Function at 0x140040490
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x800
mov rax, qword [0x14031a940]
xor rax, rsp
mov qword [rsp + 0x7f0], rax
xor r13d, r13d
xorps xmm0, xmm0
movups xmmword [rsp + 0x2a8], xmm0
movdqa xmm1, xmmword [0x1402d3620]
movdqu xmmword [rsp + 0x2b8], xmm1
mov word [rsp + 0x2a8], r13w
mov byte [rsp + 0x2a0], r13b
lea rdx, str.srl::Applications::Detect
lea rcx, [rsp + 0x2a8]
call fcn.1400184d0
nop
call fcn.140021130
cmp dword [rax + 8], 4
jl 0x140040521
lea rcx, [rsp + 0x2a0]
call fcn.140016330
nop
lea rsi, vtable.srl::Exists.0
mov qword [rsp + 0x118], rsi
mov byte [rsp + 0x120], 0
mov edx, 0x116f3
lea rcx, [rsp + 0x428]
call fcn.140022830
nop
xor r9d, r9d
lea r8, [rsp + 0x118]
mov rdx, rax
call fcn.140050f90
nop
lea rdi, vtable.srl::GroupID.0
mov qword [rsp + 0x428], rdi
mov rdx, qword [rsp + 0x448]
cmp rdx, 8
jb 0x1400405b7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x430]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400405b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041b8b
call fcn.1400041d4
nop
mov qword [rsp + 0x128], rsi
mov byte [rsp + 0x130], 0
mov edx, 0x116f5
lea rcx, [rsp + 0x458]
call fcn.140022830
nop
xor r9d, r9d
lea r8, [rsp + 0x128]
mov rdx, rax
call fcn.140050f90
nop
mov qword [rsp + 0x458], rdi
mov rdx, qword [rsp + 0x478]
cmp rdx, 8
jb 0x14004063f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x460]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040639
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041b91
call fcn.1400041d4
nop
mov qword [rsp + 0x138], rsi
mov byte [rsp + 0x140], 0
mov edx, 0x116f7
lea rcx, [rsp + 0x488]
call fcn.140022830
nop
xor r9d, r9d
lea r8, [rsp + 0x138]
mov rdx, rax
call fcn.140050f90
nop
mov qword [rsp + 0x488], rdi
mov rdx, qword [rsp + 0x4a8]
cmp rdx, 8
jb 0x1400406c7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x490]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400406c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041b97
call fcn.1400041d4
nop
mov qword [rsp + 0x148], rsi
mov byte [rsp + 0x150], 0
mov edx, 0x116f9
lea rcx, [rsp + 0x4b8]
call fcn.140022830
nop
xor r9d, r9d
lea r8, [rsp + 0x148]
mov rdx, rax
call fcn.140050f90
nop
mov qword [rsp + 0x4b8], rdi
mov rdx, qword [rsp + 0x4d8]
cmp rdx, 8
jb 0x14004074f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x4c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040749
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041b9d
call fcn.1400041d4
nop
mov qword [rsp + 0x158], rsi
mov byte [rsp + 0x160], 0
mov edx, 0x116fb
lea rcx, [rsp + 0x4e8]
call fcn.140022830
nop
xor r9d, r9d
lea r8, [rsp + 0x158]
mov rdx, rax
call fcn.140050f90
nop
mov qword [rsp + 0x4e8], rdi
mov rdx, qword [rsp + 0x508]
cmp rdx, 8
jb 0x1400407d7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x4f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400407d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041ba3
call fcn.1400041d4
nop
mov qword [rsp + 0x168], rsi
mov byte [rsp + 0x170], 0
mov edx, 0x11702
lea rcx, [rsp + 0x518]
call fcn.140022830
nop
xor r9d, r9d
lea r8, [rsp + 0x168]
mov rdx, rax
call fcn.140050f90
nop
mov qword [rsp + 0x518], rdi
mov rdx, qword [rsp + 0x538]
cmp rdx, 8
jb 0x14004085f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x520]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040859
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041ba9
call fcn.1400041d4
nop
mov qword [rsp + 0x100], r13
mov dword [rsp + 0x108], r13d
mov qword [rsp + 0x110], r13
mov qword [rsp + 0x58], r13
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMacromediaFlashPlayer
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140040921
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x100], rcx
mov dword [rsp + 0x108], r13d
mov dword [rsp + 0x48], 0x28
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x6f8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.CurrentVersion
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140040921
mov eax, dword [rsp + 0x50]
dec eax
cmp eax, 1
ja 0x140040921
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x1400409d4
test al, 1
jne 0x140040921
shr rax, 1
cmp word [rsp + rax*2 + 0x6f6], 0
je 0x1400409dd
lea r12, vtable.srl::Version.0
mov r15, 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rsp + 0x1e0], xmm0
mov qword [rsp + 0x1f0], r13
mov qword [rsp + 0x1f8], 7
mov word [rsp + 0x1e0], r13w
lea rdx, str.wmplayer.exe
lea rcx, [rsp + 0x2c8]
call fcn.1400095cc
nop
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x2c8]
call fcn.14003fa70
movzx ebx, al
mov rdx, qword [rsp + 0x2e0]
cmp rdx, 8
jb 0x140040b94
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040b8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041baf
jmp 0x140040b8f
mov word [rsp + 0x6f8], r13w
mov qword [rsp + 0x178], rsi
mov byte [rsp + 0x180], 1
mov edx, 0x116f1
lea rcx, [rsp + 0x548]
call fcn.140022830
nop
xor r9d, r9d
lea r8, [rsp + 0x178]
mov rdx, rax
call fcn.140050f90
nop
mov qword [rsp + 0x548], rdi
mov rdx, qword [rsp + 0x568]
cmp rdx, 8
jb 0x140040a65
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x550]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040a5f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041bb5
call fcn.1400041d4
nop
lea r12, vtable.srl::Version.0
mov qword [rsp + 0x78], r12
call fcn.1400102e4
mov rcx, rax
test rax, rax
je 0x140041bbb
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x6f8]
mov r15, 0xffffffffffffffff
mov r8, r15
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140040ab0
lea rdx, [rsp + 0x6f8]
lea rcx, [rsp + 0x80]
call fcn.140002b2c
nop
mov edx, 0x116f2
lea rcx, [rsp + 0x368]
call fcn.140022830
nop
xor r9d, r9d
lea r8, [rsp + 0x78]
mov rdx, rax
call fcn.140050f90
nop
mov qword [rsp + 0x368], rdi
mov rdx, qword [rsp + 0x388]
cmp rdx, 8
jb 0x140040b45
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x370]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040b40
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041bc6
call fcn.1400041d4
movdqa xmm0, xmmword [0x1402d3620]
movdqu xmmword [rsp + 0x380], xmm0
mov word [rsp + 0x370], r13w
mov qword [rsp + 0x78], r12
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004092f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14004092f
call fcn.1400041d4
test bl, bl
je 0x140040d41
xorps xmm0, xmm0
movups xmmword [rsp + 0x200], xmm0
movdqa xmm1, xmmword [0x1402d3620]
movdqu xmmword [rsp + 0x210], xmm1
mov word [rsp + 0x200], r13w
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x1e0]
call fcn.14003f8b0
test al, al
je 0x140040cf9
mov qword [rsp + 0x188], rsi
mov byte [rsp + 0x190], 1
mov edx, 0x116f3
lea rcx, [rsp + 0x608]
call fcn.140022830
nop
xor r9d, r9d
lea r8, [rsp + 0x188]
mov rdx, rax
call fcn.140050f90
nop
lea rcx, [rsp + 0x608]
call fcn.1400229c0
nop
mov qword [rsp + 0x88], r12
call fcn.1400102e4
mov rcx, rax
test rax, rax
je 0x140041bcc
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x90], rax
lea rdx, [rsp + 0x200]
cmp qword [rsp + 0x218], 8
jb 0x140040c73
mov rdx, qword [rsp + 0x200]
test rdx, rdx
jne 0x140040c73
mov r8d, r13d
jmp 0x140040c8b
mov r8, r15
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140040c80
lea rcx, [rsp + 0x90]
call fcn.140002b2c
nop
mov edx, 0x11611
lea rcx, [rsp + 0x638]
call fcn.140022830
nop
xor r9d, r9d
lea r8, [rsp + 0x88]
mov rdx, rax
call fcn.140050f90
nop
lea rcx, [rsp + 0x638]
call fcn.1400229c0
nop
mov qword [rsp + 0x88], r12
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140040cf9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x218]
cmp rdx, 8
jb 0x140040d41
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040d3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041c22
call fcn.1400041d4
mov qword [rsp + 0x1f0], r13
lea rax, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 8
cmovae rax, qword [rsp + 0x1e0]
mov word [rax], r13w
lea rdx, str.AcroRd32.exe
lea rcx, [rsp + 0x2e8]
call fcn.1400095cc
nop
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x2e8]
call fcn.14003fa70
movzx ebx, al
mov rdx, qword [rsp + 0x300]
cmp rdx, 8
jb 0x140040ddc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040dd7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041bd7
call fcn.1400041d4
test bl, bl
je 0x14004101e
xorps xmm0, xmm0
movups xmmword [rsp + 0x220], xmm0
movdqa xmm1, xmmword [0x1402d3620]
movdqu xmmword [rsp + 0x230], xmm1
mov word [rsp + 0x220], r13w
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x1e0]
call fcn.14003f8b0
test al, al
je 0x140040fd6
mov qword [rsp + 0x198], rsi
mov byte [rsp + 0x1a0], 1
mov edx, 0x116f5
lea rcx, [rsp + 0x578]
call fcn.140022830
nop
xor r9d, r9d
lea r8, [rsp + 0x198]
mov rdx, rax
call fcn.140050f90
nop
mov qword [rsp + 0x578], rdi
mov rdx, qword [rsp + 0x598]
cmp rdx, 8
jb 0x140040eae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x580]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040ea8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041bdd
call fcn.1400041d4
nop
mov qword [rsp + 0x98], r12
call fcn.1400102e4
mov rcx, rax
test rax, rax
je 0x140041be3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xa0], rax
lea rdx, [rsp + 0x220]
cmp qword [rsp + 0x238], 8
jb 0x140040efe
mov rdx, qword [rsp + 0x220]
test rdx, rdx
jne 0x140040efe
mov r8d, r13d
jmp 0x140040f0c
mov r8, r15
inc r8
cmp word [rdx + r8*2], 0
jne 0x140040f01
lea rcx, [rsp + 0xa0]
call fcn.140002b2c
nop
mov edx, 0x116f6
lea rcx, [rsp + 0x398]
call fcn.140022830
nop
xor r9d, r9d
lea r8, [rsp + 0x98]
mov rdx, rax
call fcn.140050f90
nop
mov qword [rsp + 0x398], rdi
mov rdx, qword [rsp + 0x3b8]
cmp rdx, 8
jb 0x140040f91
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x3a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040f8c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041bee
call fcn.1400041d4
movdqa xmm0, xmmword [0x1402d3620]
movdqu xmmword [rsp + 0x3b0], xmm0
mov word [rsp + 0x3a0], r13w
mov qword [rsp + 0x98], r12
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140040fd6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x238]
cmp rdx, 8
jb 0x14004101e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041019
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041c22
call fcn.1400041d4
mov qword [rsp + 0x1f0], r13
lea rax, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 8
cmovae rax, qword [rsp + 0x1e0]
mov word [rax], r13w
lea rdx, str.QuickTimePlayer.exe
lea rcx, [rsp + 0x308]
call fcn.1400095cc
nop
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x308]
call fcn.14003fa70
movzx ebx, al
mov rdx, qword [rsp + 0x320]
cmp rdx, 8
jb 0x1400410b9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x308]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400410b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041bf4
call fcn.1400041d4
test bl, bl
je 0x140041261
xorps xmm0, xmm0
movups xmmword [rsp + 0x240], xmm0
movdqa xmm1, xmmword [0x1402d3620]
movdqu xmmword [rsp + 0x250], xmm1
mov word [rsp + 0x240], r13w
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x1e0]
call fcn.14003f8b0
test al, al
je 0x140041219
mov qword [rsp + 0x1a8], rsi
mov byte [rsp + 0x1b0], 1
mov edx, 0x116f7
lea rcx, [rsp + 0x668]
call fcn.140022830
nop
xor r9d, r9d
lea r8, [rsp + 0x1a8]
mov rdx, rax
call fcn.140050f90
nop
lea rcx, [rsp + 0x668]
call fcn.1400229c0
nop
mov qword [rsp + 0xa8], r12
call fcn.1400102e4
mov rcx, rax
test rax, rax
je 0x140041bfa
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xb0], rax
lea rdx, [rsp + 0x240]
cmp qword [rsp + 0x258], 8
jb 0x140041198
mov rdx, qword [rsp + 0x240]
test rdx, rdx
jne 0x140041198
mov r8d, r13d
jmp 0x1400411ab
mov r8, r15
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400411a0
lea rcx, [rsp + 0xb0]
call fcn.140002b2c
nop
mov edx, 0x116f8
lea rcx, [rsp + 0x698]
call fcn.140022830
nop
xor r9d, r9d
lea r8, [rsp + 0xa8]
mov rdx, rax
call fcn.140050f90
nop
lea rcx, [rsp + 0x698]
call fcn.1400229c0
nop
mov qword [rsp + 0xa8], r12
mov rdx, qword [rsp + 0xb0]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140041219
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x258]
cmp rdx, 8
jb 0x140041261
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004125c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041c22
call fcn.1400041d4
mov qword [rsp + 0x1f0], r13
lea rax, [rsp + 0x1e0]
cmp qword [rsp + 0x1f8], 8
cmovae rax, qword [rsp + 0x1e0]
mov word [rax], r13w
lea rdx, str.Winword.exe
lea rcx, [rsp + 0x328]
call fcn.1400095cc
nop
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x328]
call fcn.14003fa70
movzx ebx, al
mov rdx, qword [rsp + 0x340]
cmp rdx, 8
jb 0x1400412fc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x328]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400412f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041c05
call fcn.1400041d4
test bl, bl
je 0x14004153e
xorps xmm0, xmm0
movups xmmword [rsp + 0x260], xmm0
movdqa xmm1, xmmword [0x1402d3620]
movdqu xmmword [rsp + 0x270], xmm1
mov word [rsp + 0x260], r13w
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x1e0]
call fcn.14003f8b0
test al, al
je 0x1400414f6
mov qword [rsp + 0x1b8], rsi
mov byte [rsp + 0x1c0], 1
mov edx, 0x116f9
lea rcx, [rsp + 0x5a8]
call fcn.140022830
nop
xor r9d, r9d
lea r8, [rsp + 0x1b8]
mov rdx, rax
call fcn.140050f90
nop
mov qword [rsp + 0x5a8], rdi
mov rdx, qword [rsp + 0x5c8]
cmp rdx, 8
jb 0x1400413ce
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x5b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400413c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041c0b
call fcn.1400041d4
nop
mov qword [rsp + 0xb8], r12
call fcn.1400102e4
mov rcx, rax
test rax, rax
je 0x140041c11
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xc0], rax
lea rdx, [rsp + 0x260]
cmp qword [rsp + 0x278], 8
jb 0x14004141e
mov rdx, qword [rsp + 0x260]
test rdx, rdx
jne 0x14004141e
mov r8d, r13d
jmp 0x14004142c
mov r8, r15
inc r8
cmp word [rdx + r8*2], 0
jne 0x140041421
lea rcx, [rsp + 0xc0]
call fcn.140002b2c
nop
mov edx, 0x116fa
lea rcx, [rsp + 0x3c8]
call fcn.140022830
nop
xor r9d, r9d
lea r8, [rsp + 0xb8]
mov rdx, rax
call fcn.140050f90
nop
mov qword [rsp + 0x3c8], rdi
mov rdx, qword [rsp + 0x3e8]
cmp rdx, 8
jb 0x1400414b1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x3d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400414ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041c1c
