Function at 0x140025ae0
Capabilities:
Check os version
Query or enumerate registry value
Set thread local storage value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov edi, edx
mov r15, rcx
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140025b28
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov r12d, 0x20
bt r15d, 8
jae 0x140025c1a
mov dword [0x1400a4af8], 0x100
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140025b6c
lea r9, str.BootExecute
lea r8, str.SystemCurrentControlSetControlSession_Manager
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14002beb0
cmp edi, 2
je 0x140025b71
cmp edi, 1
jne 0x140025bd9
lea r9, str.SetupExecute
lea r8, str.SystemCurrentControlSetControlSession_Manager
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14002beb0
cmp edi, 2
je 0x140025b97
cmp edi, 1
jne 0x140025bd9
lea r9, str.Execute
lea r8, str.SystemCurrentControlSetControlSession_Manager
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14002beb0
cmp edi, 2
je 0x140025bbd
cmp edi, 1
jne 0x140025bd9
lea r9, str.S0InitialCommand
lea r8, str.SystemCurrentControlSetControlSession_Manager
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14002beb0
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, ax
shr cx, 8
cmp al, 6
jne 0x140025c1a
cmp cx, 1
jb 0x140025c1a
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140025c1a
mov word [rsp + 0x20], r12w
lea r9, str.ServiceControlManagerExtension
lea r8, str.SystemCurrentControlSetControl
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140024680
bt r15d, 0x12
jae 0x140025c32
mov dword [0x1400a4af8], 0x40000
xor ecx, ecx
call fcn.14003ea10
xor r13d, r13d
bt r15d, 0x13
jae 0x140026533
mov dword [0x1400a4af8], 0x80000
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140025c8f
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareMicrosoftOfficeOutlookAddins
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.1400375e0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140025c93
test edi, edi
jne 0x140025ccb
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareMicrosoftOfficeOutlookAddins
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.1400375e0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140025cef
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140025d34
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftOfficeOutlookAddins
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.1400375e0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140025d38
test edi, edi
jne 0x140025d70
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftOfficeOutlookAddins
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.1400375e0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140025d91
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140025dd6
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareMicrosoftOfficeExcelAddins
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.1400375e0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140025dda
test edi, edi
jne 0x140025e12
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareMicrosoftOfficeExcelAddins
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.1400375e0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140025e36
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140025e7b
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftOfficeExcelAddins
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.1400375e0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140025e7f
test edi, edi
jne 0x140025eb7
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftOfficeExcelAddins
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.1400375e0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140025ed8
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140025f1d
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareMicrosoftOfficePowerPointAddins
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.1400375e0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140025f21
test edi, edi
jne 0x140025f59
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareMicrosoftOfficePowerPointAddins
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.1400375e0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140025f7d
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140025fc2
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftOfficePowerPointAddins
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.1400375e0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140025fc6
test edi, edi
jne 0x140025ffe
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftOfficePowerPointAddins
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.1400375e0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x14002601f
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140026064
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareMicrosoftOfficeWordAddins
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.1400375e0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140026068
test edi, edi
jne 0x1400260a0
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareMicrosoftOfficeWordAddins
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.1400375e0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x1400260c4
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140026109
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftOfficeWordAddins
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.1400375e0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x14002610d
test edi, edi
jne 0x140026145
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftOfficeWordAddins
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.1400375e0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140026166
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400261ab
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareMicrosoftOfficeAccessAddins
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.1400375e0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x1400261af
test edi, edi
jne 0x1400261e7
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareMicrosoftOfficeAccessAddins
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.1400375e0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x14002620b
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140026250
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftOfficeAccessAddins
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.1400375e0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140026254
test edi, edi
jne 0x14002628c
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftOfficeAccessAddins
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.1400375e0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x1400262ad
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400262f2
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareMicrosoftOfficeOnenoteAddins
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.1400375e0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x1400262f6
