Function at 0x140058be0
Capabilities:
Create http request
Delete registry key
Delete registry value
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x171c0
call fcn.1400c8a20
sub rsp, rax
mov qword [rsp + 0xe60], 0xfffffffffffffffe
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rsp + 0x171b0], rax
mov r14, r8
mov rbx, rdx
mov r13, rcx
mov qword [rsp + 0x338], rcx
mov qword [rsp + 0x360], rdx
mov qword [rsp + 0x368], r8
mov byte [rsp + 0x73], 0
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.1400339e0
nop
lea rcx, [rsp + 0x11b0]
call fcn.14002ec60
nop
mov rdx, qword [rbx]
mov qword [rsp + 0xe20], rdx
lea rcx, [rsp + 0x68]
call fcn.140019300
nop
mov rdx, qword [rsp + 0x68]
lea rax, [rdx - 0x18]
mov qword [rsp + 0xe30], rax
cmp dword [rax + 0x10], 1
jle 0x140058c97
mov edx, dword [rax + 8]
lea rcx, [rsp + 0x68]
call fcn.140019e40
mov rdx, qword [rsp + 0x68]
xor edi, edi
mov qword [rsp + 0x1048], rdi
mov qword [rsp + 0x1050], rdi
mov qword [rsp + 0x1050], 0xf
mov qword [rsp + 0x1048], rdi
mov byte [rsp + 0x1038], dil
or rsi, 0xffffffffffffffff
cmp byte [rdx], dil
jne 0x140058cd3
mov r8d, edi
jmp 0x140058cdf
mov r8, rsi
inc r8
cmp byte [rdx + r8], dil
jne 0x140058cd6
lea rcx, [rsp + 0x1038]
call fcn.1400013f0
nop
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x1038]
lea rcx, [rsp + 0x11b0]
call fcn.14002ed10
test al, al
jne 0x140058def
lea rdx, str.json_parse_error
lea rcx, [rsp + 0x2c8]
call fcn.140002f70
nop
lea rdx, [rsp + 0x2c8]
mov rcx, qword [r13 + 0x40]
call fcn.140053e90
nop
mov rcx, qword [rsp + 0x2c8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x630], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140058d67
mov rdx, qword [rsp + 0x630]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x1050], 0x10
jb 0x140058d7f
mov rcx, qword [rsp + 0x1038]
call fcn.1400c3950
mov qword [rsp + 0x1050], 0xf
mov qword [rsp + 0x1048], rdi
mov byte [rsp + 0x1038], 0
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x470], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140058dc9
mov rdx, qword [rsp + 0x470]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x11b0]
call fcn.140017f90
nop
lea rcx, [rsp + 0x50]
call fcn.140033d50
nop
xor bl, bl
mov r12d, 1
jmp 0x14005d6ee
cmp byte [rsp + 0x58], 0
jne 0x140058eda
lea rdx, str.json_parse_error
lea rcx, [rsp + 0x228]
call fcn.140002f70
nop
lea rdx, [rsp + 0x228]
mov rcx, qword [r13 + 0x40]
call fcn.140053e90
nop
mov rcx, qword [rsp + 0x228]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7c0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140058e52
mov rdx, qword [rsp + 0x7c0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x1050], 0x10
jb 0x140058e6a
mov rcx, qword [rsp + 0x1038]
call fcn.1400c3950
mov qword [rsp + 0x1050], 0xf
mov qword [rsp + 0x1048], rdi
mov byte [rsp + 0x1038], 0
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x480], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140058eb4
mov rdx, qword [rsp + 0x480]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x11b0]
call fcn.140017f90
nop
lea rcx, [rsp + 0x50]
call fcn.140033d50
nop
xor bl, bl
mov r12d, 1
jmp 0x14005d6ee
lea rdx, str.action
lea rcx, [rsp + 0x50]
call fcn.140034990
mov qword [rsp + 0xe40], rax
lea rbx, [0x1401aa398]
cmp rax, rbx
je 0x14005d5f8
lea rdx, str.action
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xe50], rax
cmp byte [rax + 8], 4
jne 0x14005d5f8
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034990
lea rdx, str.action
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0x7f8], rax
mov rdx, qword [rax]
mov qword [rsp + 0x808], rdx
lea rcx, [rsp + 0x40]
call fcn.140002f70
nop
mov rax, qword [rsp + 0x40]
lea r8, str.injectScript
mov rdx, rsi
nop word [rax + rax]
movzx ecx, word [rax + rdx*2 + 2]
cmp cx, word [r8 + rdx*2 + 2]
jne 0x140058fa8
add rdx, 2
cmp rdx, 0xd
je 0x140058fa4
movzx ecx, word [rax + rdx*2]
cmp cx, word [r8 + rdx*2]
jne 0x140058fa8
jmp 0x140058f80
mov ecx, edi
jmp 0x140058fad
sbb ecx, ecx
or ecx, 1
mov dword [rsp + 0x7c8], ecx
test ecx, ecx
jne 0x14005997f
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xf50], rax
lea rdx, str.codeMessage
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0x818], rax
cmp byte [rax + 8], 4
jne 0x14005d5b4
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xbf8], rax
lea rdx, str.codeMessage
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0x828], rax
mov rdx, qword [rax]
mov qword [rsp + 0xde8], rdx
lea rcx, [rsp + 0x98]
call fcn.140002f70
nop
mov rax, qword [rsp + 0x98]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x7d8], eax
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
call fcn.1400c43e8
mov r12, rax
mov qword [rsp + 0x138], rax
test rax, rax
je 0x140059884
mov r8, rax
lea rdx, [rsp + 0x98]
call fcn.14005d740
test al, al
je 0x140059884
mov rbx, qword [r13 + 0x40]
add rbx, 0x1b0
mov qword [rsp + 0x838], rbx
mov rcx, qword [rbx]
mov qword [rsp + 0xc08], rcx
mov edx, 0x5c
call fcn.1400c6258
mov rcx, rax
mov qword [rsp + 0x848], rax
test rax, rax
jne 0x1400590c6
mov ecx, esi
jmp 0x1400590d7
mov rax, qword [rbx]
mov qword [rsp + 0xf38], rax
sub rcx, rax
sar rcx, 1
lea r8d, [rcx + 1]
mov rcx, qword [r13 + 0x40]
add rcx, 0x1b0
lea rdx, [rsp + 0xb8]
call fcn.140024ac0
nop
mov rax, qword [r13 + 0x40]
add rax, 0x1b0
mov qword [rsp + 0x858], rax
mov rcx, qword [rax]
sub rcx, 0x18
mov qword [rsp + 0xc18], rcx
call fcn.140002390
mov qword [rsp + 0x868], rax
lea rbx, [rax + 0x18]
mov qword [rsp + 0x4f0], rbx
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [r13 + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x1e4], eax
test eax, eax
je 0x1400592b5
test r14, r14
je 0x140059174
mov r15d, 0xb
mov word [r14], r15w
mov word [r14 + 8], di
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x640], rbx
mov eax, esi
lock xadd dword [rbx + 0x10], eax
dec eax
jg 0x14005919d
mov rdx, qword [rsp + 0x640]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xb8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x490], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400591ce
mov rdx, qword [rsp + 0x490]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x98]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x720], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400591ff
mov rdx, qword [rsp + 0x720]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x40]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4a0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005922d
mov rdx, qword [rsp + 0x4a0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x1050], 0x10
jb 0x140059245
mov rcx, qword [rsp + 0x1038]
call fcn.1400c3950
mov qword [rsp + 0x1050], 0xf
mov qword [rsp + 0x1048], rdi
mov byte [rsp + 0x1038], 0
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x650], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005928f
mov rdx, qword [rsp + 0x650]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x11b0]
call fcn.140017f90
nop
lea rcx, [rsp + 0x50]
call fcn.140033d50
nop
xor bl, bl
mov r12d, 1
jmp 0x14005d6ee
mov rbx, qword [r13 + 0x40]
add rbx, 0x2c8
mov qword [rsp + 0x320], rbx
mov qword [rsp + 0x198], rbx
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xdf8], rax
lea rdx, str.forceOverwrite
mov rcx, rax
call fcn.140034990
mov qword [rsp + 0x878], rax
lea rcx, [0x1401aa398]
cmp rax, rcx
je 0x1400595f8
lea rcx, [0x1401a19a8]
mov rax, qword [0x1401a19a8]
call qword [rax + 0x18]
mov qword [rsp + 0xc28], rax
lea rbx, [rax + 0x18]
mov qword [rsp + 0x108], rbx
mov r8d, edi
mov dword [rsp + 0xc8], edi
mov r15d, edi
mov dword [rsp + 0xa0], edi
mov eax, dword [0x1401a9d80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xe
sub ecx, edx
mov eax, dword [0x1401aa7d0]
mov edx, 0xc6eeb427
cmp ecx, 0xc
cmove eax, edx
mov dword [0x1401aa7d0], eax
mov r12d, 1
nop dword [rax]
test r8d, r8d
jne 0x1400595b8
mov dword [rsp + 0x158], 0x7ffe
lea rax, [rbx - 0x18]
mov qword [rsp + 0x888], rax
mov ecx, r12d
sub ecx, dword [rax + 0x10]
mov dword [rsp + 0x7e8], ecx
mov eax, dword [rax + 0xc]
sub eax, 0x7ffe
mov dword [rsp + 0x510], eax
or eax, ecx
jge 0x1400593ea
mov edx, 0x7ffe
lea rcx, [rsp + 0x108]
call fcn.140002330
mov rbx, qword [rsp + 0x108]
cmp dword [rbx - 0xc], 0x7ffe
jge 0x1400593fd
mov ecx, 0x80070057
call fcn.140001930
mov dword [rbx - 0x10], 0x7ffe
mov word [rbx + 0xfffc], di
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x158]
mov r8, rbx
mov edx, r15d
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [rsp + 0xc8], eax
movsxd rax, dword [rbx - 0xc]
mov dword [rsp + 0x3e0], eax
mov rdx, rax
mov rcx, rbx
call fcn.1400c44a0
mov dword [rsp + 0x5f0], eax
test eax, eax
js 0x1400595ae
cmp eax, dword [rbx - 0xc]
jg 0x1400595ae
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], di
mov rax, qword [rsp + 0x320]
mov dword [rax], edi
lea r8, str._data
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x4b0]
call fcn.140019610
mov qword [rsp + 0xf40], rax
mov rdx, qword [rax]
mov qword [rsp + 0x898], rdx
test rdx, rdx
jne 0x1400594bb
mov eax, esi
jmp 0x1400594ec
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x3f0], eax