call fcn.1400041d4
movdqa xmm0, xmmword [0x1402d3620]
movdqu xmmword [rsp + 0x3e0], xmm0
mov word [rsp + 0x3d0], r13w
mov qword [rsp + 0xb8], r12
mov rdx, qword [rsp + 0xc0]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400414f6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x278]
cmp rdx, 8
jb 0x14004153e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x260]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041539
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041c22
call fcn.1400041d4
xorps xmm0, xmm0
movups xmmword [rsp + 0x280], xmm0
movdqa xmm1, xmmword [0x1402d3620]
movdqu xmmword [rsp + 0x290], xmm1
mov word [rsp + 0x280], r13w
lea rdx, str.3F0FC462_CDC1_4CD9_8E84_84D89B914EAA
lea rcx, [rsp + 0x348]
call fcn.1400095cc
nop
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x348]
call fcn.14003fcb0
movzx ebx, al
mov rdx, qword [rsp + 0x360]
cmp rdx, 8
jb 0x1400415d8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x348]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400415d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041c28
call fcn.1400041d4
test bl, bl
je 0x140041794
mov qword [rsp + 0x1c8], rsi
mov byte [rsp + 0x1d0], 1
mov edx, 0x11702
lea rcx, [rsp + 0x5d8]
call fcn.140022830
nop
xor r9d, r9d
lea r8, [rsp + 0x1c8]
mov rdx, rax
call fcn.140050f90
nop
mov qword [rsp + 0x5d8], rdi
mov rdx, qword [rsp + 0x5f8]
cmp rdx, 8
jb 0x140041668
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x5e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041662
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041c2e
call fcn.1400041d4
nop
mov qword [rsp + 0xc8], r12
call fcn.1400102e4
mov rcx, rax
test rax, rax
je 0x140041c34
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xd0], rax
lea rdx, [rsp + 0x280]
cmp qword [rsp + 0x298], 8
jb 0x1400416b8
mov rdx, qword [rsp + 0x280]
test rdx, rdx
jne 0x1400416b8
mov r8d, r13d
jmp 0x1400416cb
mov r8, r15
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400416c0
lea rcx, [rsp + 0xd0]
call fcn.140002b2c
nop
mov edx, 0x11703
lea rcx, [rsp + 0x3f8]
call fcn.140022830
nop
xor r9d, r9d
lea r8, [rsp + 0xc8]
mov rdx, rax
call fcn.140050f90
nop
mov qword [rsp + 0x3f8], rdi
mov rdx, qword [rsp + 0x418]
cmp rdx, 8
jb 0x140041750
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x400]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004174b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041c3f
call fcn.1400041d4
movdqa xmm0, xmmword [0x1402d3620]
movdqu xmmword [rsp + 0x410], xmm0
mov word [rsp + 0x400], r13w
mov qword [rsp + 0xc8], r12
mov rdx, qword [rsp + 0xd0]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140041794
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, r13
mov qword [rsp + 0xd8], r13
mov dword [rsp + 0xe0], r13d
mov qword [rsp + 0xe8], r13
mov qword [rsp + 0x60], r13
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREJavaSoftJava_Runtime_Environment
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400417f4
mov rdi, qword [rsp + 0x60]
mov qword [rsp + 0xd8], rdi
mov dword [rsp + 0xe0], r13d
mov r8d, r13d
test eax, eax
cmovne r8d, eax
test r8d, r8d
je 0x140041867
mov qword [rsp + 0x68], r13
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
xor r8d, r8d
lea rdx, str.SOFTWAREJavaSoftJava_Runtime_Environment
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140041a79
mov eax, r13d
test rdi, rdi
je 0x140041847
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x68]
mov qword [rsp + 0xd8], rdi
mov dword [rsp + 0xe0], 0x200
test eax, eax
jne 0x140041a79
call fcn.1400102e4
mov rcx, rax
test rax, rax
je 0x140041c45
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, [0x1402c7950]
cmp rdx, 0x10000
jae 0x1400418a6
movzx edx, dx
lea rcx, [rsp + 0x40]
call fcn.140010b40
jmp 0x1400418c6
mov r8, r15
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400418b0
lea rcx, [rsp + 0x40]
call fcn.140002b2c
nop
xor r14b, r14b
mov esi, r13d
mov dword [rsp + 0x4c], 0x64
test r14b, r14b
jne 0x140041974
mov dword [rsp + 0x4c], 0x64
lea rax, [rsp + 0x1d8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x4c]
lea r8, [rsp + 0x720]
mov edx, esi
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x140041925
mov r14b, 1
jmp 0x1400418d4
mov rax, qword [rsp + 0x40]
mov ebx, dword [rax - 0x10]
lea rcx, [rsp + 0x720]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, ebx
jle 0x14004196d
lea rax, [rsp + 0x720]
mov r8, r15
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140041950
lea rdx, [rsp + 0x720]
lea rcx, [rsp + 0x40]
call fcn.140002b2c
inc esi
jmp 0x1400418d4
mov rax, qword [rsp + 0x40]
cmp dword [rax - 0x10], 0
jle 0x140041a53
mov edx, 0x5f
lea rcx, [rsp + 0x40]
call fcn.140041c60
mov rax, qword [rsp + 0x40]
mov r9d, dword [rax - 0x10]
add r9d, 0xfffffffe
mov r8d, 2
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.140013230
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xf0]
call fcn.140077940
mov rbx, rax
mov edx, 0x1171e
lea rcx, [rsp + 0x6c8]
call fcn.140022830
nop
xor r9d, r9d
mov r8, rbx
mov rdx, rax
call fcn.140050f90
nop
lea rcx, [rsp + 0x6c8]
call fcn.1400229c0
nop
mov qword [rsp + 0xf0], r12
mov rdx, qword [rsp + 0xf8]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140041a24
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, vtable.srl::Value.0
mov qword [rsp + 0xf0], rax
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140041a53
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg 0x140041a71
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0xd8]
test rdi, rdi
je 0x140041a88
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x298]
cmp rdx, 8
jb 0x140041ad1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041acb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041c50
call fcn.1400041d4
nop
mov rdx, qword [rsp + 0x1f8]
cmp rdx, 8
jb 0x140041b19
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041b14
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140041c56
call fcn.1400041d4
mov qword [rsp + 0x1f0], r13
mov qword [rsp + 0x1f8], 7
mov word [rsp + 0x1e0], r13w
mov rcx, qword [rsp + 0x100]
test rcx, rcx
je 0x140041b4a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x2a0]
call fcn.140017d20
mov al, 1
mov rcx, qword [rsp + 0x7f0]
xor rcx, rsp
call fcn.140220e50
lea r11, [rsp + 0x800]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call fcn.14022a144
nop
call fcn.14022a144
nop
call fcn.14022a144
nop
call fcn.14022a144
nop
call fcn.14022a144
nop
call fcn.14022a144
nop
call fcn.14022a144
nop
call fcn.14022a144
nop
mov ecx, 0x80004005
call fcn.140002dfc
nop
call fcn.14022a144
nop
mov ecx, 0x80004005
call fcn.140002dfc
nop
call fcn.14022a144
nop
call fcn.14022a144
nop
mov ecx, 0x80004005
call fcn.140002dfc
nop
call fcn.14022a144
nop
call fcn.14022a144
nop
mov ecx, 0x80004005
call fcn.140002dfc
nop
call fcn.14022a144
nop
call fcn.14022a144
nop
mov ecx, 0x80004005
call fcn.140002dfc
nop
call fcn.14022a144
nop
call fcn.14022a144
nop
call fcn.14022a144
nop
call fcn.14022a144
nop
mov ecx, 0x80004005
call fcn.140002dfc
nop
call fcn.14022a144
nop
mov ecx, 0x80004005
call fcn.140002dfc
nop
call fcn.14022a144
nop
call fcn.14022a144
int3