test edi, edi
jne 0x14002632e
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareMicrosoftOfficeOnenoteAddins
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.1400375e0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140026352
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140026397
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftOfficeOnenoteAddins
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.1400375e0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x14002639b
test edi, edi
jne 0x1400263d3
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftOfficeOnenoteAddins
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.1400375e0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x1400263f4
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140026437
lea rcx, str.SOFTWAREMicrosoftOffice_testSpecialPerf
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.1400213b0
nop
mov rcx, rbx
call fcn.140059d2c
cmp edi, 2
je 0x14002643b
test edi, edi
jne 0x140026471
lea rcx, str.SOFTWAREMicrosoftOffice_testSpecialPerf
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.1400213b0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140026495
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400264d8
lea rcx, str.SOFTWAREMicrosoftOffice_testSpecialPerf
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.1400213b0
nop
mov rcx, rbx
call fcn.140059d2c
cmp edi, 2
je 0x1400264dc
test edi, edi
jne 0x140026512
lea rcx, str.SOFTWAREMicrosoftOffice_testSpecialPerf
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.1400213b0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140026533
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov r14d, 0x2c
bt r15d, 9
jae 0x14002680e
mov dword [0x1400a4af8], 0x200
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14002656e
mov r9b, 1
lea r8, str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.1400321c0
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140026592
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400265b2
mov r9b, 1
lea r8, str.SoftwareWow6432NodeMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.1400321c0
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x1400265d3
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400265fd
mov word [rsp + 0x20], r14w
lea r9, str.Autorun
lea r8, str.SoftwareMicrosoftCommand_Processor
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140024680
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140026621
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14002664b
mov word [rsp + 0x20], r14w
lea r9, str.Autorun
lea r8, str.SoftwareWow6432NodeMicrosoftCommand_Processor
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140024680
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x14002666c
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x14002669b
mov word [rsp + 0x20], r14w
lea r9, str.Autorun
lea r8, str.SoftwareMicrosoftCommand_Processor
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.140024680
cmp edi, 2
je 0x14002669f
test edi, edi
jne 0x1400266da
lea rcx, str.SOFTWAREClassesExefileShellOpenCommand
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.1400213b0
nop
mov rcx, rbx
call fcn.140059d2c
cmp edi, 2
je 0x1400266df
cmp edi, 1
jne 0x140026739
lea rcx, str.SOFTWAREClassesExefileShellOpenCommand
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.1400213b0
nop
mov rcx, rbx
call fcn.140059d2c
cmp edi, 2
je 0x14002671f
cmp edi, 1
jne 0x140026739
lea r8, str.SoftwareClasses.exe
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140033670
cmp edi, 2
je 0x14002673d
test edi, edi
jne 0x140026757
lea r8, str.SoftwareClasses.exe
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.140033670
cmp edi, 2
je 0x14002675c
cmp edi, 1
jne 0x140026776
lea r8, str.SoftwareClasses.cmd
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140033670
cmp edi, 2
je 0x14002677a
test edi, edi
jne 0x1400267d3
lea r8, str.SoftwareClasses.cmd
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.140033670
cmp edi, 2
je 0x140026798
test edi, edi
jne 0x1400267d3
lea rcx, str.SOFTWAREClassesHtmlfileShellOpenCommand
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.1400213b0
nop
mov rcx, rbx
call fcn.140059d2c
cmp edi, 2
je 0x1400267d8
cmp edi, 1
jne 0x14002680e
lea rcx, str.SOFTWAREClassesHtmlfileShellOpenCommand
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.1400213b0
nop
mov rcx, rbx
call fcn.140059d2c
mov esi, r15d
and esi, 0x1000
je 0x1400268b3
mov dword [0x1400a4af8], 0x1000
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x140026887
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140026860
mov word [rsp + 0x20], r12w
lea r9, str.ServiceControllerStart
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140024680
cmp edi, 2
je 0x140026865
cmp edi, 1
jne 0x1400268b3
mov word [rsp + 0x20], r12w
lea r9, str.LsaStart
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140024680
cmp edi, 2
je 0x140026891
cmp edi, 1
jne 0x1400268b3
mov word [rsp + 0x20], r14w
lea r9, str.CmdLine
lea r8, str.SYSTEMSetup
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140024680
bt r15d, 0x11
jae 0x1400268f2
mov dword [0x1400a4af8], 0x20000
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400268df
lea rdx, str.ROOT_subscription
xor ecx, ecx
call fcn.14004a490
cmp edi, 2
je 0x1400268e4
cmp edi, 1
jne 0x1400268f2
lea rdx, str.ROOTdefault
xor ecx, ecx
call fcn.14004a490
test r15b, 0x20
je 0x14002691c
mov dword [0x1400a4af8], r12d
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14002691c
lea r8, str.SystemCurrentControlSetServices
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140039770
test r15b, 0x40
je 0x140026991
mov dword [0x1400a4af8], 0x40
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14002694e
lea r8, str.SystemCurrentControlSetServices
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14002d730
cmp edi, 2
je 0x140026953
cmp edi, 1
jne 0x140026991
lea rcx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionFont_Drivers
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
test esi, esi
je 0x140026c65
mov dword [0x1400a4af8], 0x1000
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
lea eax, [rdi - 1]
jb 0x140026a7c
cmp eax, 1
ja 0x1400269f4
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionAuthenticationCredential_Providers
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14001fdd0
nop
mov rcx, rbx
call fcn.140059d2c
cmp edi, 2
je 0x1400269fd
cmp edi, 1
jne 0x140026b75
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionAuthenticationCredential_Provider_Filters
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14001fdd0
nop
mov rcx, rbx
call fcn.140059d2c
cmp edi, 2
je 0x140026a41
cmp edi, 1
jne 0x140026b75
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionAuthenticationPLAP_Providers
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14001fdd0
nop
mov rcx, rbx
call fcn.140059d2c
jmp 0x140026b75
cmp eax, 1
ja 0x140026aa8
mov word [rsp + 0x20], r14w
lea r9, str.GinaDLL
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140024680
