Function at 0x1400ac290
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov byte [rax + 0x18], r8b
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x138
mov rdi, rcx
lea rcx, [rax - 0x68]
mov r15, rdx
mov qword [rsp + 0x108], rdx
call fcn.14005818c
xor esi, esi
lea rcx, [rsp + 0x188]
mov r14b, 0xff
mov qword [rsp + 0x118], rdi
mov qword [rsp + 0x120], rsi
mov byte [rsp + 0x63], sil
mov byte [rsp + 0x64], sil
mov byte [rsp + 0xb8], r14b
mov qword [rsp + 0xe8], rsi
call fcn.14005044c
lea r8d, [rsi + 0xa]
lea rdx, [rsp + 0x188]
lea rcx, str.___initram
call fcn.14005a964
cmp al, sil
jne 0x1400acb0b
mov rdi, rsi
mov qword [rsp + 0xa8], rsi
lea edx, [rsi + 0x2a]
lea ecx, [rsi + 0x2d]
lea r8d, [rsi + 9]
lea r9d, [rsi + 0xd]
lea r12d, [rsi + 2]
mov rbp, qword [rsp + 0x188]
movabs rax, 0xfffffff000000000
mov byte [rsp + 0x198], sil
cmp cx, word [rbp]
mov qword [rsp + 0xf0], rax
movzx eax, dl
cmove eax, ecx
mov byte [rsp + 0x70], sil
mov byte [rsp + 0x61], sil
movsx ebx, al
movzx eax, word [rbp]
mov byte [rsp + 0x60], sil
mov byte [rsp + 0xba], sil
mov byte [rsp + 0x62], sil
mov byte [rsp + 0xb0], sil
mov byte [rsp + 0xb9], sil
mov r13d, esi
mov dword [rsp + 0xd0], esi
cmp ebx, eax
jne 0x1400ac7a0
mov r15b, byte [rsp + 0x64]
mov dil, byte [rsp + 0x63]
mov r14d, 0x20
jmp 0x1400ac3d0
mov r8d, 9
lea r9d, [r8 + 4]
movzx eax, word [rbp + 2]
cmp ebx, eax
jne 0x1400ac77b
mov ecx, 0xffdf
lea r11, [rbp + 4]
movzx eax, word [r11]
and ax, cx
mov ecx, 0x48
cmp cx, ax
je 0x1400ac77b
cmp r8w, word [r11]
ja 0x1400ac40a
cmp word [r11], r9w
jbe 0x1400ac77b
cmp r14w, word [r11]
je 0x1400ac77b
mov ebp, 1
lea rcx, [0x1400fc240]
mov rdx, r11
mov r8d, ebp
mov qword [rsp + 0x188], r11
call fcn.140051960
cmp al, sil
je 0x1400ac4d2
movzx eax, word [r11]
lea r8, [r11 + 2]
cmp ax, si
je 0x1400ac475
lea ecx, [rbp + 8]
lea r9d, [rbp + 0xc]
cmp cx, ax
ja 0x1400ac45b
cmp ax, r9w
jbe 0x1400ac475
cmp r14w, ax
je 0x1400ac475
add r11, r12
mov qword [rsp + 0x188], r11
mov ax, word [r11]
cmp ax, si
jne 0x1400ac450
lea rcx, [rsp + 0x188]
call fcn.14005044c
mov ecx, 0x3a
cmp cx, word [r8]
je 0x1400ac496
or r13d, 7
jmp 0x1400ac767
add r8, r12
lea rdx, [rsp + 0xb4]
lea rcx, [rsp + 0x90]
mov dword [rsp + 0xb4], esi
mov qword [rsp + 0x90], r8
call fcn.1400ab8ac
cmp eax, esi
jle 0x1400ac767
or r13d, dword [rsp + 0xb4]
jmp 0x1400ac767
lea rcx, [0x1400fc59c]
mov r8d, r12d
mov rdx, r11
call fcn.140051960
cmp al, sil
je 0x1400ac575
lea rax, [r11 + 4]
mov qword [rsp + 0x90], rax
movzx eax, word [r11]
cmp ax, si
je 0x1400ac530
mov ecx, 9
lea r9d, [rcx + 4]
cmp cx, ax
ja 0x1400ac516
cmp ax, r9w
jbe 0x1400ac530
cmp r14w, ax
je 0x1400ac530
add r11, r12
mov qword [rsp + 0x188], r11
mov ax, word [r11]
cmp ax, si
jne 0x1400ac50b
lea rcx, [rsp + 0x188]
call fcn.14005044c
lea rdx, [rsp + 0xb4]
lea rcx, [rsp + 0x90]
mov dword [rsp + 0xb4], esi
call fcn.1400665e0
cmp eax, esi
jle 0x1400ac767
mov eax, dword [rsp + 0xb4]
mov qword [rsp + 0xf0], rax
jmp 0x1400ac767
lea rdx, [rsp + 0x188]
lea rcx, [0x1400f6104]
mov r8d, r12d
call fcn.14005a964
cmp al, sil
je 0x1400ac59b
mov byte [rsp + 0x61], bpl
jmp 0x1400ac767
lea rdx, [rsp + 0x188]
lea rcx, str.byte
mov r8d, 4
call fcn.14005a964
cmp al, sil
je 0x1400ac5c4
mov byte [rsp + 0x62], bpl
jmp 0x1400ac767
lea rdx, [rsp + 0x188]
lea rcx, [0x1400f4470]
mov r8d, ebp
call fcn.14005a964
cmp al, sil
je 0x1400ac5ea
mov byte [rsp + 0x60], 3
jmp 0x1400ac767
lea rdx, [rsp + 0x188]
lea rcx, [0x1400fc590]
mov r8d, r12d
call fcn.14005a964
cmp al, sil
je 0x1400ac610
or byte [rsp + 0x60], bpl
jmp 0x1400ac767
lea rdx, [rsp + 0x188]
lea rcx, [0x1400fc58c]
mov r8d, r12d
call fcn.14005a964
cmp al, sil
je 0x1400ac636
or byte [rsp + 0x60], r12b
jmp 0x1400ac767
lea rdx, [rsp + 0x188]
lea rcx, str.name
mov r8d, 4
call fcn.14005a964
cmp al, sil
je 0x1400ac662
mov byte [rsp + 0xba], bpl
jmp 0x1400ac767
lea rdx, [rsp + 0x188]
lea rcx, [0x1400fbc04]
mov r8d, ebp
call fcn.14005a964
cmp al, sil
je 0x1400ac686
add dil, bpl
jmp 0x1400ac767
lea rdx, [rsp + 0x188]
lea rcx, [0x1400fc580]
mov r8d, r12d
call fcn.14005a964
cmp al, sil
je 0x1400ac6aa
dec dil
jmp 0x1400ac767
lea rdx, [rsp + 0x188]
lea rcx, [0x1400fc57c]
mov r8d, ebp
call fcn.14005a964
cmp al, sil
je 0x1400ac6ce
add r15b, bpl
jmp 0x1400ac767
lea rdx, [rsp + 0x188]
lea rcx, [0x1400fc578]
mov r8d, r12d
call fcn.14005a964
cmp al, sil
je 0x1400ac6f4
mov byte [rsp + 0xb0], bpl
jmp 0x1400ac767
