov dword [rsp + 0x44], eax
test eax, eax
jns 0x14000d0cb
mov rdx, qword [rsp + 0x178]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000d036
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x118]
test rcx, rcx
je 0x14000d051
call qword [sym.imp.MSVCR120.dll_free]
mov qword [rsp + 0x118], rdi
mov dword [rsp + 0x120], edi
mov dword [rsp + 0x124], edi
mov rcx, qword [rsp + 0x108]
test rcx, rcx
je 0x14000d07a
call qword [sym.imp.MSVCR120.dll_free]
mov qword [rsp + 0x108], rdi
mov dword [rsp + 0x110], edi
mov dword [rsp + 0x114], edi
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x14000d0a8
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rsp + 0x50], rbx
call qword [sym.imp.MSVCR120.dll_free]
test rbx, rbx
jne 0x14000d092
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000c689
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x68], rdi
mov eax, 0x80004005
jmp 0x14000d96d
mov rdx, qword [rsp + 0x178]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14000d0ec
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r9d, dword [rsp + 0x44]
mov r11, qword [rsp + 0x80]
mov r8d, dword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x68]
test r9d, r9d
js 0x14000d130
test r8d, r8d
je 0x14000d130
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x118]
mov rdx, qword [rsp + 0x60]
mov rcx, r11
call fcn.140009080
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x200], rdi
mov dword [rsp + 0x208], edi
mov qword [rsp + 0x210], rdi
mov rcx, qword [rsp + 0x98]
cmp dword [rsp + 0x48], 0
cmove rcx, rsi
mov qword [rsp + 0x200], rcx
mov eax, dword [rsp + 0x8c]
mov dword [rsp + 0x128], eax
mov rdx, qword [rsp + 0x118]
mov rax, qword [rsp + 0x58]
test rax, rax
cmovne rdx, rax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x128]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov qword [rsp + 0x200], rdi
test eax, eax
je 0x14000d257
mov ecx, eax
call fcn.140004720
mov dword [rsp + 0x128], eax
mov dword [rsp + 0x208], edi
mov rcx, qword [rsp + 0x118]
test rcx, rcx
je 0x14000d1e6
call qword [sym.imp.MSVCR120.dll_free]
mov qword [rsp + 0x118], rdi
mov dword [rsp + 0x120], edi
mov dword [rsp + 0x124], edi
mov rcx, qword [rsp + 0x108]
test rcx, rcx
je 0x14000d20f
call qword [sym.imp.MSVCR120.dll_free]
mov qword [rsp + 0x108], rdi
mov dword [rsp + 0x110], edi
mov dword [rsp + 0x114], edi
test rbx, rbx
je 0x14000d238
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rsp + 0x50], rbx
call qword [sym.imp.MSVCR120.dll_free]
test rbx, rbx
jne 0x14000d222
test rsi, rsi
je 0x14000d24b
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x68], rdi
mov eax, dword [rsp + 0x128]
jmp 0x14000d96d
cmp byte [rsp + 0x40], 0
cmovne rsi, rdi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x208], edi
mov rcx, qword [rsp + 0x118]
test rcx, rcx
je 0x14000d28c
call qword [sym.imp.MSVCR120.dll_free]
mov qword [rsp + 0x118], rdi
mov dword [rsp + 0x120], edi
mov dword [rsp + 0x124], edi
mov rcx, qword [rsp + 0x108]
test rcx, rcx
je 0x14000d2b5
call qword [sym.imp.MSVCR120.dll_free]
mov qword [rsp + 0x108], rdi
mov dword [rsp + 0x110], edi
mov dword [rsp + 0x114], edi
jmp 0x14000d8e6
cmp dword [rsp + 0xae0], 0
je 0x14000d8fb
mov byte [rsp + 0x40], 0
test rsi, rsi
jne 0x14000d2f7
mov rsi, qword [rsp + 0x98]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov byte [rsp + 0x40], 1
mov qword [rsp + 0xb0], rdi
mov dword [rsp + 0xb8], edi
mov dword [rsp + 0xbc], edi
mov qword [rsp + 0xc0], rdi
mov dword [rsp + 0xc8], edi
mov dword [rsp + 0xcc], edi
mov qword [rsp + 0x170], rdi
mov qword [rsp + 0x1d8], rdi
mov qword [rsp + 0x260], rdi
mov eax, edx
add rax, rax
mov r9, qword [rsp + 0x158]
mov rcx, qword [r9 + rax*8]
mov qword [rsp + 0x130], rcx
mov ecx, dword [r9 + rax*8 + 8]
mov dword [rsp + 0x88], ecx
mov edx, edi
cmp byte [r9 + rax*8 + 0xc], 1
sete dl
mov dword [rsp + 0x44], edx
mov dword [rsp + 0x90], edx
cmp edx, 1
jne 0x14000d6d5
lea rax, [rsp + 0x170]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb0]
mov r8d, ecx
mov rdx, qword [rsp + 0x60]
mov rcx, r11
call fcn.140009080
mov rax, qword [rsp + 0x170]
test rax, rax
cmove rax, qword [rsp + 0xb0]
mov qword [rsp + 0x170], rax
or r9, 0xffffffffffffffff
mov rcx, r9
inc rcx
cmp byte [rax + rcx], 0
jne 0x14000d3c7
mov qword [rsp + 0xd0], rcx
mov dword [rsp + 0xa8], ecx
test cl, 1
je 0x14000d47e
lea rax, [rsp + 0x268]
cmp qword [rsp + 0x260], rax
je 0x14000d408
lea rcx, [rsp + 0x260]
call fcn.140015710
nop
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x14000d423
call qword [sym.imp.MSVCR120.dll_free]
mov qword [rsp + 0xc0], rdi
mov dword [rsp + 0xc8], edi
mov dword [rsp + 0xcc], edi
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x14000d44c
call qword [sym.imp.MSVCR120.dll_free]
mov qword [rsp + 0xb0], rdi
mov dword [rsp + 0xb8], edi
mov dword [rsp + 0xbc], edi
test rbx, rbx
je 0x14000c676
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rsp + 0x50], rbx
call qword [sym.imp.MSVCR120.dll_free]
test rbx, rbx
jne 0x14000d463
jmp 0x14000c676
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov dword [rsp + 0x88], r8d
mov dword [rsp + 0x130], r8d
mov ecx, r8d
mov qword [rsp + 0x248], rcx
test eax, eax
jne 0x14000d4b4
mov rcx, rdi
mov qword [rsp + 0x230], rcx
jmp 0x14000d4d4
xor edx, edx
mov rax, r9
div rcx
cmp rax, 1
jae 0x14000d4cc
mov ecx, 0x80070216
call fcn.140004920
mov qword [rsp + 0x230], rcx
cmp rcx, 0x400
jbe 0x14000d4f7
mov rdx, rcx
lea rcx, [rsp + 0x260]
call fcn.1400040c0
mov r8d, dword [rsp + 0x88]
jmp 0x14000d507
lea rax, [rsp + 0x268]
mov qword [rsp + 0x260], rax
jmp 0x14000d584
mov rax, qword [rsp + 0x260]
mov qword [rsp + 0x130], rax
test rax, rax
jne 0x14000d63b
lea rax, [rsp + 0x268]
cmp qword [rsp + 0x260], rax
je 0x14000d5bd
lea rcx, [rsp + 0x260]
call fcn.140015710
nop
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x14000d5d8
call qword [sym.imp.MSVCR120.dll_free]
mov qword [rsp + 0xc0], rdi
mov dword [rsp + 0xc8], edi
mov dword [rsp + 0xcc], edi
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x14000d601
call qword [sym.imp.MSVCR120.dll_free]
mov qword [rsp + 0xb0], rdi
mov dword [rsp + 0xb8], edi
mov dword [rsp + 0xbc], edi
test rbx, rbx
je 0x14000cef6
nop dword [rax + rax]
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rsp + 0x50], rbx
call qword [sym.imp.MSVCR120.dll_free]
test rbx, rbx
jne 0x14000d620
jmp 0x14000cef6
xor edx, edx
mov rsi, rax
mov rcx, rax
call sub.MSVCR120.dll_memset
mov r8, rdi
mov qword [rsp + 0x90], rdi
movsxd rax, dword [rsp + 0xd0]
test rax, rax
jle 0x14000d6db
mov rbx, qword [rsp + 0x170]
nop dword [rax + rax]
mov eax, edi
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
add rsi, rcx
movzx edx, byte [r8 + rbx]
mov rcx, qword [rsp + 0x80]
call fcn.140004fd0
mov edx, edi
and edx, 1
shl edx, 2
mov ecx, 4
sub ecx, edx
shl al, cl
or byte [rsi], al
inc edi
mov r8, qword [rsp + 0x90]
inc r8
mov qword [rsp + 0x90], r8
movsxd rax, dword [rsp + 0xd0]
cmp r8, rax
mov rsi, qword [rsp + 0x130]
jl 0x14000d670
mov rbx, qword [rsp + 0x50]
xor edi, edi
jmp 0x14000d6db
test edx, edx
js 0x14000d71d
jmp 0x14000d6e8
mov r11, qword [rsp + 0x80]
mov r8d, dword [rsp + 0x48]
test r8d, r8d
je 0x14000d718
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xc0]
mov rdx, qword [rsp + 0x60]
mov rcx, r11
call fcn.140009080
mov dword [rsp + 0x44], eax
mov r8d, dword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
mov qword [rsp + 0x218], rdi
mov dword [rsp + 0x220], edi
mov qword [rsp + 0x228], rdi
mov rcx, qword [rsp + 0x98]
test r8d, r8d
cmove rcx, rsi
mov qword [rsp + 0x218], rcx
mov rdx, qword [rsp + 0xc0]
mov rax, qword [rsp + 0x1d8]
test rax, rax
cmovne rdx, rax
mov eax, dword [rsp + 0x88]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov qword [rsp + 0x218], rdi
test eax, eax
je 0x14000d85a
mov ecx, eax
call fcn.140004720
mov dword [rsp + 0xa8], eax
mov dword [rsp + 0x220], edi
lea rax, [rsp + 0x268]
cmp qword [rsp + 0x260], rax
je 0x14000d7ce
lea rcx, [rsp + 0x260]
call fcn.140015710
nop
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x14000d7e9
call qword [sym.imp.MSVCR120.dll_free]
mov qword [rsp + 0xc0], rdi
mov dword [rsp + 0xc8], edi
mov dword [rsp + 0xcc], edi
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x14000d812
call qword [sym.imp.MSVCR120.dll_free]
mov qword [rsp + 0xb0], rdi
mov dword [rsp + 0xb8], edi
mov dword [rsp + 0xbc], edi
test rbx, rbx
je 0x14000d83b
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rsp + 0x50], rbx
call qword [sym.imp.MSVCR120.dll_free]
test rbx, rbx
jne 0x14000d825
test rsi, rsi
je 0x14000d84e
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x68], rdi
mov eax, dword [rsp + 0xa8]
jmp 0x14000d96d
cmp byte [rsp + 0x40], 0
cmovne rsi, rdi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov dword [rsp + 0x220], edi
lea rax, [rsp + 0x268]
cmp qword [rsp + 0x260], rax
je 0x14000d894
lea rcx, [rsp + 0x260]
call fcn.140015710
nop
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x14000d8af
call qword [sym.imp.MSVCR120.dll_free]
mov qword [rsp + 0xc0], rdi
mov dword [rsp + 0xc8], edi
mov dword [rsp + 0xcc], edi
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x14000d8d8
call qword [sym.imp.MSVCR120.dll_free]
mov qword [rsp + 0xb0], rdi
mov dword [rsp + 0xb8], edi
mov dword [rsp + 0xbc], edi
mov r10, qword [rsp + 0xa0]
mov r11, qword [rsp + 0x80]
mov r9, qword [rsp + 0x60]
add qword [r10], 4
mov rax, qword [r10]
mov edx, dword [rax]
mov r8d, edx
mov eax, edx
shr r8d, 0xe
shr eax, 0x1c
and r8d, 0x3fff
and edx, 0x3fff
mov dword [rsp + 0x48], r8d
mov dword [rsp + 0x90], eax
jmp 0x14000c1b7
add qword [r10], 4
test rbx, rbx
je 0x14000d956
nop word [rax + rax]
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rsp + 0x50], rbx
call qword [sym.imp.MSVCR120.dll_free]
test rbx, rbx
jne 0x14000d940
test rsi, rsi
je 0x14000d969
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x68], rdi
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x70], edi
mov rcx, qword [rsp + 0xa80]
xor rcx, rsp
call fcn.140019e70
add rsp, 0xa90
pop rdi
pop rsi
pop rbx
ret