test eax, eax
jns 0x1400594cd
mov eax, esi
jmp 0x1400594ec
mov rcx, rbx
call fcn.1400c4670
mov qword [rsp + 0xc38], rax
test rax, rax
jne 0x1400594e6
mov eax, esi
jmp 0x1400594ec
sub rax, rbx
sar rax, 1
mov dword [rsp + 0x94], eax
cmp eax, 0xffffffff
setne byte [rsp + 0x72]
mov rcx, qword [rsp + 0x4b0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x790], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005952b
mov rdx, qword [rsp + 0x790]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp byte [rsp + 0x72], 0
je 0x140059576
mov r15d, edi
mov dword [rsp + 0xa0], edi
mov rbx, qword [rsp + 0x108]
mov rdx, rbx
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [rsp + 0x1e4], eax
test eax, eax
je 0x140059591
test r14, r14
je 0x1400595b8
mov r15d, 0xb
mov word [r14], r15w
mov word [r14 + 8], di
jmp 0x1400595be
mov r15d, dword [rsp + 0xa0]
inc r15d
mov dword [rsp + 0xa0], r15d
mov rbx, qword [rsp + 0x108]
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x320], rax
mov r8d, dword [rsp + 0xc8]
jmp 0x140059390
mov ecx, 0x80070057
call fcn.140001930
mov r15d, 0xb
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x4c0], rbx
mov eax, esi
lock xadd dword [rbx + 0x10], eax
dec eax
jg 0x1400595e6
mov rdx, qword [rsp + 0x4c0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r12, qword [rsp + 0x138]
mov rbx, qword [rsp + 0x198]
jmp 0x1400595fe
mov r15d, 0xb
mov rax, qword [rsp + 0x98]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x7ec], eax
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov rdx, r12
mov rcx, r12
call fcn.140058b60
mov edx, dword [rbx]
lea eax, [rdx + 1]
mov dword [rbx], eax
lea rcx, [rsp + 0x1188]
call fcn.140058880
mov qword [rsp + 0x8a8], rax
cmp qword [rax + 0x18], 0x10
jb 0x140059649
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x730]
call fcn.140002f70
mov rbx, rax
lea r8, str._data
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x660]
call fcn.140019610
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x238]
call fcn.14000ee60
nop
mov rcx, qword [rsp + 0x660]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4d0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400596be
mov rdx, qword [rsp + 0x4d0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x730]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4e0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400596ef
mov rdx, qword [rsp + 0x4e0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x11a0], 0x10
jb 0x140059707
mov rcx, qword [rsp + 0x1188]
call fcn.1400c3950
mov qword [rsp + 0x11a0], 0xf
mov qword [rsp + 0x1198], rdi
mov byte [rsp + 0x1188], 0
mov rbx, qword [rsp + 0x138]
xor al, al
jne 0x14005976e
mov rax, qword [rsp + 0x98]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x400], eax
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x238]
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0xb8]
mov rcx, r13
call fcn.14005d870
mov rcx, rbx
call fcn.1400c4364
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14, r14
je 0x1400597aa
mov word [r14], r15w
mov word [r14 + 8], si
mov rax, qword [r13 + 0x40]
cmp dword [rax + 0x2d0], 3
jne 0x1400597c1
mov dword [rax + 0x2d0], 4
mov rcx, qword [rsp + 0x238]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x670], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400597f2
mov rdx, qword [rsp + 0x670]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x4f0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7e0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140059823
mov rdx, qword [rsp + 0x7e0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xb8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x500], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140059854
mov rdx, qword [rsp + 0x500]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x98]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x680], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005d5b4
mov rdx, qword [rsp + 0x680]
jmp 0x14005d5aa
test r14, r14
je 0x140059898
mov r15d, 0xb
mov word [r14], r15w
mov word [r14 + 8], di
mov rcx, qword [rsp + 0x98]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x388], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400598c9
mov rdx, qword [rsp + 0x388]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x40]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x740], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400598f7
mov rdx, qword [rsp + 0x740]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x1050], 0x10
jb 0x14005990f
mov rcx, qword [rsp + 0x1038]
call fcn.1400c3950
mov qword [rsp + 0x1050], 0xf
mov qword [rsp + 0x1048], rdi
mov byte [rsp + 0x1038], 0
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x520], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140059959
mov rdx, qword [rsp + 0x520]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x11b0]
call fcn.140017f90
nop
lea rcx, [rsp + 0x50]
call fcn.140033d50
nop
xor bl, bl
mov r12d, 1
jmp 0x14005d6ee
lea r8, str.setDLLBinaryReplacment
mov rdx, rsi
nop dword [rax]
movzx ecx, word [rax + rdx*2 + 2]
cmp cx, word [r8 + rdx*2 + 2]
jne 0x1400599b8
add rdx, 2
cmp rdx, 0x17
je 0x1400599b4
movzx ecx, word [rax + rdx*2]
cmp cx, word [r8 + rdx*2]
jne 0x1400599b8
jmp 0x140059990
mov eax, edi
jmp 0x1400599bd
sbb eax, eax
or eax, 1
mov dword [rsp + 0x600], eax
test eax, eax
jne 0x14005a5f6
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xe08], rax
lea rdx, str.from
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0x8b8], rax
cmp byte [rax + 8], 4
jne 0x14005d5b4
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xc48], rax
lea rdx, [0x140139598]
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0x8c8], rax
cmp byte [rax + 8], 4
jne 0x14005d5b4
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xf48], rax
lea rdx, str.offset
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0x8d8], rax
cmp byte [rax + 8], 1
jne 0x14005d5b4
mov eax, dword [0x1401a9d80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0xb21642c9
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
cmp ecx, 9
jne 0x140059aa9
inc dword [0x1401aa7b8]
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xc58], rax
lea rdx, str.from
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0x8e8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xe18], rdx
lea rcx, [rsp + 0x80]
call fcn.140002f70
nop
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0x8f8], rax
lea rdx, [0x140139598]
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xc68], rax
mov rdx, qword [rax]
mov qword [rsp + 0x908], rdx
lea rcx, [rsp + 0x78]
call fcn.140002f70
nop
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xf80], rax
lea rdx, str.offset
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0x918], rax
mov rcx, rax
call fcn.140033fc0
mov dword [rsp + 0x1ec], eax
mov rax, qword [rsp + 0x80]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x410], eax
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
call fcn.1400c43e8
mov r15, rax
mov qword [rsp + 0x6c0], rax
mov rcx, qword [rsp + 0x78]
mov eax, dword [rcx - 0x10]
mov dword [rsp + 0x700], eax
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
call fcn.1400c43e8
mov rbx, rax
mov qword [rsp + 0x590], rax
test r15, r15
je 0x14005a4cd
test rax, rax
je 0x14005a4cd
mov r8, r15
lea rdx, [rsp + 0x80]
call fcn.14005d740
test al, al
je 0x14005a4cd
mov r8, rbx
lea rdx, [rsp + 0x78]
call fcn.14005d740
test al, al
je 0x14005a4cd
mov rax, qword [rsp + 0x80]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x420], eax
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov rdx, r15
mov rcx, r15
call fcn.140058b60
mov r8, qword [rsp + 0x78]
mov eax, dword [r8 - 0x10]
mov dword [rsp + 0x610], eax
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov rdx, rbx
mov rcx, rbx
call fcn.140058b60
mov rbx, qword [r13 + 0x40]
add rbx, 0x1b0
mov qword [rsp + 0xc78], rbx
mov rcx, qword [rbx]
mov qword [rsp + 0x928], rcx
mov edx, 0x5c
call fcn.1400c6258
mov rcx, rax
mov qword [rsp + 0xe28], rax
test rax, rax
jne 0x140059c8b
mov ecx, esi
jmp 0x140059c9c
mov rax, qword [rbx]
mov qword [rsp + 0x938], rax
sub rcx, rax
sar rcx, 1
lea r8d, [rcx + 1]
mov rcx, qword [r13 + 0x40]
add rcx, 0x1b0
lea rdx, [rsp + 0xa8]
call fcn.140024ac0
nop
mov rax, qword [r13 + 0x40]
add rax, 0x1b0
mov qword [rsp + 0xc88], rax
mov rcx, qword [rax]
sub rcx, 0x18
mov qword [rsp + 0x948], rcx
call fcn.140002390
mov qword [rsp + 0xf60], rax
add rax, 0x18
mov qword [rsp + 0x150], rax
mov rax, qword [r13 + 0x40]
add rax, 0x2cc
mov qword [rsp + 0x2d8], rax
mov edx, dword [rax]
lea rcx, [rsp + 0x1148]
call fcn.140058880
mov qword [rsp + 0x958], rax
cmp qword [rax + 0x18], 0x10
jb 0x140059d26
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x7a0]
call fcn.140002f70
mov rbx, rax
lea r8, str._from
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x690]
call fcn.140019610
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x1d8]
call fcn.14000ee60
nop
mov rcx, qword [rsp + 0x690]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x530], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140059d9b