lea rdx, [rsp + 0x188]
lea rcx, str.init
mov r8d, 4
call fcn.14005a964
cmp al, sil
je 0x1400ac71d
mov byte [rsp + 0xb9], bpl
jmp 0x1400ac767
mov rcx, qword [rsp + 0x188]
movzx eax, word [rcx]
cmp ax, si
je 0x1400ac75a
mov edx, 9
lea r9d, [rdx + 4]
cmp dx, ax
ja 0x1400ac741
cmp ax, r9w
jbe 0x1400ac752
cmp r14w, ax
je 0x1400ac752
add rcx, r12
mov ax, word [rcx]
cmp ax, si
jne 0x1400ac736
mov qword [rsp + 0x188], rcx
lea rcx, [rsp + 0x188]
call fcn.14005044c
mov rbp, qword [rsp + 0x188]
movzx eax, word [rbp]
cmp ebx, eax
je 0x1400ac3c6
mov r14b, byte [rsp + 0xb8]
mov byte [rsp + 0x63], dil
mov byte [rsp + 0x64], r15b
mov r15, qword [rsp + 0x108]
mov rdi, rsi
mov dword [rsp + 0xd0], r13d
lea rcx, [rsp + 0x88]
call fcn.14005818c
lea rcx, [rsp + 0xc8]
call fcn.14005818c
lea rcx, [rsp + 0x80]
call fcn.14005818c
lea rcx, [rsp + 0xa0]
call fcn.14005818c
lea rcx, [rsp + 0x98]
call fcn.14005818c
movzx eax, word [rbp]
mov ecx, 0x6e
or ax, 0x20
cmp cx, ax
je 0x1400ac861
mov ecx, 0x75
cmp cx, ax
je 0x1400ac861
mov ecx, 0x62
cmp cx, ax
je 0x1400ac861
lea eax, [rcx - 4]
cmp ax, word [rbp]
je 0x1400ac861
lea eax, [rcx - 0x37]
cmp ax, word [rbp]
je 0x1400ac861
lea eax, [rcx - 0x3f]
lea r13d, [rcx - 0x3e]
cmp ax, word [rbp]
je 0x1400ac867
lea eax, [rcx - 0x22]
cmp ax, word [rbp]
je 0x1400ac867
cmp r13w, word [rbp]
je 0x1400ac867
lea eax, [rcx - 0x38]
cmp ax, word [rbp]
je 0x1400ac867
lea eax, [rcx + 0x1c]
cmp ax, word [rbp]
je 0x1400ac867
cmp word [rbp], 0x2e
je 0x1400ac867
lea eax, [rcx - 0x23]
cmp ax, word [rbp]
je 0x1400ac867
mov bl, byte [rsp + 0x198]
jmp 0x1400ac87c
mov r13d, 0x24
mov bl, byte [rbp]
add rbp, r12
mov byte [rsp + 0x198], bl
mov qword [rsp + 0x188], rbp
cmp bl, sil
je 0x1400ac899
lea rcx, [rsp + 0x198]
call fcn.1400196ec
movsx ecx, byte [rax]
movzx eax, word [rbp]
cmp ecx, eax
je 0x1400ac8a0
cmp r13w, word [rbp]
jne 0x1400ac8b2
mov al, byte [rbp]
add rbp, r12
mov byte [rsp + 0x70], al
mov qword [rsp + 0x188], rbp
lea eax, [rbx - 0x41]
cmp al, 0x19
ja 0x1400ac8c3
or bl, 0x20
mov byte [rsp + 0x198], bl
lea rcx, [rsp + 0x188]
call fcn.14005044c
mov r13, qword [rsp + 0x188]
lea rdx, [0x1400fc570]
mov rcx, r13
mov qword [rsp + 0x90], r13
mov rbp, r13
call qword [sym.imp.SHLWAPI.dll_StrStrW]
mov rbx, rax
cmp rax, rsi
je 0x1400ac8ff
lea rbp, [rax + 4]
mov qword [rsp + 0xd8], rbp
mov r8, rbp
mov r9d, 0x3d
cmp word [rbp], si
je 0x1400aca02
lea r10d, [r9 - 0x11]
cmp r10w, word [r8]
je 0x1400ac97d
cmp r9w, word [r8]
je 0x1400aca02
mov eax, 0x21
cmp ax, word [r8]
jne 0x1400ac967
lea rax, [r8 + 2]
lea rcx, [rsp + 0x188]
mov qword [rsp + 0x188], rax
call fcn.14005044c
mov rcx, qword [rsp + 0x188]
cmp word [rcx], si
je 0x1400aca02
lea r8, [rcx - 2]
add r8, r12
mov qword [rsp + 0xd8], r8
cmp word [r8], si
jne 0x1400ac91e
jmp 0x1400aca02
lea rcx, [r8 + 2]
mov edx, r9d
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov r8, rax
cmp rax, rsi
je 0x1400ac99c
mov qword [rsp + 0xd8], rax
jmp 0x1400ac9fc
mov rcx, qword [rsp + 0xd8]
mov edx, 0x21
add rcx, r12
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov r11, rax
cmp rax, rsi
je 0x1400ac9f4
lea rcx, [rax + 2]
mov qword [rsp + 0x188], rcx
lea rcx, [rsp + 0x188]
call fcn.14005044c
mov r8, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x188]
cmp word [rcx], si
cmove r8, r11
mov qword [rsp + 0xd8], r8
jmp 0x1400ac9fc
mov r8, qword [rsp + 0xd8]
mov r9d, 0x3d
mov eax, 0x2c
cmp ax, word [r8]
je 0x1400aca1e
cmp r9w, word [r8]
je 0x1400aca1e
mov eax, 0x21
cmp ax, word [r8]
jne 0x1400aca46
mov r15b, byte [r8]
mov word [r8], si
add qword [rsp + 0xd8], r12
mov byte [rsp + 0x188], r15b
cmp r15b, sil
jne 0x1400acb90
mov r15, qword [rsp + 0x108]
inc r14b
cmp r14b, sil
mov byte [rsp + 0xb8], r14b
jg 0x1400acb46
mov rcx, qword [rsp + 0x180]
lea r8, [rsp + 0xe8]
xor r9d, r9d
mov rdx, r15
mov byte [rsp + 0x20], 1
call fcn.14006bbdc
mov rdx, qword [rsp + 0xe8]
lea rcx, [rsp + 0x98]
mov qword [rsp + 0x188], rdx
call fcn.14005041c
lea rcx, [rsp + 0xa0]
call fcn.14005041c
lea rcx, [rsp + 0x80]
call fcn.14005041c
lea rcx, [rsp + 0xc8]
call fcn.14005041c
lea rcx, [rsp + 0x88]
call fcn.14005041c
lea rcx, [rsp + 0x188]
call fcn.14005044c
lea rdx, [rsp + 0x188]
lea rcx, str.___initram
mov r8d, 0xa
call fcn.14005a964
mov ecx, 0x2d
lea edx, [rcx - 3]
lea r8d, [rcx - 0x24]
lea r9d, [rcx - 0x20]
cmp al, sil
je 0x1400ac343
mov ecx, 3
call fcn.140018b18
lea rcx, [rsp + 0xe8]
call fcn.14005041c
lea rcx, [rsp + 0x110]
call fcn.14005041c
mov rax, rsi
add rsp, 0x138
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, [rsp + 0x98]
call fcn.14005041c
lea rcx, [rsp + 0xa0]
call fcn.14005041c
lea rcx, [rsp + 0x80]
call fcn.14005041c
lea rcx, [rsp + 0xc8]
call fcn.14005041c
lea rcx, [rsp + 0x88]
call fcn.14005041c
mov rsi, 0xffffffff80070057
jmp 0x1400acb15
mov qword [rsp + 0xc0], rsi
mov r14d, 0x5c
cmp rbx, rsi
jne 0x1400acc9d
mov r8d, r14d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov rbx, rax
cmp rax, rsi
jne 0x1400acc9d
lea r8d, [r14 - 0x30]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x110]
mov r9b, 1
call fcn.14006f0ac
lea rdx, [rsp + 0x88]
xor r8d, r8d
mov rcx, rax
call fcn.14005bab0
mov rbp, qword [rsp + 0x88]
mov edx, r14d
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov r14, rax
cmp rax, rsi
je 0x1400accdf
add r14, r12
lea rdx, [0x1400fc570]
mov word [rax], si
mov rcx, r14
mov qword [rsp + 0x108], r14
call qword [sym.imp.SHLWAPI.dll_StrStrW]
mov rbx, rax
mov qword [rsp + 0x100], rax
cmp byte [rsp + 0x60], sil
je 0x1400acc5d
cmp rax, rsi
jne 0x1400acc81
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rbx, [r14 + rcx*2]
mov qword [rsp + 0x100], rbx
cmp rbx, rsi
jne 0x1400acc81
xor edx, edx
mov rcx, r14
lea r8d, [rdx + 0x5c]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov rbx, rax
mov qword [rsp + 0x100], rax
cmp rax, rsi
je 0x1400accdf
mov r13, qword [rsp + 0x180]
cmp word [rbx], si
je 0x1400acd2b
mov word [rbx], si
add rbx, r12
jmp 0x1400acd23
mov rdx, r13
mov r13, qword [rsp + 0x180]
lea r8, [rsp + 0x88]
xor r9d, r9d
mov rcx, r13
mov word [rbx], si
mov byte [rsp + 0x20], 1
call fcn.14006bbdc
mov rbp, qword [rsp + 0x88]
mov rcx, rbp
mov edx, r14d
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov r14, rax
cmp rax, rsi
jne 0x1400accf1
lea rcx, [rsp + 0xc0]
call fcn.14005041c
jmp 0x1400acb46
add r14, r12
lea rdx, [rbx + 2]
lea r8, [rsp + 0xc0]
xor r9d, r9d
mov rcx, r13
mov word [rax], si
mov qword [rsp + 0x108], r14
mov byte [rsp + 0x20], 1
call fcn.14006bbdc
mov rbx, qword [rsp + 0xc0]
mov qword [rsp + 0x100], rbx
mov eax, 0x5c
cmp ax, word [rbx]
jne 0x1400acd40
add rbx, r12
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0xe0], rsi
cmp byte [rsp + 0xba], sil
je 0x1400acd7c
lea r8, [rsp + 0xe0]
lea rdx, [rsp + 0xd8]
mov rcx, r13
call fcn.14006a050
mov rdx, qword [rsp + 0xe0]
mov qword [rsp + 0xd8], rdx
jmp 0x1400acd84
mov rdx, qword [rsp + 0xd8]
mov eax, 0x2c
cmp r15b, al
jne 0x1400ace64
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x110]
mov r8d, eax
mov r9b, 1
mov r15d, eax
call fcn.14006f0ac
lea rdx, [rsp + 0x80]
xor r8d, r8d
mov rcx, rax
call fcn.14005bab0
lea rdx, [rsp + 0x80]
xor r8d, r8d
mov rcx, r13
call fcn.140003700
cmp byte [rsp + 0x198], 0x2e
jne 0x1400ace3a
mov rax, qword [rsp + 0xd8]
cmp r15w, word [rax]
jne 0x1400ace3a
add rax, r12
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x110]
mov r8d, r15d
mov r9b, 1
mov qword [rsp + 0xd8], rax
call fcn.14006f0ac
lea rdx, [rsp + 0x98]
xor r8d, r8d
mov rcx, rax
call fcn.14005bab0
lea rdx, [rsp + 0x98]
xor r8d, r8d
mov rcx, r13
call fcn.140003700
mov rax, qword [rsp + 0x80]
cmp word [rax], si
jne 0x1400acfde
lea rdx, str.RegDat
lea rcx, [rsp + 0x80]
call fcn.140062700
jmp 0x1400acfde
mov eax, 0x21
cmp r15b, al
je 0x1400acfde
mov al, byte [rsp + 0x198]
cmp word [rdx], si
jne 0x1400aceb0
cmp al, 0x24
je 0x1400acedb
mov r8d, 0x2a
lea ecx, [r8 + 0x54]
cmp al, r8b
je 0x1400aceb9
cmp al, cl
je 0x1400aceb9
cmp byte [rsp + 0x64], sil
je 0x1400acfde
mov rdi, rdx
mov qword [rsp + 0xa8], rdx
jmp 0x1400acfde
mov ecx, 0x7e
lea r8d, [rcx - 0x54]
cmp al, 0x24
je 0x1400acedb
cmp al, r8b
je 0x1400acedb
cmp al, cl
je 0x1400acedb
lea rcx, [rsp + 0xd8]
call fcn.14005044c
mov rdx, qword [rsp + 0xd8]
lea rcx, [rsp + 0x78]
call fcn.140062680
mov rdi, qword [rsp + 0x78]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x68], rdi
call fcn.14005044c
mov rdx, rdi
cmp byte [rsp + 0x190], sil
je 0x1400acf15
lea rcx, [rsp + 0xa0]
call fcn.140062700
jmp 0x1400acf2d
lea r8, [rsp + 0xa0]
xor r9d, r9d
mov rcx, r13
mov byte [rsp + 0x20], 1
call fcn.14006a800
mov rdi, qword [rsp + 0xa0]
lea rcx, [rsp + 0x90]
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0x90], rdi
call fcn.14005044c
mov cl, byte [rsp + 0x198]
cmp cl, sil
jne 0x1400acfa6
mov rdx, qword [rsp + 0x68]
lea rcx, [0x1400fc554]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, esi
jne 0x1400acf7d
lea rdi, [0x1400f04f4]
jmp 0x1400acfcc
mov rax, qword [rsp + 0x90]
mov ecx, 0x23
cmp cx, word [rax]
je 0x1400acf99
mov ecx, 0x40
cmp cx, word [rax]
jne 0x1400acfd4
mov rdi, rax
mov qword [rsp + 0xa8], rax
jmp 0x1400acfd4
mov eax, 0x23
cmp cl, al
je 0x1400acfb8
mov eax, 0x40
cmp cl, al
jne 0x1400acfd4
mov rcx, qword [rsp + 0x90]
movzx eax, word [rcx]
neg ax
sbb rdi, rdi
and rdi, rcx
mov qword [rsp + 0xa8], rdi
lea rcx, [rsp + 0x78]
call fcn.14005041c
lea rdx, str.HKLM
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
je 0x1400ad0f0
lea rdx, str.HKEY_LOCAL_MACHINE
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
je 0x1400ad0f0
lea rdx, str.HKCU
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
je 0x1400ad0e7
lea rdx, str.HKEY_CURRENT_USER
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
je 0x1400ad0e7
lea rdx, str.HKCR
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
je 0x1400ad0de
lea rdx, str.HKEY_CLASSES_ROOT
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
je 0x1400ad0de
lea rdx, [0x1400fc4a8]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
je 0x1400ad0d5
lea rdx, str.HKEY_USERS
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
je 0x1400ad0d5
lea rdx, str.HKCC
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
je 0x1400ad0cc
lea rdx, str.HKEY_CURRENT_CONFIG
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, esi
je 0x1400ad0cc
lea rcx, [rsp + 0xe0]
call fcn.14005041c
jmp 0x1400accdf
mov r15, 0xffffffff80000005
jmp 0x1400ad0f7
mov r15, 0xffffffff80000003
jmp 0x1400ad0f7
mov r15, 0xffffffff80000000
jmp 0x1400ad0f7
mov r15, 0xffffffff80000001
jmp 0x1400ad0f7
mov r15, 0xffffffff80000002
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x90], r15
cmp word [rax], si
je 0x1400adc1e
mov cl, byte [rsp + 0x198]
mov edx, 0x3f
cmp cl, 0x2e
je 0x1400ad128
mov r13d, esi
cmp cl, dl
jne 0x1400ad132
mov r13d, 1
cmp cl, dl
je 0x1400ad140
cmp r13d, esi
je 0x1400ad13c
cmp word [rax], si
je 0x1400ad140
mov ebp, esi
jmp 0x1400ad145
mov ebp, 1
xor ecx, ecx
mov dword [rsp + 0xf8], ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea rcx, [rsp + 0x78]
mov edx, 0x64
mov dword [rsp + 0x12c], esi
call fcn.140058200
lea rcx, [rsp + 0xa8]
call fcn.14005818c
cmp byte [rsp + 0x198], 0x2e
lea rax, [rsp + 0x78]
lea r14, [rsp + 0xa8]
lea rcx, [rsp + 0x68]
mov edx, 0x1000
cmovne r14, rax
call fcn.140057f14
mov rdx, qword [rsp + 0x108]
mov dword [rsp + 0xb4], 0xfff
mov dword [rsp + 0x188], esi
mov dword [rsp + 0x128], esi
mov rcx, r15
cmp byte [rsp + 0x60], sil
je 0x1400ad457
lea rax, [rsp + 0x90]
mov r9d, 9
xor r8d, r8d
mov dword [rsp + 0x100], esi
mov dword [rsp + 0xd0], esi
mov dword [rsp + 0x188], esi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xf8], esi
mov dword [rsp + 0xf0], esi
mov qword [rsp + 0x90], rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x188]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xd0]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
lea rax, [rsp + 0xf0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xf8]
xor edx, edx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x188]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ecx, dword [rsp + 0x188]
cmp ecx, dword [rsp + 0xf0]
mov ebx, eax
cmovb ecx, dword [rsp + 0xf0]
mov dword [rsp + 0x188], ecx
lea r15d, [rcx*4 + 0x20]
lea rcx, [rsp + 0x108]
movsxd rdx, r15d
shr rdx, 1
add rdx, 8
call fcn.140058200
mov rdi, qword [rsp + 0x108]
mov eax, 0xd
mov word [rdi], ax
mov eax, 0xa
mov ecx, 0x76
mov word [rdi + 2], ax
lea rax, [rdi + 4]
lea r13, [rdi + 8]
mov word [rax], cx
mov ecx, 0x20
mov rbp, rax
mov word [rdi + 6], cx
mov cl, byte [rsp + 0x60]
mov word [r13], si
cmp cl, 3
cmovne r13, rax
cmp ebx, esi
jne 0x1400ad432
test cl, 1
je 0x1400ad3bf
cmp dword [rsp + 0xf8], esi
mov ebx, esi
jle 0x1400ad3bf
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x100], r15d
mov word [r13], si
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x100]
mov r8, r13
mov edx, ebx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
jne 0x1400ad3ac
lea rcx, [rsp + 0x78]
mov rdx, rbp
call fcn.1400582c8
mov rbp, rdi
inc ebx
cmp ebx, dword [rsp + 0xf8]
jl 0x1400ad35c
mov cl, byte [rsp + 0x60]
lea rax, [rdi + 4]
mov edx, 0x6b
mov word [rax], dx
test r12b, cl
je 0x1400ad432
cmp dword [rsp + 0xd0], esi
mov ebx, esi
jle 0x1400ad432