cmp edi, 2
je 0x140026ab1
cmp edi, 1
jne 0x140026ba6
mov word [rsp + 0x20], r14w
lea r9, str.UIHost
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140024680
cmp edi, 2
je 0x140026ae1
cmp edi, 1
jne 0x140026ba6
mov word [rsp + 0x20], r14w
lea r9, str.System
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140024680
cmp edi, 2
je 0x140026b11
cmp edi, 1
jne 0x140026ba6
mov qword [rbp + 0x40], r13
lea rcx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonNotify
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140046210
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140026b53
cmp edi, 1
jne 0x140026ba6
mov word [rsp + 0x20], r12w
lea r9, str.SaveDumpStart
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140024680
cmp edi, 2
je 0x140026b7f
cmp edi, 1
jne 0x140026ba6
mov word [rsp + 0x20], r12w
lea r9, str.Taskman
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140024680
cmp edi, 2
je 0x140026baa
test edi, edi
jne 0x140026bfc
mov word [rsp + 0x20], r14w
lea r9, str.Scrnsave.exe
lea r8, str.SOFTWAREPoliciesMicrosoftWindowsControl_PanelDesktop
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.140024680
cmp edi, 2
je 0x140026bd5
test edi, edi
jne 0x140026bfc
mov word [rsp + 0x20], r14w
lea r9, str.Scrnsave.exe
lea r8, str.Control_PanelDesktop
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.140024680
cmp edi, 2
je 0x140026c01
cmp edi, 1
jne 0x140026c65
mov word [rsp + 0x20], r14w
lea r9, str.ImagePath
lea r8, str.SystemCurrentControlSetControlBootVerificationProgram
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140024680
cmp edi, 2
je 0x140026c2d
cmp edi, 1
jne 0x140026c65
mov qword [rbp + 0x40], r13
lea rcx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogonGpExtensions
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140046210
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
bt r15d, 0xe
jae 0x140026d08
mov dword [0x1400a4af8], 0x4000
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140026cc5
mov qword [rbp + 0x40], r13
lea rcx, str.SYSTEMCurrentControlSetControlPrintMonitors
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov r9d, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140038610
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140026cca
cmp edi, 1
jne 0x140026d08
mov qword [rbp + 0x40], r13
lea rcx, str.SYSTEMCurrentControlSetControlPrintProviders
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov r9d, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140038610
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
bt r15d, 0xf
jae 0x140026de3
mov dword [0x1400a4af8], 0x8000
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140026d4c
mov word [rsp + 0x20], r14w
lea r9, str.SecurityProviders
lea r8, str.SYSTEMCurrentControlSetControlSecurityProviders
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140024680
cmp edi, 2
je 0x140026d55
cmp edi, 1
jne 0x140026de3
lea r9, str.Authentication_Packages
lea r8, str.SYSTEMCurrentControlSetControlLsa
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140035b40
cmp edi, 2
je 0x140026d7b
cmp edi, 1
jne 0x140026de3
lea r9, str.Notification_Packages
lea r8, str.SYSTEMCurrentControlSetControlLsa
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140035b40
cmp edi, 2
je 0x140026da1
cmp edi, 1
jne 0x140026de3
lea r9, str.Security_Packages
lea r8, str.SYSTEMCurrentControlSetControlLsa
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140035b40
cmp edi, 2
je 0x140026dc7
cmp edi, 1
jne 0x140026de3
lea r9, str.Security_Packages
lea r8, str.SYSTEMCurrentControlSetControlLsaOSConfig
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140035b40
bt r15d, 0x10
jae 0x140026e34
mov dword [0x1400a4af8], 0x10000
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140026e34
mov qword [rbp + 0x40], r13
lea rcx, str.SYSTEMCurrentControlSetControlNetworkProviderOrder
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140036840
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
bt r15d, 0xd
jae 0x140026f0b
mov dword [0x1400a4af8], 0x10000
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140026e7c
mov qword [rbp + 0x40], r13
lea rcx, str.SystemCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
lea rdx, [rbp + 0x40]
xor ecx, ecx
call fcn.1400477b0
cmp edi, 2
je 0x140026e85
cmp edi, 1
jne 0x140026f0b
mov qword [rbp + 0x40], r13
lea rcx, str.SystemCurrentControlSetServicesWinSock2ParametersNameSpace_Catalog5Catalog_Entries
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
lea rdx, [rbp + 0x40]
xor ecx, ecx
call fcn.140046d60
cmp edi, 2
je 0x140026eb5
cmp edi, 1
jne 0x140026f0b
mov qword [rbp + 0x40], r13
lea rcx, str.SystemCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries64
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
lea rdx, [rbp + 0x40]
xor ecx, ecx
call fcn.1400477b0
cmp edi, 2
je 0x140026ee5
cmp edi, 1
jne 0x140026f0b
mov qword [rbp + 0x40], r13
lea rcx, str.SystemCurrentControlSetServicesWinSock2ParametersNameSpace_Catalog5Catalog_Entries64
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
lea rdx, [rbp + 0x40]
xor ecx, ecx
call fcn.140046d60
mov r12d, r15d
and r12d, 2
je 0x1400273f2
mov dword [0x1400a4af8], 2
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140026f51
mov word [rsp + 0x20], r14w
lea r9, str.StartupPrograms
lea r8, str.SystemCurrentControlSetControlTerminal_ServerWds_rdpwd
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140024680
cmp edi, 2
je 0x140026f56
cmp edi, 1
jne 0x140026f78
mov word [rsp + 0x20], r14w
lea r9, str.AppSetup
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140024680
mov dword [0x1400a4af8], 2
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140026fca
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwarePoliciesMicrosoftWindowsSystemScriptsStartup
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14002e2c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140026fce
test edi, edi
jne 0x14002700e
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwarePoliciesMicrosoftWindowsSystemScriptsLogon
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14002e2c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140027013
cmp edi, 1
jne 0x140027053
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwarePoliciesMicrosoftWindowsSystemScriptsLogon
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14002e2c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140027057
test edi, edi
jne 0x1400270a9
mov word [rsp + 0x20], r14w
lea r9, str.UserInitMprLogonScript
lea r8, str.Environment
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.140024680
cmp edi, 2
je 0x140027082
test edi, edi
jne 0x1400270a9
mov word [rsp + 0x20], r14w
lea r9, str.UserInitMprLogonScript
lea r8, str.Environment
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140024680
cmp edi, 2
je 0x1400270b2
cmp edi, 1
jne 0x14002714a
mov word [rsp + 0x20], r14w
lea r9, str.Userinit
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140024680
cmp edi, 2
je 0x1400270de
cmp edi, 1
jne 0x14002714a