mov rdx, qword [rsp + 0x530]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x7a0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x540], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140059dcc
mov rdx, qword [rsp + 0x540]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x1160], 0x10
jb 0x140059de4
mov rcx, qword [rsp + 0x1148]
call fcn.1400c3950
mov qword [rsp + 0x1160], 0xf
mov qword [rsp + 0x1158], rdi
mov byte [rsp + 0x1148], 0
mov rax, qword [rsp + 0x2d8]
mov edx, dword [rax]
lea rcx, [rsp + 0x10e8]
call fcn.140058880
mov qword [rsp + 0xc98], rax
cmp qword [rax + 0x18], 0x10
jb 0x140059e29
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x750]
call fcn.140002f70
mov rbx, rax
lea r8, [0x140139588]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x6a0]
call fcn.140019610
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x1a8]
call fcn.14000ee60
nop
mov rcx, qword [rsp + 0x6a0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x550], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140059e9e
mov rdx, qword [rsp + 0x550]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x750]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x560], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140059ecf
mov rdx, qword [rsp + 0x560]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x1100], 0x10
jb 0x140059ee7
mov rcx, qword [rsp + 0x10e8]
call fcn.1400c3950
mov qword [rsp + 0x1100], 0xf
mov qword [rsp + 0x10f8], rdi
mov byte [rsp + 0x10e8], 0
mov rcx, qword [rsp + 0x2d8]
mov edx, dword [rcx]
lea eax, [rdx + 1]
mov dword [rcx], eax
lea rcx, [rsp + 0x1128]
call fcn.140058880
mov qword [rsp + 0x968], rax
cmp qword [rax + 0x18], 0x10
jb 0x140059f31
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x7d0]
call fcn.140002f70
mov rbx, rax
lea r8, [0x1401395e0]
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x6b0]
call fcn.140019610
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x148]
call fcn.14000ee60
nop
mov rcx, qword [rsp + 0x6b0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x570], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140059fa6
mov rdx, qword [rsp + 0x570]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x7d0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x580], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140059fd7
mov rdx, qword [rsp + 0x580]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x1140], 0x10
jb 0x140059fef
mov rcx, qword [rsp + 0x1128]
call fcn.1400c3950
mov qword [rsp + 0x1140], 0xf
mov qword [rsp + 0x1138], rdi
mov byte [rsp + 0x1128], 0
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsp + 0x150]
mov rcx, qword [r13 + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005a2af
mov rax, qword [rsp + 0x80]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x430], eax
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x28], eax
mov r15, qword [rsp + 0x6c0]
mov qword [rsp + 0x20], r15
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x1d8]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14005a2af
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x1ec]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x1a8]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14005a2af
mov rax, qword [rsp + 0x78]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x780], eax
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x28], eax
mov rbx, qword [rsp + 0x590]
mov qword [rsp + 0x20], rbx
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x148]
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14005a2af
lea r8, [rsp + 0xe0]
lea rdx, [rsp + 0xa8]
mov rcx, r13
call fcn.14005d870
mov rcx, rbx
call fcn.1400c4364
mov rcx, r15
call fcn.1400c4364
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14, r14
je 0x14005a15c
mov r15d, 0xb
mov word [r14], r15w
mov word [r14 + 8], si
mov rcx, qword [rsp + 0x148]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x760], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a18d
mov rdx, qword [rsp + 0x760]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x1a8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5a0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a1be
mov rdx, qword [rsp + 0x5a0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x1d8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6d0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a1ef
mov rdx, qword [rsp + 0x6d0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x150]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5b0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a220
mov rdx, qword [rsp + 0x5b0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xa8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7b0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a251
mov rdx, qword [rsp + 0x7b0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x78]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5c0], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a27f
mov rdx, qword [rsp + 0x5c0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x80]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x390], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005d5b4
mov rdx, qword [rsp + 0x390]
jmp 0x14005d5aa
test r14, r14
je 0x14005a2c3
mov r15d, 0xb
mov word [r14], r15w
mov word [r14 + 8], di
mov rcx, qword [rsp + 0x148]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x398], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a2f4
mov rdx, qword [rsp + 0x398]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x1a8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x3a8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a325
mov rdx, qword [rsp + 0x3a8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x1d8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x3b8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a356
mov rdx, qword [rsp + 0x3b8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x150]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x3c8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a387
mov rdx, qword [rsp + 0x3c8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xa8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x3d8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a3b8
mov rdx, qword [rsp + 0x3d8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x78]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x3e8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a3e6
mov rdx, qword [rsp + 0x3e8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x80]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x3f8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a417
mov rdx, qword [rsp + 0x3f8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x40]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x408], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a445
mov rdx, qword [rsp + 0x408]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x1050], 0x10
jb 0x14005a45d
mov rcx, qword [rsp + 0x1038]
call fcn.1400c3950
mov qword [rsp + 0x1050], 0xf
mov qword [rsp + 0x1048], rdi
mov byte [rsp + 0x1038], 0
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x418], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a4a7
mov rdx, qword [rsp + 0x418]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x11b0]
call fcn.140017f90
nop
lea rcx, [rsp + 0x50]
call fcn.140033d50
nop
xor bl, bl
mov r12d, 1
jmp 0x14005d6ee
test r14, r14
je 0x14005a4e1
mov r15d, 0xb
mov word [r14], r15w
mov word [r14 + 8], di
mov rcx, qword [rsp + 0x78]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x428], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a50f
mov rdx, qword [rsp + 0x428]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x80]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x438], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a540
mov rdx, qword [rsp + 0x438]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x40]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x448], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a56e
mov rdx, qword [rsp + 0x448]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x1050], 0x10
jb 0x14005a586
mov rcx, qword [rsp + 0x1038]
call fcn.1400c3950
mov qword [rsp + 0x1050], 0xf
mov qword [rsp + 0x1048], rdi
mov byte [rsp + 0x1038], 0
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x458], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a5d0
mov rdx, qword [rsp + 0x458]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x11b0]
call fcn.140017f90
nop
lea rcx, [rsp + 0x50]
call fcn.140033d50
nop
xor bl, bl
mov r12d, 1
jmp 0x14005d6ee
lea rdx, str.getCurrentCppTime
lea rcx, [rsp + 0x40]
call fcn.1400033d0
test eax, eax
jne 0x14005a795
test r14, r14
je 0x14005d5b4
lea rcx, [rsp + 0x468]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov qword [rsp + 0x160], rdi
mov rcx, qword [rsp + 0x468]
mov qword [rsp + 0x160], rcx
movabs rax, 0xcccccccccccccccd
mul rcx
shr rdx, 3
mov qword [rsp + 0x160], rdx
lea rcx, [0x1401a19a8]
mov rax, qword [0x1401a19a8]
call qword [rax + 0x18]
mov qword [rsp + 0xe38], rax
lea rbx, [rax + 0x18]
mov qword [rsp + 0x2e0], rbx
mov dword [rsp + 0xe8], edi
cmp edi, 8
jge 0x14005a73b
lea rcx, [0x1401a19a8]
mov rax, qword [0x1401a19a8]
call qword [rax + 0x18]
mov qword [rsp + 0x978], rax
add rax, 0x18
mov qword [rsp + 0x248], rax
movsxd rax, edi
movzx r8d, byte [rsp + rax + 0x160]
lea rdx, str._.2x
lea rcx, [rsp + 0x248]
call fcn.1400111b0
mov rbx, qword [rsp + 0x248]
mov r8d, dword [rbx - 0x10]
mov dword [rsp + 0x440], r8d
mov rdx, rbx
lea rcx, [rsp + 0x2e0]
call fcn.14000f920
nop
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x478], rbx
mov eax, esi
lock xadd dword [rbx + 0x10], eax
dec eax
jg 0x14005a71e
mov rdx, qword [rsp + 0x478]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rsp + 0xe8]
inc edi
mov dword [rsp + 0xe8], edi
mov rbx, qword [rsp + 0x2e0]
jmp 0x14005a683
mov edx, dword [rbx - 0x10]
mov dword [rsp + 0x620], edx
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xca8], rax
test rax, rax
jne 0x14005a760
call fcn.140002420
mov qword [r14 + 8], rax
mov eax, 8
mov word [r14], ax
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x488], rbx
mov eax, esi
lock xadd dword [rbx + 0x10], eax
dec eax
jg 0x14005d5b4
mov rdx, qword [rsp + 0x488]
jmp 0x14005d5aa
lea rdx, str.getChromeVersion
lea rcx, [rsp + 0x40]
call fcn.1400033d0
test eax, eax
jne 0x14005a828
lea rdx, [rsp + 0x258]
mov rcx, qword [r13 + 0x40]
call fcn.140058940
nop
test r14, r14
je 0x14005a7f8
mov rcx, qword [rsp + 0x258]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x450], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0x988], rax
test rax, rax
jne 0x14005a7eb
call fcn.140002420
mov qword [r14 + 8], rax
mov eax, 8
mov word [r14], ax
mov rcx, qword [rsp + 0x258]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x498], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005d5b4
mov rdx, qword [rsp + 0x498]
jmp 0x14005d5aa
lea rdx, str.getDLLVersion
lea rcx, [rsp + 0x40]
call fcn.1400033d0
test eax, eax
jne 0x14005a90e
lea rdx, [rsp + 0x2e8]
mov rcx, qword [r13 + 0x40]
call fcn.140058990
nop
test r14, r14
je 0x14005a88f
mov rcx, qword [rsp + 0x2e8]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x710], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xfa0], rax
test rax, rax
jne 0x14005a882
call fcn.140002420
mov qword [r14 + 8], rax
mov eax, 8
mov word [r14], ax
mov ecx, dword [0x1401a9d80]
imul ecx, ecx
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 0xb
jne 0x14005a8de
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
nop
mov rcx, qword [rsp + 0x2e8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4a8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005d5b4
mov rdx, qword [rsp + 0x4a8]
jmp 0x14005d5aa
lea rdx, str.getCharPref
lea rcx, [rsp + 0x40]
call fcn.1400033d0
test eax, eax
je 0x14005d072
lea rdx, str.getIntPref
lea rcx, [rsp + 0x40]
call fcn.1400033d0
test eax, eax
je 0x14005d072
lea rdx, str.setCharPref
lea rcx, [rsp + 0x40]
call fcn.1400033d0
test eax, eax
jne 0x14005aef1
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0x998], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xcb8], rax
cmp byte [rax + 8], 4
jne 0x14005d5b4
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0x9a8], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xe48], rax
cmp byte [rax + 8], 4
jne 0x14005d5b4
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0x9b8], rax
lea rdx, [0x1401396f0]
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xcc8], rax
cmp byte [rax + 8], 4
jne 0x14005d5b4
mov byte [rsp + 0x4a], 0
mov qword [rsp + 0x170], rdi
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0x9c8], rax
lea rdx, str.hive
mov rcx, rax
call fcn.140034990
mov qword [rsp + 0xf70], rax
cmp rax, rbx
je 0x14005ad0b
mov r8d, dword [0x1401a9d80]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 0xf
jne 0x14005aabb
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x63
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400c2fb8
mov qword [rsp + 0x9d8], rax
mov rcx, rax
call fcn.1400c4098
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xcd8], rax
lea rdx, str.hive
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0x9e8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xe58], rdx
lea rcx, [rsp + 0x268]
call fcn.140002f70
nop
mov rbx, qword [r13 + 0x50]
mov qword [rsp + 0x170], rbx
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x268]
call fcn.1400033d0
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0x170], rbx
mov rcx, qword [rsp + 0x268]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4b8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005ab69
mov rdx, qword [rsp + 0x4b8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x170]
test rbx, rbx
je 0x14005ad0b
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0x9f8], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xce8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xa08], rdx
lea rcx, [rsp + 0x330]
call fcn.140002f70
nop
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xf90], rax
lea rdx, [0x1401396f0]
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xa18], rax
mov rdx, qword [rax]
mov qword [rsp + 0xcf8], rdx
lea rcx, [rsp + 0x278]
call fcn.140002f70
nop
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xa28], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xe68], rax
mov rdx, qword [rax]
mov qword [rsp + 0xa38], rdx
lea rcx, [rsp + 0x2f0]
call fcn.140002f70
nop
mov r9, rbx
lea r8, [rsp + 0x330]
lea rdx, [rsp + 0x278]
lea rcx, [rsp + 0x2f0]
call fcn.140043980
mov byte [rsp + 0x4a], al
mov rcx, qword [rsp + 0x2f0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4c8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005acaa
mov rdx, qword [rsp + 0x4c8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x278]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4d8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005acdb
mov rdx, qword [rsp + 0x4d8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x330]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4e8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005aeca
mov rdx, qword [rsp + 0x4e8]
jmp 0x14005aec1
lea rax, [rsp + 0x4f8]
mov qword [rsp + 0xd08], rax
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xa48], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xf30], rax
mov rdx, qword [rax]
mov qword [rsp + 0xa58], rdx
lea rcx, [rsp + 0x298]
call fcn.140002f70
nop
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xd18], rax
lea rdx, [0x1401396f0]
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xa68], rax
mov rdx, qword [rax]
mov qword [rsp + 0xe88], rdx
lea rcx, [rsp + 0x300]
call fcn.140002f70
nop
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xa78], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xd28], rax
mov rdx, qword [rax]
mov qword [rsp + 0xa88], rdx
lea rcx, [rsp + 0x288]
call fcn.140002f70
nop
lea rdx, [0x140133728]
lea rcx, [rsp + 0x4f8]
call fcn.140002090
nop
mov qword [rsp + 0x20], rax
mov r9, qword [0x1401a4d48]
lea r8, [rsp + 0x298]
lea rdx, [rsp + 0x300]
lea rcx, [rsp + 0x288]
call fcn.1400434f0
mov byte [rsp + 0x4a], al
mov rcx, qword [rsp + 0x288]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x508], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005ae69
mov rdx, qword [rsp + 0x508]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x300]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x518], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005ae9a
mov rdx, qword [rsp + 0x518]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x298]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x528], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005aeca
mov rdx, qword [rsp + 0x528]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r14, r14
je 0x14005d5b4
movzx eax, byte [rsp + 0x4a]
neg al
sbb cx, cx
mov word [r14 + 8], cx
mov r15d, 0xb
mov word [r14], r15w
jmp 0x14005d5b4
lea rdx, str.setIntPref
lea rcx, [rsp + 0x40]
call fcn.1400033d0
test eax, eax
jne 0x14005b41c
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xf58], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xa98], rax
cmp byte [rax + 8], 4
jne 0x14005d5b4
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xd38], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xaa8], rax
cmp byte [rax + 8], 4
jne 0x14005d5b4
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xea8], rax
lea rdx, [0x1401396f0]
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xab8], rax
movzx ecx, byte [rax + 8]
lea eax, [rcx - 1]
cmp al, 2
jbe 0x14005afc2
cmp cl, 5
jne 0x14005d5b4
mov byte [rsp + 0x49], 0
mov qword [rsp + 0x190], rdi
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xd48], rax
lea rdx, str.hive
mov rcx, rax
call fcn.140034990
mov qword [rsp + 0xac8], rax
cmp rax, rbx
je 0x14005b27c
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xf68], rax
lea rdx, str.hive
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xad8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd58], rdx