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x100], r15d
mov word [r13], si
mov rcx, qword [rsp + 0x90]
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x100]
mov r8, r13
mov edx, ebx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, esi
jne 0x1400ad427
lea rcx, [rsp + 0x78]
mov rdx, rbp
call fcn.1400582c8
mov rbp, rdi
inc ebx
cmp ebx, dword [rsp + 0xd0]
jl 0x1400ad3d7
mov rcx, qword [rsp + 0x90]
cmp rcx, rsi
je 0x1400ad445
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x108]
call fcn.14005041c
jmp 0x1400adb35
lea rax, [rsp + 0x188]
lea r9, [rsp + 0x68]
mov r8, rbx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb4]
mov qword [rsp + 0x20], rax
call fcn.14005d014
movsxd rdi, dword [rsp + 0x188]
mov ebx, eax
cmp edi, esi
je 0x1400ad58f
mov rax, qword [rsp + 0x100]
cmp word [rax], si
jne 0x1400ad4ce
cmp edi, r12d
jne 0x1400ad4ce
cmp ebx, 0xfffffffe
jne 0x1400ad4ce
cmp r13d, esi
je 0x1400adb35
lea rdx, [0x1400fc454]
or rax, 0xffffffffffffffff
mov rcx, r14
mov r8, rax
mov r9, rax
call fcn.140058348
jmp 0x1400adb35
mov dword [rsp + 0x12c], edi
cmp r13d, esi
je 0x1400ad4e3
lea rdx, str.ERROR
jmp 0x1400ad4b7
cmp byte [rsp + 0xb9], sil
jne 0x1400adb35
lea rcx, [rsp + 0x68]
call fcn.14005041c
lea rcx, [rsp + 0xa8]
call fcn.14005041c
lea rcx, [rsp + 0x78]
call fcn.14005041c
lea rcx, [rsp + 0xe0]
call fcn.14005041c
lea rcx, [rsp + 0xc0]
call fcn.14005041c
lea rcx, [rsp + 0x98]
call fcn.14005041c
lea rcx, [rsp + 0xa0]
call fcn.14005041c
lea rcx, [rsp + 0x80]
call fcn.14005041c
lea rcx, [rsp + 0xc8]
call fcn.14005041c
lea rcx, [rsp + 0x88]
call fcn.14005041c
lea rcx, [rsp + 0xe8]
call fcn.14005041c
lea rcx, [rsp + 0x110]
call fcn.14005041c
mov rax, rdi
jmp 0x1400acb32
mov r8, qword [rsp + 0xf0]
cmp r8, rsi
jl 0x1400ad5a7
mov r15d, 1
cmp r8, rbx
jne 0x1400ad5aa
mov r15d, esi
or rax, 0xffffffffffffffff
mov cl, sil
lea rdx, str.REG_SZ
mov dil, al
cmp ebx, 1
jne 0x1400ad5c8
mov dil, sil
lea ebx, [rax + 0x25]
jmp 0x1400ad5ea
cmp ebx, 6
jne 0x1400ad5d8
lea rdx, str.REG_LINK
mov bl, 0x5e
jmp 0x1400ad5ea
cmp ebx, 0x15
jne 0x1400ad6dd
lea rdx, str.REG_MUI_SZ
mov bl, 0x75
cmp r13d, esi
je 0x1400ad60d
mov r9, rax
mov r8, rax
mov rcx, r14
call fcn.140058348
cmp ebp, esi
jne 0x1400adb35
mov r8, qword [rsp + 0xf0]
cmp r15d, esi
jne 0x1400ad63b
cmp r8, rsi
jge 0x1400ad8c2
mov al, byte [rsp + 0x198]
cmp bl, al
je 0x1400ad8c2
cmp al, 0x2e
je 0x1400ad8c2
cmp dil, al
je 0x1400ad8c2
lea rcx, [rsp + 0x68]
call fcn.14005041c
lea rcx, [rsp + 0xa8]
call fcn.14005041c
lea rcx, [rsp + 0x78]
call fcn.14005041c
lea rcx, [rsp + 0xe0]
call fcn.14005041c
lea rcx, [rsp + 0xc0]
call fcn.14005041c
lea rcx, [rsp + 0x98]
call fcn.14005041c
lea rcx, [rsp + 0xa0]
call fcn.14005041c
lea rcx, [rsp + 0x80]
call fcn.14005041c
lea rcx, [rsp + 0xc8]
call fcn.14005041c
lea rcx, [rsp + 0x88]
call fcn.14005041c
lea rcx, [rsp + 0xe8]
call fcn.14005041c
lea rcx, [rsp + 0x110]
call fcn.14005041c
mov rax, 0xffffffff80070057
jmp 0x1400acb32
cmp ebx, 0xb
jne 0x1400ad74b
cmp r13d, esi
je 0x1400ad70c
lea rdx, str.REG_QWORD
mov r9, rax
mov r8, rax
mov rcx, r14
call fcn.140058348
cmp ebp, esi
jne 0x1400adb35
mov r8, qword [rsp + 0xf0]
cmp r15d, esi
jne 0x1400ad63b
cmp r8, rsi
jge 0x1400ad72d
mov al, byte [rsp + 0x198]
cmp al, 0x2b
je 0x1400ad72d
cmp al, 0x2e
jne 0x1400ad63b
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
lea r8, str.0x_I64x
mov rdx, qword [rdx]
call fcn.1400c3b98
jmp 0x1400adb35
mov rdi, qword [rsp + 0x68]
cmp ebx, 4
jne 0x1400ad7aa
cmp r13d, esi
je 0x1400ad77f
lea rdx, str.REG_DWORD
mov r9, rax
mov r8, rax
mov rcx, r14
call fcn.140058348
cmp ebp, esi
jne 0x1400adb35
mov r8, qword [rsp + 0xf0]
cmp r15d, esi
jne 0x1400ad63b
cmp r8, rsi
jge 0x1400ad819
mov al, byte [rsp + 0x198]
mov ecx, 0x23
cmp al, cl
je 0x1400ad819
cmp al, 0x2e
je 0x1400ad819
jmp 0x1400ad63b
cmp ebx, 5
jne 0x1400ad833
cmp r13d, esi
je 0x1400ad7dd
lea rdx, str.REG_DWORD_BIG_ENDIAN
mov r9, rax
mov r8, rax
mov rcx, r14
call fcn.140058348
cmp ebp, esi
jne 0x1400adb35
mov r8, qword [rsp + 0xf0]
cmp r15d, esi
jne 0x1400ad63b
cmp r8, rsi
jge 0x1400ad803
mov al, byte [rsp + 0x198]
mov ecx, 0x62
cmp al, cl
je 0x1400ad803
cmp al, 0x2e
jne 0x1400ad63b
mov al, byte [rdi + 3]
mov cl, byte [rdi]
mov byte [rdi], al
mov byte [rdi + 3], cl
mov al, byte [rdi + 2]
mov cl, byte [rdi + 1]
mov byte [rdi + 1], al
mov byte [rdi + 2], cl
mov r8d, dword [rdi]
mov rcx, qword [rsp + 0x78]
lea rdx, str.0x_x
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x1400adb35
cmp ebx, r12d
jne 0x1400ad8db
cmp r13d, esi
je 0x1400ad866
lea rdx, str.REG_EXPAND_SZ
mov r9, rax
mov r8, rax
mov rcx, r14
call fcn.140058348
cmp ebp, esi
jne 0x1400adb35
mov r8, qword [rsp + 0xf0]
cmp r15d, esi
jne 0x1400ad63b
cmp r8, rsi
jge 0x1400ad88c
mov al, byte [rsp + 0x198]
mov ecx, 0x7e
cmp al, cl
je 0x1400ad88c
cmp al, 0x2e
jne 0x1400ad63b
mov r8b, byte [rsp + 0x70]
cmp r8b, sil
je 0x1400ad8c2
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x180]
lea r8, [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0xd8], rdx
mov byte [rsp + 0x20], 1
call fcn.14006bbdc
jmp 0x1400adb35
mov rcx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x68], rcx
jmp 0x1400adb35
cmp ebx, 7
jne 0x1400ad9fa
cmp r13d, esi
je 0x1400ad90e
lea rdx, str.REG_MULTI_SZ
mov r9, rax
mov r8, rax
mov rcx, r14
call fcn.140058348
cmp ebp, esi
jne 0x1400adb35
mov r8, qword [rsp + 0xf0]
cmp r15d, esi
jne 0x1400ad63b
cmp r8, rsi
mov ebx, 0x2a
jge 0x1400ad934
mov al, byte [rsp + 0x198]
cmp al, bl
je 0x1400ad934
cmp al, 0x2e
jne 0x1400ad63b
movsxd rdi, dword [rsp + 0xb4]
lea rcx, [rsp + 0x78]
shr rdi, 1
lea edx, [rdi*4 + 6]
call fcn.14005828c
mov rcx, qword [rsp + 0x68]
mov r11, qword [rsp + 0x78]
mov eax, edi
lea rdi, [rcx + rax*2]
cmp rcx, rdi
jae 0x1400ad9f1
mov r8b, byte [rsp + 0x70]
mov edx, 0x30
mov r9d, 0x5c
cmp r8b, bl
jne 0x1400ad9ac
cmp r9w, word [rcx]
jne 0x1400ad9ac
lea rax, [rcx + 2]
cmp dx, word [rax]
je 0x1400ad998
cmp r9w, word [rax]
je 0x1400ad998
cmp word [rax], si
jne 0x1400ad9ac
lea rcx, [r12 + rax]
mov word [r11], r9w
movzx eax, word [rax]
add r11, r12
mov word [r11], ax
jmp 0x1400ad9e9
movzx eax, word [rcx]
cmp ax, si
je 0x1400ad9c0
mov word [r11], ax
add r11, r12
add rcx, r12
jmp 0x1400ad9ec
add rcx, r12
cmp r8b, 0x24
jne 0x1400ad9de
cmp rcx, rdi
jae 0x1400ad9f1
mov eax, 0xd
mov word [r11], ax
mov eax, 0xa
jmp 0x1400ad9a3
mov word [r11], r9w
add r11, r12
mov word [r11], dx
add r11, r12
cmp rcx, rdi
jb 0x1400ad973
mov word [r11], si
jmp 0x1400adb35
cmp ebx, 3
jne 0x1400ada08
lea rdx, str.REG_BINARY
jmp 0x1400ada13
cmp ebx, esi
jne 0x1400ada1b
lea rdx, str.REG_NONE
mov r12d, 0xa
jmp 0x1400ada4f
mov ebp, 8
cmp ebx, ebp
jne 0x1400ada2d
lea rdx, str.REG_RESOURCE_LIST
jmp 0x1400ada13
mov edx, 9
lea r12d, [rdx + 1]
cmp ebx, edx
jne 0x1400ada43
lea rdx, str.REG_FULL_RESOURCE_DESCRIPTOR
jmp 0x1400ada4f
cmp ebx, r12d
jne 0x1400ada73
lea rdx, str.REG_RESOURCE_REQUIREMENTS_LIST
cmp r13d, esi
je 0x1400ada6f
mov r9, rax
mov r8, rax
mov rcx, r14
call fcn.140058348
cmp dword [rsp + 0xf8], esi
jne 0x1400adb35
mov cl, 0x40
jmp 0x1400adaa8
cmp r13d, esi
je 0x1400adaa8
mov edx, 0x32
mov rcx, r14
call fcn.14005828c
mov rcx, qword [r14]
lea rdx, str.0x_lx
mov r8d, ebx
call qword [sym.imp.USER32.dll_wsprintfW]
cmp dword [rsp + 0xf8], esi
jne 0x1400adb35
mov cl, sil
mov rax, qword [rsp + 0xf0]
cmp rax, rsi
jge 0x1400adac8
mov al, byte [rsp + 0x198]
cmp cl, al
je 0x1400adac8
cmp al, 0x2e
jne 0x1400ad63b
cmp r15d, esi
jne 0x1400ad63b
mov eax, dword [rsp + 0xb4]
lea ecx, [rax + rax*4 + 7]
movsxd rdx, ecx
lea rcx, [rsp + 0x78]
call fcn.14005828c
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x68]
mov word [rdi], si
mov word [rdi + 2], si
cmp dword [rsp + 0xb4], esi
mov dword [rsp + 0x128], 1
mov ebp, esi
jle 0x1400adb35
movzx r8d, byte [rbx]
lea rdx, str._0x_02X
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
inc ebp
inc rbx
add rdi, r12
cmp ebp, dword [rsp + 0xb4]
jl 0x1400adb10
mov rdx, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x180]
cmp word [rdx], si
je 0x1400adb63
movsxd rcx, dword [rsp + 0x128]
mov rax, qword [rsp + 0x78]
lea r8, [rax + rcx*2]
mov rcx, rdi
call fcn.140057738
mov rdx, qword [rsp + 0x98]
cmp word [rdx], si
je 0x1400adb7b
mov r8, qword [r14]
mov rcx, rdi
call fcn.140057738
lea rcx, [rsp + 0x68]
call fcn.14005041c
lea rcx, [rsp + 0xa8]
call fcn.14005041c
lea rcx, [rsp + 0x78]
call fcn.14005041c
lea rcx, [rsp + 0xe0]
call fcn.14005041c
lea rcx, [rsp + 0xc0]
call fcn.14005041c
lea rcx, [rsp + 0x98]
call fcn.14005041c
lea rcx, [rsp + 0xa0]
call fcn.14005041c
lea rcx, [rsp + 0x80]
call fcn.14005041c
lea rcx, [rsp + 0xc8]
call fcn.14005041c
lea rcx, [rsp + 0x88]
call fcn.14005041c
lea rcx, [rsp + 0xe8]
call fcn.14005041c
lea rcx, [rsp + 0x110]
call fcn.14005041c
movsxd rax, dword [rsp + 0x12c]
jmp 0x1400acb32
cmp rdi, rsi
je 0x1400ae3cb
mov al, byte [rsp + 0x63]
mov qword [rsp + 0x180], rsi
mov ebp, 8
cmp al, sil
mov qword [rsp + 0x68], rsi
lea r13, [rsp + 0x68]
jg 0x1400adc4e
cmp byte [rsp + 0x64], sil
je 0x1400adc76
movsx r8d, al
mov rdx, r14
mov rcx, r15
call fcn.140054860
cmp byte [rsp + 0x63], r12b
movsxd rbx, eax
jge 0x1400ae341
cmp byte [rsp + 0x64], sil
jne 0x1400ae341
mov al, byte [rsp + 0x198]
mov ecx, 0x2b
cmp al, cl
je 0x1400adc9f
cmp al, sil
jne 0x1400addf6
cmp cx, word [rdi]
jne 0x1400adcd3
add rdi, r12
mov qword [rsp + 0xa8], rdi
mov r14d, 0xb
cmp byte [rsp + 0x62], sil
je 0x1400ae1cf
movsx r8d, byte [rsp + 0x61]
lea rdx, [rsp + 0x180]
mov rcx, rdi
call fcn.1400ac194
mov r13, qword [rsp + 0x180]
jmp 0x1400ae250
mov ecx, 0x23
cmp cx, word [rdi]
jne 0x1400add21
add rdi, r12
mov qword [rsp + 0xa8], rdi
mov ebx, 4
mov r14, rbx
cmp byte [rsp + 0x62], sil
je 0x1400ae0db
movsx r8d, byte [rsp + 0x61]
lea rdx, [rsp + 0x180]
mov rcx, rdi
call fcn.1400ac194
mov r13, qword [rsp + 0x180]
mov rbp, rbx
jmp 0x1400ae250
mov ecx, 0x2a
cmp cx, word [rdi]
jne 0x1400add65
add rdi, r12
mov r14d, 7
mov qword [rsp + 0xf0], r14
cmp byte [rsp + 0x62], sil
je 0x1400adfa5
movsx r8d, byte [rsp + 0x61]
lea rdx, [rsp + 0x180]
mov rcx, rdi
call fcn.1400ac194
movsxd rbp, eax
jmp 0x1400adcc6
mov ecx, 0x7e
cmp cx, word [rdi]
jne 0x1400addda
add rdi, r12
mov r14, r12
cmp byte [rsp + 0x62], sil
jne 0x1400add47
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x180]
add eax, r12d
movsxd rdx, eax
call fcn.14005828c
mov r13, qword [rsp + 0x180]
mov rbp, r13
cmp word [rdi], si
je 0x1400adf96
mov edx, 0x30
lea ecx, [rdx + 0x2c]
movzx eax, word [rdi]
cmp cx, ax
jne 0x1400adf83
cmp dx, word [rdi + 2]
jne 0x1400adf83
mov word [rbp], si
add rbp, r12
add rdi, 4
jmp 0x1400adf8d
mov ecx, 0x40
cmp cx, word [rdi]
jne 0x1400adf22
add rdi, r12
mov r14d, 3
jmp 0x1400add47
mov ecx, 0x23
cmp al, cl
je 0x1400adce8
mov ecx, 0x62
cmp al, cl
jne 0x1400adeea
lea r14d, [rcx - 0x5d]
cmp byte [rsp + 0x62], sil
je 0x1400ade3e
movsx r8d, byte [rsp + 0x61]
lea rdx, [rsp + 0x180]
mov rcx, rdi
call fcn.1400ac194
mov r13, qword [rsp + 0x180]
jmp 0x1400adee0
cmp byte [rsp + 0x61], sil
je 0x1400adea5
mov edx, 0x30
cmp word [rdi], dx
jb 0x1400ade55
cmp word [rdi], 0x39
jbe 0x1400ade78
movzx eax, word [rdi]
mov ecx, 0x20
or ax, cx
cmp ax, 0x61
jb 0x1400ade6c
cmp ax, 0x66
jbe 0x1400ade7d
mov rsi, 0xffffffff80070057
jmp 0x1400ae162
mov ecx, 0x20
cmp dx, word [rdi]
jne 0x1400ade97
movzx eax, word [rdi + 2]
or ax, cx
mov ecx, 0x78
cmp cx, ax
jne 0x1400ade97
add rdi, 4
mov rcx, rdi
call fcn.1400593a0
mov dword [rsp + 0x68], eax
jmp 0x1400adec0
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xa8]
call fcn.1400665e0
cmp eax, 1
jl 0x1400ae15d
mov cl, byte [rsp + 0x68]
mov al, byte [rsp + 0x6b]
mov byte [rsp + 0x68], al
mov al, byte [rsp + 0x6a]
mov byte [rsp + 0x6b], cl
mov cl, byte [rsp + 0x69]
mov byte [rsp + 0x69], al
mov byte [rsp + 0x6a], cl
mov ebp, 4
jmp 0x1400ae250
mov ecx, 0x2a
cmp al, cl
je 0x1400add2e
mov ecx, 0x7e
cmp al, cl
je 0x1400add72
mov ecx, 0x40
cmp al, cl
je 0x1400addeb
mov ecx, 0x6e
cmp al, cl
jne 0x1400adf22
mov r14, rsi
jmp 0x1400add47
mov r14, qword [rsp + 0xf0]
cmp r14, rsi
jge 0x1400add47
cmp al, 0x5e
jne 0x1400adf3f
mov r14d, 6
jmp 0x1400adf61
mov ecx, 0x75
cmp al, cl
jne 0x1400adf4e
lea r14d, [rcx - 0x60]
jmp 0x1400adf61
cmp al, sil
je 0x1400adf5b
cmp al, 0x24
jne 0x1400ade6c
mov r14d, 1
cmp byte [rsp + 0x62], sil
jne 0x1400add47
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r13, rdi
movsxd rbp, eax
add rbp, rbp
jmp 0x1400ae250
mov word [rbp], ax
add rbp, r12
add rdi, r12
cmp word [rdi], si
jne 0x1400addb4
mov word [rbp], si
sub rbp, r13
add rbp, r12
jmp 0x1400ae250
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, esi
movsxd r14, eax
lea ecx, [r14 + 0x10]
movsxd rdx, ecx
lea rcx, [rsp + 0x180]
call fcn.14005828c
mov r13, qword [rsp + 0x180]
lea r8, [rdi + r14*2]
mov qword [rsp + 0xa8], r13
mov rbp, r13
cmp rdi, r8
jae 0x1400ae0a0
mov r13b, byte [rsp + 0x70]
mov edx, 0x30
lea r15d, [rdx + 0x2c]
lea r9d, [rdx - 0x26]
mov eax, 0x2a
mov word [rbp], si
cmp r13b, al
jne 0x1400ae027
cmp r15w, word [rdi]
jne 0x1400ae058
lea rax, [rdi + 2]
cmp r15w, word [rax]
jne 0x1400ae058
lea rdi, [r12 + rax]
movzx eax, word [rax]
mov word [rbp], ax
add rbp, r12
jmp 0x1400ae080
cmp r13b, 0x24
jne 0x1400ae058
movzx eax, word [rdi]
mov ecx, 0xd
cmp cx, ax
jne 0x1400ae046
cmp r9w, word [rdi + 2]
jne 0x1400ae046
add rdi, r12
jmp 0x1400ae04c
cmp r9w, ax
jne 0x1400ae076
add rdi, r12
mov word [rbp], si
add rbp, r12
jmp 0x1400ae072
mov ax, word [rdi]
cmp r15w, ax
jne 0x1400ae076
cmp dx, word [rdi + 2]
jne 0x1400ae076
mov word [rbp], si
add rbp, r12
add rdi, 4
inc ebx
jmp 0x1400ae082
mov word [rbp], ax
add rbp, r12
add rdi, r12
mov ebx, esi
cmp rdi, r8
jb 0x1400adff9
cmp ebx, 1
mov r13, qword [rsp + 0xa8]
mov r15, qword [rsp + 0x90]
jge 0x1400ae0a9
inc ebx
mov word [rbp], si
add rbp, r12
cmp r14d, esi
jle 0x1400ae0c7
cmp ebx, r12d
jge 0x1400ae0c7
sub r12d, ebx
mov rdi, rbp
movzx eax, si
mov ecx, r12d
lea rbp, [rbp + r12*2]
rep stosw word [rdi], ax
mov r14, qword [rsp + 0xf0]
mov word [rbp], si
sub rbp, r13
jmp 0x1400ae250
cmp byte [rsp + 0x61], sil
je 0x1400ae142
mov edx, 0x30
cmp word [rdi], dx
jb 0x1400ae0f2
cmp word [rdi], 0x39
jbe 0x1400ae113
movzx eax, word [rdi]
mov ecx, 0x20
or ax, cx
cmp ax, 0x61
jb 0x1400ade6c
cmp ax, 0x66
ja 0x1400ade6c
jmp 0x1400ae118
mov ecx, 0x20
cmp dx, word [rdi]
jne 0x1400ae131
movzx eax, word [rdi + 2]
or ax, cx
mov ecx, 0x78
cmp cx, ax
jne 0x1400ae131
add rdi, rbx
mov rcx, rdi
call fcn.1400593a0
mov dword [rsp + 0x68], eax
jmp 0x1400add19
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xa8]
call fcn.1400665e0
cmp eax, 1
jge 0x1400add19
mov esi, 1
lea rcx, [rsp + 0x180]
call fcn.14005041c
lea rcx, [rsp + 0xe0]
call fcn.14005041c
lea rcx, [rsp + 0xc0]
call fcn.14005041c
lea rcx, [rsp + 0x98]
call fcn.14005041c
lea rcx, [rsp + 0xa0]
call fcn.14005041c
lea rcx, [rsp + 0x80]
call fcn.14005041c
lea rcx, [rsp + 0xc8]
call fcn.14005041c
lea rcx, [rsp + 0x88]
call fcn.14005041c
jmp 0x1400acb15
cmp byte [rsp + 0x61], sil
je 0x1400ae235
mov edx, 0x30
cmp word [rdi], dx
jb 0x1400ae1e6
cmp word [rdi], 0x39
jbe 0x1400ae207
movzx eax, word [rdi]
mov ecx, 0x20
or ax, cx
cmp ax, 0x61
jb 0x1400ade6c
cmp ax, 0x66
ja 0x1400ade6c
jmp 0x1400ae20c
mov ecx, 0x20
cmp dx, word [rdi]
jne 0x1400ae226
movzx eax, word [rdi + 2]
or ax, cx
mov ecx, 0x78
cmp cx, ax
jne 0x1400ae226
add rdi, 4
mov rcx, rdi
call fcn.1400593a0
mov qword [rsp + 0x68], rax
jmp 0x1400ae250
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0xa8]
call fcn.140066408
cmp eax, 1
jl 0x1400ae15d
mov rbx, qword [rsp + 0x108]
mov r12b, byte [rsp + 0xb0]
mov r8, qword [rsp + 0x100]
mov dword [rsp + 0x28], ebp
mov edi, esi
mov qword [rsp + 0x20], r13
mov r9d, r14d
mov rdx, rbx
mov rcx, r15
cmp r12b, sil
je 0x1400ae28b
call qword [0x14010e1a0]
mov edi, eax
jmp 0x1400ae290
call fcn.140051788
cmp edi, 0x3fd
jne 0x1400ae2b7
cmp byte [rsp + 0x63], sil
jne 0x1400ae2b7
mov r8d, 1
mov rdx, rbx
mov rcx, r15
mov byte [rsp + 0x63], 1
call fcn.140054860
jmp 0x1400ae260
lea rcx, [rsp + 0x180]
call fcn.14005041c
lea rcx, [rsp + 0xe0]
call fcn.14005041c
lea rcx, [rsp + 0xc0]
call fcn.14005041c
lea rcx, [rsp + 0x98]
call fcn.14005041c
lea rcx, [rsp + 0xa0]
call fcn.14005041c
lea rcx, [rsp + 0x80]
call fcn.14005041c
lea rcx, [rsp + 0xc8]
call fcn.14005041c
lea rcx, [rsp + 0x88]
call fcn.14005041c
lea rcx, [rsp + 0xe8]
call fcn.14005041c
lea rcx, [rsp + 0x110]
call fcn.14005041c
movsxd rax, edi
jmp 0x1400acb32
lea rcx, [rsp + 0x180]
call fcn.14005041c
lea rcx, [rsp + 0xe0]
call fcn.14005041c
lea rcx, [rsp + 0xc0]
call fcn.14005041c
lea rcx, [rsp + 0x98]
call fcn.14005041c
lea rcx, [rsp + 0xa0]
call fcn.14005041c
lea rcx, [rsp + 0x80]
call fcn.14005041c
lea rcx, [rsp + 0xc8]
call fcn.14005041c
lea rcx, [rsp + 0x88]
call fcn.14005041c
lea rcx, [rsp + 0xe8]
call fcn.14005041c
lea rcx, [rsp + 0x110]
call fcn.14005041c
mov rax, rbx
jmp 0x1400acb32
mov eax, 0x21
cmp byte [rsp + 0x188], al
jne 0x1400ae400
cmp word [rbx], si
jne 0x1400ae400
mov eax, dword [rsp + 0xd0]
mov rdx, r14
mov rcx, r15
cmp eax, esi
je 0x1400ae3f9
mov r8d, eax
call fcn.140063f48
jmp 0x1400ae467
call fcn.140063c50
jmp 0x1400ae467
mov eax, dword [rsp + 0xd0]
mov rdx, r14
mov rcx, r15
cmp eax, esi
je 0x1400ae45f
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x188]
xor r9d, r9d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
xor r8d, r8d
mov dword [rsp + 0x28], 0x2001b
mov qword [rsp + 0x188], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x188]
mov edi, eax
cmp rcx, rsi
je 0x1400ae469
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400ae469
mov r8, rbx
call fcn.1400517fc
mov edi, eax
cmp edi, r12d
cmove edi, esi
jmp 0x1400ae2c4