mov word [rsp + 0x20], r13w
lea r9, str.VmApplet
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140024680
cmp edi, 2
je 0x14002710a
cmp edi, 1
jne 0x14002714a
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwarePoliciesMicrosoftWindowsSystemScriptsShutdown
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14002e2c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x14002714e
test edi, edi
jne 0x14002718e
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwarePoliciesMicrosoftWindowsSystemScriptsLogoff
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14002e2c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140027193
cmp edi, 1
jne 0x1400271d3
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwarePoliciesMicrosoftWindowsSystemScriptsLogoff
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14002e2c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x1400271d7
test edi, edi
jne 0x140027217
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionGroup_PolicyScriptsStartup
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14002e2c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x14002721c
cmp edi, 1
jne 0x14002725c
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionGroup_PolicyScriptsStartup
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14002e2c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140027260
test edi, edi
jne 0x1400272a0
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionGroup_PolicyScriptsLogon
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14002e2c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x1400272a5
cmp edi, 1
jne 0x1400272e5
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionGroup_PolicyScriptsLogon
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14002e2c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x1400272e9
test edi, edi
jne 0x140027329
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionGroup_PolicyScriptsLogoff
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14002e2c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x14002732e
cmp edi, 1
jne 0x14002736e
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionGroup_PolicyScriptsLogoff
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14002e2c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140027372
test edi, edi
jne 0x1400273b2
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionGroup_PolicyScriptsShutdown
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14002e2c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x1400273b7
cmp edi, 1
jne 0x1400273f2
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionGroup_PolicyScriptsShutdown
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14002e2c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
bt r15d, 0xa
jae 0x140027520
mov dword [0x1400a4af8], 0x400
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14002744e
mov qword [rbp + 0x40], r13
lea rcx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r9, str.Appinit_Dlls
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.1400126b0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140027472
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400274b9
mov qword [rbp + 0x40], r13
lea rcx, str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWindows
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r9, str.Appinit_Dlls
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.1400126b0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x1400274da
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140027520
lea rcx, str.SystemCurrentControlSetControlSession_ManagerAppCertDlls
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
bt r15d, 0xb
jae 0x140027577
mov dword [0x1400a4af8], 0x800
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140027577
mov qword [rbp + 0x40], r13
lea rcx, str.SystemCurrentControlSetControlSession_ManagerKnownDlls
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov r9d, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140034b50
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
test r12d, r12d
je 0x140027d74
mov dword [0x1400a4af8], 2
test edi, 0xfffffffd
jne 0x1400275b9
mov word [rsp + 0x20], r14w
lea r9, str.Shell
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.140024680
cmp edi, 2
je 0x1400275bd
test edi, edi
jne 0x1400275e4
mov word [rsp + 0x20], r14w
lea r9, str.Shell
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.140024680
cmp edi, 2
je 0x1400275ed
cmp edi, 1
jne 0x140027672
mov word [rsp + 0x20], r14w
lea r9, str.Shell
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140024680
cmp edi, 2
je 0x140027619
cmp edi, 1
jne 0x140027672
mov word [rsp + 0x20], r14w
lea r9, str.Shell
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140024680
cmp edi, 2
je 0x140027645
cmp edi, 1
jne 0x140027672
mov ebx, 0x20
mov word [rsp + 0x20], bx
lea r9, str.AlternateShell
lea r8, str.SYSTEMCurrentControlSetControlSafeBoot
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140024680
cmp edi, 2
je 0x14002767c
jmp 0x140027677
mov ebx, 0x20
cmp edi, 1
jne 0x14002769d
mov word [rsp + 0x20], bx
lea r9, str.Taskman
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140024680
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SystemCurrentControlSetControlSafeBootOption
mov rcx, qword [0x1400a36f8]
call fcn.14001d250
test eax, eax
jne 0x140027736
mov dword [rbp + 0x40], 4
mov dword [rbp + 0x50], 4
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x50]
xor r8d, r8d
lea rdx, str.UseAlternateShell
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002772c
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14002772c
mov word [rsp + 0x20], r14w
lea r9, str.AlternateShell
lea r8, str.SystemCurrentControlSetControlSafeBoot
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140024680
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140027781
lea rcx, str.SoftwareMicrosoftWindows_NTCurrentVersionWinlogonAlternateShellsAvailableShells
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
cmp edi, 2
je 0x14002778a
cmp edi, 1
jne 0x1400278d4
lea rcx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRunonce
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
cmp edi, 2
je 0x1400277d6
cmp edi, 1
jne 0x1400278d4
lea rcx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRunonceEx
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14002a420
nop
mov rcx, rbx
call fcn.140059d2c
cmp edi, 2
je 0x140027822
cmp edi, 1
jne 0x1400278d4
lea rcx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRun
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
cmp edi, 2
je 0x14002786a
cmp edi, 1
jne 0x1400278d4
mov word [rsp + 0x20], r14w
lea r9, str.InitialProgram
lea r8, str.SYSTEMCurrentControlSetControlTerminal_ServerWinStationsRDP_Tcp
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140024680
cmp edi, 2
je 0x140027896
cmp edi, 1
jne 0x1400278d4
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x1400278f8
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14002793e
lea rcx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x14002795f
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x1400279a5
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x1400279c9
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140027a0f
lea rcx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRun
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140027a30
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140027a76
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14002a420
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140027a9a
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140027ae0
lea rcx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRunOnceEx
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14002a420
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140027b01
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140027b47
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14002a420
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140027b6b
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140027bb1
lea rcx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRunOnceEx
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14002a420
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140027bd2
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140027c18
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140027c3c
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140027c82
lea rcx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRunOnce
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140027ca3
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140027ce9
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140027d0d
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140027d53
lea rcx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionRunOnce
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140027d74
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, r15d
and esi, 4
je 0x140027ed0
mov dword [0x1400a4af8], 4
test edi, 0xfffffffd
jne 0x140027dcf
mov qword [rbp + 0x40], r13
lea rcx, str.SOFTWAREClassesProtocolsFilter
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14002fa80
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140027dd4
cmp edi, 1
jne 0x140027e11
mov qword [rbp + 0x40], r13
lea rcx, str.SOFTWAREClassesProtocolsFilter
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14002fa80
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140027e15
test edi, edi
jne 0x140027e52
mov qword [rbp + 0x40], r13
lea rcx, str.SOFTWAREClassesProtocolsHandler
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14002fa80
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140027e57
cmp edi, 1
jne 0x140027e94
mov qword [rbp + 0x40], r13
lea rcx, str.SOFTWAREClassesProtocolsHandler
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14002fa80
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140027e98
test edi, edi
jne 0x140027ed0
mov qword [rbp + 0x40], r13
lea rcx, str.SOFTWAREMicrosoftInternet_ExplorerDesktopComponents
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.1400307e0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
test r12d, r12d
je 0x14002817d
mov dword [0x1400a4af8], 2
test edi, 0xfffffffd
jne 0x140027f0c
lea r9, str.AltStartup
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.140040870
cmp edi, 2
je 0x140027f11
cmp edi, 1
jne 0x140027f58
lea r9, str.Common_AltStartup
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140040870
cmp edi, 2
je 0x140027f37
cmp edi, 1
jne 0x140027f58
lea r9, str.Common_Startup
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140040870
cmp edi, 2
je 0x140027f5c
test edi, edi
jne 0x140027fd3
lea r9, str.Startup
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.140040870
cmp edi, 2
je 0x140027f81
test edi, edi
jne 0x140027fd3
lea r9, str.Startup
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.140040870
cmp edi, 2
je 0x140027fa6
test edi, edi
jne 0x140027fd3
mov ebx, 0x20
mov word [rsp + 0x20], bx
lea r9, str.Load
lea r8, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.140024680
cmp edi, 2
je 0x140027fdc
jmp 0x140027fd8
mov ebx, 0x20
test edi, edi
jne 0x140028002
mov word [rsp + 0x20], bx
lea r9, [0x140086090]
lea r8, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.140024680
cmp edi, 2
je 0x140028007
cmp edi, 1
jne 0x14002804a
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
cmp edi, 2
je 0x14002804e
test edi, edi
jne 0x140028091
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorerRun
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
cmp edi, 2
je 0x140028096
cmp edi, 1
jne 0x1400280ce
mov qword [rbp + 0x40], r13
lea rcx, str.SOFTWAREMicrosoftActive_SetupInstalled_Components
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.1400119a0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x1400280f2
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140028132
mov qword [rbp + 0x40], r13
lea rcx, str.SOFTWAREWow6432NodeMicrosoftActive_SetupInstalled_Components
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.1400119a0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140028153
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14002817d
mov word [rsp + 0x20], r14w
lea r9, str.IconServiceLib
lea r8, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140024680
test esi, esi
je 0x140028478
mov dword [0x1400a4af8], 4
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400281d5
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x1400281f9
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14002823f
lea rcx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionExplorerSharedTaskScheduler
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140028260
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14002829e
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellServiceObjects
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14001fdd0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x1400282c2
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140028300
lea rcx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionExplorerShellServiceObjects
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14001fdd0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140028321
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140028364
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShellServiceObjects
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14001fdd0
nop
mov rcx, rbx
call fcn.140059d2c
cmp edi, 2
je 0x140028369
cmp edi, 1
jne 0x1400283a7
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x1400283cb
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140028411
lea rcx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140028432
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140028478
lea rcx, str.SOFTWAREMicrosoftWindowsCurrentVersionShellServiceObjectDelayLoad
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
test r12d, r12d
je 0x140028752
mov dword [0x1400a4af8], 2
test edi, 0xfffffffd
jne 0x1400284d6
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionPoliciesExplorerRun
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
cmp edi, 2
je 0x1400284de
test edi, edi
jne 0x1400285b3
lea rcx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRunonce
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
cmp edi, 2
je 0x140028529
test edi, edi
jne 0x1400285b3
lea rcx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRunonceEx
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14002a420
nop
mov rcx, rbx
call fcn.140059d2c
cmp edi, 2
je 0x140028570
test edi, edi
jne 0x1400285b3
lea rcx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionTerminal_ServerInstallSoftwareMicrosoftWindowsCurrentVersionRun
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
cmp edi, 2
je 0x1400285b8
cmp edi, 1
jne 0x1400285f6
lea rcx, str.SOFTWAREMicrosoftWindows_CE_ServicesAutoStartOnConnect
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x14002861a
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140028660
lea rcx, str.SOFTWAREWow6432NodeMicrosoftWindows_CE_ServicesAutoStartOnConnect
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140028681
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400286c7
lea rcx, str.SOFTWAREMicrosoftWindows_CE_ServicesAutoStartOnDisconnect
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x1400286eb
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140028731
lea rcx, str.SOFTWAREWow6432NodeMicrosoftWindows_CE_ServicesAutoStartOnDisconnect
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140028752
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test r15b, 0x10
je 0x140028771
mov dword [0x1400a4af8], 0x10
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140028771
xor ecx, ecx
call fcn.140043690
mov r14d, r15d
and r14d, 8
je 0x140028849
mov dword [0x1400a4af8], 8
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400287c6
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14001fdd0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x1400287ea
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140028828
lea rcx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14001fdd0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140028849
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
je 0x140029bca
mov dword [0x1400a4af8], 4
lea eax, [rdi - 1]
cmp eax, 1
ja 0x1400288a1
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x1400288c5
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14002890b
lea rcx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionExplorerShellExecuteHooks
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x14002892c
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140028971
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesShellExContextMenuHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140028976
cmp edi, 1
jne 0x1400289ae
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesShellExContextMenuHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x1400289d2
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140028a12
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeClassesShellExContextMenuHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140028a33
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140028a78
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesDriveShellExContextMenuHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140028a7d
cmp edi, 1
jne 0x140028ab5
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesDriveShellExContextMenuHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140028ad9
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140028b19
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeClassesDriveShellExContextMenuHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140028b3a
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140028b7f
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesShellExPropertySheetHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140028b84
cmp edi, 1
jne 0x140028bbc
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesShellExPropertySheetHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140028be0
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140028c20
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeClassesShellExPropertySheetHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140028c41
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140028c86
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesAllFileSystemObjectsShellExContextMenuHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140028c8b
cmp edi, 1
jne 0x140028cc3
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesAllFileSystemObjectsShellExContextMenuHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140028ce7
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140028d27
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeClassesAllFileSystemObjectsShellExContextMenuHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140028d48
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140028d8d
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesAllFileSystemObjectsShellExDragDropHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140028d92
cmp edi, 1
jne 0x140028dca
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesAllFileSystemObjectsShellExDragDropHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140028dee
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140028e2e
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeClassesAllFileSystemObjectsShellExDragDropHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140028e4f
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140028e94
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesAllFileSystemObjectsShellExPropertySheetHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140028e99
cmp edi, 1
jne 0x140028ed1
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesAllFileSystemObjectsShellExPropertySheetHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140028ef5
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140028f35
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeClassesAllFileSystemObjectsShellExPropertySheetHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140028f56
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140028f9b
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesDirectoryShellExContextMenuHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140028fa0
cmp edi, 1
jne 0x140028fd8
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesDirectoryShellExContextMenuHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140028ffc
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14002903c
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeClassesDirectoryShellExContextMenuHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x14002905d
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x1400290a2
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesDirectoryShellexDragDropHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x1400290a7
cmp edi, 1
jne 0x1400290df
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesDirectoryShellexDragDropHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140029103
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140029143
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeClassesDirectoryShellexDragDropHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140029164
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x1400291a9
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesDirectoryShellexPropertySheetHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x1400291ae
cmp edi, 1
jne 0x1400291e6
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesDirectoryShellexPropertySheetHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x14002920a
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14002924a
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeClassesDirectoryShellexPropertySheetHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x14002926b
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x1400292b0
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesDirectoryShellexCopyHookHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x1400292b5
cmp edi, 1
jne 0x1400292ed
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesDirectoryShellexCopyHookHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140029311
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140029351
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeClassesDirectoryShellexCopyHookHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140029372
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x1400293b7
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesDirectoryBackgroundShellExContextMenuHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x1400293bc
cmp edi, 1
jne 0x1400293f4
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesDirectoryBackgroundShellExContextMenuHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140029418
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140029458
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeClassesDirectoryBackgroundShellExContextMenuHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140029479
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x1400294bc
lea rcx, str.SoftwareClassesFolderShellexColumnHandlers
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14001fdd0
nop
mov rcx, rbx
call fcn.140059d2c
cmp edi, 2
je 0x1400294c1
cmp edi, 1
jne 0x1400294f7
lea rcx, str.SoftwareClassesFolderShellexColumnHandlers
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14001fdd0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x14002951b
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140029559
lea rcx, str.SoftwareWow6432NodeClassesFolderShellexColumnHandlers
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14001fdd0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x14002957a
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x1400295bf
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesFolderShellExContextMenuHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x1400295c4
cmp edi, 1
jne 0x1400295fc
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesFolderShellExContextMenuHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140029620
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140029660
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeClassesFolderShellExContextMenuHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140029681
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x1400296c6
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesFolderShellExDragDropHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x1400296cb
cmp edi, 1
jne 0x140029703
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesFolderShellExDragDropHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140029727
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140029767
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeClassesFolderShellExDragDropHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140029788
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x1400297cd
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesFolderShellExExtShellFolderViews
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x1400297d2
cmp edi, 1
jne 0x14002980a
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesFolderShellExExtShellFolderViews
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x14002982e
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14002986e
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeClassesFolderShellExExtShellFolderViews
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x14002988f
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x1400298d4
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesFolderShellExPropertySheetHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x1400298d9
cmp edi, 1
jne 0x140029911
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareClassesFolderShellExPropertySheetHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140029935
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140029975
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeClassesFolderShellExPropertySheetHandlers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140029996
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x1400299db
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x1400299e0
cmp edi, 1
jne 0x140029a18
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140029a3c
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140029a7c
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftWindowsCurrentVersionExplorerShellIconOverlayIdentifiers
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14003a8c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140029a9d
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140029acd
mov word [rsp + 0x20], 0x20
lea r9, str.Inprocserver32
lea r8, str.SoftwareClassesClsidAB8902B4_09CA_4bb6_B78D_A8F59079A8D5
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.140024680
cmp edi, 2
je 0x140029ad1
test edi, edi
jne 0x140029b0c
lea rcx, str.SoftwareMicrosoftCtfLangBarAddin
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14001fdd0
nop
mov rcx, rbx
call fcn.140059d2c
cmp edi, 2
je 0x140029b11
cmp edi, 1
jne 0x140029b47
lea rcx, str.SoftwareMicrosoftCtfLangBarAddin
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14001fdd0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140029b6b
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140029ba9
lea rcx, str.SoftwareMicrosoftCtfLangBarAddin
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14001fdd0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140029bca
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test r14d, r14d
je 0x140029f88
mov dword [0x1400a4af8], 8
test edi, 0xfffffffd
jne 0x140029c28
lea rcx, str.SoftwareMicrosoftInternet_ExplorerUrlSearchHooks
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
cmp edi, 2
je 0x140029c2d
cmp edi, 1
jne 0x140029c6b
lea rcx, str.SoftwareMicrosoftInternet_ExplorerToolbar
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140029c8f
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x140029cd5
lea rcx, str.SoftwareWow6432NodeMicrosoftInternet_ExplorerToolbar
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 1
xor r9d, r9d
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140029cf6
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140029d3b
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareMicrosoftInternet_ExplorerExplorer_Bars
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.1400312c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140029d40
cmp edi, 1
jne 0x140029d78
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareMicrosoftInternet_ExplorerExplorer_Bars
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.1400312c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140029d9c
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140029de1
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftInternet_ExplorerExplorer_Bars
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.1400312c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140029de6
cmp edi, 1
jne 0x140029e1e
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftInternet_ExplorerExplorer_Bars
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.1400312c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140029e3f
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140029e84
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareMicrosoftInternet_ExplorerExtensions
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.1400312c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140029e89
cmp edi, 1
jne 0x140029ec1
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareMicrosoftInternet_ExplorerExtensions
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.1400312c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140029ee5
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x140029f2a
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftInternet_ExplorerExtensions
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.1400312c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x140029f2f
cmp edi, 1
jne 0x140029f67
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwareWow6432NodeMicrosoftInternet_ExplorerExtensions
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.1400312c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x140029f88
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test r15b, r15b
jns 0x14002a362
mov dword [0x1400a4af8], 0x80
lea rax, [rbp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionDrivers32
mov rcx, qword [0x1400a36f8]
call fcn.14001d250
test eax, eax
je 0x140029ff5
cmp dword [0x1400a5978], 0
je 0x14002a362
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14002a362
lea rdx, str._nNo_entry_to_display_for_codecs._Codecs_are_not_supported_on_Nano_Server._n
mov rcx, qword [0x1400a6040]
call fcn.1400117d0
jmp 0x14002a362
test edi, 0xfffffffd
jne 0x14002a040
lea rcx, str.SoftwareMicrosoftWindows_NTCurrentVersionDrivers32
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
cmp edi, 2
je 0x14002a045
cmp edi, 1
jne 0x14002a083
lea rcx, str.SoftwareMicrosoftWindows_NTCurrentVersionDrivers32
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x14002a0a7
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x14002a0f2
lea rcx, str.SoftwareWow6432NodeMicrosoftWindows_NTCurrentVersionDrivers32
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
cmp edi, 2
je 0x14002a0f7
cmp edi, 1
jne 0x14002a135
lea rcx, str.SoftwareWow6432NodeMicrosoftWindows_NTCurrentVersionDrivers32
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov byte [rsp + 0x20], 0
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.140021fb0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x14002a156
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x14002a199
lea rcx, str.SoftwareClassesFilter
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14001fdd0
nop
mov rcx, rbx
call fcn.140059d2c
cmp edi, 2
je 0x14002a19e
cmp edi, 1
jne 0x14002a1d4
lea rcx, str.SoftwareClassesFilter
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14001fdd0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x14002a1f8
mov ecx, 1
call rax
mov edx, 0x200
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
lea eax, [rdi - 1]
cmp eax, 1
ja 0x14002a236
lea rcx, str.SoftwareClassesFilter
call fcn.140059d48
mov rbx, rax
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14001fdd0
nop
mov rcx, rbx
call fcn.140059d2c
mov rax, qword [0x1400a5c18]
test rax, rax
je 0x14002a257
xor ecx, ecx
call rax
mov edx, 0x100
mov ecx, dword [0x1400a555c]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test edi, 0xfffffffd
jne 0x14002a27c
lea r9, str.083863F1_70DE_11d0_BD40_00A0C911CE86
mov r8, qword [0x1400a3700]
xor edx, edx
lea ecx, [rdx + 1]
call fcn.140021110
cmp edi, 2
je 0x14002a280
test edi, edi
jne 0x14002a2df
lea r9, str.AC757296_3522_4E11_9862_C17BE5A1767E
mov r8, qword [0x1400a3700]
xor edx, edx
lea ecx, [rdx + 1]
call fcn.140021110
cmp edi, 2
je 0x14002a2a1
test edi, edi
jne 0x14002a2df
lea r9, str.7ED96837_96F0_4812_B211_F13C24117ED3
mov r8, qword [0x1400a3700]
xor edx, edx
lea ecx, [rdx + 1]
call fcn.140021110
cmp edi, 2
je 0x14002a2c2
test edi, edi
jne 0x14002a2df
lea r9, str.ABE3B9A4_257D_4B97_BD1A_294AF496222E
mov r8, qword [0x1400a3700]
xor edx, edx
lea ecx, [rdx + 1]
call fcn.140021110
cmp edi, 2
je 0x14002a2e4
cmp edi, 1
jne 0x14002a362
lea r9, str.083863F1_70DE_11d0_BD40_00A0C911CE86
mov r8, qword [0x1400a36f8]
xor edx, edx
lea ecx, [rdx + 1]
call fcn.140021110
cmp edi, 2
je 0x14002a306
cmp edi, 1
jne 0x14002a362
lea r9, str.AC757296_3522_4E11_9862_C17BE5A1767E
mov r8, qword [0x1400a36f8]
xor edx, edx
lea ecx, [rdx + 1]
call fcn.140021110
cmp edi, 2
je 0x14002a328
cmp edi, 1
jne 0x14002a362
lea r9, str.7ED96837_96F0_4812_B211_F13C24117ED3
mov r8, qword [0x1400a36f8]
xor edx, edx
lea ecx, [rdx + 1]
call fcn.140021110
cmp edi, 2
je 0x14002a34a
cmp edi, 1
jne 0x14002a362
lea r9, str.ABE3B9A4_257D_4B97_BD1A_294AF496222E
mov r8, qword [0x1400a36f8]
xor edx, edx
lea ecx, [rdx + 1]
call fcn.140021110
test r12d, r12d
je 0x14002a3fd
mov dword [0x1400a4af8], 2
test edi, 0xfffffffd
jne 0x14002a3bd
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwarePoliciesMicrosoftWindowsSystemScriptsLogoff
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a3700]
xor ecx, ecx
call fcn.14002e2c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
cmp edi, 2
je 0x14002a3c2
cmp edi, 1
jne 0x14002a3fd
mov qword [rbp + 0x40], r13
lea rcx, str.SoftwarePoliciesMicrosoftWindowsSystemScriptsShutdown
call fcn.140059d48
mov qword [rbp + 0x40], rax
xor ecx, ecx
call fcn.140059d2c
nop
mov r9b, 1
lea r8, [rbp + 0x40]
mov rdx, qword [0x1400a36f8]
xor ecx, ecx
call fcn.14002e2c0
nop
mov rcx, qword [rbp + 0x40]
call fcn.140059d2c
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret