Function at 0x140091400
Capabilities:
Delete file
Query environment variable

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2010]
mov eax, 0x2110
call fcn.140247340
sub rsp, rax
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov qword [rsp + 0x2158], rbx
mov rsi, r8
mov ebx, edx
mov r14, rcx
mov rcx, qword [rcx + 0x12d8]
mov rax, qword [rcx]
lea rdx, str.CSASScanner::Remove_Item
call qword [rax + 0x48]
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x1010]
call fcn.140249b10
mov r8d, dword [rsi + 0x860]
lea rdx, str.IsCookie:__x
lea rcx, [rbp + 0x1010]
call fcn.140006bc0
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
lea rdx, [rbp + 0x1010]
call qword [rax + 0x48]
mov r8d, dword [rsi + 0x8c]
lea rdx, str.File_Size:__x
lea rcx, [rbp + 0x1010]
call fcn.140006bc0
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
lea rdx, [rbp + 0x1010]
call qword [rax + 0x48]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
mov rdx, qword [rsi + 0x48]
call qword [rax + 0x48]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
mov rdx, qword [rsi + 0xb0]
call qword [rax + 0x48]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
mov rdx, qword [rsi + 0x2c8]
call qword [rax + 0x48]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
mov rdx, qword [rsi + 0x1a8]
call qword [rax + 0x48]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
mov rdx, qword [rsi + 0x1c0]
call qword [rax + 0x48]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
mov rdx, qword [rsi + 0x158]
call qword [rax + 0x48]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
mov rdx, qword [rsi + 0x1d8]
call qword [rax + 0x48]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
mov rdx, qword [rsi + 0x1f0]
call qword [rax + 0x48]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
mov rdx, qword [rsi + 0x208]
call qword [rax + 0x48]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
mov rdx, qword [rsi + 0x78]
call qword [rax + 0x48]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
mov rdx, qword [rsi + 0xf8]
call qword [rax + 0x48]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
mov rdx, qword [rsi + 0xc8]
call qword [rax + 0x48]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
mov rdx, qword [rsi + 0x128]
call qword [rax + 0x48]
mov eax, dword [r14 + 0x14e4]
mov dword [rbp + 0x2068], eax
mov rcx, qword [r14 + 0x12d8]
cmp dword [rsi + 0x16c], 0
je 0x1400915ec
mov dword [r14 + 0x14e4], 0x100
lea rdx, str.64Bit
jmp 0x1400915fe
mov dword [r14 + 0x14e4], 0x200
lea rdx, str.32Bit
mov rax, qword [rcx]
call qword [rax + 0x48]
lea rdx, str.SYSTEM32USERINIT.EXE
mov rcx, qword [rsi + 0x48]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
jne 0x14009297c
cmp ebx, 0x401
jne 0x14009167a
mov rcx, qword [r14 + 0x18]
mov rax, qword [rcx]
mov r8d, 0x80
mov rdx, qword [rsi + 0x48]
call qword [rax + 0xb0]
mov rcx, qword [r14 + 0x18]
mov rax, qword [rcx]
mov rdx, qword [rsi + 0x48]
call qword [rax + 0x88]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
lea rdx, str.MemoryItem::AddToInUseFileList
call qword [rax + 0x48]
lea rcx, [r14 + 0x1380]
lea r8, [rsi + 0x40]
mov rdx, qword [rcx]
call fcn.14007aa40
jmp 0x14009296f
cmp ebx, 0x400
jne 0x140091998
cmp dword [rsi + 0x858], 0
je 0x14009169c
mov rcx, qword [rsi + 0x850]
call qword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x10]
call fcn.140249b10
mov rcx, qword [r14 + 0x18]
mov rax, qword [rcx]
mov rdx, qword [rsi + 0x48]
call qword [rax + 0xa0]
mov ebx, eax
mov rcx, qword [r14 + 0x18]
mov r8, qword [rcx]
mov rdx, qword [rsi + 0x48]
call qword [r8 + 0xd0]
test eax, eax
jne 0x140091706
cmp ebx, 0xffffffff
je 0x1400916e0
test bl, 0x10
jne 0x140091706
cmp dword [rsi + 0x760], 5
jne 0x14009185d
mov rdx, qword [rsi + 0x48]
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rcx, [rbp + 0x10]
call fcn.1400fca30
jmp 0x140091714
mov rdx, qword [rsi + 0x48]
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rax, qword [r14 + 0x1558]
mov qword [rsp + 0x28], rax
xor r15d, r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x1010]
call fcn.14003fbb0
nop
lea rdi, vtable.CSABString.0
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x50], r15d
lea ecx, [r15 + 0x10]
call fcn.140247068
mov rbx, rax
mov qword [rsp + 0x48], rax
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov dword [rsp + 0x54], 1
lea edx, [rax + 1]
lea rcx, [rbp + 0x1010]
call fcn.140040490
test rbx, rbx
je 0x140091793
mov rcx, rbx
call fcn.140247060
mov qword [rsp + 0x48], r15
lea rax, [rbp + 0x10]
mov rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400917a0
mov dword [rsp + 0x50], ebx
lea eax, [rbx + 1]
mov ebx, eax
mov ecx, eax
call fcn.140247068
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1400917d2
mov r8d, ebx
lea rdx, [rbp + 0x10]
mov rcx, rax
call fcn.1402496a0
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
lea rdx, str.FileItem::AddToInUseFolderList
call qword [rax + 0x48]
mov rdi, qword [r14 + 0x1390]
mov r15, qword [rdi + 8]
lea r9, [rsp + 0x40]
mov r8, r15
mov rdx, rdi
lea rcx, [r14 + 0x1390]
call fcn.140039da0
mov rdx, rax
mov rax, qword [r14 + 0x1398]
movabs rcx, 0x666666666666665
sub rcx, rax
cmp rcx, 1
jb 0x1400929a9
inc rax
mov qword [r14 + 0x1398], rax
mov qword [rdi + 8], rdx
mov qword [r15], rdx
cmp dword [rsp + 0x54], 1
jne 0x140091851
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140091851
call fcn.140247060
nop
lea rcx, [rbp + 0x1010]
call fcn.14003fd70
mov rcx, qword [r14 + 0x18]
mov rax, qword [rcx]
mov r8d, 0x80
mov rdx, qword [rsi + 0x48]
call qword [rax + 0xb0]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
lea rdx, str.DeleteFile
call qword [rax + 0x48]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
mov rdx, qword [rsi + 0x48]
call qword [rax + 0x48]
mov rcx, qword [r14 + 0x18]
mov rax, qword [rcx]
mov rdx, qword [rsi + 0x48]
call qword [rax + 0x88]
test eax, eax
jne 0x14009190e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7b
jne 0x14009190e
mov rcx, qword [rsi + 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14009190e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, qword [r14 + 0x12d8]
mov r8, qword [rcx]
lea rdx, str.DeleteFile___FAILED__
call qword [r8 + 0x48]
mov r8d, ebx
lea rdx, str.Last_Error:__d
lea rcx, [rbp + 0x1010]
call fcn.140006bc0
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
lea rdx, [rbp + 0x1010]
call qword [rax + 0x48]
cmp dword [rsi + 0x860], 0
jne 0x14009193e
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
lea rdx, str.FileItem::AddToInUseFileList
call qword [rax + 0x48]
lea rcx, [r14 + 0x1380]
lea r8, [rsi + 0x40]
mov rdx, qword [rcx]
call fcn.14007aa40
mov rdx, qword [rsi + 0x48]
mov rcx, r14
call fcn.14008bc60
mov rcx, qword [r14 + 0x12d8]
test eax, eax
mov rax, qword [rcx]
je 0x140091978
lea rdx, str.File_Still_On_Drive_After_Removal...............................FAILURE
call qword [rax + 0x48]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
mov rdx, qword [rsi + 0x48]
call qword [rax + 0x48]
jmp 0x14009296f
lea rdx, str.File_Not_Found_On_Drive___Removed_Correctly
call qword [rax + 0x48]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
mov rdx, qword [rsi + 0x48]
call qword [rax + 0x48]
jmp 0x14009296f
cmp ebx, 0x402
jne 0x14009204b
mov rdx, qword [rsi + 0xf8]
mov rcx, r14
call fcn.140086e70
mov r13, rax
cmp dword [rsi + 0x130], 0
jne 0x140091cc2
cmp dword [rsi + 0x75c], 5
je 0x140091cc2
lea rdx, [rsi + 0xc0]
lea rcx, [rsp + 0x40]
call fcn.140008ba0
nop
mov rbx, 0xffffffffffffffff
cmp dword [rsi + 0x80], 0
je 0x140091b22
lea rdi, vtable.CSABString.0
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x68], 1
lea ecx, [rbx + 3]
call fcn.140247068
mov rdi, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140091a29
movzx ecx, word [0x140287e84]
mov word [rax], cx
mov dword [rsp + 0x6c], 1
mov r15d, dword [rsp + 0x50]
lea ecx, [r15 + 2]
call fcn.140247068
mov r12, rax
cmp qword [rsp + 0x48], 0
je 0x140091a7b
mov rcx, qword [rsp + 0x48]
mov rdx, rcx
mov r8, rax
sub r8, rcx
nop dword [rax + rax]
movzx eax, byte [rdx]
mov byte [r8 + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140091a60
call fcn.140247060
mov qword [rsp + 0x48], r12
jmp 0x140091a80
mov qword [rsp + 0x48], rax
test r12, r12
je 0x140091aa2
mov edx, r15d
movzx ecx, word [rdi]
mov word [rdx + r12], cx
mov r15, rbx
inc r15
cmp byte [r12 + r15], 0
jne 0x140091a93
mov dword [rsp + 0x50], r15d
test rdi, rdi
je 0x140091aaf
mov rcx, rdi
call fcn.140247060
mov ecx, dword [rsi + 0x80]
inc ecx
add ecx, r15d
call fcn.140247068
mov rdi, rax
test r12, r12
je 0x140091aed
mov rcx, r12
mov rdx, rax
sub rdx, r12
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140091ad0
mov rcx, r12
call fcn.140247060
mov qword [rsp + 0x48], rdi
jmp 0x140091af2
mov qword [rsp + 0x48], rax
test rdi, rdi
je 0x140091b27
mov r8d, dword [rsi + 0x80]
inc r8d
mov ecx, r15d
add rcx, rdi
mov rdx, qword [rsi + 0x78]
call fcn.1402496a0
mov rax, rbx
inc rax
cmp byte [rdi + rax], 0
jne 0x140091b13
mov dword [rsp + 0x50], eax
jmp 0x140091b27
mov rdi, qword [rsp + 0x48]
mov r8, rdi
mov rdx, r13
lea rcx, [r14 + 0x28]
call fcn.1400790a0
mov r8, rdi
mov rdx, r13
lea rcx, [r14 + 0x28]
call fcn.1400790a0
xor r15d, r15d
mov qword [rbp + 0x2050], r15
mov r10, qword [r14 + 0x28]
mov eax, dword [r14 + 0x14e4]
or eax, 0x20019
lea rcx, [rbp + 0x2050]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8, rdi
mov rdx, r13
lea rcx, [r14 + 0x28]
call qword [r10 + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
jne 0x140091b9f
mov rax, qword [r14 + 0x28]
mov rdx, qword [rbp + 0x2050]
lea rcx, [r14 + 0x28]
call qword [rax + 0x28]
lea rdx, str.Key_Still_In_Registry_After_Removal.............................FAILURE
jmp 0x140091ba6
lea rdx, str.Key_Not_Found_In_Registry_After_Removal
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + 0x48]
lea rcx, [rsp + 0x70]
call fcn.14007c070
nop
lea rdx, [rsi + 0xf0]
lea rcx, [rsp + 0x78]
call fcn.140004780
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140091bf1
call fcn.140247060
mov qword [rbp - 0x68], r15
test rdi, rdi
je 0x140091c27
inc rbx
cmp byte [rdi + rbx], 0
jne 0x140091bf6
mov dword [rbp - 0x60], ebx
lea ecx, [rbx + 1]
call fcn.140247068
mov qword [rbp - 0x68], rax
test rax, rax
je 0x140091c42
mov r8d, dword [rbp - 0x60]
inc r8d
mov rdx, rdi
mov rcx, rax
call fcn.1402496a0
jmp 0x140091c42
mov dword [rbp - 0x60], r15d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp - 0x68], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov rsi, qword [r14 + 0x13c0]
mov r15, qword [rsi + 8]
lea r9, [rsp + 0x70]
mov r8, r15
mov rdx, rsi
lea rcx, [r14 + 0x13c0]
call fcn.14007a7e0
mov rdx, rax
mov rax, qword [r14 + 0x13c8]
movabs rcx, 0x2aaaaaaaaaaaaa9
sub rcx, rax
cmp rcx, 1
jb 0x1400929b6
inc rax
mov qword [r14 + 0x13c8], rax
mov qword [rsi + 8], rdx
mov qword [r15], rdx
lea rcx, [rsp + 0x70]
call fcn.14007cf80
nop
cmp dword [rsp + 0x54], 1
jne 0x14009296f
test rdi, rdi
je 0x14009296f
mov rcx, rdi
call fcn.140247060
jmp 0x14009296f
lea rdx, [rsi + 0xc0]
lea rcx, [rsp + 0x58]
call fcn.140008ba0
nop
mov r12, qword [rsp + 0x60]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
cmp dword [rsi + 0x75c], 5
je 0x140091eed
lea rdx, str.Remove
call qword [rax + 0x48]
lea rcx, [r14 + 0x28]
mov r9, qword [rsi + 0x128]
mov r8, r12
mov rdx, r13
call fcn.1400790c0
lea rcx, [rsp + 0x70]
call fcn.14007c070
nop
lea rdx, [rsi + 0xf0]
lea rcx, [rsp + 0x78]
call fcn.140004780
xor r15d, r15d
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140091d41
call fcn.140247060
mov qword [rbp - 0x68], r15
test r12, r12
je 0x140091d81
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [r12 + rbx], r15b
jne 0x140091d50
mov dword [rbp - 0x60], ebx
lea ecx, [rbx + 1]
call fcn.140247068
mov qword [rbp - 0x68], rax
test rax, rax
je 0x140091d9c
mov r8d, dword [rbp - 0x60]
inc r8d
mov rdx, r12
mov rcx, rax
call fcn.1402496a0
jmp 0x140091d9c
mov dword [rbp - 0x60], r15d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp - 0x68], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
lea rdx, [rsi + 0x120]
lea rcx, [rbp - 0x58]
call fcn.140004780
mov rdi, qword [r14 + 0x13c0]
mov rax, qword [rdi + 8]
mov qword [rbp - 0x20], rax
lea r9, [rsp + 0x70]
mov r8, rax
mov rdx, rdi
lea rcx, [r14 + 0x13c0]
call fcn.14007a7e0
mov rdx, rax
mov rax, qword [r14 + 0x13c8]
movabs rcx, 0x2aaaaaaaaaaaaa9
sub rcx, rax
cmp rcx, 1
jb 0x1400929c3
inc rax
mov qword [r14 + 0x13c8], rax
mov qword [rdi + 8], rdx
mov rax, qword [rbp - 0x20]
mov qword [rax], rdx
lea rax, vtable.CSASRegistryDescriptor.0
mov qword [rsp + 0x70], rax
lea rdi, vtable.CSABString.0
mov qword [rbp - 0x58], rdi
add dword [rbp - 0x44], 0xffffffff
jne 0x140091e33
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x140091e33
call fcn.140247060
mov qword [rbp - 0x70], rdi
add dword [rbp - 0x5c], 0xffffffff
jne 0x140091e4b
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140091e4b
call fcn.140247060
mov qword [rsp + 0x78], rdi
add dword [rbp - 0x74], 0xffffffff
jne 0x140091e64
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140091e64
call fcn.140247060
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x10]
call fcn.140249b10
mov dword [rbp + 0x2050], 0x800
mov dword [rbp + 0x2060], r15d
lea rcx, [r14 + 0x28]
mov rax, qword [rcx]
lea rdx, [rbp + 0x2050]
mov qword [rsp + 0x30], rdx
lea rdx, [rbp + 0x10]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp + 0x2060]
mov qword [rsp + 0x20], rdx
mov r9, qword [rsi + 0x128]
mov r8, r12
mov rdx, r13
call qword [rax + 0x98]
mov rcx, qword [r14 + 0x12d8]
test eax, eax
mov rax, qword [rcx]
jne 0x140091ede
lea rdx, str.Value_Still_In_Registry_After_Removal...............................FAILURE
call qword [rax + 0x48]
jmp 0x140092005
lea rdx, str.Value_Not_Found_In_Registry_After_Removal
call qword [rax + 0x48]
jmp 0x140092005
lea rdx, str.Restore
call qword [rax + 0x48]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
mov rdx, qword [rsi + 0x820]
call qword [rax + 0x48]
mov rax, qword [rsi + 0x820]
inc rax
mov qword [rbp + 0x2050], rax
lea rdx, [0x14028d644]
mov rcx, rax
call fcn.140248db4
mov rdi, rax
test rax, rax
je 0x140092005
mov byte [rax], 0
inc rdi
mov rbx, qword [rsi + 0x128]
xor r15d, r15d
cmp byte [rbx], r15b
cmove rbx, r15
mov qword [rbp + 0x2060], rbx
lea rcx, [r14 + 0x28]
mov r9, rbx
mov r8, r12
mov rdx, r13
call fcn.1400790c0
lea rdx, str.REG_SZ
mov r15, qword [rbp + 0x2050]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x140091fb5
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rdi + rbx], 0
jne 0x140091f90
inc ebx
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 1
mov r9, qword [rbp + 0x2060]
jmp 0x140091ff6
lea rdx, str.REG_DWORD
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x140092005
mov rcx, rdi
call fcn.1402520ac
mov dword [rbp + 0x2050], eax
mov dword [rsp + 0x30], 4
lea rax, [rbp + 0x2050]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 4
mov r9, rbx
mov r8, r12
mov rdx, r13
lea rcx, [r14 + 0x28]
call fcn.140079210
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
mov rdx, qword [rsi + 0x128]
call qword [rax + 0x48]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + 0x48]
nop
cmp dword [rsp + 0x6c], 1
jne 0x14009296f
test r12, r12
je 0x14009296f
mov rcx, r12
call fcn.140247060
jmp 0x14009296f
cmp ebx, 0x405
jne 0x140092271
lea rdi, vtable.CSABString.0
mov qword [rsp + 0x58], rdi
mov rdi, qword [rsi + 0xc8]
xor r15d, r15d
lea rbx, [r15 - 1]
test rdi, rdi
je 0x1400920b6
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [rdi + rax], r15b
jne 0x140092080
mov dword [rsp + 0x68], eax
inc eax
mov r13d, eax
mov ecx, eax
call fcn.140247068
mov r12, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x1400920d8
mov r8d, r13d
mov rdx, rdi
mov rcx, rax
call fcn.1402496a0
jmp 0x1400920d8
mov dword [rsp + 0x68], r15d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov r12, rax
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [r12], rax
mov qword [r12 + 8], rax
mov dword [rsp + 0x6c], 1
mov rdx, qword [rsi + 0xf8]
mov rcx, r14
call fcn.140086e70
mov rdi, rax
mov r8, r12
mov rdx, rax
lea rcx, [r14 + 0x28]
call fcn.1400790a0
mov r8, r12
mov rdx, rdi
lea rcx, [r14 + 0x28]
call fcn.1400790a0
mov qword [rbp + 0x2050], r15
mov r10, qword [r14 + 0x28]
mov edx, dword [r14 + 0x14e4]
or edx, 0x20019
lea rax, [rbp + 0x2050]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edx
xor r9d, r9d
mov r8, r12
mov rdx, rdi
lea rcx, [r14 + 0x28]
call qword [r10 + reloc.OLEAUT32.dll_SafeArrayGetElement]
test eax, eax
jne 0x140092168
mov rax, qword [r14 + 0x28]
mov rdx, qword [rbp + 0x2050]
lea rcx, [r14 + 0x28]
call qword [rax + 0x28]
lea rdx, str.Key_Still_In_Registry_After_Removal.............................FAILURE
jmp 0x14009216f
lea rdx, str.Key_Not_Found_In_Registry_After_Removal
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + 0x48]
lea rcx, [rsp + 0x70]
call fcn.14007c070
nop
lea rdx, [rsi + 0xf0]
lea rcx, [rsp + 0x78]
call fcn.140004780
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400921ba
call fcn.140247060
mov qword [rbp - 0x68], r15
test r12, r12
je 0x1400921f2
nop
inc rbx
cmp byte [r12 + rbx], 0
jne 0x1400921c0
mov dword [rbp - 0x60], ebx
lea ecx, [rbx + 1]
call fcn.140247068
mov qword [rbp - 0x68], rax
test rax, rax
je 0x14009220d
mov r8d, dword [rbp - 0x60]
inc r8d
mov rdx, r12
mov rcx, rax
call fcn.1402496a0
jmp 0x14009220d
mov dword [rbp - 0x60], r15d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rbp - 0x68], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov rdi, qword [r14 + 0x13c0]
mov rsi, qword [rdi + 8]
lea r9, [rsp + 0x70]
mov r8, rsi
mov rdx, rdi
lea rcx, [r14 + 0x13c0]
call fcn.14007a7e0
mov rdx, rax
mov rax, qword [r14 + 0x13c8]
movabs rcx, 0x2aaaaaaaaaaaaa9
sub rcx, rax
cmp rcx, 1
jb 0x14009299c
inc rax
mov qword [r14 + 0x13c8], rax
mov qword [rdi + 8], rdx
mov qword [rsi], rdx
lea rcx, [rsp + 0x70]
call fcn.14007cf80
nop
jmp 0x140092035
cmp ebx, 0x404
jne 0x1400924b8
lea rdx, [rsi + 0xc0]
lea rcx, [rbp - 0x10]
call fcn.140008ba0
nop
mov rdx, qword [rsi + 0xf8]
mov rcx, r14
call fcn.140086e70
mov rcx, qword [r14 + 0x13d8]
xor r15d, r15d
mov qword [rbp + 0x2050], r15
mov qword [rbp + 0x2060], r15
mov rax, qword [rcx]
lea r8, [rbp + 0x2060]
lea rdx, [rbp + 0x2050]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rbp + 0x2060]
cmp qword [rbp + 0x2050], rax
je 0x140092497
lea rdi, vtable.CSABString.0
nop dword [rax]
nop dword [rax + rax]
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x68], r15d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [rsp + 0x60], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [rsp + 0x6c], 1
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x50], r15d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov rbx, rax
mov qword [rsp + 0x48], rax
xor eax, eax
mov qword [rbx], rax
mov qword [rbx + 8], rax
mov dword [rsp + 0x54], 1
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x10]
call fcn.140249b10
mov rcx, qword [rbp + 0x2050]
mov rdx, qword [rcx + 0x10]
add rdx, 0x30
lea rcx, [rsp + 0x58]
call fcn.140004820
mov rax, qword [rbp + 0x2050]
mov r13, qword [rax + 0x10]
test rbx, rbx
je 0x14009238e
mov rcx, rbx
call fcn.140247060
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], 0x58
mov ecx, 0x59
call fcn.140247068
mov rcx, rax
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1400923fa
movups xmm0, xmmword [str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries_]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140299030]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x140299040]
movups xmmword [rax + 0x20], xmm0
movups xmm1, xmmword [0x140299050]
movups xmmword [rax + 0x30], xmm1
movups xmm0, xmmword [0x140299060]
movups xmmword [rax + 0x40], xmm0
movsd xmm1, qword [0x140299070]
movsd qword [rax + 0x50], xmm1
movzx eax, byte [0x140299078]
mov byte [rcx + 0x58], al
lea rdx, [r13 + 0x18]
lea rcx, [rsp + 0x40]
call fcn.140081fe0
mov r8d, 0x410
lea rdx, [rbp + 0x10]
mov r12, qword [rsp + 0x60]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov rdx, qword [rsi + 0xc8]
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x140092449
mov rcx, qword [rbp + 0x2050]
mov rcx, qword [rcx + 0x10]
call fcn.140068b30
mov rax, qword [rbp + 0x2050]
mov rdx, qword [rax]
mov qword [rbp + 0x2050], rdx
cmp dword [rsp + 0x54], 1
jne 0x14009246f
test rbx, rbx
je 0x14009246f
mov rcx, rbx
call fcn.140247060
nop
cmp dword [rsp + 0x6c], 1
jne 0x140092483
test r12, r12
je 0x140092483
mov rcx, r12
call fcn.140247060
mov rax, qword [rbp + 0x2060]
cmp qword [rbp + 0x2050], rax
jne 0x1400922f0
cmp dword [rbp + 4], 1
jne 0x14009296f
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x14009296f
call fcn.140247060
jmp 0x14009296f
cmp ebx, 0x403
jne 0x140092603
lea rdx, [rsi + 0xc0]
lea rcx, [rsp + 0x58]
call fcn.140008ba0
nop
mov rdx, qword [rsi + 0xf8]
mov rcx, r14
call fcn.140086e70
mov rdi, rax
mov r9, qword [rsi + 0x128]
mov r12, qword [rsp + 0x60]
mov r8, r12
mov rdx, rax
lea rcx, [r14 + 0x28]
call fcn.1400790c0
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp + 0x10]
call fcn.140249b10
mov dword [rbp + 0x2050], 0x800
xor r15d, r15d
mov dword [rbp + 0x2060], r15d
mov rax, qword [r14 + 0x28]
lea rcx, [rbp + 0x2050]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x10]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x2060]
mov qword [rsp + 0x20], rcx
mov r9, qword [rsi + 0x128]
mov r8, r12
mov rdx, rdi
lea rcx, [r14 + 0x28]
call qword [rax + 0x98]
mov rcx, qword [r14 + 0x12d8]
test eax, eax
mov rax, qword [rcx]
lea rdx, str.Value_Still_In_Registry_After_Removal.................................FAILURE
je 0x140092580
lea rdx, str.Value_Not_Found_In_Registry_After_Removal
call qword [rax + 0x48]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
mov rdx, qword [rsi + 0x128]
call qword [rax + 0x48]
mov rcx, qword [r14 + 0x12d8]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + 0x48]
lea rcx, [rsp + 0x70]
call fcn.14007c070
nop
lea rdx, [rsi + 0xf0]
lea rcx, [rsp + 0x78]
call fcn.140004780
lea rdx, [rsp + 0x58]
lea rcx, [rbp - 0x70]
call fcn.140004780
lea rdx, [rsi + 0x120]
lea rcx, [rbp - 0x58]
call fcn.140004780
lea rcx, [r14 + 0x13c0]
lea rdx, [rsp + 0x70]
call fcn.1400b2ef0
nop
lea rcx, [rsp + 0x70]
call fcn.14007cf80
nop
jmp 0x14009202a
cmp ebx, 0x407
jne 0x140092623
lea r8, [rsi + 0x40]
lea rdx, [rsi + 0x830]
mov rcx, r14
call fcn.140082440
jmp 0x14009296f
cmp ebx, 0x408
jne 0x1400926e1
lea rcx, [rsp + 0x70]
call fcn.14007ba30
nop
mov r8d, 1
mov rdx, qword [rsi + 0x838]
lea rcx, [rsp + 0x70]
call fcn.14006d170
test eax, eax
je 0x1400926d2
mov r8, qword [rsi + 0x48]
lea rdx, str.DELETE_FROM_moz_cookies_where_host_s
lea rcx, [rbp + 0x10]
call fcn.140006bc0
xor r15d, r15d
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x140092695
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rbp + 0x2050]
lea rdx, [rbp + 0x10]
call qword [rax]
mov r15d, eax
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test r15d, r15d
je 0x1400926d2
mov rbx, qword [rbp + 0x2050]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x1400926c7
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rsp + 0x70]
call fcn.14006b800
jmp 0x14009296f
cmp ebx, 0x409
jne 0x140092827
lea rcx, [rsp + 0x70]
call fcn.14007ba30
nop
mov r8d, 1
mov rdx, qword [rsi + 0x838]
lea rcx, [rsp + 0x70]
call fcn.14006d170
test eax, eax
je 0x140092818
xor edx, edx
mov r8d, 0x898
lea rcx, [rbp + 0x10]
call fcn.140249b10
mov rcx, qword [rsi + 0x48]
lea rdx, [rbp + 0x10]
sub rdx, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140092740
lea rax, [rbp + 0x10]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140092760
lea rax, [rbp + 0x10]
dec rax
add rbx, rax
movzx eax, byte [rbx]
test al, al
je 0x14009278e
nop word [rax + rax]
cmp al, 0x5c
je 0x140092792
dec rbx
movzx eax, byte [rbx]
test al, al
jne 0x140092780
cmp al, 0x5c
jne 0x140092795
mov byte [rbx], 0
lea r8, [rbp + 0x10]
lea rdx, str.DELETE_FROM_cookies_where_host_key_s
lea rcx, [rbp + 0x1010]
call fcn.140006bc0
xor r15d, r15d
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x1400927db
mov rax, qword [rcx]
xor r9d, r9d
lea r8, [rbp + 0x2050]
lea rdx, [rbp + 0x1010]
call qword [rax]
mov r15d, eax
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test r15d, r15d
je 0x140092818
mov rbx, qword [rbp + 0x2050]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x14009280d
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
lea rcx, [rsp + 0x70]
call fcn.14006b800
jmp 0x14009296f
cmp ebx, 0x40a
jne 0x140092943
cmp dword [rsi + 0x840], 0
je 0x14009296f
cmp dword [rsi + 0x50], 0
je 0x14009296f
lea rdx, str.MACROMEDIAFLASH_PLAYERSHAREDOBJECTS
mov rcx, qword [rsi + 0x838]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
je 0x14009296f
xor edx, edx
lea r8d, [rbx + 6]
lea rcx, [rbp + 0x10]
call fcn.140249b10
mov rdx, qword [rsi + 0x838]
lea rcx, [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rdx, qword [rsi + 0x48]
lea rax, [rbp + 0x10]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140092896
test ebx, ebx
je 0x1400928d3
mov eax, ebx
cmp byte [rbp + rax + 0xf], 0x5c
je 0x1400928d3
test rdx, rdx
je 0x1400928d3
cmp byte [rdx], 0x5c
je 0x1400928d3
lea rcx, [rbp + 0x10]
dec rcx
nop dword [rax]
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x1400928c0
movzx eax, word [0x140287e84]
mov word [rcx], ax
lea r8, [rdx + 1]
cmp byte [rdx], 0x5c
cmovne r8, rdx
lea rcx, [rbp + 0x10]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x1400928e5
xor edx, edx
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400928f0
xor r15d, r15d
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x1010]
call fcn.14003fbb0
nop
lea edx, [r15 + 1]
lea rcx, [rbp + 0x1010]
call fcn.140040490
nop
lea rcx, [rbp + 0x1010]
call fcn.14003fd70
jmp 0x14009296f
cmp ebx, 0x40c
je 0x14009295b
cmp ebx, 0x40d
je 0x14009295b
cmp ebx, 0x40e
jne 0x14009296f
mov rcx, qword [r14 + 0x18]
mov rax, qword [rcx]
mov rdx, qword [rsi + 0x838]
call qword [rax + 0x88]
mov eax, dword [rbp + 0x2068]
mov dword [r14 + 0x14e4], eax
mov eax, 1
mov rbx, qword [rsp + 0x2158]
add rsp, 0x2110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.list_T__too_long
call fcn.1402453d0
nop
lea rcx, str.list_T__too_long
call fcn.1402453d0
nop
lea rcx, str.list_T__too_long
call fcn.1402453d0
nop
lea rcx, str.list_T__too_long
call fcn.1402453d0
int3