lea rcx, [rsp + 0x350]
call fcn.140002f70
nop
mov rbx, qword [r13 + 0x50]
mov qword [rsp + 0x190], rbx
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x350]
call fcn.1400033d0
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0x190], rbx
mov ecx, dword [0x1401a9d80]
mov eax, ecx
imul eax, ecx
and eax, 0x8000000f
jge 0x14005b09f
dec eax
or eax, 0xfffffff0
inc eax
cmp eax, 0xc
jne 0x14005b0e5
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub ecx, edx
add ecx, 0x7b
movsxd rcx, ecx
mov eax, 4
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.1400c2fb8
mov qword [rsp + 0xae8], rax
mov rcx, rax
call fcn.1400c4098
nop
mov rcx, qword [rsp + 0x350]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x538], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005b115
mov rdx, qword [rsp + 0x538]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x190]
test rbx, rbx
je 0x14005b27c
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xec8], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xaf8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd68], rdx
lea rcx, [rsp + 0x310]
call fcn.140002f70
nop
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xb08], rax
lea rdx, [0x1401396f0]
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xf78], rax
mov rcx, rax
call fcn.140034120
mov dword [rsp + 0x1e0], eax
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xb18], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xd78], rax
mov rdx, qword [rax]
mov qword [rsp + 0xb28], rdx
lea rcx, [rsp + 0x2a8]
call fcn.140002f70
nop
mov r9, rbx
lea r8, [rsp + 0x310]
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x2a8]
call fcn.140043ae0
mov byte [rsp + 0x49], al
mov rcx, qword [rsp + 0x2a8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x548], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005b24c
mov rdx, qword [rsp + 0x548]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x310]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x558], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005b3f5
mov rdx, qword [rsp + 0x558]
jmp 0x14005b3ec
lea rax, [rsp + 0x568]
mov qword [rsp + 0xee8], rax
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xb38], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xd88], rax
mov rdx, qword [rax]
mov qword [rsp + 0xb48], rdx
lea rcx, [rsp + 0x340]
call fcn.140002f70
nop
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xf88], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xb58], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd98], rdx
lea rcx, [rsp + 0x2b8]
call fcn.140002f70
nop
lea rdx, [0x140133728]
lea rcx, [rsp + 0x568]
call fcn.140002090
mov rbx, rax
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xb68], rax
lea rdx, [0x1401396f0]
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xf08], rax
mov rcx, rax
call fcn.140034120
mov edx, eax
mov qword [rsp + 0x20], rbx
mov r9, qword [0x1401a4d48]
lea r8, [rsp + 0x340]
lea rcx, [rsp + 0x2b8]
call fcn.140044390
mov byte [rsp + 0x49], al
mov rcx, qword [rsp + 0x2b8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x578], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005b3c5
mov rdx, qword [rsp + 0x578]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x340]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x588], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005b3f5
mov rdx, qword [rsp + 0x588]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r14, r14
je 0x14005d5b4
movzx eax, byte [rsp + 0x49]
neg al
sbb cx, cx
mov word [r14 + 8], cx
mov r15d, 0xb
mov word [r14], r15w
jmp 0x14005d5b4
lea rdx, str.removePref
lea rcx, [rsp + 0x40]
call fcn.1400033d0
test eax, eax
jne 0x14005ba54
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xb78], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xda8], rax
cmp byte [rax + 8], 4
jne 0x14005d5b4
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xb88], rax
lea rdx, str.hive
mov rcx, rax
call fcn.140034990
mov qword [rsp + 0xf98], rax
lea rdx, str.param
lea rcx, [rsp + 0x50]
cmp rax, rbx
je 0x14005b850
call fcn.140034790
mov qword [rsp + 0xb98], rax
lea rdx, str.hive
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xdb8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xba8], rdx
lea rcx, [rsp + 0x1b0]
call fcn.140002f70
nop
mov rbx, qword [r13 + 0x50]
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x1b0]
call fcn.1400033d0
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0xf28], rbx
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xbb8], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xdc8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xbc8], rdx
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0xd8], eax
test eax, eax
je 0x14005b680
test r14, r14
je 0x14005b599
mov dword [r14 + 8], eax
mov eax, 0x16
mov word [r14], ax
mov rcx, qword [rsp + 0x1b0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x598], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005b5ca
mov rdx, qword [rsp + 0x598]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x40]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5a8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005b5f8
mov rdx, qword [rsp + 0x5a8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x1050], 0x10
jb 0x14005b610
mov rcx, qword [rsp + 0x1038]
call fcn.1400c3950
mov qword [rsp + 0x1050], 0xf
mov qword [rsp + 0x1048], rdi
mov byte [rsp + 0x1038], 0
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5b8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005b65a
mov rdx, qword [rsp + 0x5b8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x11b0]
call fcn.140017f90
nop
lea rcx, [rsp + 0x50]
call fcn.140033d50
nop
xor bl, bl
mov r12d, 1
jmp 0x14005d6ee
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xfa8], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xbd8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xdd8], rdx
lea rcx, [rsp + 0x200]
call fcn.140002f70
nop
mov rdx, qword [rsp + 0x200]
mov eax, dword [rdx - 0x10]
mov dword [rsp + 0x460], eax
mov rcx, qword [rsp + 0x1a0]
test eax, eax
jne 0x14005b713
lea rdx, [0x140133728]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [rsp + 0xd8], eax
test eax, eax
je 0x14005b738
test r14, r14
je 0x14005b74c
mov dword [r14 + 8], eax
mov eax, 0x16
mov word [r14], ax
jmp 0x14005b74c
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [rsp + 0xd8], eax
test eax, eax
je 0x14005b738
test r14, r14
je 0x14005b74c
mov dword [r14 + 8], eax
mov eax, 0x16
mov word [r14], ax
jmp 0x14005b74c
test r14, r14
je 0x14005b74c
mov word [r14 + 8], si
mov r15d, 0xb
mov word [r14], r15w
mov rcx, qword [rsp + 0x1a0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0x200]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5c8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005b78c
mov rdx, qword [rsp + 0x5c8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x1b0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5d8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005b7bd
mov rdx, qword [rsp + 0x5d8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x40]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5e8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005b7eb
mov rdx, qword [rsp + 0x5e8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x1050], 0x10
jb 0x14005b803
mov rcx, qword [rsp + 0x1038]
call fcn.1400c3950
mov qword [rsp + 0x1050], 0xf
mov qword [rsp + 0x1048], rdi
mov byte [rsp + 0x1038], 0
lea rcx, [rsp + 0x68]
call fcn.140002130
nop
lea rcx, [rsp + 0x11b0]
call fcn.140017f90
nop
lea rcx, [rsp + 0x50]
call fcn.140033d50
nop
xor bl, bl
mov r12d, 1
jmp 0x14005d6ee
call fcn.140034790
mov qword [rsp + 0xbe8], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0x800], rax
cmp byte [rax + 8], 4
jne 0x14005b972
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0x810], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0x820], rax
mov rdx, qword [rax]
mov qword [rsp + 0x830], rdx
lea rcx, [rsp + 0x240]
call fcn.140002f70
nop
lea rdx, [0x140133728]
lea rcx, [rsp + 0x230]
call fcn.140002090
nop
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0x840], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0x850], rax
mov rdx, qword [rax]
mov qword [rsp + 0x860], rdx
lea rcx, [rsp + 0x220]
call fcn.140002f70
nop
lea r8, [rsp + 0x240]
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x220]
call fcn.140042b10
movzx ebx, al
mov byte [rsp + 0x71], al
lea rcx, [rsp + 0x220]
call fcn.140002130
nop
lea rcx, [rsp + 0x230]
call fcn.140002130
nop
lea rcx, [rsp + 0x240]
jmp 0x14005ba2d
lea rdx, [0x140133728]
lea rcx, [rsp + 0x270]
call fcn.140002090
nop
lea rdx, [0x140133728]
lea rcx, [rsp + 0x260]
call fcn.140002090
nop
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0x870], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0x880], rax
mov rdx, qword [rax]
mov qword [rsp + 0x890], rdx
lea rcx, [rsp + 0x250]
call fcn.140002f70
nop
lea r8, [rsp + 0x270]
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x250]
call fcn.140042b10
movzx ebx, al
mov byte [rsp + 0x71], al
lea rcx, [rsp + 0x250]
call fcn.140002130
nop
lea rcx, [rsp + 0x260]
call fcn.140002130
nop
lea rcx, [rsp + 0x270]
call fcn.140002130
test r14, r14
je 0x14005d5b4
neg bl
sbb ax, ax
mov word [r14 + 8], ax
mov r15d, 0xb
mov word [r14], r15w
jmp 0x14005d5b4
lea rdx, str.getChildValues
lea rcx, [rsp + 0x40]
call fcn.1400033d0
test eax, eax
je 0x14005ca14
lea rdx, str.getChildKeys
lea rcx, [rsp + 0x40]
call fcn.1400033d0
test eax, eax
je 0x14005ca14
lea rdx, str.requestGet
lea rcx, [rsp + 0x40]
call fcn.1400033d0
test eax, eax
jne 0x14005c09a
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov r12d, 1
mov edx, r12d
lea rcx, [0x140133728]
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r15, rax
mov qword [rsp + 0x8a0], rax
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0x8b0], rax
lea rdx, [0x140136de0]
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0x8c0], rax
cmp byte [rax + 8], 4
jne 0x14005c01c
test r15, r15
je 0x14005c01c
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0x8d0], rax
lea rdx, [0x140136de0]
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0x8e0], rax
lea rdx, [rsp + 0x1168]
mov rcx, rax
call fcn.140033e90
mov qword [rsp + 0x8f0], rax
cmp qword [rax + 0x18], 0x10
jb 0x14005bb5f
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.140002f70
nop
cmp qword [rsp + 0x1180], 0x10
jb 0x14005bb88
mov rcx, qword [rsp + 0x1168]
call fcn.1400c3950
mov qword [rsp + 0x1180], 0xf
mov qword [rsp + 0x1178], rdi
mov byte [rsp + 0x1168], 0
mov ecx, dword [0x1401a9d80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0xb21642c9
imul r8d
add edx, r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub r8d, edx
cmp r8d, 0xd
jne 0x14005bc01
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
xor r8d, r8d
lea rdx, str.error
lea rcx, [rsp + 0x88]
call fcn.14000ed20
mov ebx, eax
mov dword [rsp + 0x1e8], eax
test eax, eax
jle 0x14005bcdc
add ebx, 6
mov dword [rsp + 0x1e8], ebx
mov edx, 0x26
mov rcx, qword [rsp + 0x88]
call fcn.1400c6258
mov qword [rsp + 0x900], rax
test rax, rax
jne 0x14005bc56
mov eax, esi
jmp 0x14005bc61
sub rax, qword [rsp + 0x88]
sar rax, 1
sub eax, ebx
mov r9d, eax
mov r8d, ebx
lea rdx, [rsp + 0x5f8]
lea rcx, [rsp + 0x88]
call fcn.14000ed70
mov qword [rsp + 0x910], rax
mov rdx, rax
lea rcx, [rsp + 0x88]
call fcn.1400021b0
nop
lea rcx, [rsp + 0x5f8]
call fcn.140002130
lea rdx, str.js_code
lea rcx, [rsp + 0x280]
call fcn.140002f70
nop
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x88]
call fcn.14001bba0
nop
lea rcx, [rsp + 0x280]
call fcn.140002130
xor edx, edx
lea rcx, [rsp + 0x370]
call fcn.1400339e0
nop
lea rdx, [0x140136e10]
lea rcx, [rsp + 0xe70]
call fcn.140033aa0
nop
lea rdx, [0x140136e14]
lea rcx, [rsp + 0x370]
call fcn.140034790
mov rcx, rax
lea rdx, [rsp + 0xe70]
call fcn.140033e00
nop
lea rcx, [rsp + 0xe70]
call fcn.140033d50
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0x920], rax
lea rdx, [0x140136de0]
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0x930], rax
lea rdx, [rsp + 0x1108]
mov rcx, rax
call fcn.140033e90
nop
mov rdx, rax
lea rcx, [rsp + 0xe90]
call fcn.140033b30
nop
lea rdx, [0x140136de0]
lea rcx, [rsp + 0x370]
call fcn.140034790
mov rcx, rax
lea rdx, [rsp + 0xe90]
call fcn.140033e00
nop
lea rcx, [rsp + 0xe90]
call fcn.140033d50
nop
cmp qword [rsp + 0x1120], 0x10
jb 0x14005bdd0
mov rcx, qword [rsp + 0x1108]
call fcn.1400c3950
mov qword [rsp + 0x1120], 0xf
mov qword [rsp + 0x1118], rdi
mov byte [rsp + 0x1108], 0
lea rdx, [0x140136e1c]
lea rcx, [rsp + 0xeb0]
call fcn.140033aa0
nop
lea rdx, str.acceptedStatusCodes
lea rcx, [rsp + 0x370]
call fcn.140034790
mov rcx, rax
lea rdx, [rsp + 0xeb0]
call fcn.140034ab0
nop
lea rcx, [rsp + 0xeb0]
call fcn.140033d50
lea rdx, [0x140136e34]
lea rcx, [rsp + 0xed0]
call fcn.140033aa0
nop
lea rdx, str.acceptTypes
lea rcx, [rsp + 0x370]
call fcn.140034790
mov rcx, rax
lea rdx, [rsp + 0xed0]
call fcn.140033e00
nop
lea rcx, [rsp + 0xed0]
call fcn.140033d50
lea rdx, str.Accept_Encoding:_gzip__deflate_r_n
lea rcx, [rsp + 0xef0]
call fcn.140033aa0
nop
lea rdx, str.additionalRequestHeaders
lea rcx, [rsp + 0x370]
call fcn.140034790
mov rcx, rax
lea rdx, [rsp + 0xef0]
call fcn.140033e00
nop
lea rcx, [rsp + 0xef0]
call fcn.140033d50
mov qword [rsp + 0x608], rdi
lea r9, [rsp + 0x370]
lea r8, [rsp + 0x608]
mov rdx, r15
lea rcx, [rsp + 0xf10]
call fcn.140029d80
nop
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test r14, r14
je 0x14005bfee
lea rax, vtable.Json::Writer.0
mov qword [rsp + 0x1098], rax
lea rax, vtable.Json::FastWriter.0
mov qword [rsp + 0x1098], rax
mov qword [rsp + 0x10b0], rdi
mov qword [rsp + 0x10b8], rdi
mov qword [rsp + 0x10b8], 0xf
mov qword [rsp + 0x10b0], rdi
mov byte [rsp + 0x10a0], 0
mov byte [rsp + 0x10c0], 0
lea r8, [rsp + 0xf10]
lea rdx, [rsp + 0x1270]
lea rcx, [rsp + 0x1098]
call fcn.140037050
mov qword [rsp + 0x940], rax
cmp qword [rax + 0x18], 0x10
jb 0x14005bf7d
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x290]
call fcn.140002f70
nop
lea rcx, [rsp + 0x1270]
call fcn.1400013b0
mov rcx, qword [rsp + 0x290]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x7f0], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0x950], rax
test rax, rax
jne 0x14005bfc5
call fcn.140002420
mov qword [r14 + 8], rax
mov eax, 8
mov word [r14], ax
lea rcx, [rsp + 0x290]
call fcn.140002130
nop
lea rcx, [rsp + 0x1098]
call fcn.14000acd0
nop
lea rcx, [rsp + 0xf10]
call fcn.140033d50
nop
lea rcx, [rsp + 0x370]
call fcn.140033d50
nop
lea rcx, [rsp + 0x88]
call fcn.140002130
jmp 0x14005d5b4
test r14, r14
je 0x14005c030
mov word [r14 + 8], di
mov r15d, 0xb
mov word [r14], r15w
lea rcx, [rsp + 0x40]
call fcn.140002130
nop
cmp qword [rsp + 0x1050], 0x10
jb 0x14005c053
mov rcx, qword [rsp + 0x1038]
call fcn.1400c3950
mov qword [rsp + 0x1050], 0xf
mov qword [rsp + 0x1048], rdi
mov byte [rsp + 0x1038], 0
lea rcx, [rsp + 0x68]
call fcn.140002130
nop
lea rcx, [rsp + 0x11b0]
call fcn.140017f90
nop
lea rcx, [rsp + 0x50]
call fcn.140033d50
nop
xor bl, bl
jmp 0x14005d6ee
lea rdx, str.NVP_IsSupported
lea rcx, [rsp + 0x40]
call fcn.1400033d0
test eax, eax
jne 0x14005c0cc
test r14, r14
je 0x14005d5b4
mov word [r14 + 8], si
mov r15d, 0xb
mov word [r14], r15w
jmp 0x14005d5b4
lea rdx, str.NVP_Inject
lea rcx, [rsp + 0x40]
call fcn.1400033d0
test eax, eax
jne 0x14005c59a
test r14, r14
je 0x14005d5b4
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0x960], rax
lea rdx, str.match
mov rcx, rax
call fcn.140034990
mov qword [rsp + 0x970], rax
cmp rax, rbx
je 0x14005c550
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0x980], rax
lea rdx, str.inject
mov rcx, rax
call fcn.140034990
mov qword [rsp + 0x990], rax
cmp rax, rbx
je 0x14005c550
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0x9a0], rax
lea rdx, str.message
mov rcx, rax
call fcn.140034990
mov qword [rsp + 0x9b0], rax
cmp rax, rbx
je 0x14005c550
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0x9c0], rax
lea rdx, str.match
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0x9d0], rax
cmp byte [rax + 8], 1
jne 0x14005c550
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0x9e0], rax
lea rdx, str.inject
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0x9f0], rax
cmp byte [rax + 8], 1
jne 0x14005c550
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xa00], rax
lea rdx, str.message
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xa10], rax
cmp byte [rax + 8], 4
jne 0x14005c550
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xa20], rax
lea rdx, str.message
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xa30], rax
lea rdx, [rsp + 0x1058]
mov rcx, rax
call fcn.140033e90
nop
mov qword [rsp + 0x2a0], rdi
lea rcx, [rsp + 0x1058]
cmp qword [rsp + 0x1070], 0x10
cmovae rcx, qword [rsp + 0x1058]
mov qword [rsp + 0xa40], rcx
mov rdx, qword [rsp + 0x1068]
test dl, 3
jne 0x14005c4f8
lea r8, [rsp + 0x2a0]
call fcn.14001e1b0
mov byte [rsp + 0x90], al
test al, al
je 0x14005c4f8
mov qword [rsp + 0x118], rdi
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0x128], rdi
mov rbx, qword [rsp + 0x2a0]
mov rdx, rbx
lea rcx, [rsp + 0x118]
call fcn.14002d4c0
nop
mov qword [rsp + 0x2b0], rdi
cmp qword [rsp + 0x1070], 0x10
jb 0x14005c342
mov rcx, qword [rsp + 0x1058]
mov qword [rsp + 0x618], rcx
test rcx, rcx
jne 0x14005c352
mov rbx, qword [rsp + 0x118]
jmp 0x14005c385
lea rcx, [rsp + 0x1058]
mov qword [rsp + 0x618], rcx
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov rbx, qword [rsp + 0x118]
mov r8, rbx
mov rdx, qword [rsp + 0x1068]
call fcn.14001e1e0
mov byte [rsp + 0x91], al
test al, al
jne 0x14005c402
test rbx, rbx
je 0x14005c3aa
mov rcx, rbx
call fcn.1400c3950
mov qword [rsp + 0x118], rdi
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0x128], rdi
lea rcx, [rsp + 0x1058]
call fcn.1400013b0
nop
lea rcx, [rsp + 0x40]
call fcn.140002130
nop
lea rcx, [rsp + 0x1038]
call fcn.1400013b0
nop
lea rcx, [rsp + 0x68]
call fcn.140002130
nop
lea rcx, [rsp + 0x11b0]
call fcn.140017f90
nop
lea rcx, [rsp + 0x50]
call fcn.140033d50
nop
xor bl, bl
mov r12d, 1
jmp 0x14005d6ee
mov rdx, qword [rsp + 0x2b0]
lea rcx, [rsp + 0x118]
call fcn.14002d4c0
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xa50], rax
lea rdx, str.match
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xa60], rax
mov rcx, rax
call fcn.140034120
mov ebx, eax
mov dword [rsp + 0x6e0], eax
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xa70], rax
lea rdx, str.inject
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xa80], rax
mov rcx, rax
call fcn.140034120
mov dword [rsp + 0x3a0], eax
lea r9, [rsp + 0x118]
mov r8d, eax
mov edx, ebx
mov rcx, qword [r13 + 0x40]
call fcn.140053ff0
mov word [r14 + 8], si
mov r15d, 0xb
mov word [r14], r15w
mov rcx, qword [rsp + 0x118]
test rcx, rcx
je 0x14005c4e6
call fcn.1400c3950
mov qword [rsp + 0x118], rdi
mov qword [rsp + 0x120], rdi
mov qword [rsp + 0x128], rdi
lea rcx, [rsp + 0x1058]
call fcn.1400013b0
jmp 0x14005d5b4
lea rcx, [rsp + 0x1058]
call fcn.1400013b0
nop
lea rcx, [rsp + 0x40]
call fcn.140002130
nop
lea rcx, [rsp + 0x1038]
call fcn.1400013b0
nop
lea rcx, [rsp + 0x68]
call fcn.140002130
nop
lea rcx, [rsp + 0x11b0]
call fcn.140017f90
nop
lea rcx, [rsp + 0x50]
call fcn.140033d50
nop
xor bl, bl
mov r12d, 1
jmp 0x14005d6ee
lea rcx, [rsp + 0x40]
call fcn.140002130
nop
lea rcx, [rsp + 0x1038]
call fcn.1400013b0
nop
lea rcx, [rsp + 0x68]
call fcn.140002130
nop
lea rcx, [rsp + 0x11b0]
call fcn.140017f90
nop
lea rcx, [rsp + 0x50]
call fcn.140033d50
nop
xor bl, bl
mov r12d, 1
jmp 0x14005d6ee
lea rdx, str.NVP_UTF8ToUTF16
lea rcx, [rsp + 0x40]
call fcn.1400033d0
test eax, eax
jne 0x14005c7ff
test r14, r14
je 0x14005d5b4
xor r15b, r15b
mov byte [rsp + 0x70], r15b
lea rcx, [rsp + 0x1c0]
call fcn.140002050
nop
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xa90], rax
lea rdx, [0x1401397e0]
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xaa0], rax
cmp byte [rax + 8], 4
jne 0x14005c7de
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xab0], rax
lea rdx, [0x1401397e0]
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xac0], rax
lea rdx, [rsp + 0x1078]
mov rcx, rax
call fcn.140033e90
nop
mov rax, qword [rsp + 0x1088]
mov qword [rsp + 0xad0], rax
lea r8, [rsp + 0x1078]
cmp qword [rsp + 0x1090], 0x10
cmovae r8, qword [rsp + 0x1078]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, eax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov dword [rsp + 0x5d0], ebx
test eax, eax
je 0x14005c793
mov qword [rsp + 0x208], rdi
mov qword [rsp + 0x210], rdi
mov qword [rsp + 0x218], rdi
mov rdx, rbx
add rdx, rdx
lea rcx, [rsp + 0x208]
call fcn.14002d4c0
nop
mov rax, qword [rsp + 0x1088]
mov qword [rsp + 0xae0], rax
lea r8, [rsp + 0x1078]
cmp qword [rsp + 0x1090], 0x10
cmovae r8, qword [rsp + 0x1078]
mov dword [rsp + 0x28], ebx
mov rbx, qword [rsp + 0x208]
mov qword [rsp + 0x20], rbx
mov r9d, eax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14005c76e
mov r8, qword [rsp + 0x210]
sub r8, rbx
mov qword [rsp + 0xaf0], r8
mov rdx, rbx
lea rcx, [rsp + 0x628]
call fcn.14001e3f0
mov qword [rsp + 0xb00], rax
mov rdx, rax
lea rcx, [rsp + 0x1c0]
call fcn.1400021b0
nop
lea rcx, [rsp + 0x628]
call fcn.140002130
mov r15b, 1
mov byte [rsp + 0x70], r15b
test rbx, rbx
je 0x14005c793
mov rcx, rbx
call fcn.1400c3950
mov qword [rsp + 0x208], rdi
mov qword [rsp + 0x210], rdi
mov qword [rsp + 0x218], rdi
lea rcx, [rsp + 0x1078]
call fcn.1400013b0
test r15b, r15b
je 0x14005c7de
mov rcx, qword [rsp + 0x1c0]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x3b0], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xb10], rax
test rax, rax
jne 0x14005c7cf
call fcn.140002420
mov qword [r14 + 8], rax
mov eax, 8
mov word [r14], ax
jmp 0x14005c7ed
mov word [r14 + 8], di
mov r15d, 0xb
mov word [r14], r15w
lea rcx, [rsp + 0x1c0]
call fcn.140002130
jmp 0x14005d5b4
lea rdx, str.reloadBackground
lea rcx, [rsp + 0x40]
call fcn.1400033d0
test eax, eax
jne 0x14005c83c
mov rcx, qword [r13 + 0x40]
add rcx, 0x1f0
call fcn.1400620a0
test r14, r14
je 0x14005d5b4
mov r12d, 1
mov word [r14], r12w
jmp 0x14005d5b4
lea rdx, str.debugMessage
lea rcx, [rsp + 0x40]
call fcn.1400033d0
test eax, eax
jne 0x14005c9f7
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xb20], rax
lea rdx, str.message
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xb30], rax
cmp byte [rax + 8], 4
jne 0x14005c9f7
mov ecx, dword [0x1401a9d80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0xb21642c9
imul r8d
add edx, r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub r8d, edx
cmp r8d, 0xc
jne 0x14005c988
mov word [rsp + 0x1290], di
xor edx, edx
mov r8d, 0x15f1e
lea rcx, [rsp + 0x1292]
call fcn.1400c8db0
mov dword [0x1401a9d80], edi
mov r10d, edi
mov dword [rsp + 0x1c8], edi
cmp r10d, 0xd4
jge 0x14005c97a
mov r9d, edi
mov dword [rsp + 0x1b8], edi
nop dword [rax]
cmp r9d, 0xd4
jge 0x14005c96a
test r10d, r10d
je 0x14005c95d
test r9d, r9d
je 0x14005c95d
movsxd r8, r10d
movsxd rcx, r9d
mov rdx, r8
imul rdx, rdx, 0xd4
add rdx, rcx
imul r8, r8, 0xd4
add r8, rcx
movsx ecx, word [rsp + r8*2 + 0x10e8]
movsx eax, word [rsp + rdx*2 + 0x128e]
inc ecx
add ecx, eax
mov word [rsp + rdx*2 + 0x1290], cx
inc r9d
mov dword [rsp + 0x1b8], r9d
jmp 0x14005c910
inc r10d
mov dword [rsp + 0x1c8], r10d
jmp 0x14005c8f6
movsx eax, word [rsp + 0x171ae]
mov dword [0x1401a9d80], eax
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xb40], rax
lea rdx, str.message
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xb50], rax
mov rdx, qword [rax]
mov qword [rsp + 0xb60], rdx
lea rcx, [rsp + 0x638]
call fcn.140002f70
nop
test r14, r14
je 0x14005c9e5
mov word [r14 + 8], si
mov r15d, 0xb
mov word [r14], r15w
lea rcx, [rsp + 0x638]
call fcn.140002130
jmp 0x14005d5b4
test r14, r14
je 0x14005d5b4
mov word [r14 + 8], di
mov r15d, 0xb
mov word [r14], r15w
jmp 0x14005d5b4
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xb70], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xb80], rax
cmp byte [rax + 8], 4
jne 0x14005d5b4
test r14, r14
je 0x14005d5b4
mov qword [rsp + 0x178], rdi
mov qword [rsp + 0x180], rdi
mov qword [rsp + 0x188], rdi
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xb90], rax
lea rdx, str.hive
mov rcx, rax
call fcn.140034990
mov qword [rsp + 0xba0], rax
cmp rax, rbx
je 0x14005cd55
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xbb0], rax
lea rdx, str.hive
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xbc0], rax
mov rdx, qword [rax]
mov qword [rsp + 0xbd0], rdx
lea rcx, [rsp + 0x1d0]
call fcn.140002f70
nop
mov rbx, qword [r13 + 0x50]
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x1d0]
call fcn.1400033d0
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0xbe0], rbx
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xbf0], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xc00], rax
mov rdx, qword [rax]
mov qword [rsp + 0xc10], rdx
lea rax, [rsp + 0x648]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x770], eax
test eax, eax
je 0x14005cc20
mov dword [r14 + 8], eax
mov eax, 0x16
mov word [r14], ax
lea rcx, [rsp + 0x1d0]
call fcn.140002130
nop
lea rcx, [rsp + 0x178]
call fcn.140019980
nop
lea rcx, [rsp + 0x40]
call fcn.140002130
nop
cmp qword [rsp + 0x1050], 0x10
jb 0x14005cbd3
mov rcx, qword [rsp + 0x1038]
call fcn.1400c3950
mov qword [rsp + 0x1050], 0xf
mov qword [rsp + 0x1048], rdi
mov byte [rsp + 0x1038], 0
lea rcx, [rsp + 0x68]
call fcn.140002130
nop
lea rcx, [rsp + 0x11b0]
call fcn.140017f90
nop
lea rcx, [rsp + 0x50]
call fcn.140033d50
nop
xor bl, bl
mov r12d, 1
jmp 0x14005d6ee
mov ebx, edi
mov dword [rsp + 0x1f0], ebx
mov dword [rsp + 0xc0], 0x7ffe
lea rdx, str.getChildValues
lea rcx, [rsp + 0x40]
call fcn.1400033d0
mov r12, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
cmove r12, qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov qword [rsp + 0xc20], r12
mov ecx, 0x7ffe
call fcn.1400c2fb8
mov r15, rax
mov qword [rsp + 0xc30], rax
xor edx, edx
mov r8d, 0x7ffe
mov rcx, rax
call fcn.1400c8db0
nop word [rax + rax]
mov edx, ebx
inc ebx
mov dword [rsp + 0x1f0], ebx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0xc0]
mov r8, r15
mov rcx, qword [rsp + 0x648]
call r12
mov dword [rsp + 0x3c0], eax
test eax, eax
jne 0x14005cd1f
mov rdx, r15
lea rcx, [rsp + 0x658]
call fcn.140002f70
nop
mov rdx, rax
lea rcx, [rsp + 0x178]
call fcn.140024b00
nop
lea rcx, [rsp + 0x658]
call fcn.140002130
xor edx, edx
mov r8d, 0x7ffe
mov rcx, r15
call fcn.1400c8db0
mov dword [rsp + 0xc0], 0x7ffe
jmp 0x14005cc90
cmp eax, 0x103
je 0x14005cd42
mov rax, qword [rsp + 0x180]
sub rax, qword [rsp + 0x178]
test rax, 0xfffffffffffffff8
jne 0x14005cd42
xor bl, bl
jmp 0x14005cd44
mov bl, 1
mov byte [rsp + 0x48], bl
lea rcx, [rsp + 0x1d0]
jmp 0x14005ce3a
lea rdx, str.getChildValues
lea rcx, [rsp + 0x40]
call fcn.1400033d0
lea rdx, str.param
lea rcx, [rsp + 0x50]
test eax, eax
jne 0x14005cdd9
call fcn.140034790
mov qword [rsp + 0xc40], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xc50], rax
mov rdx, qword [rax]
mov qword [rsp + 0xc60], rdx
lea rcx, [rsp + 0x2c0]
call fcn.140002f70
nop
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x2c0]
call fcn.140044bf0
movzx ebx, al
mov byte [rsp + 0x48], al
lea rcx, [rsp + 0x2c0]
jmp 0x14005ce3a
call fcn.140034790
mov qword [rsp + 0xc70], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xc80], rax
mov rdx, qword [rax]
mov qword [rsp + 0xc90], rdx
lea rcx, [rsp + 0x2d0]
call fcn.140002f70
nop
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x2d0]
call fcn.140044810
movzx ebx, al
mov byte [rsp + 0x48], al
lea rcx, [rsp + 0x2d0]
call fcn.140002130
test bl, bl
je 0x14005d051
lea rdx, [0x140139734]
lea rcx, [rsp + 0xb0]
call fcn.140002090
nop
mov rbx, qword [rsp + 0x178]
mov qword [rsp + 0x688], rbx
cmp rbx, qword [rsp + 0x180]
je 0x14005cf42
lea rdx, [0x140139710]
lea rcx, [rsp + 0x2f8]
call fcn.140002f70
nop
lea rdx, [0x140139714]
lea rcx, [rsp + 0x1f8]
call fcn.140002f70
nop
mov r8, rbx
lea rdx, [rsp + 0x1f8]
lea rcx, [rsp + 0x678]
call fcn.14000ee60
nop
lea r8, [rsp + 0x2f8]
mov rdx, rax
lea rcx, [rsp + 0x668]
call fcn.14000ee60
mov qword [rsp + 0xca0], rax
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x5e0], r8d
mov qword [rsp + 0xcb0], rdx
lea rcx, [rsp + 0xb0]
call fcn.14000f920
nop
lea rcx, [rsp + 0x668]
call fcn.140002130
nop
lea rcx, [rsp + 0x678]
call fcn.140002130
nop
lea rcx, [rsp + 0x1f8]
call fcn.140002130
nop
lea rcx, [rsp + 0x2f8]
call fcn.140002130
add rbx, 8
jmp 0x14005ce64
mov rax, qword [rsp + 0xb0]
mov r8d, dword [rax - 0x10]
mov dword [rsp + 0x3d0], r8d
dec r8d
lea rdx, [rsp + 0x6a8]
lea rcx, [rsp + 0xb0]
call fcn.140019570
nop
lea r8, [0x140139758]
mov rdx, rax
lea rcx, [rsp + 0x698]
call fcn.140019610
mov qword [rsp + 0xcc0], rax
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.1400021b0
nop
lea rcx, [rsp + 0x698]
call fcn.140002130
nop
lea rcx, [rsp + 0x6a8]
call fcn.140002130
mov rcx, qword [rsp + 0xb0]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x6f0], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xcd0], rax
test rax, rax
jne 0x14005cfe4
call fcn.140002420
mov qword [r14 + 8], rax
mov eax, 8
mov word [r14], ax
mov eax, dword [0x1401a9d80]
lea ecx, [rax + 1]
imul ecx, eax
mov eax, 0x2aaaaaab
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
cmp ecx, 5
jne 0x14005d042
mov ecx, 4
call fcn.1400c4130
mov rbx, rax
mov qword [rsp + 0xce0], rax
call fcn.1400c426c
mov dword [rbx], eax
mov dword [0x1401a9d80], eax
mov rcx, rbx
call fcn.1400c3950
nop
lea rcx, [rsp + 0xb0]
call fcn.140002130
jmp 0x14005d060
mov word [r14 + 8], di
mov r15d, 0xb
mov word [r14], r15w
lea rcx, [rsp + 0x178]
call fcn.140019980
jmp 0x14005d5b4
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xcf0], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xd00], rax
cmp byte [rax + 8], 4
jne 0x14005d5b4
test r14, r14
je 0x14005d5b4
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xd10], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xd20], rax
cmp byte [rax + 8], 4
jne 0x14005d5b4
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xd30], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xd40], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd50], rdx
lea rcx, [rsp + 0x100]
call fcn.140002f70
nop
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xd60], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xd70], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd80], rdx
lea rcx, [rsp + 0xf0]
call fcn.140002f70
nop
mov r15, rdi
mov qword [rsp + 0x110], rdi
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xd90], rax
lea rdx, str.hive
mov rcx, rax
call fcn.140034990
mov qword [rsp + 0xda0], rax
cmp rax, rbx
je 0x14005d317
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.140034790
mov qword [rsp + 0xdb0], rax
lea rdx, str.hive
mov rcx, rax
call fcn.140034790
mov qword [rsp + 0xdc0], rax
mov rdx, qword [rax]
mov qword [rsp + 0xdd0], rdx
lea rcx, [rsp + 0x308]
call fcn.140002f70
nop
mov r8d, dword [0x1401a9d80]
lea r9d, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, r9d
imul ecx, r8d
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 1
jne 0x14005d255
mov dword [rsp + 0xfb0], edi
mov dword [rsp + 0xfd8], edi
mov dword [rsp + 0x1008], edi
mov rbx, qword [r13 + 0x50]
mov qword [rsp + 0x110], rbx
imul r9d, r8d
mov eax, 0x38e38e39
imul r9d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub r9d, eax
cmp r9d, 0xd
jne 0x14005d2b6
mov r12d, 1
mov dword [rsp + 0x168], r12d
cmp r12d, r8d
jge 0x14005d2af
mov eax, r8d
cdq
idiv r12d
inc r12d
add r12d, edx
mov dword [rsp + 0x168], r12d
jmp 0x14005d293
mov dword [0x1401a9d80], r12d
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x308]
call fcn.1400033d0
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0x110], rbx
mov rcx, qword [rsp + 0x308]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6b8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005d30f
mov rdx, qword [rsp + 0x6b8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r15, qword [rsp + 0x110]
lea rdx, str.getCharPref
lea rcx, [rsp + 0x40]
call fcn.1400033d0
test eax, eax
jne 0x14005d47e
lea rcx, [rsp + 0x130]
call fcn.140002050
nop
test r15, r15
je 0x14005d368
mov r9, r15
lea r8, [rsp + 0x100]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x130]
call fcn.140043c20
jmp 0x14005d40e
lea rax, [rsp + 0x6c8]
mov qword [rsp + 0xde0], rax
lea rdx, [0x140133728]
lea rcx, [rsp + 0x6c8]
call fcn.140002090
nop
mov qword [rsp + 0x20], rax
mov r9, qword [0x1401a4d48]
lea r8, [rsp + 0x100]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x6d8]
call fcn.1400433a0
mov qword [rsp + 0xdf0], rax
mov rdx, rax
lea rcx, [rsp + 0x130]
call fcn.1400021b0
nop
mov rcx, qword [rsp + 0x6d8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6e8], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005d400
mov rdx, qword [rsp + 0x6e8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x14005d40e
mov rcx, qword [rsp + 0x130]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x7b8], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xe00], rax
test rax, rax
jne 0x14005d438
call fcn.140002420
mov qword [r14 + 8], rax
mov eax, 8
mov word [r14], ax
mov rcx, qword [rsp + 0x130]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x708], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005d552
mov rdx, qword [rsp + 0x708]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14005d552
mov ebx, esi
mov dword [rsp + 0xa4], ebx
mov dword [rsp + 0xc4], 0xffffffff
test r15, r15
je 0x14005d4d2
mov r9, r15
lea r8, [rsp + 0x100]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0xc4]
call fcn.140043e10
mov byte [rsp + 0x74], al
mov ecx, dword [rsp + 0xc4]
cmp ecx, 0xffffffff
je 0x14005d530
mov ebx, ecx
mov dword [rsp + 0xa4], ecx
jmp 0x14005d52b
lea rax, [rsp + 0x718]
mov qword [rsp + 0xe10], rax
lea rdx, [0x140133728]
lea rcx, [rsp + 0x718]
call fcn.140002090
nop
mov qword [rsp + 0x20], rax
mov r9, qword [0x1401a4d48]
lea r8, [rsp + 0x100]
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0xa4]
call fcn.140044020
mov byte [rsp + 0x74], al
mov ebx, dword [rsp + 0xa4]
cmp ebx, 0xffffffff
jne 0x14005d545
test al, al
jne 0x14005d545
mov word [r14 + 8], di
mov r15d, 0xb
mov word [r14], r15w
jmp 0x14005d552
mov dword [r14 + 8], ebx
mov eax, 0x16
mov word [r14], ax
mov rcx, qword [rsp + 0xf0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x728], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005d583
mov rdx, qword [rsp + 0x728]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x100]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x738], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005d5b4
mov rdx, qword [rsp + 0x738]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x40]
call fcn.140002130
nop
lea rcx, [rsp + 0x1038]
call fcn.1400013b0
nop
lea rcx, [rsp + 0x68]
call fcn.140002130
nop
lea rcx, [rsp + 0x11b0]
call fcn.140017f90
nop
lea rcx, [rsp + 0x50]
call fcn.140033d50
nop
mov bl, 1
jmp 0x14005d6f7
lea rdx, str.json_parse_action_not_found
lea rcx, [rsp + 0x328]
call fcn.140002f70
nop
lea rdx, [rsp + 0x328]
mov rcx, qword [r13 + 0x40]
call fcn.140053e90
nop
mov rcx, qword [rsp + 0x328]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x748], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005d650
mov rdx, qword [rsp + 0x748]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x1050], 0x10
jb 0x14005d668
mov rcx, qword [rsp + 0x1038]
call fcn.1400c3950
mov qword [rsp + 0x1050], 0xf
mov qword [rsp + 0x1048], rdi
mov byte [rsp + 0x1038], 0
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x758], rcx
mov eax, esi
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005d6b2
mov rdx, qword [rsp + 0x758]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x11b0]
call fcn.140017f90
nop
lea rcx, [rsp + 0x50]
call fcn.140033d50
nop
xor bl, bl
mov r12d, 1
jmp 0x14005d6ee
test r14, r14
je 0x14005d6f7
mov word [r14], r12w
mov rax, qword [rsp + 0x360]
mov rdx, qword [rax]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
dec esi
jg 0x14005d719
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, bl
mov rcx, qword [rsp + 0x171b0]
xor rcx, rsp
call fcn.1400c3970
add rsp, 0x171c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret