Function at 0x1401d5640
Capabilities:
Hash data using sha256
Persist via active setup registry key
Persist via appinit_dlls registry key
Persist via winlogon helper dll registry key
Query environment variable
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd240]
mov eax, 0xd340
call fcn.1402c8f60
sub rsp, rax
mov qword [rbp + 0x9c8], 0xfffffffffffffffe
mov qword [rsp + 0xd378], rbx
mov qword [rsp + 0xd380], rsi
mov qword [rsp + 0xd388], rdi
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rbp + 0xd230], rax
mov r13, rcx
mov qword [rbp - 0x80], rcx
xor r14d, r14d
mov dword [rsp + 0x78], r14d
lea rbx, [0x140346ce0]
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], r14
mov qword [rbp + 0x290], rbx
mov qword [rbp + 0x298], r14
lea rax, vtable.Core::Array_class_Core::String_.0
mov qword [rbp + 0x7b8], rax
mov dword [rbp + 0x7c0], r14d
mov qword [rbp + 0x7c8], r14
lea rcx, str.SeTakeOwnershipPrivilege
call fcn.1400fe3d0
lea rax, vtable.Core::Collection_class_Core::String_.0
mov qword [rbp + 0xa08], rax
mov edi, r14d
mov dword [rbp + 0xa10], r14d
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xa18], xmm0
mov eax, dword [0x140429a18]
lea r12, vtable.Core::Win32::RegistryKey.0
test al, 1
jne 0x1401d5742
or eax, 1
mov dword [0x140429a18], eax
mov qword [0x1404299f0], r12
mov qword [0x1404299f8], 0xffffffff80000002
lea rcx, [0x1402fedc0]
call fcn.1402b8a74
mov qword [rbp + 0x7d0], r14
lea rax, [rbp + 0x7d0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x140355a28]
mov rcx, qword [0x1404299f8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d597d
lea ecx, [rax + 0x10]
call fcn.1402b6dbc
mov rsi, rax
test rax, rax
je 0x1401d597d
mov rcx, qword [rbp + 0x7d0]
mov qword [rax], r12
mov qword [rax + 8], rcx
lea rax, vtable.Core::Array_class_Core::String_.0
mov qword [rbp + 0x9d8], rax
mov dword [rbp + 0x9e0], r14d
mov qword [rbp + 0x9e8], r14
lea rdx, [rbp + 0x9d8]
mov rcx, rsi
call fcn.1400ea910
mov r14, qword [rbp + 0x9e8]
test al, al
je 0x1401d5815
mov eax, dword [rbp + 0x9e0]
test eax, eax
jle 0x1401d5815
mov rbx, r14
mov edi, eax
xor r8d, r8d
lea rdx, str.ControlSet0
mov rcx, rbx
call fcn.1401ff2c0
test al, al
je 0x1401d5806
mov rdx, rbx
lea rcx, [rbp + 0xa08]
call fcn.140117a40
add rbx, 0x10
dec rdi
jne 0x1401d57e1
mov edi, dword [rbp + 0xa10]
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
nop
test r14, r14
je 0x1401d5849
lea r9, [fcn.140005eb0]
mov r8d, dword [r14 - 8]
mov edx, 0x10
mov rcx, r14
call fcn.1402b7cf4
lea rcx, [r14 - 8]
call fcn.1402b712c
test edi, edi
je 0x1401d5973
mov edx, edi
lea rcx, [rbp + 0x7b8]
call fcn.1400c7e30
xor eax, eax
mov r14d, eax
mov r12d, dword [rbp + 0x7c0]
cmp r12d, edi
mov rdi, qword [rbp + 0xa18]
jl 0x1401d5a4c
mov rbx, rdi
test rdi, rdi
je 0x1401d5a4c
lea rax, [rbp + 0x280]
mov qword [rbp + 0xc0], rax
mov rsi, qword [rbp + 0x7c8]
xor r15d, r15d
lea r13, [0x140346ce0]
nop word [rax + rax]
mov qword [rbp + 0x288], r15
mov edx, dword [rbx + 0x1c]
test edx, edx
jne 0x1401d58c7
mov qword [rbp + 0x280], r13
jmp 0x1401d58f2
lea rcx, [rbp + 0x280]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0x1c]
mov eax, dword [rbp + 0x288]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x10]
mov rcx, qword [rbp + 0x280]
call fcn.1402ba94c
mov edx, dword [rbx + 0x1c]
lea rcx, [rbp + 0x280]
call fcn.1401fde50
nop
cmp r14d, r12d
jge 0x1401d5942
mov edx, dword [rbp + 0x28c]
mov rcx, rsi
call fcn.1401fcb40
movsxd r9, dword [rbp + 0x28c]
mov eax, dword [rsi + 8]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x280]
mov rcx, qword [rsi]
call fcn.1402ba94c
mov edx, dword [rbp + 0x28c]
mov rcx, rsi
call fcn.1401fde50
nop
cmp dword [rbp + 0x288], 0
jle 0x1401d5957
mov rcx, qword [rbp + 0x280]
call fcn.1402b7350
inc r14d
add rsi, 0x10
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1401d58b0
mov r13, qword [rbp - 0x80]
jmp 0x1401d5a4c
xor r14d, r14d
lea rbx, [0x140346ce0]
mov qword [rbp + 0x3c0], 0
mov edx, 0x11
lea rcx, [rbp + 0x3b8]
call fcn.1401fcb40
mov eax, dword [rbp + 0x3c0]
inc eax
movsxd rdx, eax
mov r9d, 0x11
lea r8, str.CurrentControlSet
mov rcx, qword [rbp + 0x3b8]
call fcn.1402ba94c
mov edx, 0x11
lea rcx, [rbp + 0x3b8]
call fcn.1401fde50
nop
mov ecx, 0x20
call fcn.1402b6dbc
mov rdi, rax
test rax, rax
je 0x1401d59ef
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0
jmp 0x1401d59f2
mov rdi, r14
mov edx, dword [rbp + 0x3c4]
lea rcx, [rdi + 0x10]
call fcn.1401fcb40
movsxd r9, dword [rbp + 0x3c4]
mov eax, dword [rdi + 0x18]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x3b8]
mov rcx, qword [rdi + 0x10]
call fcn.1402ba94c
mov edx, dword [rbp + 0x3c4]
lea rcx, [rdi + 0x10]
call fcn.1401fde50
mov qword [rdi], r14
mov qword [rdi + 8], r14
cmp dword [rbp + 0x3c0], 0
jle 0x1401d5a4c
mov rcx, qword [rbp + 0x3b8]
call fcn.1402b7350
nop
test rdi, rdi
je 0x1401d5a73
mov rbx, qword [rdi]
cmp dword [rdi + 0x18], 0
jle 0x1401d5a63
mov rcx, qword [rdi + 0x10]
call fcn.1402b7350
mov rcx, rdi
call fcn.1402150f0
mov rdi, rbx
test rbx, rbx
jne 0x1401d5a51
mov rcx, r13
call fcn.1401d2f20
mov rcx, r13
call fcn.1401d2620
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersion
mov qword [rbp + 0xc0], rax
lea rax, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersion
mov qword [rbp + 0xc8], rax
xor ebx, ebx
mov r14d, ebx
mov dword [rsp + 0x70], ebx
lea r12, [rbp + 0xc0]
nop
mov rsi, qword [r12]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d5b50
lea edx, [rax + 5]
lea rcx, [rbp + 0x290]
call fcn.1401fcb40
mov eax, dword [rbp + 0x298]
inc eax
movsxd rdx, eax
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x290]
call fcn.1402ba94c
mov edx, 5
lea rcx, [rbp + 0x290]
call fcn.1401fde50
mov rdx, rsi
lea rcx, [rbp + 0x290]
call fcn.1401fb190
xor r9d, r9d
lea r8, [rbp + 0x290]
mov rdx, qword [rsp + 0x68]
mov rcx, r13
call fcn.1401d39f0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp + 0x2ec], ebx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
lea rax, [rbp + 0x2ec]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, ebx
cmp dword [rbp + 0x2ec], 0
jbe 0x1401d5d53
xor r15d, r15d
lea r14, [0x140346ce0]
nop dword [rax]
nop word [rax + rax]
mov r9d, 0x400
lea r8, [rbp + 0x2630]
mov edx, edi
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc edi
test eax, eax
jne 0x1401d5d39
lea rax, [rbp + 0x2630]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d5bf1
mov qword [rbp + 0x4e0], r15
test ebx, ebx
jne 0x1401d5c0f
mov qword [rbp + 0x4d8], r14
jmp 0x1401d5c3e
mov edx, ebx
lea rcx, [rbp + 0x4d8]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp + 0x4e0]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x2630]
mov rcx, qword [rbp + 0x4d8]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x4d8]
call fcn.1401fde50
nop
lea r8, [0x140345f98]
mov edx, 0x400
lea rcx, [rbp + 0x2630]
call fcn.1402b9308
mov r8, rsi
mov edx, 0x400
lea rcx, [rbp + 0x2630]
call fcn.1402b9308
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x2630]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d5d22
lea edx, [rax + 4]
lea rcx, [rbp + 0x290]
call fcn.1401fcb40
mov eax, dword [rbp + 0x298]
inc eax
movsxd rdx, eax
mov r9d, 4
lea r8, str.HKU_
mov rcx, qword [rbp + 0x290]
call fcn.1402ba94c
mov edx, 4
lea rcx, [rbp + 0x290]
call fcn.1401fde50
lea rdx, [rbp + 0x2630]
lea rcx, [rbp + 0x290]
call fcn.1401fb190
mov r9, qword [rbp + 0x4d8]
lea r8, [rbp + 0x290]
mov rdx, qword [rsp + 0x68]
mov rcx, r13
call fcn.1401d39f0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0x4e0], 0
jle 0x1401d5d40
mov rcx, qword [rbp + 0x4d8]
call fcn.1402b7350
jmp 0x1401d5d40
cmp eax, 0x103
je 0x1401d5d4c
cmp edi, dword [rbp + 0x2ec]
jb 0x1401d5bc0
mov r14d, dword [rsp + 0x70]
xor ebx, ebx
inc r14d
mov dword [rsp + 0x70], r14d
add r12, 8
movsxd rax, r14d
cmp rax, 2
jb 0x1401d5ab0
lea rax, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
mov qword [rbp + 0xc0], rax
lea rax, str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWindows
mov qword [rbp + 0xc8], rax
mov eax, ebx
mov dword [rbp - 0x60], ebx
lea r15, [rbp + 0xc0]
mov qword [rbp], r15
mov rcx, qword [rbp - 0x80]
nop dword [rax]
mov r14, qword [r15]
mov r13d, ebx
mov rdi, rbx
mov qword [rbp - 0x48], rbx
cmp dword [rcx + 0x18], 0
jl 0x1401d61a7
mov r15, qword [rbp - 0x80]
lea r12, [0x140346ce0]
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], 0
mov rsi, rbx
test r13d, r13d
setne sil
add rsi, 0xffffffff80000002
test rdi, rdi
jne 0x1401d5e51
test r14, r14
je 0x1401d5ee7
or rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [r14 + rbx*2], 0
jne 0x1401d5e00
test ebx, ebx
jle 0x1401d5ee7
mov edx, ebx
lea rcx, [rbp + 0xb0]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp + 0xb8]
inc eax
movsxd rdx, eax
mov r8, r14
mov rcx, qword [rbp + 0xb0]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0xb0]
call fcn.1401fde50
jmp 0x1401d5ee7
mov rbx, rdi
shl rbx, 4
add rbx, qword [r15 + 0x20]
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0xb0]
call fcn.1401fcb40
movsxd r9, dword [rbx - 4]
mov eax, dword [rbp + 0xb8]
inc eax
movsxd rdx, eax
mov r8, qword [rbx - 0x10]
mov rcx, qword [rbp + 0xb0]
call fcn.1402ba94c
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0xb0]
call fcn.1401fde50
mov edx, dword [rbp + 0xbc]
inc edx
lea rcx, [rbp + 0xb0]
call fcn.1401fcb40
movsxd rcx, dword [rbp + 0xbc]
mov rax, qword [rbp + 0xb0]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0xbc]
inc edx
lea rcx, [rbp + 0xb0]
call fcn.1401fde50
mov rdx, r14
lea rcx, [rbp + 0xb0]
call fcn.1401fb190
lea rax, [rbp + 0x770]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0xb0]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d616e
mov dword [rbp + 0x3c8], 0x800
lea rax, [rbp + 0x3c8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x7230]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14034bfe8]
mov rcx, qword [rbp + 0x770]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401d6160
cmp dword [rbp + 0x3c8], eax
jbe 0x1401d6160
lea rax, [rbp + 0x7230]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d5f70
xor eax, eax
mov qword [rbp + 0x4a8], rax
test ebx, ebx
jne 0x1401d5f90
mov qword [rbp + 0x4a0], r12
jmp 0x1401d5fbf
mov edx, ebx
lea rcx, [rbp + 0x4a0]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp + 0x4a8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x7230]
mov rcx, qword [rbp + 0x4a0]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x4a0]
call fcn.1401fde50
nop
lea rdx, [rbp + 0x4a0]
call fcn.1401d4ec0
mov r8b, 1
lea rdx, [rbp + 0x4a0]
mov rcx, qword [r15 + 8]
call fcn.1400f8340
mov r12, rax
test rax, rax
je 0x1401d6144
lea rdi, [0x140345fb0]
cmp rsi, 0xffffffff80000002
lea rax, [0x140345fb8]
cmove rdi, rax
test rdi, rdi
jne 0x1401d6021
xor eax, eax
mov ebx, eax
mov qword [rbp - 8], rax
jmp 0x1401d6039
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1401d6025
xor eax, eax
mov qword [rbp - 8], rax
test ebx, ebx
jne 0x1401d6046
lea rax, [0x140346ce0]
mov qword [rbp - 0x10], rax
jmp 0x1401d6068
mov edx, ebx
lea rcx, [rbp - 0x10]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp - 8]
inc eax
movsxd rdx, eax
mov r8, rdi
mov rcx, qword [rbp - 0x10]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp - 0x10]
call fcn.1401fde50
nop
mov edx, dword [rbp - 4]
inc edx
lea rcx, [rbp - 0x10]
call fcn.1401fcb40
movsxd rcx, dword [rbp - 4]
mov rax, qword [rbp - 0x10]
mov edi, 0x5c
mov word [rax + rcx*2], di
mov edx, dword [rbp - 4]
inc edx
lea rcx, [rbp - 0x10]
call fcn.1401fde50
mov ebx, dword [rbp - 4]
add ebx, dword [rbp + 0xbc]
mov edx, ebx
lea rcx, [rbp - 0x10]
call fcn.1401fcb40
movsxd r9, dword [rbp + 0xbc]
mov ecx, dword [rbp - 8]
movsxd rax, dword [rbp - 4]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp - 0x10]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0xb0]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp - 0x10]
call fcn.1401fde50
mov edx, dword [rbp - 4]
inc edx
lea rcx, [rbp - 0x10]
call fcn.1401fcb40
movsxd rcx, dword [rbp - 4]
mov rax, qword [rbp - 0x10]
mov word [rax + rcx*2], di
mov edx, dword [rbp - 4]
inc edx
lea rcx, [rbp - 0x10]
call fcn.1401fde50
lea rdx, [0x14034bfe8]
lea rcx, [rbp - 0x10]
call fcn.1401fb190
lea rdx, [rbp - 0x10]
mov rcx, r12
call fcn.1400eb2a0
nop
cmp dword [rbp - 8], 0
jle 0x1401d6140
mov rcx, qword [rbp - 0x10]
call fcn.1402b7350
mov rdi, qword [rbp - 0x48]
cmp dword [rbp + 0x4a8], 0
jle 0x1401d6159
mov rcx, qword [rbp + 0x4a0]
call fcn.1402b7350
lea r12, [0x140346ce0]
mov rcx, qword [rbp + 0x770]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0xb8], 0
jle 0x1401d6183
mov rcx, qword [rbp + 0xb0]
call fcn.1402b7350
inc r13d
inc rdi
mov qword [rbp - 0x48], rdi
cmp r13d, dword [r15 + 0x18]
mov ebx, 0
jle 0x1401d5dc2
mov r15, qword [rbp]
mov eax, dword [rbp - 0x60]
mov rcx, qword [rbp - 0x80]
inc eax
mov dword [rbp - 0x60], eax
add r15, 8
mov qword [rbp], r15
cdqe
cmp rax, 2
mov eax, dword [rbp - 0x60]
jb 0x1401d5da0
lea r13, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov qword [rbp + 0xc0], r13
lea rax, str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWinlogon
mov qword [rbp + 0xc8], rax
mov r14d, ebx
mov dword [rsp + 0x70], ebx
lea r12, [rbp + 0xc0]
mov r15d, dword [rsp + 0x78]
lea r13, [0x140346ce0]
nop dword [rax]
lea r9, str.Notify
lea r8, [0x140345f98]
mov rdx, qword [r12]
lea rcx, [rbp + 0x720]
call fcn.1401fc600
nop
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x720]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d6532
mov dword [rbp + 0x2ac], ebx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
lea rax, [rbp + 0x2ac]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, ebx
cmp dword [rbp + 0x2ac], 0
jbe 0x1401d6526
mov r15, qword [rbp - 0x80]
xor r14d, r14d
nop dword [rax]
mov r9d, 0x400
lea r8, [rbp + 0x4a30]
mov edx, edi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc edi
test eax, eax
jne 0x1401d6507
lea rax, [rbp + 0x7a0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x4a30]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d650e
mov dword [rbp + 0x658], 0x800
lea rax, [rbp + 0x658]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xa230]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DLLName
mov rcx, qword [rbp + 0x7a0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401d64f8
lea rax, [rbp + 0xa230]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d6352
mov qword [rbp + 0x498], r14
test ebx, ebx
jne 0x1401d6370
mov qword [rbp + 0x490], r13
jmp 0x1401d639f
mov edx, ebx
lea rcx, [rbp + 0x490]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp + 0x498]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0xa230]
mov rcx, qword [rbp + 0x490]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x490]
call fcn.1401fde50
nop
lea rdx, [rbp + 0x490]
call fcn.1401d4ec0
mov r8b, 1
lea rdx, [rbp + 0x490]
mov rcx, qword [r15 + 8]
call fcn.1400f8340
mov rsi, rax
test rax, rax
je 0x1401d64e3
mov qword [rbp + 0x1c8], r14
mov edx, 5
lea rcx, [rbp + 0x1c0]
call fcn.1401fcb40
mov ecx, dword [rbp + 0x1c8]
inc ecx
movsxd rdx, ecx
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x1c0]
call fcn.1402ba94c
mov edx, 5
lea rcx, [rbp + 0x1c0]
call fcn.1401fde50
nop
mov ebx, dword [rbp + 0x72c]
add ebx, dword [rbp + 0x1cc]
mov edx, ebx
lea rcx, [rbp + 0x1c0]
call fcn.1401fcb40
movsxd r9, dword [rbp + 0x72c]
mov ecx, dword [rbp + 0x1c8]
movsxd rax, dword [rbp + 0x1cc]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x1c0]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x720]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x1c0]
call fcn.1401fde50
lea rdx, [0x140345f98]
lea rcx, [rbp + 0x1c0]
call fcn.1401fb190
lea rdx, [rbp + 0x4a30]
lea rcx, [rbp + 0x1c0]
call fcn.1401fb190
lea rdx, [0x140345f98]
lea rcx, [rbp + 0x1c0]
call fcn.1401fb190
lea rdx, [rbp + 0x1c0]
mov rcx, rsi
call fcn.1400eb2a0
nop
cmp dword [rbp + 0x1c8], 0
jle 0x1401d64e3
mov rcx, qword [rbp + 0x1c0]
call fcn.1402b7350
nop
cmp dword [rbp + 0x498], 0
jle 0x1401d64f8
mov rcx, qword [rbp + 0x490]
call fcn.1402b7350
mov rcx, qword [rbp + 0x7a0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1401d650e
cmp eax, 0x103
je 0x1401d651a
cmp edi, dword [rbp + 0x2ac]
jb 0x1401d62b0
mov r15d, dword [rsp + 0x78]
mov r14d, dword [rsp + 0x70]
xor ebx, ebx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0x728], 0
jle 0x1401d6547
mov rcx, qword [rbp + 0x720]
call fcn.1402b7350
inc r14d
mov dword [rsp + 0x70], r14d
add r12, 8
movsxd rax, r14d
cmp rax, 2
jb 0x1401d6200
mov qword [rbp + 0x380], rbx
mov qword [rbp + 0x388], rbx
call fcn.14012acd0
mov qword [rbp + 0x380], rax
lea r13, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov qword [rbp + 0xd0], r13
lea rax, str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWinlogon
mov qword [rbp + 0xd8], rax
mov ecx, ebx
mov dword [rsp + 0x60], ebx
mov rax, rbx
mov qword [rbp], rbx
mov r14, qword [rbp - 0x80]
nop word [rax + rax]
mov r12, qword [rbp + rax*8 + 0xd0]
mov qword [rbp + 0xc0], r12
mov esi, ebx
mov dword [rsp + 0x70], ebx
mov r13, rbx
mov qword [rbp - 0x68], rbx
cmp dword [r14 + 0x18], 0
jl 0x1401d7060
nop word [rax + rax]
lea rax, [0x140346ce0]
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0xf0], 0
test r13, r13
jne 0x1401d6671
mov rdi, 0xffffffff80000002
mov qword [rbp + 0xe0], rdi
test r12, r12
je 0x1401d6717
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [r12 + rbx*2], 0
jne 0x1401d6620
test ebx, ebx
jle 0x1401d6715
mov edx, ebx
lea rcx, [rbp + 0xe8]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp + 0xf0]
inc eax
movsxd rdx, eax
mov r8, r12
mov rcx, qword [rbp + 0xe8]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0xe8]
call fcn.1401fde50
jmp 0x1401d6715
mov rdi, 0xffffffff80000003
mov qword [rbp + 0xe0], rdi
mov rbx, r13
shl rbx, 4
add rbx, qword [r14 + 0x20]
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0xe8]
call fcn.1401fcb40
movsxd r9, dword [rbx - 4]
mov eax, dword [rbp + 0xf0]
inc eax
movsxd rdx, eax
mov r8, qword [rbx - 0x10]
mov rcx, qword [rbp + 0xe8]
call fcn.1402ba94c
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0xe8]
call fcn.1401fde50
mov edx, dword [rbp + 0xf4]
inc edx
lea rcx, [rbp + 0xe8]
call fcn.1401fcb40
movsxd rcx, dword [rbp + 0xf4]
mov rax, qword [rbp + 0xe8]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0xf4]
inc edx
lea rcx, [rbp + 0xe8]
call fcn.1401fde50
mov rdx, r12
lea rcx, [rbp + 0xe8]
call fcn.1401fb190
xor ebx, ebx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0xe8]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d702c
mov r14d, ebx
mov dword [rbp - 0x60], ebx
mov r12, rbx
mov qword [rbp - 0x48], rbx
nop
mov dword [rbp + 0x70c], 0x800
lea rax, [rbp + 0x70c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xb230]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rax, str.Shell
mov rdx, qword [rax + r12*8]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401d6ff3
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x9d8], xmm0
mov qword [rbp + 0x9e8], rbx
lea rax, [rbp + 0xb230]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d67b3
xor eax, eax
mov qword [rbp + 0x560], rax
test ebx, ebx
jne 0x1401d67da
lea rax, [0x140346ce0]
mov qword [rbp + 0x558], rax
jmp 0x1401d6809
mov edx, ebx
lea rcx, [rbp + 0x558]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp + 0x560]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0xb230]
mov rcx, qword [rbp + 0x558]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x558]
call fcn.1401fde50
nop
lea rdx, [rbp + 0x9d8]
lea rcx, [rbp + 0x558]
call fcn.1401d0740
mov ebx, eax
cmp dword [rbp + 0x560], 0
jle 0x1401d6842
mov rcx, qword [rbp + 0x558]
call fcn.1402b7350
mov rdi, qword [rbp + 0x9e0]
test ebx, ebx
je 0x1401d6faa
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xa08], xmm0
xor ecx, ecx
mov r14d, ecx
mov qword [rbp + 0xa18], rcx
mov r12, rdi
mov rsi, qword [rbp + 0x9d8]
sub r12, rsi
sar r12, 4
mov rdi, qword [rbp + 0xa10]
mov r13, qword [rbp + 0xa08]
test r12, r12
je 0x1401d6a9c
add rsi, 0xc
xor r15d, r15d
nop word [rax + rax]
mov qword [rbp + 0x1b8], r15
mov edx, dword [rsi]
test edx, edx
jne 0x1401d68bd
lea rbx, [0x140346ce0]
mov qword [rbp + 0x1b0], rbx
jmp 0x1401d68ee
lea rcx, [rbp + 0x1b0]
call fcn.1401fcb40
movsxd r9, dword [rsi]
mov eax, dword [rbp + 0x1b8]
inc eax
movsxd rdx, eax
mov r8, qword [rsi - 0xc]
mov rcx, qword [rbp + 0x1b0]
call fcn.1402ba94c
lea rbx, [0x140346ce0]
mov edx, dword [rsi]
lea rcx, [rbp + 0x1b0]
call fcn.1401fde50
nop
cmp dword [rbp + 0x1bc], 1
jl 0x1401d692c
mov r8d, 1
lea rdx, [0x14034cfc4]
mov rcx, qword [rbp + 0x1b0]
call fcn.1402bc40c
test eax, eax
sete al
test al, al
jne 0x1401d6a75
lea rdx, [rbp + 0x1b0]
call fcn.1401d4ec0
lea rax, [rbp + 0x1b0]
cmp rax, rdi
jae 0x1401d69e9
lea rax, [rbp + 0x1b0]
cmp r13, rax
ja 0x1401d69e9
lea rbx, [rbp + 0x1b0]
sub rbx, r13
cmp rdi, r14
jne 0x1401d6988
lea rcx, [rbp + 0xa08]
call fcn.1400c8e70
mov r14, qword [rbp + 0xa18]
mov rdi, qword [rbp + 0xa10]
mov r13, qword [rbp + 0xa08]
and rbx, 0xfffffffffffffff0
add rbx, r13
mov qword [rbp + 0x7d8], rdi
mov qword [rbp + 0x88], rdi
test rdi, rdi
je 0x1401d69e4
mov qword [rdi + 8], r15
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x1401d69b9
lea rax, [0x140346ce0]
mov qword [rdi], rax
jmp 0x1401d69d8
mov rcx, rdi
call fcn.1401fcb40
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rdi + 8]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rdi]
call fcn.1402ba94c
mov edx, dword [rbx + 0xc]
mov rcx, rdi
call fcn.1401fde50
nop
jmp 0x1401d6a6a
cmp rdi, r14
jne 0x1401d6a0f
lea rcx, [rbp + 0xa08]
call fcn.1400c8e70
mov r14, qword [rbp + 0xa18]
mov rdi, qword [rbp + 0xa10]
mov r13, qword [rbp + 0xa08]
mov qword [rbp + 0x7d8], rdi
mov qword [rbp + 0x88], rdi
test rdi, rdi
je 0x1401d6a6a
mov qword [rdi + 8], r15
mov edx, dword [rbp + 0x1bc]
test edx, edx
jne 0x1401d6a35
mov qword [rdi], rbx
jmp 0x1401d6a5b
mov rcx, rdi
call fcn.1401fcb40
movsxd r9, dword [rbp + 0x1bc]
mov eax, dword [rdi + 8]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x1b0]
mov rcx, qword [rdi]
call fcn.1402ba94c
mov edx, dword [rbp + 0x1bc]
mov rcx, rdi
call fcn.1401fde50
nop
add rdi, 0x10
mov qword [rbp + 0xa10], rdi
cmp dword [rbp + 0x1b8], 0
jle 0x1401d6a8a
mov rcx, qword [rbp + 0x1b0]
call fcn.1402b7350
add rsi, 0x10
dec r12
jne 0x1401d68a0
mov r15d, dword [rsp + 0x78]
mov rax, rdi
sub rax, r13
sar rax, 4
test rax, rax
je 0x1401d6f4a
lea r12, [r13 + 0xc]
mov rbx, rax
mov qword [rbp + 0x88], rax
mov r13, rax
mov rdi, qword [rbp + 0xe0]
nop word [rax + rax]
mov qword [rbp + 0x378], 0
mov edx, dword [r12]
test edx, edx
jne 0x1401d6af3
lea rax, [0x140346ce0]
mov qword [rbp + 0x370], rax
jmp 0x1401d6b1f
lea rcx, [rbp + 0x370]
call fcn.1401fcb40
movsxd r9, dword [r12]
mov eax, dword [rbp + 0x378]
inc eax
movsxd rdx, eax
mov r8, qword [r12 - 0xc]
mov rcx, qword [rbp + 0x370]
call fcn.1402ba94c
mov edx, dword [r12]
lea rcx, [rbp + 0x370]
call fcn.1401fde50
nop
mov r8b, 1
lea rdx, [rbp + 0x370]
mov rax, qword [rbp - 0x80]
mov rcx, qword [rax + 8]
call fcn.1400f8340
mov r14, rax
test rax, rax
je 0x1401d6f13
lea rsi, [0x140345fb0]
cmp rdi, 0xffffffff80000002
lea rax, [0x140345fb8]
cmove rsi, rax
test rsi, rsi
jne 0x1401d6b7b
xor eax, eax
mov ebx, eax
mov qword [rbp - 0x38], rax
jmp 0x1401d6b94
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1401d6b80
xor eax, eax
mov qword [rbp - 0x38], rax
test ebx, ebx
jne 0x1401d6ba1
lea rax, [0x140346ce0]
mov qword [rbp - 0x40], rax
jmp 0x1401d6bc3
mov edx, ebx
lea rcx, [rbp - 0x40]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp - 0x38]
inc eax
movsxd rdx, eax
mov r8, rsi
mov rcx, qword [rbp - 0x40]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp - 0x40]
call fcn.1401fde50
nop
mov edx, dword [rbp - 0x34]
inc edx
lea rcx, [rbp - 0x40]
call fcn.1401fcb40
movsxd rcx, dword [rbp - 0x34]
mov rax, qword [rbp - 0x40]
mov esi, 0x5c
mov word [rax + rcx*2], si
mov edx, dword [rbp - 0x34]
inc edx
lea rcx, [rbp - 0x40]
call fcn.1401fde50
mov ebx, dword [rbp - 0x34]
add ebx, dword [rbp + 0xf4]
mov edx, ebx
lea rcx, [rbp - 0x40]
call fcn.1401fcb40
movsxd r9, dword [rbp + 0xf4]
mov ecx, dword [rbp - 0x38]
movsxd rax, dword [rbp - 0x34]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp - 0x40]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0xe8]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp - 0x40]
call fcn.1401fde50
mov edx, dword [rbp - 0x34]
inc edx
lea rcx, [rbp - 0x40]
call fcn.1401fcb40
movsxd rcx, dword [rbp - 0x34]
mov rax, qword [rbp - 0x40]
mov word [rax + rcx*2], si
mov edx, dword [rbp - 0x34]
inc edx
lea rcx, [rbp - 0x40]
call fcn.1401fde50
mov rsi, qword [rbp - 0x48]
lea rax, str.Shell
mov rdx, qword [rax + rsi*8]
lea rcx, [rbp - 0x40]
call fcn.1401fb190
lea rdx, [rbp + 0x370]
lea rcx, [rbp + 0x968]
call fcn.1400d44c0
nop
xor r8d, r8d
lea rdx, str.cmd.exe
mov rcx, rax
call fcn.1401fce20
movzx ebx, al
cmp dword [rbp + 0x970], 0
jle 0x1401d6cc5
mov rcx, qword [rbp + 0x968]
call fcn.1402b7350
test bl, bl
je 0x1401d6e8b
cmp rdi, 0xffffffff80000002
jne 0x1401d6d30
xor eax, eax
mov qword [rbp + 0x590], rax
lea edx, [rax + 4]
lea rcx, [rbp + 0x588]
call fcn.1401fcb40
mov eax, dword [rbp + 0x590]
inc eax
movsxd rdx, eax
mov r9d, 4
lea r8, [0x140345fb8]
mov rcx, qword [rbp + 0x588]
call fcn.1402ba94c
mov edx, 4
lea rcx, [rbp + 0x588]
call fcn.1401fde50
lea rbx, [rbp + 0x588]
or r15d, 1
jmp 0x1401d6d5f
mov eax, dword [rsp + 0x70]
dec eax
movsxd r8, eax
shl r8, 4
mov rax, qword [rbp - 0x80]
add r8, qword [rax + 0x20]
lea rdx, str.HKU_
lea rcx, [rbp + 0x868]
call fcn.1401fb6b0
mov rbx, rax
or r15d, 2
mov dword [rsp + 0x78], r15d
xor eax, eax
mov qword [rbp + 0x500], rax
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x1401d6d84
lea rax, [0x140346ce0]
mov qword [rbp + 0x4f8], rax
jmp 0x1401d6dae
lea rcx, [rbp + 0x4f8]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rbp + 0x500]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x4f8]
call fcn.1402ba94c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x4f8]
call fcn.1401fde50
nop
test r15b, 2
je 0x1401d6de3
and r15d, 0xfffffffd
mov dword [rsp + 0x78], r15d
cmp dword [rbp + 0x870], 0
jle 0x1401d6de3
mov rcx, qword [rbp + 0x868]
call fcn.1402b7350
nop
test r15b, 1
je 0x1401d6e07
and r15d, 0xfffffffe
mov dword [rsp + 0x78], r15d
cmp dword [rbp + 0x590], 0
jle 0x1401d6e07
mov rcx, qword [rbp + 0x588]
call fcn.1402b7350
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0x4f8]
lea rcx, [rbp + 0x9a8]
call fcn.1401cd710
nop
mov rdx, rax
lea rcx, [rbp + 0x380]
call fcn.1401592e0
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0xac0]
lea rcx, [rbp + 0x380]
call fcn.1401cd870
nop
cmp dword [rbp + 0x9c0], 0
jle 0x1401d6e60
mov rcx, qword [rbp + 0x9b8]
call fcn.1402b7350
cmp dword [rbp + 0x9b0], 0
jle 0x1401d6e76
mov rcx, qword [rbp + 0x9a8]
call fcn.1402b7350
nop
cmp dword [rbp + 0x500], 0
jle 0x1401d6e8b
mov rcx, qword [rbp + 0x4f8]
call fcn.1402b7350
lea rdx, [rbp - 0x40]
mov rcx, r14
call fcn.1400eb2a0
cmp r13, 2
jb 0x1401d6efd
lea rdx, str.shell
lea rbx, str.Shell
mov rcx, qword [rbx + rsi*8]
call fcn.1402b71dc
test eax, eax
jne 0x1401d6ec1
lea rdx, [0x14034b998]
jmp 0x1401d6edc
lea rdx, str.userinit
mov rcx, qword [rbx + rsi*8]
call fcn.1402b71dc
test eax, eax
jne 0x1401d6efd
lea rdx, str.userinit.exe
xor r8d, r8d
lea rcx, [rbp + 0x370]
call fcn.1401fc9f0
test al, al
jne 0x1401d6efd
movabs rax, 0x1000000000000
or qword [r14 + 0x40], rax
cmp dword [rbp - 0x38], 0
jle 0x1401d6f0c
mov rcx, qword [rbp - 0x40]
call fcn.1402b7350
mov rbx, qword [rbp + 0x88]
cmp dword [rbp + 0x378], 0
jle 0x1401d6f28
mov rcx, qword [rbp + 0x370]
call fcn.1402b7350
add r12, 0x10
dec rbx
mov qword [rbp + 0x88], rbx
jne 0x1401d6ad0
mov rdi, qword [rbp + 0xa10]
mov r13, qword [rbp + 0xa08]
test r13, r13
je 0x1401d6f9b
mov rbx, r13
cmp r13, rdi
je 0x1401d6f6e
cmp dword [rbx + 8], 0
jle 0x1401d6f65
mov rcx, qword [rbx]
call fcn.1402b7350
add rbx, 0x10
cmp rbx, rdi
jne 0x1401d6f57
mov rcx, r13
call fcn.1402150f0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xa08], xmm0
xor ebx, ebx
mov qword [rbp + 0xa18], rbx
mov rdi, qword [rbp + 0x9e0]
mov r14d, dword [rbp - 0x60]
mov r12, qword [rbp - 0x48]
jmp 0x1401d6fac
mov rdi, qword [rbp + 0x9e0]
mov r14d, dword [rbp - 0x60]
mov r12, qword [rbp - 0x48]
xor ebx, ebx
mov rsi, qword [rbp + 0x9d8]
test rsi, rsi
je 0x1401d6ff3
mov rbx, rsi
cmp rsi, rdi
je 0x1401d6fd7
cmp dword [rbx + 8], 0
jle 0x1401d6fce
mov rcx, qword [rbx]
call fcn.1402b7350
add rbx, 0x10
cmp rbx, rdi
jne 0x1401d6fc0
mov rcx, rsi
call fcn.1402150f0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x9d8], xmm0
xor ebx, ebx
mov qword [rbp + 0x9e8], rbx
inc r14d
mov dword [rbp - 0x60], r14d
inc r12
mov qword [rbp - 0x48], r12
movsxd rax, r14d
cmp rax, 4
jb 0x1401d6750
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [rsp + 0x70]
mov r14, qword [rbp - 0x80]
mov r12, qword [rbp + 0xc0]
mov r13, qword [rbp - 0x68]
cmp dword [rbp + 0xf0], 0
jle 0x1401d7041
mov rcx, qword [rbp + 0xe8]
call fcn.1402b7350
inc esi
mov dword [rsp + 0x70], esi
inc r13
mov qword [rbp - 0x68], r13
cmp esi, dword [r14 + 0x18]
jle 0x1401d65e0
mov rax, qword [rbp]
mov ecx, dword [rsp + 0x60]
inc ecx
mov dword [rsp + 0x60], ecx
inc rax
mov qword [rbp], rax
movsxd rax, ecx
cmp rax, 2
mov rax, qword [rbp]
jb 0x1401d65b0
lea rax, str.SOFTWAREMicrosoftCommand_Processor
mov qword [rbp + 0xd0], rax
lea rax, str.SOFTWAREWow6432NodeMicrosoftCommand_Processor
mov qword [rbp + 0xd8], rax
mov ecx, ebx
mov dword [rsp + 0x60], ebx
lea rax, [rbp + 0xd0]
mov qword [rbp + 0x88], rax
mov rsi, qword [rbp - 0x80]
mov r12, qword [rax]
mov r13d, ebx
mov rdi, rbx
mov qword [rbp], rbx
cmp dword [rsi + 0x18], 0
jl 0x1401d76a1
nop dword [rax]
lea rax, [0x140346ce0]
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], 0
test rdi, rdi
jne 0x1401d7153
mov r14, 0xffffffff80000002
test r12, r12
je 0x1401d71f0
or rbx, 0xffffffffffffffff
inc rbx
cmp word [r12 + rbx*2], 0
jne 0x1401d7102
test ebx, ebx
jle 0x1401d71f0
mov edx, ebx
lea rcx, [rbp + 0x100]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp + 0x108]
inc eax
movsxd rdx, eax
mov r8, r12
mov rcx, qword [rbp + 0x100]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x100]
call fcn.1401fde50
jmp 0x1401d71f0
mov r14, 0xffffffff80000003
mov rbx, rdi
shl rbx, 4
add rbx, qword [rsi + 0x20]
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0x100]
call fcn.1401fcb40
movsxd r9, dword [rbx - 4]
mov eax, dword [rbp + 0x108]
inc eax
movsxd rdx, eax
mov r8, qword [rbx - 0x10]
mov rcx, qword [rbp + 0x100]
call fcn.1402ba94c
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0x100]
call fcn.1401fde50
mov edx, dword [rbp + 0x10c]
inc edx
lea rcx, [rbp + 0x100]
call fcn.1401fcb40
movsxd rcx, dword [rbp + 0x10c]
mov rax, qword [rbp + 0x100]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x10c]
inc edx
lea rcx, [rbp + 0x100]
call fcn.1401fde50
mov rdx, r12
lea rcx, [rbp + 0x100]
call fcn.1401fb190
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x100]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d766b
mov dword [rbp + 0x660], 0x800
lea rax, [rbp + 0x660]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x5230]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.AutoRun
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401d765f
lea rax, [rbp + 0x5230]
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d7270
xor eax, eax
mov qword [rbp + 0x478], rax
test ebx, ebx
jne 0x1401d7297
lea rax, [0x140346ce0]
mov qword [rbp + 0x470], rax
jmp 0x1401d72c6
mov edx, ebx
lea rcx, [rbp + 0x470]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp + 0x478]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x5230]
mov rcx, qword [rbp + 0x470]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x470]
call fcn.1401fde50
nop
lea rdx, [rbp + 0x470]
call fcn.1401d4ec0
mov r8b, 1
lea rdx, [rbp + 0x470]
mov rcx, qword [rsi + 8]
call fcn.1400f8340
mov rsi, rax
test rax, rax
je 0x1401d7646
lea rdi, [0x140345fb0]
cmp r14, 0xffffffff80000002
lea rax, [0x140345fb8]
cmove rdi, rax
test rdi, rdi
jne 0x1401d7328
xor eax, eax
mov ebx, eax
mov qword [rbp - 0x18], rax
jmp 0x1401d7344
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1401d7330
xor eax, eax
mov qword [rbp - 0x18], rax
test ebx, ebx
jne 0x1401d7351
lea rax, [0x140346ce0]
mov qword [rbp - 0x20], rax
jmp 0x1401d7373
mov edx, ebx
lea rcx, [rbp - 0x20]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp - 0x18]
inc eax
movsxd rdx, eax
mov r8, rdi
mov rcx, qword [rbp - 0x20]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp - 0x20]
call fcn.1401fde50
nop
mov edx, dword [rbp - 0x14]
inc edx
lea rcx, [rbp - 0x20]
call fcn.1401fcb40
movsxd rcx, dword [rbp - 0x14]
mov rax, qword [rbp - 0x20]
mov edi, 0x5c
mov word [rax + rcx*2], di
mov edx, dword [rbp - 0x14]
inc edx
lea rcx, [rbp - 0x20]
call fcn.1401fde50
mov ebx, dword [rbp - 0x14]
add ebx, dword [rbp + 0x10c]
mov edx, ebx
lea rcx, [rbp - 0x20]
call fcn.1401fcb40
movsxd r9, dword [rbp + 0x10c]
mov ecx, dword [rbp - 0x18]
movsxd rax, dword [rbp - 0x14]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp - 0x20]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x100]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp - 0x20]
call fcn.1401fde50
mov edx, dword [rbp - 0x14]
inc edx
lea rcx, [rbp - 0x20]
call fcn.1401fcb40
movsxd rcx, dword [rbp - 0x14]
mov rax, qword [rbp - 0x20]
mov word [rax + rcx*2], di
mov edx, dword [rbp - 0x14]
inc edx
lea rcx, [rbp - 0x20]
call fcn.1401fde50
lea rdx, str.AutoRun
lea rcx, [rbp - 0x20]
call fcn.1401fb190
lea rdx, [rbp - 0x20]
mov rcx, rsi
call fcn.1400eb2a0
cmp r14, 0xffffffff80000002
jne 0x1401d749a
xor edi, edi
mov qword [rbp + 0x5a0], rdi
lea edx, [rdi + 4]
lea rcx, [rbp + 0x598]
call fcn.1401fcb40
mov eax, dword [rbp + 0x5a0]
inc eax
movsxd rdx, eax
lea r9d, [rdi + 4]
lea r8, [0x140345fb8]
mov rcx, qword [rbp + 0x598]
call fcn.1402ba94c
lea edx, [rdi + 4]
lea rcx, [rbp + 0x598]
call fcn.1401fde50
lea rbx, [rbp + 0x598]
or r15d, 4
jmp 0x1401d74c7
lea eax, [r13 - 1]
movsxd r8, eax
shl r8, 4
mov rax, qword [rbp - 0x80]
add r8, qword [rax + 0x20]
lea rdx, str.HKU_
lea rcx, [rbp + 0x908]
call fcn.1401fb6b0
mov rbx, rax
or r15d, 8
mov dword [rsp + 0x78], r15d
mov qword [rbp + 0x438], 0
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x1401d74ee
lea rax, [0x140346ce0]
mov qword [rbp + 0x430], rax
jmp 0x1401d7518
lea rcx, [rbp + 0x430]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rbp + 0x438]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x430]
call fcn.1402ba94c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x430]
call fcn.1401fde50
nop
test r15b, 8
je 0x1401d754d
and r15d, 0xfffffff7
mov dword [rsp + 0x78], r15d
cmp dword [rbp + 0x910], 0
jle 0x1401d754d
mov rcx, qword [rbp + 0x908]
call fcn.1402b7350
nop
test r15b, 4
je 0x1401d7571
and r15d, 0xfffffffb
mov dword [rsp + 0x78], r15d
cmp dword [rbp + 0x5a0], 0
jle 0x1401d7571
mov rcx, qword [rbp + 0x598]
call fcn.1402b7350
mov rax, qword [rbp + 0x380]
mov rbx, qword [rax + 8]
mov rdi, rax
cmp byte [rbx + 0x19], 0
jne 0x1401d75ed
nop word [rax + rax]
mov rdx, qword [rbp + 0x430]
mov rcx, qword [rbx + 0x20]
call fcn.1402b71dc
test eax, eax
jns 0x1401d75aa
mov rbx, qword [rbx + 0x10]
jmp 0x1401d75b0
mov rdi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1401d7590
mov rax, qword [rbp + 0x380]
cmp rdi, rax
je 0x1401d75ed
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rbp + 0x430]
call fcn.1402b71dc
test eax, eax
mov rax, qword [rbp + 0x380]
js 0x1401d75ed
mov qword [rbp + 0x830], rdi
lea rdx, [rbp + 0x830]
jmp 0x1401d75fb
mov qword [rbp + 0x828], rax
lea rdx, [rbp + 0x828]
mov rdx, qword [rdx]
cmp rdx, rax
je 0x1401d761d
add rdx, 0x30
mov rcx, rsi
call fcn.1400eb2a0
movabs rax, 0x1000000000000
or qword [rsi + 0x40], rax
cmp dword [rbp + 0x438], 0
jle 0x1401d7633
mov rcx, qword [rbp + 0x430]
call fcn.1402b7350
nop
cmp dword [rbp - 0x18], 0
jle 0x1401d7642
mov rcx, qword [rbp - 0x20]
call fcn.1402b7350
mov rdi, qword [rbp]
cmp dword [rbp + 0x478], 0
jle 0x1401d765b
mov rcx, qword [rbp + 0x470]
call fcn.1402b7350
mov rsi, qword [rbp - 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0x108], 0
jle 0x1401d7680
mov rcx, qword [rbp + 0x100]
call fcn.1402b7350
inc r13d
inc rdi
mov qword [rbp], rdi
cmp r13d, dword [rsi + 0x18]
jle 0x1401d70d0
mov rax, qword [rbp + 0x88]
mov ecx, dword [rsp + 0x60]
xor ebx, ebx
inc ecx
mov dword [rsp + 0x60], ecx
add rax, 8
mov qword [rbp + 0x88], rax
movsxd rax, ecx
cmp rax, 2
mov rax, qword [rbp + 0x88]
jb 0x1401d70b2
mov edx, 0x3b
lea rcx, [rbp - 0x78]
call fcn.1401fcb40
mov eax, dword [rbp - 0x70]
inc eax
movsxd rdx, eax
mov r9d, 0x3b
lea r8, str.SYSTEMCurrentControlSetControlSession_ManagerSubSystems
mov rcx, qword [rbp - 0x78]
call fcn.1402ba94c
mov edx, 0x3b
lea rcx, [rbp - 0x78]
call fcn.1401fde50
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp - 0x78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d7a61
mov dword [rbp + 0x690], 0x800
lea rax, [rbp + 0x690]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x5a30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14034f9d8]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401d7a56
lea rax, [rbp + 0x5a30]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d7780
xor r14d, r14d
mov qword [rbp + 0x358], r14
test ebx, ebx
jne 0x1401d77a8
lea r13, [0x140346ce0]
mov qword [rbp + 0x350], r13
jmp 0x1401d77de
mov edx, ebx
lea rcx, [rbp + 0x350]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp + 0x358]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x5a30]
mov rcx, qword [rbp + 0x350]
call fcn.1402ba94c
lea r13, [0x140346ce0]
mov edx, ebx
lea rcx, [rbp + 0x350]
call fcn.1401fde50
nop
mov edi, r14d
movabs r12, 0x400100100000000
mov r15, qword [rbp - 0x80]
nop
mov r9d, dword [rbp + 0x35c]
sub r9d, edi
mov dword [rsp + 0x20], r14d
mov r8d, edi
lea rdx, str._ServerDll
lea rcx, [rbp + 0x350]
call fcn.1401fd640
mov edi, eax
test eax, eax
jle 0x1401d7a39
add edi, 0xb
mov rsi, qword [0x140416ee8]
test rsi, rsi
jne 0x1401d784a
mov ebx, r14d
mov qword [rbp + 0x198], r14
jmp 0x1401d7865
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1401d7850
mov qword [rbp + 0x198], r14
test ebx, ebx
jne 0x1401d786e
mov qword [rbp + 0x190], r13
jmp 0x1401d7899
mov edx, ebx
lea rcx, [rbp + 0x190]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp + 0x198]
inc eax
movsxd rdx, eax
mov r8, rsi
mov rcx, qword [rbp + 0x190]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x190]
call fcn.1401fde50
nop
cmp edi, dword [rbp + 0x35c]
jge 0x1401d7911
mov edx, edi
lea rcx, [rbp + 0x350]
call fcn.1401fb010
movzx ebx, ax
inc edi
cmp ax, 0x3a
ja 0x1401d78cf
bt r12, rbx
jb 0x1401d7911
mov edx, dword [rbp + 0x19c]
inc edx
lea rcx, [rbp + 0x190]
call fcn.1401fcb40
movsxd rcx, dword [rbp + 0x19c]
mov rax, qword [rbp + 0x190]
mov word [rax + rcx*2], bx
mov edx, dword [rbp + 0x19c]
inc edx
lea rcx, [rbp + 0x190]
call fcn.1401fde50
cmp edi, dword [rbp + 0x35c]
jl 0x1401d78b0
cmp dword [rbp + 0x19c], 0
jle 0x1401d7a24
lea rdx, [rbp + 0x190]
call fcn.1401d4ec0
mov r8b, 1
lea rdx, [rbp + 0x190]
mov rcx, qword [r15 + 8]
call fcn.1400f8340
mov rsi, rax
test rax, rax
je 0x1401d7a24
mov qword [rbp + 0x2c0], r14
mov edx, 5
lea rcx, [rbp + 0x2b8]
call fcn.1401fcb40
mov ecx, dword [rbp + 0x2c0]
inc ecx
movsxd rdx, ecx
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x2b8]
call fcn.1402ba94c
mov edx, 5
lea rcx, [rbp + 0x2b8]
call fcn.1401fde50
nop
mov ebx, dword [rbp + 0x2c4]
add ebx, dword [rbp - 0x6c]
mov edx, ebx
lea rcx, [rbp + 0x2b8]
call fcn.1401fcb40
movsxd r9, dword [rbp - 0x6c]
mov ecx, dword [rbp + 0x2c0]
movsxd rax, dword [rbp + 0x2c4]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x2b8]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp - 0x78]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x2b8]
call fcn.1401fde50
lea rdx, [0x140363940]
lea rcx, [rbp + 0x2b8]
call fcn.1401fb190
lea rdx, [rbp + 0x2b8]
mov rcx, rsi
call fcn.1400eb2a0
nop
cmp dword [rbp + 0x2c0], 0
jle 0x1401d7a24
mov rcx, qword [rbp + 0x2b8]
call fcn.1402b7350
nop
cmp dword [rbp + 0x198], 0
jle 0x1401d7a39
mov rcx, qword [rbp + 0x190]
call fcn.1402b7350
test edi, edi
jns 0x1401d7800
cmp dword [rbp + 0x358], 0
jle 0x1401d7a56
mov rcx, qword [rbp + 0x350]
call fcn.1402b7350
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
mov qword [rbp + 0xd0], rax
lea rax, str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWindows
mov qword [rbp + 0xd8], rax
xor esi, esi
mov r12d, esi
lea r13, [rbp + 0xd0]
nop dword [rax]
mov r14, qword [r13]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r14
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d7da2
mov word [rbp + 0x8230], si
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp + 0x8232]
call fcn.1402bfa30
mov dword [rbp + 0x65c], 0x800
lea rax, [rbp + 0x65c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x8230]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140363a90]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401d7d97
lea rdi, [rbp + 0x8230]
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x14034b8c0]
mov rcx, rdi
call fcn.1402bc438
mov rsi, rax
mov r8, rdi
mov edx, 0x400
lea rcx, [rbp + 0x1e30]
test rax, rax
je 0x1401d7b89
mov rbx, rax
sub rbx, rdi
sar rbx, 1
mov r9, rbx
call fcn.1402bc470
add rbx, rbx
cmp rbx, 0x800
jae 0x1401d7db7
xor eax, eax
mov word [rbp + rbx + 0x1e30], ax
lea rdi, [rsi + 2]
xor esi, esi
jmp 0x1401d7b92
call fcn.1402b6e28
xor esi, esi
mov edi, esi
lea rcx, [rbp + 0x1e30]
or rdx, 0xffffffffffffffff
mov rax, rdx
inc rax
cmp word [rcx + rax*2], 0
jne 0x1401d7ba0
test rax, rax
je 0x1401d7d8e
lea rax, [rbp + 0x1e30]
mov rbx, rdx
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d7bc0
mov qword [rbp + 0x4c0], 0
test ebx, ebx
jne 0x1401d7be9
lea rax, [0x140346ce0]
mov qword [rbp + 0x4b8], rax
jmp 0x1401d7c18
mov edx, ebx
lea rcx, [rbp + 0x4b8]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp + 0x4c0]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1e30]
mov rcx, qword [rbp + 0x4b8]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x4b8]
call fcn.1401fde50
nop
lea rdx, [rbp + 0x4b8]
call fcn.1401d4ec0
lea rax, [rbp + 0x1e30]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d7c40
mov qword [rbp + 0x540], 0
test ebx, ebx
jne 0x1401d7c69
lea rax, [0x140346ce0]
mov qword [rbp + 0x538], rax
jmp 0x1401d7c98
mov edx, ebx
lea rcx, [rbp + 0x538]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp + 0x540]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1e30]
mov rcx, qword [rbp + 0x538]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x538]
call fcn.1401fde50
nop
mov r8b, 1
lea rdx, [rbp + 0x538]
mov rax, qword [rbp - 0x80]
mov rcx, qword [rax + 8]
call fcn.1400f8340
mov rbx, rax
cmp dword [rbp + 0x540], 0
jle 0x1401d7cd6
mov rcx, qword [rbp + 0x538]
call fcn.1402b7350
test rbx, rbx
je 0x1401d7d79
mov qword [rbp + 0x458], 0
mov edx, 5
lea rcx, [rbp + 0x450]
call fcn.1401fcb40
mov eax, dword [rbp + 0x458]
inc eax
movsxd rdx, eax
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x450]
call fcn.1402ba94c
mov edx, 5
lea rcx, [rbp + 0x450]
call fcn.1401fde50
nop
mov rdx, r14
lea rcx, [rbp + 0x450]
call fcn.1401fb190
lea rdx, [0x140363a70]
lea rcx, [rbp + 0x450]
call fcn.1401fb190
lea rdx, [rbp + 0x450]
mov rcx, rbx
call fcn.1400eb2a0
nop
cmp dword [rbp + 0x458], 0
jle 0x1401d7d79
mov rcx, qword [rbp + 0x450]
call fcn.1402b7350
nop
cmp dword [rbp + 0x4c0], 0
jle 0x1401d7d8e
mov rcx, qword [rbp + 0x4b8]
call fcn.1402b7350
test rdi, rdi
jne 0x1401d7b30
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r12d
add r13, 8
movsxd rax, r12d
cmp rax, 2
jae 0x1401d7dbd
jmp 0x1401d7a90
call fcn.1402b8d20
int3
mov eax, dword [rbp + 0x7c0]
test eax, eax
jle 0x1401d80d1
mov r14, qword [rbp + 0x7c8]
mov r12d, eax
mov r15, qword [rbp - 0x80]
nop dword [rax]
mov r8, qword [r14]
lea rdx, str.SYSTEM_sControlSession_ManagerAppCertDlls
lea rcx, [rbp + 0x888]
call fcn.1401fcfe0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp - 0x78]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp - 0x70]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp - 0x78]
call fcn.1402ba94c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp - 0x78]
call fcn.1401fde50
nop
cmp dword [rbp + 0x890], 0
jle 0x1401d7e3f
mov rcx, qword [rbp + 0x888]
call fcn.1402b7350
mov eax, dword [0x140429a18]
lea rbx, vtable.Core::Win32::RegistryKey.0
test al, 1
jne 0x1401d7e77
or eax, 1
mov dword [0x140429a18], eax
mov qword [0x1404299f0], rbx
mov qword [0x1404299f8], 0xffffffff80000002
lea rcx, [0x1402fedc0]
call fcn.1402b8a74
mov qword [rbp + 0x788], rsi
lea rax, [rbp + 0x788]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp - 0x78]
mov rcx, qword [0x1404299f8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d80c4
lea ecx, [rax + 0x10]
call fcn.1402b6dbc
mov rdi, rax
test rax, rax
je 0x1401d7ecc
mov rax, qword [rbp + 0x788]
mov qword [rdi], rbx
mov qword [rdi + 8], rax
jmp 0x1401d7ecf
mov rdi, rsi
test rdi, rdi
je 0x1401d80c4
lea rbx, [0x140346ce0]
mov qword [rbp + 0x4c8], rbx
mov qword [rbp + 0x4d0], 0
lea r8, [rbp + 0x4c8]
lea rdx, str.AppSecDll
mov rcx, rdi
call fcn.1400d8ae0
test al, al
je 0x1401d80a1
mov qword [rbp + 0x408], 0
mov edx, dword [rbp + 0x4d4]
test edx, edx
jne 0x1401d7f2d
mov qword [rbp + 0x400], rbx
jmp 0x1401d7f64
lea rcx, [rbp + 0x400]
call fcn.1401fcb40
movsxd r9, dword [rbp + 0x4d4]
mov eax, dword [rbp + 0x408]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x4c8]
mov rcx, qword [rbp + 0x400]
call fcn.1402ba94c
mov edx, dword [rbp + 0x4d4]
lea rcx, [rbp + 0x400]
call fcn.1401fde50
nop
lea rdx, [rbp + 0x400]
call fcn.1401d4ec0
mov r8b, 1
lea rdx, [rbp + 0x400]
mov rcx, qword [r15 + 8]
call fcn.1400f8340
mov rsi, rax
test rax, rax
je 0x1401d808a
xor eax, eax
mov qword [rbp + 0x268], rax
lea edx, [rax + 5]
lea rcx, [rbp + 0x260]
call fcn.1401fcb40
mov ecx, dword [rbp + 0x268]
inc ecx
movsxd rdx, ecx
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x260]
call fcn.1402ba94c
mov edx, 5
lea rcx, [rbp + 0x260]
call fcn.1401fde50
nop
mov ebx, dword [rbp + 0x26c]
add ebx, dword [rbp - 0x6c]
mov edx, ebx
lea rcx, [rbp + 0x260]
call fcn.1401fcb40
movsxd r9, dword [rbp - 0x6c]
mov ecx, dword [rbp + 0x268]
movsxd rax, dword [rbp + 0x26c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x260]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp - 0x78]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x260]
call fcn.1401fde50
lea rdx, [0x140345f98]
lea rcx, [rbp + 0x260]
call fcn.1401fb190
lea rdx, str.AppSecDll
lea rcx, [rbp + 0x260]
call fcn.1401fb190
lea rdx, [rbp + 0x260]
mov rcx, rsi
call fcn.1400eb2a0
nop
cmp dword [rbp + 0x268], 0
jle 0x1401d808a
mov rcx, qword [rbp + 0x260]
call fcn.1402b7350
nop
cmp dword [rbp + 0x408], 0
jle 0x1401d809f
mov rcx, qword [rbp + 0x400]
call fcn.1402b7350
xor esi, esi
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
nop
cmp dword [rbp + 0x4d0], 0
jle 0x1401d80c4
mov rcx, qword [rbp + 0x4c8]
call fcn.1402b7350
add r14, 0x10
dec r12
jne 0x1401d7de0
lea rax, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
mov qword [rbp + 0xd0], rax
lea rax, str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
mov qword [rbp + 0xd8], rax
xor r14d, r14d
mov ebx, r14d
mov dword [rsp + 0x60], ebx
lea rdi, [rbp + 0xd0]
mov qword [rbp - 0x68], rdi
mov r13, qword [rdi]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r13
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d8625
mov dword [rbp + 0x2c8], r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea rax, [rbp + 0x2c8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov r12d, r14d
cmp dword [rbp + 0x2c8], 0
jbe 0x1401d861a
mov r15, qword [rbp - 0x80]
nop dword [rax]
mov r9d, 0x400
lea r8, [rbp + 0x3a30]
mov edx, r12d
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc r12d
test eax, eax
jne 0x1401d85fe
lea edx, [rax + 0x2e]
lea rcx, [rbp + 0x3a30]
call fcn.1402ba4e4
test rax, rax
je 0x1401d8605
lea rax, [rbp + 0x7b0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x3a30]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d85ef
mov dword [rbp + 0x648], 0x800
lea rax, [rbp + 0x648]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x6a30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140360ad0]
mov rcx, qword [rbp + 0x7b0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401d85ef
lea rax, [rbp + 0x6a30]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d8250
mov qword [rbp + 0x428], 0
test ebx, ebx
jne 0x1401d8279
lea rax, [0x140346ce0]
mov qword [rbp + 0x420], rax
jmp 0x1401d82a8
mov edx, ebx
lea rcx, [rbp + 0x420]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp + 0x428]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x6a30]
mov rcx, qword [rbp + 0x420]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x420]
call fcn.1401fde50
nop
lea rdx, [rbp + 0x420]
call fcn.1401d4ec0
mov r8b, 1
lea rdx, [rbp + 0x420]
mov rcx, qword [r15 + 8]
call fcn.1400f8340
mov rbx, rax
test rax, rax
je 0x1401d85da
mov qword [rbp + 0x348], 0
mov edx, 5
lea rcx, [rbp + 0x340]
call fcn.1401fcb40
mov ecx, dword [rbp + 0x348]
inc ecx
movsxd rdx, ecx
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x340]
call fcn.1402ba94c
mov edx, 5
lea rcx, [rbp + 0x340]
call fcn.1401fde50
nop
mov rdx, r13
lea rcx, [rbp + 0x340]
call fcn.1401fb190
lea rdx, [0x140345f98]
lea rcx, [rbp + 0x340]
call fcn.1401fb190
lea rdx, [rbp + 0x3a30]
lea rcx, [rbp + 0x340]
call fcn.1401fb190
lea rdx, str.Debugger
lea rcx, [rbp + 0x340]
call fcn.1401fb190
lea rdx, [rbp + 0x340]
mov rcx, rbx
call fcn.1400eb2a0
mov rbx, qword [r15 + 8]
mov eax, dword [0x1404194a4]
cmp eax, 0xffffffff
jne 0x1401d83d1
call fcn.140112080
test al, al
je 0x1401d83af
mov dword [0x1404194a4], 1
jmp 0x1401d83da
cmp qword [rbx + 0x2f0], 0
je 0x1401d83c5
mov dword [0x1404194a4], 1
jmp 0x1401d83da
mov dword [0x1404194a4], r14d
jmp 0x1401d85c4
cmp eax, 1
jne 0x1401d85c4
lea r8, str.ImageFileExecutionOptions
lea rdx, str.Policies__s_Title
lea rcx, [rbp + 0x988]
call fcn.1401fcfe0
nop
mov rdx, rax
lea rcx, [rbp + 0x808]
call fcn.1400f4800
nop
cmp dword [rbp + 0x990], 0
jle 0x1401d841a
mov rcx, qword [rbp + 0x988]
call fcn.1402b7350
lea r8, [rbp + 0x3a30]
mov rdx, qword [rbp + 0x808]
lea rcx, [rbp + 0x818]
call fcn.1401fcfe0
nop
mov ecx, 0x90
call fcn.1402b6dbc
mov qword [rbp + 0xc0], rax
test rax, rax
je 0x1401d8466
lea r9, [rbp + 0x818]
lea rdx, [rbp + 0x340]
mov rcx, rax
call fcn.1401f58e0
mov rbx, rax
jmp 0x1401d8469
mov rbx, r14
lea rdx, [rbx + 8]
mov rcx, qword [r15 + 8]
call fcn.140110c70
movzx edi, al
test al, al
sete r14b
movzx edx, r14b
mov rcx, rbx
call fcn.1400d7a00
mov rdx, rbx
mov rcx, qword [r15 + 8]
call fcn.1400f8580
mov rcx, rbx
call fcn.1400d95a0
mov rsi, rax
mov rcx, rax
call fcn.1400e3810
mov dword [rsp + 0x70], 7
movzx edx, byte [0x140429189]
mov byte [rsp + 0x20], dl
lea r9, [rsp + 0x70]
lea rdx, [rbp + 0xac0]
lea rcx, [rsi + 0x18]
call fcn.1400e3a70
mov dword [rsp + 0x70], 8
movzx edx, byte [0x140429189]
mov byte [rsp + 0x20], dl
lea r9, [rsp + 0x70]
lea rdx, [rbp + 0x7d8]
lea rcx, [rsi + 0x18]
call fcn.1400e3a70
xor eax, eax
mov edx, eax
test dil, dil
setne dl
add edx, 7
mov rcx, rsi
call fcn.1400e3730
cmp byte [rsi + 0xa], 1
je 0x1401d854d
mov byte [rsi + 0xa], 1
cmp byte [rsi + 8], 0
je 0x1401d854d
mov rax, qword [rsi]
mov rdx, qword [0x140428b78]
mov qword [rbp + 0x8a8], rax
mov dword [rbp + 0x8b0], 1
lea rcx, [rdx + 0x388]
lea r8, [rbp + 0x8a8]
call fcn.1401188e0
cmp byte [rsi + 9], r14b
je 0x1401d858b
mov byte [rsi + 9], r14b
cmp byte [rsi + 8], 0
je 0x1401d858b
mov rax, qword [rsi]
mov rdx, qword [0x140428b78]
mov qword [rbp + 0x928], rax
mov dword [rbp + 0x930], 2
lea rcx, [rdx + 0x388]
lea r8, [rbp + 0x928]
call fcn.1401188e0
mov dl, 1
mov rcx, rsi
call fcn.1400e37a0
nop
cmp dword [rbp + 0x820], 0
jle 0x1401d85ac
mov rcx, qword [rbp + 0x818]
call fcn.1402b7350
nop
cmp dword [rbp + 0x810], 0
jle 0x1401d85c1
mov rcx, qword [rbp + 0x808]
call fcn.1402b7350
xor r14d, r14d
cmp dword [rbp + 0x348], 0
jle 0x1401d85da
mov rcx, qword [rbp + 0x340]
call fcn.1402b7350
nop
cmp dword [rbp + 0x428], 0
jle 0x1401d85ef
mov rcx, qword [rbp + 0x420]
call fcn.1402b7350
mov rcx, qword [rbp + 0x7b0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1401d8605
cmp eax, 0x103
je 0x1401d8612
cmp r12d, dword [rbp + 0x2c8]
jb 0x1401d8190
mov ebx, dword [rsp + 0x60]
mov rdi, qword [rbp - 0x68]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
mov dword [rsp + 0x60], ebx
add rdi, 8
mov qword [rbp - 0x68], rdi
movsxd rax, ebx
cmp rax, 2
jb 0x1401d8102
lea rax, str.SOFTWARE_
mov qword [rbp + 0xd0], rax
lea rax, str.SOFTWAREWow6432Node_
mov qword [rbp + 0xd8], rax
mov dword [rbp - 0x60], r14d
lea rax, str.ShellServiceObjectDelayLoad
mov qword [rbp + 0xc0], rax
lea rax, str.SharedTaskScheduler
mov qword [rbp + 0xc8], rax
lea rcx, [rbp + 0xd0]
mov qword [rbp + 0x88], rcx
nop word [rax + rax]
mov rsi, qword [rcx]
mov qword [rbp], rsi
lea r8, str.MicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
mov rdx, rsi
lea rcx, [rbp - 0x30]
call fcn.1401fb9f0
nop
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp - 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d891d
mov dword [rbp + 0x2a0], r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, r14d
cmp dword [rbp + 0x2a0], 0
jbe 0x1401d8912
mov rsi, qword [rbp - 0x80]
nop dword [rax]
nop dword [rax + rax]
mov r9d, 0x400
lea r8, [rbp + 0x9230]
mov edx, edi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc edi
test eax, eax
jne 0x1401d88fb
mov qword [rbp + 0x1d8], 0
lea edx, [rax + 5]
lea rcx, [rbp + 0x1d0]
call fcn.1401fcb40
mov eax, dword [rbp + 0x1d8]
inc eax
movsxd rdx, eax
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x1d0]
call fcn.1402ba94c
mov edx, 5
lea rcx, [rbp + 0x1d0]
call fcn.1401fde50
nop
mov ebx, dword [rbp - 0x24]
add ebx, dword [rbp + 0x1dc]
mov edx, ebx
lea rcx, [rbp + 0x1d0]
call fcn.1401fcb40
movsxd r9, dword [rbp - 0x24]
mov ecx, dword [rbp + 0x1d8]
movsxd rax, dword [rbp + 0x1dc]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x1d0]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp - 0x30]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x1d0]
call fcn.1401fde50
lea rdx, [0x140345f98]
lea rcx, [rbp + 0x1d0]
call fcn.1401fb190
lea rdx, [rbp + 0x9230]
lea rcx, [rbp + 0x1d0]
call fcn.1401fb190
lea rdx, [0x140345f98]
lea rcx, [rbp + 0x1d0]
call fcn.1401fb190
lea rax, [rbp + 0x9230]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d8850
mov qword [rbp + 0x4f0], 0
test ebx, ebx
jne 0x1401d8879
lea rax, [0x140346ce0]
mov qword [rbp + 0x4e8], rax
jmp 0x1401d88a8
mov edx, ebx
lea rcx, [rbp + 0x4e8]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp + 0x4f0]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x9230]
mov rcx, qword [rbp + 0x4e8]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x4e8]
call fcn.1401fde50
nop
lea r8, [rbp + 0x1d0]
lea rdx, [rbp + 0x4e8]
mov rcx, rsi
call fcn.1401d1a20
nop
cmp dword [rbp + 0x4f0], 0
jle 0x1401d88e4
mov rcx, qword [rbp + 0x4e8]
call fcn.1402b7350
nop
cmp dword [rbp + 0x1d8], 0
jle 0x1401d8902
mov rcx, qword [rbp + 0x1d0]
call fcn.1402b7350
jmp 0x1401d8902
cmp eax, 0x103
je 0x1401d890e
cmp edi, dword [rbp + 0x2a0]
jb 0x1401d8740
mov rsi, qword [rbp]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, str.MicrosoftWindowsCurrentVersionShell_ExtensionsApproved
mov rdx, rsi
lea rcx, [rbp + 0x8c8]
call fcn.1401fb9f0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp - 0x30]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp - 0x28]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp - 0x30]
call fcn.1402ba94c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp - 0x30]
call fcn.1401fde50
nop
cmp dword [rbp + 0x8d0], 0
jle 0x1401d897c
mov rcx, qword [rbp + 0x8c8]
call fcn.1402b7350
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp - 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d8bfd
mov dword [rbp + 0x2a4], r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea rax, [rbp + 0x2a4]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, r14d
cmp dword [rbp + 0x2a4], 0
jbe 0x1401d8bf2
mov rsi, qword [rbp - 0x80]
nop word [rax + rax]
mov dword [rbp + 0x708], 0x400
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x708]
lea r8, [rbp + 0x6230]
mov edx, edi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc edi
test eax, eax
jne 0x1401d8bdb
mov qword [rbp + 0x238], 0
lea edx, [rax + 5]
lea rcx, [rbp + 0x230]
call fcn.1401fcb40
mov eax, dword [rbp + 0x238]
inc eax
movsxd rdx, eax
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x230]
call fcn.1402ba94c
mov edx, 5
lea rcx, [rbp + 0x230]
call fcn.1401fde50
nop
mov ebx, dword [rbp + 0x23c]
add ebx, dword [rbp - 0x24]
mov edx, ebx
lea rcx, [rbp + 0x230]
call fcn.1401fcb40
movsxd r9, dword [rbp - 0x24]
mov ecx, dword [rbp + 0x238]
movsxd rax, dword [rbp + 0x23c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x230]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp - 0x30]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x230]
call fcn.1401fde50
lea rdx, [0x140345f98]
lea rcx, [rbp + 0x230]
call fcn.1401fb190
lea rdx, [rbp + 0x6230]
lea rcx, [rbp + 0x230]
call fcn.1401fb190
lea rax, [rbp + 0x6230]
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d8b30
mov qword [rbp + 0x510], 0
test ebx, ebx
jne 0x1401d8b59
lea rax, [0x140346ce0]
mov qword [rbp + 0x508], rax
jmp 0x1401d8b88
mov edx, ebx
lea rcx, [rbp + 0x508]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp + 0x510]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x6230]
mov rcx, qword [rbp + 0x508]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x508]
call fcn.1401fde50
nop
lea r8, [rbp + 0x230]
lea rdx, [rbp + 0x508]
mov rcx, rsi
call fcn.1401d1a20
nop
cmp dword [rbp + 0x510], 0
jle 0x1401d8bc4
mov rcx, qword [rbp + 0x508]
call fcn.1402b7350
nop
cmp dword [rbp + 0x238], 0
jle 0x1401d8be2
mov rcx, qword [rbp + 0x230]
call fcn.1402b7350
jmp 0x1401d8be2
cmp eax, 0x103
je 0x1401d8bee
cmp edi, dword [rbp + 0x2a4]
jb 0x1401d8a10
mov rsi, qword [rbp]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r13d, r14d
mov dword [rsp + 0x70], r14d
lea r15, [rbp + 0xc0]
mov qword [rbp + 0xe0], r15
mov rdi, qword [rbp - 0x80]
nop word [rax + rax]
mov r8, qword [r15]
lea rdx, str.MicrosoftWindowsCurrentVersion_s
lea rcx, [rbp + 0x848]
call fcn.1401fcfe0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp - 0x30]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp - 0x28]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp - 0x30]
call fcn.1402ba94c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp - 0x30]
call fcn.1401fde50
nop
cmp dword [rbp + 0x850], 0
jle 0x1401d8c7f
mov rcx, qword [rbp + 0x848]
call fcn.1402b7350
lea r8, [rbp - 0x30]
mov rdx, rsi
lea rcx, [rbp + 0x8e8]
call fcn.1401fb6b0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp - 0x30]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp - 0x28]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp - 0x30]
call fcn.1402ba94c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp - 0x30]
call fcn.1401fde50
nop
cmp dword [rbp + 0x8f0], 0
jle 0x1401d8cdb
mov rcx, qword [rbp + 0x8e8]
call fcn.1402b7350
xor ebx, ebx
mov r12d, ebx
mov dword [rsp + 0x60], ebx
mov r14d, ebx
mov qword [rbp - 0x68], rbx
cmp dword [rdi + 0x18], ebx
jl 0x1401d9102
lea rax, [0x140346ce0]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x30], 0
lea rcx, [rbp + 0x28]
test r14, r14
jne 0x1401d8d4d
mov rsi, 0xffffffff80000002
mov edx, dword [rbp - 0x24]
call fcn.1401fcb40
movsxd r9, dword [rbp - 0x24]
mov eax, dword [rbp + 0x30]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x30]
mov rcx, qword [rbp + 0x28]
call fcn.1402ba94c
mov edx, dword [rbp - 0x24]
lea rcx, [rbp + 0x28]
call fcn.1401fde50
lea r15d, [r14 + 0x5c]
jmp 0x1401d8dff
mov rsi, 0xffffffff80000003
mov rbx, r14
shl rbx, 4
add rbx, qword [rdi + 0x20]
mov edx, dword [rbx - 4]
call fcn.1401fcb40
movsxd r9, dword [rbx - 4]
mov eax, dword [rbp + 0x30]
inc eax
movsxd rdx, eax
mov r8, qword [rbx - 0x10]
mov rcx, qword [rbp + 0x28]
call fcn.1402ba94c
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0x28]
call fcn.1401fde50
mov edx, dword [rbp + 0x34]
inc edx
lea rcx, [rbp + 0x28]
call fcn.1401fcb40
movsxd rcx, dword [rbp + 0x34]
mov rax, qword [rbp + 0x28]
mov r15d, 0x5c
mov word [rax + rcx*2], r15w
mov edx, dword [rbp + 0x34]
inc edx
lea rcx, [rbp + 0x28]
call fcn.1401fde50
mov ebx, dword [rbp + 0x34]
add ebx, dword [rbp - 0x24]
mov edx, ebx
lea rcx, [rbp + 0x28]
call fcn.1401fcb40
movsxd r9, dword [rbp - 0x24]
mov ecx, dword [rbp + 0x30]
movsxd rax, dword [rbp + 0x34]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x28]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp - 0x30]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x28]
call fcn.1401fde50
xor ebx, ebx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x28]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d90ca
mov dword [rbp + 0x2e4], ebx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
lea rax, [rbp + 0x2e4]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, ebx
cmp dword [rbp + 0x2e4], 0
jbe 0x1401d90bb
mov r13, qword [rbp - 0x80]
lea r12, [0x140346ce0]
lea r14, [0x140345fb8]
mov dword [rbp + 0x710], 0x400
mov dword [rbp + 0x678], 0x800
lea rax, [rbp + 0x678]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x7a30]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x710]
lea r8, [rbp + 0xba30]
mov edx, edi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc edi
test eax, eax
jne 0x1401d9095
lea rdx, [0x140345fb0]
cmp rsi, 0xffffffff80000002
cmove rdx, r14
lea rcx, [rbp + 0x120]
call fcn.1401faae0
nop
mov edx, dword [rbp + 0x12c]
inc edx
lea rcx, [rbp + 0x120]
call fcn.1401fcb40
movsxd rcx, dword [rbp + 0x12c]
mov rax, qword [rbp + 0x120]
mov word [rax + rcx*2], r15w
mov edx, dword [rbp + 0x12c]
inc edx
lea rcx, [rbp + 0x120]
call fcn.1401fde50
mov ebx, dword [rbp + 0x12c]
add ebx, dword [rbp + 0x34]
mov edx, ebx
lea rcx, [rbp + 0x120]
call fcn.1401fcb40
movsxd r9, dword [rbp + 0x34]
mov ecx, dword [rbp + 0x128]
movsxd rax, dword [rbp + 0x12c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x120]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x28]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x120]
call fcn.1401fde50
mov edx, dword [rbp + 0x12c]
inc edx
lea rcx, [rbp + 0x120]
call fcn.1401fcb40
movsxd rcx, dword [rbp + 0x12c]
mov rax, qword [rbp + 0x120]
mov word [rax + rcx*2], r15w
mov edx, dword [rbp + 0x12c]
inc edx
lea rcx, [rbp + 0x120]
call fcn.1401fde50
lea rdx, [rbp + 0xba30]
lea rcx, [rbp + 0x120]
call fcn.1401fb190
lea rax, [rbp + 0x7a30]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d8ff2
xor r15d, r15d
mov qword [rbp + 0x530], r15
test ebx, ebx
jne 0x1401d9013
mov qword [rbp + 0x528], r12
jmp 0x1401d9042
mov edx, ebx
lea rcx, [rbp + 0x528]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp + 0x530]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x7a30]
mov rcx, qword [rbp + 0x528]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x528]
call fcn.1401fde50
nop
lea r8, [rbp + 0x120]
lea rdx, [rbp + 0x528]
mov rcx, r13
call fcn.1401d1a20
nop
cmp dword [rbp + 0x530], 0
jle 0x1401d907e
mov rcx, qword [rbp + 0x528]
call fcn.1402b7350
nop
cmp dword [rbp + 0x128], 0
jle 0x1401d909e
mov rcx, qword [rbp + 0x120]
call fcn.1402b7350
jmp 0x1401d909e
cmp eax, 0x103
je 0x1401d90b2
jmp 0x1401d90a0
xor ebx, ebx
cmp edi, dword [rbp + 0x2e4]
mov r15d, 0x5c
jb 0x1401d8e90
mov r14, qword [rbp - 0x68]
mov r12d, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rbp - 0x80]
cmp dword [rbp + 0x30], 0
jle 0x1401d90d9
mov rcx, qword [rbp + 0x28]
call fcn.1402b7350
inc r12d
mov dword [rsp + 0x60], r12d
inc r14
mov qword [rbp - 0x68], r14
cmp r12d, dword [rdi + 0x18]
jle 0x1401d8cf4
mov r13d, dword [rsp + 0x70]
mov r15, qword [rbp + 0xe0]
mov rsi, qword [rbp]
inc r13d
mov dword [rsp + 0x70], r13d
add r15, 8
mov qword [rbp + 0xe0], r15
movsxd rax, r13d
cmp rax, 2
jb 0x1401d8c20
cmp dword [rbp - 0x28], 0
jle 0x1401d9131
mov rcx, qword [rbp - 0x30]
call fcn.1402b7350
mov ebx, dword [rbp - 0x60]
inc ebx
mov dword [rbp - 0x60], ebx
mov rcx, qword [rbp + 0x88]
add rcx, 8
mov qword [rbp + 0x88], rcx
movsxd rax, ebx
cmp rax, 2
mov r14d, 0
jb 0x1401d8690
lea rax, str.F3130CDB_AA52_4C3A_AB32_85FFC23AF9C1
mov qword [rbp + 0xa30], rax
lea rax, str._SystemRoot__system32wbemwbemess.dll
mov qword [rbp + 0xa38], rax
mov byte [rbp + 0xa40], r14b
lea rax, str.42AEDC87_2188_41FD_B9A3_0C966FEABEC1
mov qword [rbp + 0xa48], rax
lea rcx, str._SystemRoot__system32_shell32.dll
mov qword [rbp + 0xa50], rcx
mov byte [rbp + 0xa58], 1
lea rax, str.5839FCA9_774D_42A1_ACDA_D6A79037F57F
mov qword [rbp + 0xa60], rax
lea rax, str._SystemRoot__system32wbem_fastprox.dll
mov qword [rbp + 0xa68], rax
mov byte [rbp + 0xa70], r14b
lea rax, str.FBEB8A05_BEEE_4442_804E_409D6C4515E9
mov qword [rbp + 0xa78], rax
mov qword [rbp + 0xa80], rcx
mov byte [rbp + 0xa88], r14b
lea rax, [0x140364060]
mov qword [rbp + 0xa90], rax
lea rax, str._SystemRoot__system32_thumbcache.dll
mov qword [rbp + 0xa98], rax
mov byte [rbp + 0xaa0], r14b
lea rax, [0x140363fc0]
mov qword [rbp + 0xaa8], rax
lea rax, str._systemroot__system32wbemwmiprvse.exe
mov qword [rbp + 0xab0], rax
mov byte [rbp + 0xab8], r14b
xor esi, esi
mov r13d, esi
mov dword [rsp + 0x60], esi
cmp dword [rdi + 0x18], esi
mov r15d, dword [rsp + 0x78]
jl 0x1401d9914
test r13d, r13d
jne 0x1401d929f
mov qword [rbp + 0x5f0], 0
lea edx, [r13 + 4]
lea rcx, [rbp + 0x5e8]
call fcn.1401fcb40
mov eax, dword [rbp + 0x5f0]
inc eax
movsxd rdx, eax
lea r9d, [r13 + 4]
lea r8, [0x140345fb8]
mov rcx, qword [rbp + 0x5e8]
call fcn.1402ba94c
lea edx, [r13 + 4]
lea rcx, [rbp + 0x5e8]
call fcn.1401fde50
lea rbx, [rbp + 0x5e8]
or r15d, 0x10
jmp 0x1401d92c8
lea eax, [r13 - 1]
movsxd r8, eax
shl r8, 4
add r8, qword [rdi + 0x20]
lea rdx, str.HKU_
lea rcx, [rbp + 0x948]
call fcn.1401fb6b0
mov rbx, rax
or r15d, 0x20
mov dword [rsp + 0x78], r15d
mov qword [rbp + 0x398], 0
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x1401d92ef
lea rax, [0x140346ce0]
mov qword [rbp + 0x390], rax
jmp 0x1401d9319
lea rcx, [rbp + 0x390]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rbp + 0x398]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x390]
call fcn.1402ba94c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x390]
call fcn.1401fde50
nop
test r15b, 0x20
je 0x1401d934e
and r15d, 0xffffffdf
mov dword [rsp + 0x78], r15d
cmp dword [rbp + 0x950], 0
jle 0x1401d934e
mov rcx, qword [rbp + 0x948]
call fcn.1402b7350
nop
test r15b, 0x10
je 0x1401d9372
and r15d, 0xffffffef
mov dword [rsp + 0x78], r15d
cmp dword [rbp + 0x5f0], 0
jle 0x1401d9372
mov rcx, qword [rbp + 0x5e8]
call fcn.1402b7350
lea rdx, str.SOFTWAREClassesCLSID_
lea rcx, [rbp + 0x390]
call fcn.1401fb190
mov r8b, 1
xor edx, edx
lea rcx, [rbp + 0x390]
call fcn.1400eb0d0
mov r12, rax
test rax, rax
je 0x1401d98ed
mov r14d, esi
lea rsi, [rbp + 0xa30]
mov r13, qword [rbp - 0x80]
xor r15d, r15d
mov rbx, qword [rsi]
lea r8, str.LocalServer32_
mov rdx, rbx
lea rcx, [rbp + 0x548]
call fcn.1401fb9f0
nop
mov qword [rbp + 0x780], r15
lea rax, [rbp + 0x780]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x548]
mov rcx, qword [r12 + 8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d9426
lea ecx, [rax + 0x10]
call fcn.1402b6dbc
mov rdi, rax
test rax, rax
je 0x1401d9426
mov rax, qword [rbp + 0x780]
lea rcx, vtable.Core::Win32::RegistryKey.0
mov qword [rdi], rcx
mov qword [rdi + 8], rax
jmp 0x1401d9429
mov rdi, r15
test rdi, rdi
jne 0x1401d9501
lea r8, str.InprocServer32_
mov rdx, rbx
lea rcx, [rbp + 0x858]
call fcn.1401fb9f0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0x548]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0x550]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x548]
call fcn.1402ba94c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x548]
call fcn.1401fde50
nop
cmp dword [rbp + 0x860], edi
jle 0x1401d949c
mov rcx, qword [rbp + 0x858]
call fcn.1402b7350
mov qword [rbp + 0x7a8], r15
lea rax, [rbp + 0x7a8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x548]
mov rcx, qword [r12 + 8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d94f5
lea ecx, [rax + 0x10]
call fcn.1402b6dbc
mov rdi, rax
test rax, rax
je 0x1401d94f5
mov rax, qword [rbp + 0x7a8]
lea rcx, vtable.Core::Win32::RegistryKey.0
mov qword [rdi], rcx
mov qword [rdi + 8], rax
jmp 0x1401d94f8
mov rdi, r15
test rdi, rdi
je 0x1401d98a6
lea rax, [0x140346ce0]
mov qword [rbp + 0x140], rax
mov qword [rbp + 0x148], r15
lea r8, [rbp + 0x140]
xor edx, edx
mov rcx, rdi
call fcn.1400d8ae0
test al, al
je 0x1401d987d
cmp dword [rbp + 0x14c], 0
jle 0x1401d987d
mov r8d, 0x104
lea rdx, [rbp + 0x1000]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rax, [rbp + 0x1000]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d9560
mov qword [rbp + 0x1e8], r15
test ebx, ebx
jne 0x1401d9585
lea rax, [0x140346ce0]
mov qword [rbp + 0x1e0], rax
jmp 0x1401d95b4
mov edx, ebx
lea rcx, [rbp + 0x1e0]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp + 0x1e8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1000]
mov rcx, qword [rbp + 0x1e0]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x1e0]
call fcn.1401fde50
nop
mov edx, 0x25
mov rcx, qword [rbp + 0x140]
call fcn.1402ba4e4
test rax, rax
je 0x1401d9656
mov r8d, 0x104
lea rdx, [rbp + 0x1210]
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rax, [rbp + 0x1210]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d9600
test ebx, ebx
jle 0x1401d963f
mov edx, ebx
lea rcx, [rbp + 0x140]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp + 0x148]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1210]
mov rcx, qword [rbp + 0x140]
call fcn.1402ba94c
jmp 0x1401d9648
cmp dword [rbp + 0x14c], 0
jle 0x1401d9656
mov edx, ebx
lea rcx, [rbp + 0x140]
call fcn.1401fde50
mov eax, dword [rbp + 0x14c]
cmp dword [rbp + 0x1ec], eax
jne 0x1401d9684
mov rdx, qword [rbp + 0x140]
mov rcx, qword [rbp + 0x1e0]
call fcn.1402b71dc
test eax, eax
sete al
test al, al
jne 0x1401d9868
cmp byte [rsi + 0x10], 0
je 0x1401d97c2
call fcn.1400ce2d0
test al, al
jne 0x1401d97c2
mov qword [rbp + 0x630], r15
mov edx, 0xb
lea rcx, [rbp + 0x628]
call fcn.1401fcb40
mov eax, dword [rbp + 0x630]
inc eax
movsxd rdx, eax
mov r9d, 0xb
lea r8, str.shdocvw.dll
mov rcx, qword [rbp + 0x628]
call fcn.1402ba94c
mov edx, 0xb
lea rcx, [rbp + 0x628]
call fcn.1401fde50
nop
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x898]
call fcn.1400d2fc0
nop
lea r8, [rbp + 0x628]
mov rdx, rax
lea rcx, [rbp + 0x878]
call fcn.1400d2ba0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0x1e0]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0x1e8]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x1e0]
call fcn.1402ba94c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x1e0]
call fcn.1401fde50
nop
cmp dword [rbp + 0x880], 0
jle 0x1401d9769
mov rcx, qword [rbp + 0x878]
call fcn.1402b7350
nop
cmp dword [rbp + 0x8a0], 0
jle 0x1401d977f
mov rcx, qword [rbp + 0x898]
call fcn.1402b7350
nop
cmp dword [rbp + 0x630], 0
jle 0x1401d9794
mov rcx, qword [rbp + 0x628]
call fcn.1402b7350
mov eax, dword [rbp + 0x14c]
cmp dword [rbp + 0x1ec], eax
jne 0x1401d97c2
mov rdx, qword [rbp + 0x140]
mov rcx, qword [rbp + 0x1e0]
call fcn.1402b71dc
test eax, eax
sete al
test al, al
jne 0x1401d9868
lea r8, [rbp + 0x548]
lea rdx, [rbp + 0x390]
lea rcx, [rbp + 0x7e8]
call fcn.1401fb600
nop
mov eax, dword [rbp + 0x14c]
add eax, eax
lea rcx, [rbp + 0x1000]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x140]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [0x140346ce0]
lea rdx, [rbp + 0x7e8]
mov rcx, r13
call fcn.1401d0b10
test al, al
jne 0x1401d9852
lea rdx, [rbp + 0x140]
call fcn.1401d4ec0
mov r8b, 1
lea rdx, [rbp + 0x140]
mov rcx, qword [r13 + 8]
call fcn.1400f8340
test rax, rax
je 0x1401d9852
lea rdx, [rbp + 0x7e8]
mov rcx, rax
call fcn.1400eb2a0
nop
cmp dword [rbp + 0x7f0], 0
jle 0x1401d9868
mov rcx, qword [rbp + 0x7e8]
call fcn.1402b7350
nop
cmp dword [rbp + 0x1e8], 0
jle 0x1401d987d
mov rcx, qword [rbp + 0x1e0]
call fcn.1402b7350
test rdi, rdi
je 0x1401d9890
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
nop
cmp dword [rbp + 0x148], 0
jle 0x1401d98a6
mov rcx, qword [rbp + 0x140]
call fcn.1402b7350
nop
cmp dword [rbp + 0x550], 0
jle 0x1401d98bb
mov rcx, qword [rbp + 0x548]
call fcn.1402b7350
inc r14d
add rsi, 0x18
movsxd rax, r14d
cmp rax, 6
jb 0x1401d93b3
mov rax, qword [r12]
mov edx, 1
mov rcx, r12
call qword [rax]
mov r15d, dword [rsp + 0x78]
mov r13d, dword [rsp + 0x60]
mov rdi, qword [rbp - 0x80]
xor esi, esi
cmp dword [rbp + 0x398], 0
jle 0x1401d9902
mov rcx, qword [rbp + 0x390]
call fcn.1402b7350
inc r13d
mov dword [rsp + 0x60], r13d
cmp r13d, dword [rdi + 0x18]
jle 0x1401d9240
mov edx, 0x34
lea rcx, [rbp - 0x78]
call fcn.1401fcb40
mov eax, dword [rbp - 0x70]
inc eax
movsxd rdx, eax
mov r9d, 0x34
lea r8, str.SOFTWAREMicrosoftActive_SetupInstalled_Components
mov rcx, qword [rbp - 0x78]
call fcn.1402ba94c
mov edx, 0x34
lea rcx, [rbp - 0x78]
call fcn.1401fde50
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp - 0x78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d9d1e
mov dword [rbp + 0x2e0], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea rax, [rbp + 0x2e0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov r14d, esi
cmp dword [rbp + 0x2e0], 0
jbe 0x1401d9d13
nop dword [rax]
nop word [rax + rax]
mov r9d, 0x400
lea r8, [rbp + 0x8a30]
mov edx, r14d
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc r14d
test eax, eax
jne 0x1401d9cff
lea rax, [rbp + 0x778]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x8a30]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d9cf0
mov dword [rbp + 0x6a8], 0x800
lea rax, [rbp + 0x6a8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xc230]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.StubPath
mov rcx, qword [rbp + 0x778]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401d9cf0
lea rbx, [rbp + 0xc230]
cmp word [rbx], 0x22
jne 0x1401d9a99
add rbx, 2
mov edx, 0x22
mov rcx, rbx
call fcn.1402ba4e4
jmp 0x1401d9aa8
lea rdx, [0x1403641d8]
mov rcx, rbx
call fcn.1402bc438
mov rdi, rax
test rax, rax
je 0x1401d9ac2
cmp word [rax], 0x2c
mov word [rax], si
jne 0x1401d9abe
mov rdi, rsi
jmp 0x1401d9ac2
add rdi, 2
mov rdx, rbx
lea rcx, [rbp + 0x5a8]
call fcn.1401faae0
nop
lea rdx, [rbp + 0x5a8]
call fcn.1401d4ec0
cmp dword [rbp + 0x5b4], 3
jl 0x1401d9c35
mov rcx, qword [rbp + 0x5a8]
add rcx, 2
mov r8d, 2
lea rdx, [0x140360b40]
call fcn.1402bc40c
test eax, eax
jne 0x1401d9c35
mov r8b, 1
lea rdx, [rbp + 0x5a8]
mov rax, qword [rbp - 0x80]
mov rcx, qword [rax + 8]
call fcn.1400f8340
mov rsi, rax
test rax, rax
je 0x1401d9c33
xor eax, eax
mov qword [rbp + 0x208], rax
lea edx, [rax + 5]
lea rcx, [rbp + 0x200]
call fcn.1401fcb40
mov ecx, dword [rbp + 0x208]
inc ecx
movsxd rdx, ecx
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x200]
call fcn.1402ba94c
mov edx, 5
lea rcx, [rbp + 0x200]
call fcn.1401fde50
nop
mov ebx, dword [rbp + 0x20c]
add ebx, dword [rbp - 0x6c]
mov edx, ebx
lea rcx, [rbp + 0x200]
call fcn.1401fcb40
movsxd r9, dword [rbp - 0x6c]
mov ecx, dword [rbp + 0x208]
movsxd rax, dword [rbp + 0x20c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x200]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp - 0x78]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x200]
call fcn.1401fde50
lea rdx, [0x140345f98]
lea rcx, [rbp + 0x200]
call fcn.1401fb190
lea rdx, [rbp + 0x8a30]
lea rcx, [rbp + 0x200]
call fcn.1401fb190
lea rdx, [0x140345f98]
lea rcx, [rbp + 0x200]
call fcn.1401fb190
lea rdx, [rbp + 0x200]
mov rcx, rsi
call fcn.1400eb2a0
nop
cmp dword [rbp + 0x208], 0
jle 0x1401d9c33
mov rcx, qword [rbp + 0x200]
call fcn.1402b7350
xor esi, esi
test rdi, rdi
je 0x1401d9cdb
lea rdx, [0x1403641d0]
mov rcx, rdi
call fcn.1402bc438
mov rbx, rax
test rax, rax
jne 0x1401d9cbb
lea edx, [rax + 0x3a]
mov rcx, rdi
call fcn.1402ba31c
mov rbx, rax
test rax, rax
jne 0x1401d9c76
movzx ecx, word [rdi]
call fcn.1402bbd18
test eax, eax
je 0x1401d9cbb
jmp 0x1401d9cb8
cmp word [rax], 0x3a
jne 0x1401d9cb8
movzx eax, word [rax - 4]
test ax, ax
jne 0x1401d9c8b
sub rbx, 2
jmp 0x1401d9cbb
cmp ax, 0x20
jne 0x1401d9c97
add rbx, 0xfffffffffffffffc
jmp 0x1401d9cbb
cmp ax, 0x2f
jne 0x1401d9cbb
mov edx, 0x20
mov rcx, rbx
call fcn.1402ba31c
mov rbx, rax
test rax, rax
je 0x1401d9cbb
add rbx, 2
jmp 0x1401d9cbb
mov rbx, rdi
cmp dword [rbp + 0x5b0], 0
jle 0x1401d9cd0
mov rcx, qword [rbp + 0x5a8]
call fcn.1402b7350
test rbx, rbx
jne 0x1401d9a80
jmp 0x1401d9cf0
cmp dword [rbp + 0x5b0], 0
jle 0x1401d9cf0
mov rcx, qword [rbp + 0x5a8]
call fcn.1402b7350
mov rcx, qword [rbp + 0x778]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1401d9d06
cmp eax, 0x103
je 0x1401d9d13
cmp r14d, dword [rbp + 0x2e0]
jb 0x1401d99e0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 0x74
lea rcx, [rbp - 0x78]
call fcn.1401fcb40
mov eax, dword [rbp - 0x70]
inc eax
movsxd rdx, eax
mov r9d, 0x74
lea r8, str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList
mov rcx, qword [rbp - 0x78]
call fcn.1402ba94c
mov edx, 0x74
lea rcx, [rbp - 0x78]
call fcn.1401fde50
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp - 0x78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401d9fed
mov dword [rbp + 0x2e8], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x2e8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, esi
cmp dword [rbp + 0x2e8], 0
jbe 0x1401d9fe2
nop dword [rax + rax]
mov dword [rbp + 0x718], 0x400
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x718]
lea r8, [rbp + 0xaa30]
mov edx, edi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc edi
test eax, eax
jne 0x1401d9fcb
lea rax, [rbp + 0xaa30]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401d9e30
mov qword [rbp + 0x448], 0
test ebx, ebx
jne 0x1401d9e59
lea rax, [0x140346ce0]
mov qword [rbp + 0x440], rax
jmp 0x1401d9e88
mov edx, ebx
lea rcx, [rbp + 0x440]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp + 0x448]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0xaa30]
mov rcx, qword [rbp + 0x440]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x440]
call fcn.1401fde50
nop
lea rdx, [rbp + 0x440]
call fcn.1401d4ec0
mov r8b, 1
lea rdx, [rbp + 0x440]
mov rax, qword [rbp - 0x80]
mov rcx, qword [rax + 8]
call fcn.1400f8340
mov rsi, rax
test rax, rax
je 0x1401d9fb4
xor eax, eax
mov qword [rbp + 0x258], rax
lea edx, [rax + 5]
lea rcx, [rbp + 0x250]
call fcn.1401fcb40
mov ecx, dword [rbp + 0x258]
inc ecx
movsxd rdx, ecx
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x250]
call fcn.1402ba94c
mov edx, 5
lea rcx, [rbp + 0x250]
call fcn.1401fde50
nop
mov ebx, dword [rbp + 0x25c]
add ebx, dword [rbp - 0x6c]
mov edx, ebx
lea rcx, [rbp + 0x250]
call fcn.1401fcb40
movsxd r9, dword [rbp - 0x6c]
mov ecx, dword [rbp + 0x258]
movsxd rax, dword [rbp + 0x25c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x250]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp - 0x78]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x250]
call fcn.1401fde50
lea rdx, [0x140345f98]
lea rcx, [rbp + 0x250]
call fcn.1401fb190
lea rdx, [rbp + 0xaa30]
lea rcx, [rbp + 0x250]
call fcn.1401fb190
lea rdx, [rbp + 0x250]
mov rcx, rsi
call fcn.1400eb2a0
nop
cmp dword [rbp + 0x258], 0
jle 0x1401d9fb4
mov rcx, qword [rbp + 0x250]
call fcn.1402b7350
nop
cmp dword [rbp + 0x448], 0
jle 0x1401d9fd4
mov rcx, qword [rbp + 0x440]
call fcn.1402b7350
jmp 0x1401d9fd4
cmp eax, 0x103
je 0x1401d9fe2
jmp 0x1401d9fd6
xor esi, esi
cmp edi, dword [rbp + 0x2e8]
jb 0x1401d9de0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 0x32
lea rcx, [rbp - 0x78]
call fcn.1401fcb40
mov eax, dword [rbp - 0x70]
inc eax
movsxd rdx, eax
mov r9d, 0x32
lea r8, str.SYSTEMCurrentControlSetControlSecurityProviders
mov rcx, qword [rbp - 0x78]
call fcn.1402ba94c
mov edx, 0x32
lea rcx, [rbp - 0x78]
call fcn.1401fde50
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp - 0x78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401da187
mov dword [rbp + 0x6c0], 0x800
lea rax, [rbp + 0x6c0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xca30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SecurityProviders
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401da17c
lea rdi, [rbp + 0xca30]
nop dword [rax]
mov edx, 0x20
mov rcx, rdi
call fcn.1402ba4e4
mov rbx, rax
test rax, rax
je 0x1401da0cc
mov rcx, rsi
cmp word [rax - 2], 0x2c
mov rax, 0xffffffffffffffff
cmove rcx, rax
mov word [rbx + rcx*2], si
mov rdx, rdi
lea rcx, [rbp + 0x750]
call fcn.1401faae0
nop
lea rdx, [rbp + 0x750]
call fcn.1401d4ec0
mov r8b, 1
lea rdx, [rbp + 0x750]
mov rax, qword [rbp - 0x80]
mov rcx, qword [rax + 8]
call fcn.1400f8340
mov rdi, rax
test rax, rax
je 0x1401da140
mov r8, qword [rbp - 0x78]
lea rdx, str.HKLM_wsSecurityProviders
lea rcx, [rbp + 0x8b8]
call fcn.1401fcfe0
nop
mov rdx, rax
mov rcx, rdi
call fcn.1400eb2a0
nop
cmp dword [rbp + 0x8c0], 0
jle 0x1401da140
mov rcx, qword [rbp + 0x8b8]
call fcn.1402b7350
test rbx, rbx
je 0x1401da167
lea rdi, [rbx + 2]
cmp dword [rbp + 0x758], 0
jle 0x1401da0a0
mov rcx, qword [rbp + 0x750]
call fcn.1402b7350
jmp 0x1401da0a0
cmp dword [rbp + 0x758], 0
jle 0x1401da17c
mov rcx, qword [rbp + 0x750]
call fcn.1402b7350
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x180], rsi
mov qword [rbp + 0x188], rsi
call fcn.14000a340
mov qword [rbp + 0x180], rax
mov qword [rbp + 0x5c0], 0
mov edx, 0x2c
lea rcx, [rbp + 0x5b8]
call fcn.1401fcb40
mov eax, dword [rbp + 0x5c0]
inc eax
movsxd rdx, eax
mov r9d, 0x2c
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerToolbar
mov rcx, qword [rbp + 0x5b8]
call fcn.1402ba94c
mov edx, 0x2c
lea rcx, [rbp + 0x5b8]
call fcn.1401fde50
nop
movzx eax, byte [0x14042918a]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x5b8]
lea rdx, [rbp + 0xac0]
lea rcx, [rbp + 0x180]
call fcn.1400e8550
nop
cmp dword [rbp + 0x5c0], 0
jle 0x1401da22e
mov rcx, qword [rbp + 0x5b8]
call fcn.1402b7350
mov qword [rbp + 0x5d0], 0
mov edx, 0x35
lea rcx, [rbp + 0x5c8]
call fcn.1401fcb40
mov eax, dword [rbp + 0x5d0]
inc eax
movsxd rdx, eax
mov r9d, 0x35
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerToolbarExplorer
mov rcx, qword [rbp + 0x5c8]
call fcn.1402ba94c
mov edx, 0x35
lea rcx, [rbp + 0x5c8]
call fcn.1401fde50
nop
movzx eax, byte [0x14042918a]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x5c8]
lea rdx, [rbp + 0xac0]
lea rcx, [rbp + 0x180]
call fcn.1400e8550
nop
cmp dword [rbp + 0x5d0], 0
jle 0x1401da2bb
mov rcx, qword [rbp + 0x5c8]
call fcn.1402b7350
mov qword [rbp + 0x5e0], 0
mov edx, 0x39
lea rcx, [rbp + 0x5d8]
call fcn.1401fcb40
mov eax, dword [rbp + 0x5e0]
inc eax
movsxd rdx, eax
mov r9d, 0x39
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerToolbarShellBrowser
mov rcx, qword [rbp + 0x5d8]
call fcn.1402ba94c
mov edx, 0x39
lea rcx, [rbp + 0x5d8]
call fcn.1401fde50
nop
movzx eax, byte [0x14042918a]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x5d8]
lea rdx, [rbp + 0xac0]
lea rcx, [rbp + 0x180]
call fcn.1400e8550
nop
cmp dword [rbp + 0x5e0], 0
jle 0x1401da348
mov rcx, qword [rbp + 0x5d8]
call fcn.1402b7350
mov qword [rbp + 0x600], 0
mov edx, 0x37
lea rcx, [rbp + 0x5f8]
call fcn.1401fcb40
mov eax, dword [rbp + 0x600]
inc eax
movsxd rdx, eax
mov r9d, 0x37
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerToolbarWebBrowser
mov rcx, qword [rbp + 0x5f8]
call fcn.1402ba94c
mov edx, 0x37
lea rcx, [rbp + 0x5f8]
call fcn.1401fde50
nop
movzx eax, byte [0x14042918a]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x5f8]
lea rdx, [rbp + 0xac0]
lea rcx, [rbp + 0x180]
call fcn.1400e8550
nop
cmp dword [rbp + 0x600], 0
jle 0x1401da3d5
mov rcx, qword [rbp + 0x5f8]
call fcn.1402b7350
mov qword [rbp + 0x620], 0
mov edx, 0x33
lea rcx, [rbp + 0x618]
call fcn.1401fcb40
mov eax, dword [rbp + 0x620]
inc eax
movsxd rdx, eax
mov r9d, 0x33
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerUrlSearchHooks
mov rcx, qword [rbp + 0x618]
call fcn.1402ba94c
mov edx, 0x33
lea rcx, [rbp + 0x618]
call fcn.1401fde50
nop
movzx eax, byte [0x14042918a]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x618]
lea rdx, [rbp + 0xac0]
lea rcx, [rbp + 0x180]
call fcn.1400e8550
nop
cmp dword [rbp + 0x620], 0
jle 0x1401da462
mov rcx, qword [rbp + 0x618]
call fcn.1402b7350
mov r12d, esi
mov dword [rsp + 0x60], esi
mov r13, qword [rbp - 0x80]
cmp dword [r13 + 0x18], 0
jl 0x1401da928
mov r15, rsi
mov qword [rbp - 0x68], rsi
mov rax, qword [rbp + 0x180]
mov r14, rsi
test r12d, r12d
setne r14b
add r14, 0xffffffff80000002
mov rbx, qword [rax]
mov qword [rbp - 0x48], rbx
cmp rbx, rax
je 0x1401da90f
nop word [rax + rax]
mov edx, dword [rbx + 0x2c]
lea rcx, [rbp - 0x78]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rbp - 0x70]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rbp - 0x78]
call fcn.1402ba94c
mov edx, dword [rbx + 0x2c]
lea rcx, [rbp - 0x78]
call fcn.1401fde50
lea rax, [0x140346ce0]
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], 0
lea rcx, [rbp + 0x18]
test r15, r15
jne 0x1401da526
mov edx, dword [rbp - 0x6c]
call fcn.1401fcb40
movsxd r9, dword [rbp - 0x6c]
mov eax, dword [rbp + 0x20]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x78]
mov rcx, qword [rbp + 0x18]
call fcn.1402ba94c
mov edx, dword [rbp - 0x6c]
jmp 0x1401da5c4
mov rdi, r15
shl rdi, 4
add rdi, qword [r13 + 0x20]
mov edx, dword [rdi - 4]
call fcn.1401fcb40
movsxd r9, dword [rdi - 4]
mov eax, dword [rbp + 0x20]
inc eax
movsxd rdx, eax
mov r8, qword [rdi - 0x10]
mov rcx, qword [rbp + 0x18]
call fcn.1402ba94c
mov edx, dword [rdi - 4]
lea rcx, [rbp + 0x18]
call fcn.1401fde50
mov edx, dword [rbp + 0x24]
inc edx
lea rcx, [rbp + 0x18]
call fcn.1401fcb40
movsxd rcx, dword [rbp + 0x24]
mov rax, qword [rbp + 0x18]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x24]
inc edx
lea rcx, [rbp + 0x18]
call fcn.1401fde50
mov edi, dword [rbp + 0x24]
add edi, dword [rbp - 0x6c]
mov edx, edi
lea rcx, [rbp + 0x18]
call fcn.1401fcb40
movsxd r9, dword [rbp - 0x6c]
mov ecx, dword [rbp + 0x20]
movsxd rax, dword [rbp + 0x24]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x18]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp - 0x78]
call fcn.1402ba94c
mov edx, edi
lea rcx, [rbp + 0x18]
call fcn.1401fde50
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x18]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401da88e
mov dword [rbp + 0x2b0], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [rbp + 0x2b0], 0
jbe 0x1401da881
xor r12d, r12d
lea r15, [0x140346ce0]
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
mov dword [rbp + 0x714], 0x400
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x714]
lea r8, [rbp + 0x2e30]
mov edx, esi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc esi
test eax, eax
jne 0x1401da866
cmp word [rbp + 0x2e30], 0x7b
jne 0x1401da86d
lea rdx, [0x140345fb0]
cmp r14, 0xffffffff80000002
lea rax, [0x140345fb8]
cmove rdx, rax
lea rcx, [rbp + 0x110]
call fcn.1401faae0
nop
mov edx, dword [rbp + 0x11c]
inc edx
lea rcx, [rbp + 0x110]
call fcn.1401fcb40
movsxd rcx, dword [rbp + 0x11c]
mov rax, qword [rbp + 0x110]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x11c]
inc edx
lea rcx, [rbp + 0x110]
call fcn.1401fde50
mov edi, dword [rbp + 0x11c]
add edi, dword [rbp + 0x24]
mov edx, edi
lea rcx, [rbp + 0x110]
call fcn.1401fcb40
movsxd r9, dword [rbp + 0x24]
mov ecx, dword [rbp + 0x118]
movsxd rax, dword [rbp + 0x11c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x110]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x18]
call fcn.1402ba94c
mov edx, edi
lea rcx, [rbp + 0x110]
call fcn.1401fde50
mov edx, dword [rbp + 0x11c]
inc edx
lea rcx, [rbp + 0x110]
call fcn.1401fcb40
movsxd rcx, dword [rbp + 0x11c]
mov rax, qword [rbp + 0x110]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x11c]
inc edx
lea rcx, [rbp + 0x110]
call fcn.1401fde50
lea rdx, [rbp + 0x2e30]
lea rcx, [rbp + 0x110]
call fcn.1401fb190
lea rax, [rbp + 0x2e30]
mov rdi, rbx
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1401da7c6
mov qword [rbp + 0x570], r12
test edi, edi
jne 0x1401da7e4
mov qword [rbp + 0x568], r15
jmp 0x1401da813
mov edx, edi
lea rcx, [rbp + 0x568]
call fcn.1401fcb40
movsxd r9, edi
mov eax, dword [rbp + 0x570]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x2e30]
mov rcx, qword [rbp + 0x568]
call fcn.1402ba94c
mov edx, edi
lea rcx, [rbp + 0x568]
call fcn.1401fde50
nop
lea r8, [rbp + 0x110]
lea rdx, [rbp + 0x568]
mov rcx, r13
call fcn.1401d1a20
nop
cmp dword [rbp + 0x570], 0
jle 0x1401da84f
mov rcx, qword [rbp + 0x568]
call fcn.1402b7350
nop
cmp dword [rbp + 0x118], 0
jle 0x1401da86d
mov rcx, qword [rbp + 0x110]
call fcn.1402b7350
jmp 0x1401da86d
cmp eax, 0x103
je 0x1401da879
cmp esi, dword [rbp + 0x2b0]
jb 0x1401da660
mov rbx, qword [rbp - 0x48]
mov r15, qword [rbp - 0x68]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
cmp dword [rbp + 0x20], 0
jle 0x1401da89d
mov rcx, qword [rbp + 0x18]
call fcn.1402b7350
cmp byte [rbx + 0x19], 0
jne 0x1401da8fa
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401da8d2
mov rbx, rax
mov qword [rbp - 0x48], rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401da8fa
nop dword [rax]
mov rbx, rax
mov qword [rbp - 0x48], rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401da8c0
jmp 0x1401da8fa
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401da8f3
nop dword [rax]
cmp rbx, qword [rax + 0x10]
jne 0x1401da8f3
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401da8e0
mov rbx, rax
mov qword [rbp - 0x48], rax
mov rax, qword [rbp + 0x180]
cmp rbx, rax
jne 0x1401da4b0
mov r12d, dword [rsp + 0x60]
inc r12d
mov dword [rsp + 0x60], r12d
inc r15
mov qword [rbp - 0x68], r15
cmp r12d, dword [r13 + 0x18]
jle 0x1401da486
lea rcx, [rbp + 0x180]
call fcn.140009e30
mov qword [rbp + 0x640], 0
mov edx, 0x32
lea rcx, [rbp + 0x638]
call fcn.1401fcb40
mov eax, dword [rbp + 0x640]
inc eax
movsxd rdx, eax
mov r9d, 0x32
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerExplorer_Bars
mov rcx, qword [rbp + 0x638]
call fcn.1402ba94c
mov edx, 0x32
lea rcx, [rbp + 0x638]
call fcn.1401fde50
nop
movzx eax, byte [0x14042918a]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x638]
lea rdx, [rbp + 0xac0]
lea rcx, [rbp + 0x180]
call fcn.1400e8550
nop
cmp dword [rbp + 0x640], 0
jle 0x1401da9c1
mov rcx, qword [rbp + 0x638]
call fcn.1402b7350
mov qword [rbp + 0x610], 0
mov edx, 0x2f
lea rcx, [rbp + 0x608]
call fcn.1401fcb40
mov eax, dword [rbp + 0x610]
inc eax
movsxd rdx, eax
mov r9d, 0x2f
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerExtensions
mov rcx, qword [rbp + 0x608]
call fcn.1402ba94c
mov edx, 0x2f
lea rcx, [rbp + 0x608]
call fcn.1401fde50
nop
movzx eax, byte [0x14042918a]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x608]
lea rdx, [rbp + 0xac0]
lea rcx, [rbp + 0x180]
call fcn.1400e8550
nop
cmp dword [rbp + 0x610], 0
jle 0x1401daa4e
mov rcx, qword [rbp + 0x608]
call fcn.1402b7350
mov r12d, esi
mov dword [rsp + 0x60], esi
cmp dword [r13 + 0x18], 0
jl 0x1401daf08
mov r15, rsi
mov qword [rbp - 0x68], rsi
mov rax, qword [rbp + 0x180]
nop
mov r14, rsi
test r12d, r12d
setne r14b
add r14, 0xffffffff80000002
mov rbx, qword [rax]
mov qword [rbp - 0x48], rbx
cmp rbx, rax
je 0x1401daeef
mov edx, dword [rbx + 0x2c]
lea rcx, [rbp - 0x78]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rbp - 0x70]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rbp - 0x78]
call fcn.1402ba94c
mov edx, dword [rbx + 0x2c]
lea rcx, [rbp - 0x78]
call fcn.1401fde50
lea rax, [0x140346ce0]
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], 0
lea rcx, [rbp + 8]
test r15, r15
jne 0x1401dab07
mov edx, dword [rbp - 0x6c]
call fcn.1401fcb40
movsxd r9, dword [rbp - 0x6c]
mov eax, dword [rbp + 0x10]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x78]
mov rcx, qword [rbp + 8]
call fcn.1402ba94c
mov edx, dword [rbp - 0x6c]
jmp 0x1401daba5
mov rdi, r15
shl rdi, 4
add rdi, qword [r13 + 0x20]
mov edx, dword [rdi - 4]
call fcn.1401fcb40
movsxd r9, dword [rdi - 4]
mov eax, dword [rbp + 0x10]
inc eax
movsxd rdx, eax
mov r8, qword [rdi - 0x10]
mov rcx, qword [rbp + 8]
call fcn.1402ba94c
mov edx, dword [rdi - 4]
lea rcx, [rbp + 8]
call fcn.1401fde50
mov edx, dword [rbp + 0x14]
inc edx
lea rcx, [rbp + 8]
call fcn.1401fcb40
movsxd rcx, dword [rbp + 0x14]
mov rax, qword [rbp + 8]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x14]
inc edx
lea rcx, [rbp + 8]
call fcn.1401fde50
mov edi, dword [rbp + 0x14]
add edi, dword [rbp - 0x6c]
mov edx, edi
lea rcx, [rbp + 8]
call fcn.1401fcb40
movsxd r9, dword [rbp - 0x6c]
mov ecx, dword [rbp + 0x10]
movsxd rax, dword [rbp + 0x14]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 8]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp - 0x78]
call fcn.1402ba94c
mov edx, edi
lea rcx, [rbp + 8]
call fcn.1401fde50
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 8]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401dae6e
mov dword [rbp + 0x2a8], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea rax, [rbp + 0x2a8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [rbp + 0x2a8], 0
jbe 0x1401dae61
xor r12d, r12d
lea r15, [0x140346ce0]
or rbx, 0xffffffffffffffff
nop dword [rax]
mov dword [rbp + 0x64c], 0x800
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x64c]
lea r8, [rbp + 0x4230]
mov edx, esi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc esi
test eax, eax
jne 0x1401dae46
cmp word [rbp + 0x4230], 0x7b
jne 0x1401dae4d
lea rdx, [0x140345fb0]
cmp r14, 0xffffffff80000002
lea rax, [0x140345fb8]
cmove rdx, rax
lea rcx, [rbp + 0x130]
call fcn.1401faae0
nop
mov edx, dword [rbp + 0x13c]
inc edx
lea rcx, [rbp + 0x130]
call fcn.1401fcb40
movsxd rcx, dword [rbp + 0x13c]
mov rax, qword [rbp + 0x130]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x13c]
inc edx
lea rcx, [rbp + 0x130]
call fcn.1401fde50
mov edi, dword [rbp + 0x13c]
add edi, dword [rbp + 0x14]
mov edx, edi
lea rcx, [rbp + 0x130]
call fcn.1401fcb40
movsxd r9, dword [rbp + 0x14]
mov ecx, dword [rbp + 0x138]
movsxd rax, dword [rbp + 0x13c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x130]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 8]
call fcn.1402ba94c
mov edx, edi
lea rcx, [rbp + 0x130]
call fcn.1401fde50
mov edx, dword [rbp + 0x13c]
inc edx
lea rcx, [rbp + 0x130]
call fcn.1401fcb40
movsxd rcx, dword [rbp + 0x13c]
mov rax, qword [rbp + 0x130]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x13c]
inc edx
lea rcx, [rbp + 0x130]
call fcn.1401fde50
lea rdx, [rbp + 0x4230]
lea rcx, [rbp + 0x130]
call fcn.1401fb190
lea rax, [rbp + 0x4230]
mov rdi, rbx
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1401dada6
mov qword [rbp + 0x520], r12
test edi, edi
jne 0x1401dadc4
mov qword [rbp + 0x518], r15
jmp 0x1401dadf3
mov edx, edi
lea rcx, [rbp + 0x518]
call fcn.1401fcb40
movsxd r9, edi
mov eax, dword [rbp + 0x520]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x4230]
mov rcx, qword [rbp + 0x518]
call fcn.1402ba94c
mov edx, edi
lea rcx, [rbp + 0x518]
call fcn.1401fde50
nop
lea r8, [rbp + 0x130]
lea rdx, [rbp + 0x518]
mov rcx, r13
call fcn.1401d1a20
nop
cmp dword [rbp + 0x520], 0
jle 0x1401dae2f
mov rcx, qword [rbp + 0x518]
call fcn.1402b7350
nop
cmp dword [rbp + 0x138], 0
jle 0x1401dae4d
mov rcx, qword [rbp + 0x130]
call fcn.1402b7350
jmp 0x1401dae4d
cmp eax, 0x103
je 0x1401dae59
cmp esi, dword [rbp + 0x2a8]
jb 0x1401dac40
mov rbx, qword [rbp - 0x48]
mov r15, qword [rbp - 0x68]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
cmp dword [rbp + 0x10], 0
jle 0x1401dae7d
mov rcx, qword [rbp + 8]
call fcn.1402b7350
cmp byte [rbx + 0x19], 0
jne 0x1401daeda
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401daeb2
mov rbx, rax
mov qword [rbp - 0x48], rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401daeda
nop dword [rax]
mov rbx, rax
mov qword [rbp - 0x48], rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401daea0
jmp 0x1401daeda
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401daed3
nop dword [rax]
cmp rbx, qword [rax + 0x10]
jne 0x1401daed3
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401daec0
mov rbx, rax
mov qword [rbp - 0x48], rax
mov rax, qword [rbp + 0x180]
cmp rbx, rax
jne 0x1401daa91
mov r12d, dword [rsp + 0x60]
inc r12d
mov dword [rsp + 0x60], r12d
inc r15
mov qword [rbp - 0x68], r15
cmp r12d, dword [r13 + 0x18]
jle 0x1401daa70
lea rax, str.ControlPanel
mov qword [rbp + 0xa08], rax
lea rax, str.Desktop
mov qword [rbp + 0xa10], rax
lea rax, str.MyComputer
mov qword [rbp + 0xa18], rax
lea rax, str.NetworkNeighborhood
mov qword [rbp + 0xa20], rax
mov ebx, esi
mov dword [rsp + 0x60], ebx
lea rdi, [rbp + 0xa08]
mov qword [rbp + 0xe0], rdi
mov r14d, 0x5c
nop word [rax + rax]
mov qword [rbp + 0x80], 0
mov edx, 0x32
lea rcx, [rbp + 0x78]
call fcn.1401fcb40
mov eax, dword [rbp + 0x80]
inc eax
movsxd rdx, eax
mov r9d, 0x32
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorer
mov rcx, qword [rbp + 0x78]
call fcn.1402ba94c
mov edx, 0x32
lea rcx, [rbp + 0x78]
call fcn.1401fde50
nop
mov edx, dword [rbp + 0x84]
inc edx
lea rcx, [rbp + 0x78]
call fcn.1401fcb40
movsxd rcx, dword [rbp + 0x84]
mov rax, qword [rbp + 0x78]
mov word [rax + rcx*2], r14w
mov edx, dword [rbp + 0x84]
inc edx
lea rcx, [rbp + 0x78]
call fcn.1401fde50
mov rdx, qword [rdi]
lea rcx, [rbp + 0x78]
call fcn.1401fb190
mov edx, dword [rbp + 0x84]
inc edx
lea rcx, [rbp + 0x78]
call fcn.1401fcb40
movsxd rcx, dword [rbp + 0x84]
mov rax, qword [rbp + 0x78]
mov word [rax + rcx*2], r14w
mov edx, dword [rbp + 0x84]
inc edx
lea rcx, [rbp + 0x78]
call fcn.1401fde50
lea rdx, str.NameSpace
lea rcx, [rbp + 0x78]
call fcn.1401fb190
mov eax, dword [0x140429a18]
lea r15, vtable.Core::Win32::RegistryKey.0
test al, 1
jne 0x1401db061
or eax, 1
mov dword [0x140429a18], eax
mov qword [0x1404299f0], r15
mov qword [0x1404299f8], 0xffffffff80000002
lea rcx, [0x1402fedc0]
call fcn.1402b8a74
mov qword [rbp + 0x798], rsi
lea rax, [rbp + 0x798]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x78]
mov rcx, qword [0x1404299f8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401db510
lea ecx, [rax + 0x10]
call fcn.1402b6dbc
mov r13, rax
mov qword [rbp - 0x68], rax
test rax, rax
je 0x1401db0bb
mov rax, qword [rbp + 0x798]
mov qword [r13], r15
mov qword [r13 + 8], rax
jmp 0x1401db0c2
mov r13, rsi
mov qword [rbp - 0x68], rsi
lea r15, vtable.Core::Array_class_Core::String_.0
test r13, r13
je 0x1401db517
mov qword [rbp + 0x9d8], r15
mov dword [rbp + 0x9e0], esi
mov qword [rbp + 0x9e8], rsi
xor edx, edx
lea rcx, [rbp + 0x9d8]
call fcn.1400c7e30
nop
lea rdx, [rbp + 0x9d8]
mov rcx, r13
call fcn.1400ea910
test al, al
je 0x1401db4ea
mov eax, dword [rbp + 0x9e0]
test eax, eax
jle 0x1401db4ea
mov rsi, qword [rbp + 0x9e8]
mov r15, rsi
mov r12d, eax
mov r13, qword [rbp - 0x80]
nop dword [rax + rax]
mov r8d, 1
lea rdx, [0x140350078]
mov rcx, r15
call fcn.1401ff2c0
test al, al
je 0x1401db4bc
mov r8, qword [rsi]
lea rdx, str.HKLMSOFTWAREClassesCLSID_s_
lea rcx, [rbp + 0x668]
call fcn.1401fcfe0
nop
xor ebx, ebx
mov qword [rbp + 0x3e8], rbx
mov edx, dword [rbp + 0x674]
test edx, edx
jne 0x1401db187
lea r14, [0x140346ce0]
mov qword [rbp + 0x3e0], r14
jmp 0x1401db1c5
lea rcx, [rbp + 0x3e0]
call fcn.1401fcb40
movsxd r9, dword [rbp + 0x674]
mov eax, dword [rbp + 0x3e8]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x668]
mov rcx, qword [rbp + 0x3e0]
call fcn.1402ba94c
mov edx, dword [rbp + 0x674]
lea r14, [0x140346ce0]
lea rcx, [rbp + 0x3e0]
call fcn.1401fde50
nop
lea rdx, str.ShellOpenCommand
lea rcx, [rbp + 0x3e0]
call fcn.1401fb190
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x3e0]
call fcn.1400eb0d0
mov rdi, rax
test rax, rax
je 0x1401db491
mov qword [rbp + 0x2f0], r14
mov qword [rbp + 0x2f8], rbx
lea r8, [rbp + 0x2f0]
mov rdx, qword [0x140416ee8]
mov rcx, rax
call fcn.1400d8ae0
test al, al
je 0x1401db46d
lea rdx, [rbp + 0x2f0]
call fcn.1401d4ec0
cmp dword [rbp + 0x2fc], 2
jle 0x1401db46d
mov r8d, 2
lea rdx, [0x140346b08]
lea rcx, [rbp + 0x2f0]
call fcn.1401fd400
test eax, eax
jle 0x1401db2d0
lea r8d, [rax - 1]
lea rdx, [rbp + 0x8d8]
lea rcx, [rbp + 0x2f0]
call fcn.1401feab0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0x2f0]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0x2f8]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x2f0]
call fcn.1402ba94c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x2f0]
call fcn.1401fde50
nop
cmp dword [rbp + 0x8e0], 0
jle 0x1401db2d0
mov rcx, qword [rbp + 0x8d8]
call fcn.1402b7350
mov r8b, 1
lea rdx, [rbp + 0x2f0]
mov rcx, qword [r13 + 8]
call fcn.1400f8340
mov r14, rax
test rax, rax
je 0x1401db46d
lea rdx, [rbp + 0x668]
mov rcx, rax
call fcn.1400e4160
mov qword [rbp - 0x50], 0
mov edx, 4
lea rcx, [rbp - 0x58]
call fcn.1401fcb40
mov ecx, dword [rbp - 0x50]
inc ecx
movsxd rdx, ecx
mov r9d, 4
lea r8, [0x140345fb8]
mov rcx, qword [rbp - 0x58]
call fcn.1402ba94c
mov edx, 4
lea rcx, [rbp - 0x58]
call fcn.1401fde50
nop
mov edx, dword [rbp - 0x4c]
inc edx
lea rcx, [rbp - 0x58]
call fcn.1401fcb40
movsxd rcx, dword [rbp - 0x4c]
mov rax, qword [rbp - 0x58]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp - 0x4c]
inc edx
lea rcx, [rbp - 0x58]
call fcn.1401fde50
mov ebx, dword [rbp - 0x4c]
add ebx, dword [rbp + 0x84]
mov edx, ebx
lea rcx, [rbp - 0x58]
call fcn.1401fcb40
movsxd r9, dword [rbp + 0x84]
mov ecx, dword [rbp - 0x50]
movsxd rax, dword [rbp - 0x4c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp - 0x58]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x78]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp - 0x58]
call fcn.1401fde50
mov edx, dword [rbp - 0x4c]
inc edx
lea rcx, [rbp - 0x58]
call fcn.1401fcb40
movsxd rcx, dword [rbp - 0x4c]
mov rax, qword [rbp - 0x58]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp - 0x4c]
inc edx
lea rcx, [rbp - 0x58]
call fcn.1401fde50
mov ebx, dword [rbp - 0x4c]
add ebx, dword [rsi + 0xc]
mov edx, ebx
lea rcx, [rbp - 0x58]
call fcn.1401fcb40
movsxd r9, dword [rsi + 0xc]
mov ecx, dword [rbp - 0x50]
movsxd rax, dword [rbp - 0x4c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp - 0x58]
lea rcx, [rax + rcx*2]
mov r8, qword [rsi]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp - 0x58]
call fcn.1401fde50
mov edx, dword [rbp - 0x4c]
inc edx
lea rcx, [rbp - 0x58]
call fcn.1401fcb40
movsxd rcx, dword [rbp - 0x4c]
mov rax, qword [rbp - 0x58]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp - 0x4c]
inc edx
lea rcx, [rbp - 0x58]
call fcn.1401fde50
lea rdx, [rbp - 0x58]
mov rcx, r14
call fcn.1400e4160
nop
cmp dword [rbp - 0x50], 0
jle 0x1401db46d
mov rcx, qword [rbp - 0x58]
call fcn.1402b7350
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
nop
cmp dword [rbp + 0x2f8], 0
jle 0x1401db491
mov rcx, qword [rbp + 0x2f0]
call fcn.1402b7350
nop
cmp dword [rbp + 0x3e8], 0
jle 0x1401db4a7
mov rcx, qword [rbp + 0x3e0]
call fcn.1402b7350
nop
cmp dword [rbp + 0x670], 0
jle 0x1401db4bc
mov rcx, qword [rbp + 0x668]
call fcn.1402b7350
add r15, 0x10
add rsi, 0x10
dec r12
jne 0x1401db130
mov r13, qword [rbp - 0x68]
mov ebx, dword [rsp + 0x60]
mov rdi, qword [rbp + 0xe0]
xor esi, esi
lea r14d, [r12 + 0x5c]
lea r15, vtable.Core::Array_class_Core::String_.0
mov rax, qword [r13]
mov edx, 1
mov rcx, r13
call qword [rax]
nop
mov qword [rbp + 0x9d8], r15
xor edx, edx
lea rcx, [rbp + 0x9d8]
call fcn.1400c7e30
jmp 0x1401db517
lea r15, vtable.Core::Array_class_Core::String_.0
cmp dword [rbp + 0x80], 0
jle 0x1401db529
mov rcx, qword [rbp + 0x78]
call fcn.1402b7350
inc ebx
mov dword [rsp + 0x60], ebx
add rdi, 8
mov qword [rbp + 0xe0], rdi
movsxd rax, ebx
cmp rax, 4
jb 0x1401daf60
mov qword [rbp + 0x278], 0
mov edx, 0x54
lea rcx, [rbp + 0x270]
call fcn.1401fcb40
mov eax, dword [rbp + 0x278]
inc eax
movsxd rdx, eax
mov r9d, 0x54
lea r8, str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionexplorerShellIconOverlayIdentifiers_
mov rcx, qword [rbp + 0x270]
call fcn.1402ba94c
mov edx, 0x54
lea rcx, [rbp + 0x270]
call fcn.1401fde50
nop
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x270]
call fcn.1400eb0d0
mov r12, rax
test rax, rax
je 0x1401db947
mov qword [rbp + 0x9d8], r15
mov dword [rbp + 0x9e0], esi
mov qword [rbp + 0x9e8], rsi
xor edx, edx
lea rcx, [rbp + 0x9d8]
call fcn.1400c7e30
nop
lea rdx, [rbp + 0x9d8]
mov rcx, r12
call fcn.1400ea910
mov r13, qword [rbp - 0x80]
test al, al
je 0x1401db921
mov eax, dword [rbp + 0x9e0]
test eax, eax
jle 0x1401db921
mov r14, qword [rbp + 0x9e8]
lea rdi, [r14 + 0xc]
mov r15d, eax
mov r8d, 1
lea rdx, [0x140350078]
mov rcx, r14
call fcn.1401ff2c0
test al, al
je 0x1401db758
mov qword [rbp + 0x168], 0
mov edx, dword [rbp + 0x27c]
test edx, edx
jne 0x1401db652
lea rax, [0x140346ce0]
mov qword [rbp + 0x160], rax
jmp 0x1401db689
lea rcx, [rbp + 0x160]
call fcn.1401fcb40
movsxd r9, dword [rbp + 0x27c]
mov eax, dword [rbp + 0x168]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x270]
mov rcx, qword [rbp + 0x160]
call fcn.1402ba94c
mov edx, dword [rbp + 0x27c]
lea rcx, [rbp + 0x160]
call fcn.1401fde50
nop
mov ebx, dword [rbp + 0x16c]
add ebx, dword [rdi]
mov edx, ebx
lea rcx, [rbp + 0x160]
call fcn.1401fcb40
movsxd r9, dword [rdi]
mov ecx, dword [rbp + 0x168]
movsxd rax, dword [rbp + 0x16c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x160]
lea rcx, [rax + rcx*2]
mov r8, qword [rdi - 0xc]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x160]
call fcn.1401fde50
mov edx, dword [rbp + 0x16c]
inc edx
lea rcx, [rbp + 0x160]
call fcn.1401fcb40
movsxd rcx, dword [rbp + 0x16c]
mov rax, qword [rbp + 0x160]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x16c]
inc edx
lea rcx, [rbp + 0x160]
call fcn.1401fde50
lea r8, [rbp + 0x160]
mov rdx, r14
mov rcx, r13
call fcn.1401d1a20
nop
cmp dword [rbp + 0x168], 0
jle 0x1401db909
mov rcx, qword [rbp + 0x160]
call fcn.1402b7350
jmp 0x1401db909
xor r8d, r8d
mov rdx, qword [rdi - 0xc]
mov rcx, r12
call fcn.1400ead50
mov rsi, rax
test rax, rax
je 0x1401db907
lea rax, [0x140346ce0]
mov qword [rbp + 0x680], rax
xor ebx, ebx
mov qword [rbp + 0x688], rbx
lea r8, [rbp + 0x680]
xor edx, edx
mov rcx, rsi
call fcn.1400d8ae0
test al, al
je 0x1401db8e4
lea r8d, [rbx + 1]
lea rdx, [0x140350078]
lea rcx, [rbp + 0x680]
call fcn.1401ff2c0
test al, al
je 0x1401db8e4
mov qword [rbp + 0x178], rbx
mov edx, dword [rbp + 0x27c]
test edx, edx
jne 0x1401db7e3
lea rax, [0x140346ce0]
mov qword [rbp + 0x170], rax
jmp 0x1401db81a
lea rcx, [rbp + 0x170]
call fcn.1401fcb40
movsxd r9, dword [rbp + 0x27c]
mov eax, dword [rbp + 0x178]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x270]
mov rcx, qword [rbp + 0x170]
call fcn.1402ba94c
mov edx, dword [rbp + 0x27c]
lea rcx, [rbp + 0x170]
call fcn.1401fde50
nop
mov ebx, dword [rbp + 0x17c]
add ebx, dword [rdi]
mov edx, ebx
lea rcx, [rbp + 0x170]
call fcn.1401fcb40
movsxd r9, dword [rdi]
mov ecx, dword [rbp + 0x178]
movsxd rax, dword [rbp + 0x17c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x170]
lea rcx, [rax + rcx*2]
mov r8, qword [rdi - 0xc]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x170]
call fcn.1401fde50
mov edx, dword [rbp + 0x17c]
inc edx
lea rcx, [rbp + 0x170]
call fcn.1401fcb40
movsxd rcx, dword [rbp + 0x17c]
mov rax, qword [rbp + 0x170]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x17c]
inc edx
lea rcx, [rbp + 0x170]
call fcn.1401fde50
lea r8, [rbp + 0x170]
lea rdx, [rbp + 0x680]
mov rcx, r13
call fcn.1401d1a20
nop
cmp dword [rbp + 0x178], 0
jle 0x1401db8e4
mov rcx, qword [rbp + 0x170]
call fcn.1402b7350
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
nop
cmp dword [rbp + 0x688], 0
jle 0x1401db907
mov rcx, qword [rbp + 0x680]
call fcn.1402b7350
xor esi, esi
add r14, 0x10
add rdi, 0x10
dec r15
jne 0x1401db610
lea r15, vtable.Core::Array_class_Core::String_.0
mov rax, qword [r12]
mov edx, 1
mov rcx, r12
call qword [rax]
nop
mov qword [rbp + 0x9d8], r15
xor edx, edx
lea rcx, [rbp + 0x9d8]
call fcn.1400c7e30
jmp 0x1401db94b
mov r13, qword [rbp - 0x80]
cmp dword [rbp + 0x278], 0
jle 0x1401db960
mov rcx, qword [rbp + 0x270]
call fcn.1402b7350
lea rcx, [rbp + 0x180]
call fcn.140009e30
mov qword [rbp + 0x580], 0
mov edx, 0x35
lea rcx, [rbp + 0x578]
call fcn.1401fcb40
mov eax, dword [rbp + 0x580]
inc eax
movsxd rdx, eax
mov r9d, 0x35
lea r8, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows_
mov rcx, qword [rbp + 0x578]
call fcn.1402ba94c
mov edx, 0x35
lea rcx, [rbp + 0x578]
call fcn.1401fde50
nop
movzx eax, byte [0x14042918a]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x578]
lea rdx, [rbp + 0xac0]
lea rcx, [rbp + 0x180]
call fcn.1400e8550
nop
cmp dword [rbp + 0x580], 0
jle 0x1401db9f9
mov rcx, qword [rbp + 0x578]
call fcn.1402b7350
mov r15d, esi
mov dword [rsp + 0x60], esi
cmp dword [r13 + 0x18], 0
jl 0x1401dbe0d
mov r14, rsi
mov rax, qword [rbp + 0x180]
nop word [rax + rax]
test r15d, r15d
setne sil
add rsi, 0xffffffff80000002
mov rbx, qword [rax]
cmp rbx, rax
je 0x1401dbdf3
xor r12d, r12d
lea r15, [0x140346ce0]
mov edx, dword [rbx + 0x2c]
lea rcx, [rbp - 0x78]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rbp - 0x70]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rbp - 0x78]
call fcn.1402ba94c
mov edx, dword [rbx + 0x2c]
lea rcx, [rbp - 0x78]
call fcn.1401fde50
mov qword [rbp + 0x38], r15
mov qword [rbp + 0x40], r12
lea rcx, [rbp + 0x38]
test r14, r14
jne 0x1401dbaaf
mov edx, dword [rbp - 0x6c]
call fcn.1401fcb40
movsxd r9, dword [rbp - 0x6c]
mov eax, dword [rbp + 0x40]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x78]
mov rcx, qword [rbp + 0x38]
call fcn.1402ba94c
mov edx, dword [rbp - 0x6c]
jmp 0x1401dbb4d
mov rdi, r14
shl rdi, 4
add rdi, qword [r13 + 0x20]
mov edx, dword [rdi - 4]
call fcn.1401fcb40
movsxd r9, dword [rdi - 4]
mov eax, dword [rbp + 0x40]
inc eax
movsxd rdx, eax
mov r8, qword [rdi - 0x10]
mov rcx, qword [rbp + 0x38]
call fcn.1402ba94c
mov edx, dword [rdi - 4]
lea rcx, [rbp + 0x38]
call fcn.1401fde50
mov edx, dword [rbp + 0x44]
inc edx
lea rcx, [rbp + 0x38]
call fcn.1401fcb40
movsxd rcx, dword [rbp + 0x44]
mov rax, qword [rbp + 0x38]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x44]
inc edx
lea rcx, [rbp + 0x38]
call fcn.1401fde50
mov edi, dword [rbp + 0x44]
add edi, dword [rbp - 0x6c]
mov edx, edi
lea rcx, [rbp + 0x38]
call fcn.1401fcb40
movsxd r9, dword [rbp - 0x6c]
mov ecx, dword [rbp + 0x40]
movsxd rax, dword [rbp + 0x44]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x38]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp - 0x78]
call fcn.1402ba94c
mov edx, edi
lea rcx, [rbp + 0x38]
call fcn.1401fde50
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x38]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401dbd80
mov dword [rbp + 0x3a0], 0x800
lea rax, [rbp + 0x3a0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x9a30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.load
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401dbd74
cmp dword [rbp + 0x3a0], eax
jbe 0x1401dbd74
lea rax, [rbp + 0x9a30]
or rdi, 0xffffffffffffffff
nop word [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1401dbbe0
mov qword [rbp + 0x3d8], r12
test edi, edi
jne 0x1401dbbfe
mov qword [rbp + 0x3d0], r15
jmp 0x1401dbc2d
mov edx, edi
lea rcx, [rbp + 0x3d0]
call fcn.1401fcb40
movsxd r9, edi
mov eax, dword [rbp + 0x3d8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x9a30]
mov rcx, qword [rbp + 0x3d0]
call fcn.1402ba94c
mov edx, edi
lea rcx, [rbp + 0x3d0]
call fcn.1401fde50
nop
cmp dword [rbp + 0x3dc], 0
jle 0x1401dbd5f
lea rdx, [rbp + 0x3d0]
call fcn.1401d4ec0
lea rdx, [0x140345fb0]
cmp rsi, 0xffffffff80000002
lea rax, [0x140345fb8]
cmove rdx, rax
lea rcx, [rbp + 0x210]
call fcn.1401faae0
nop
mov edx, dword [rbp + 0x21c]
inc edx
lea rcx, [rbp + 0x210]
call fcn.1401fcb40
movsxd rcx, dword [rbp + 0x21c]
mov rax, qword [rbp + 0x210]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x21c]
inc edx
lea rcx, [rbp + 0x210]
call fcn.1401fde50
mov edi, dword [rbp + 0x21c]
add edi, dword [rbp + 0x44]
mov edx, edi
lea rcx, [rbp + 0x210]
call fcn.1401fcb40
movsxd r9, dword [rbp + 0x44]
mov ecx, dword [rbp + 0x218]
movsxd rax, dword [rbp + 0x21c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x210]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x38]
call fcn.1402ba94c
mov edx, edi
lea rcx, [rbp + 0x210]
call fcn.1401fde50
lea rdx, str.load
lea rcx, [rbp + 0x210]
call fcn.1401fb190
mov r8b, 1
lea rdx, [rbp + 0x3d0]
mov rcx, qword [r13 + 8]
call fcn.1400f8340
test rax, rax
je 0x1401dbd49
lea rdx, [rbp + 0x210]
mov rcx, rax
call fcn.1400eb2a0
nop
cmp dword [rbp + 0x218], 0
jle 0x1401dbd5f
mov rcx, qword [rbp + 0x210]
call fcn.1402b7350
nop
cmp dword [rbp + 0x3d8], 0
jle 0x1401dbd74
mov rcx, qword [rbp + 0x3d0]
call fcn.1402b7350
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0x40], 0
jle 0x1401dbd8f
mov rcx, qword [rbp + 0x38]
call fcn.1402b7350
cmp byte [rbx + 0x19], 0
jne 0x1401dbdde
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401dbdbe
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401dbdde
nop dword [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401dbdb0
jmp 0x1401dbdde
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401dbddb
cmp rbx, qword [rax + 0x10]
jne 0x1401dbddb
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401dbdc8
mov rbx, rax
mov rax, qword [rbp + 0x180]
cmp rbx, rax
jne 0x1401dba44
mov r15d, dword [rsp + 0x60]
inc r15d
mov dword [rsp + 0x60], r15d
inc r14
cmp r15d, dword [r13 + 0x18]
mov esi, 0
jle 0x1401dba20
lea rax, [0x14034be40]
mov qword [rbp + 0x9d8], rax
lea rax, str.exefile
mov qword [rbp + 0x9e0], rax
lea rax, str..pif
mov qword [rbp + 0x9e8], rax
lea rax, str.piffile
mov qword [rbp + 0x9f0], rax
lea rax, str..com
mov qword [rbp + 0x9f8], rax
lea rax, str.comfile
mov qword [rbp + 0xa00], rax
mov eax, esi
mov dword [rsp + 0x70], eax
lea r13, [rbp + 0x9d8]
lea r15, str.Wow6432Node
mov rdi, qword [rbp - 0x80]
nop dword [rax]
mov dword [rsp + 0x60], esi
mov rbx, rsi
mov qword [rbp - 0x68], rbx
cmp dword [rdi + 0x18], 0
jl 0x1401dc7ea
lea rax, [0x140346ce0]
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], r15
jmp 0x1401dbeb7
lea rax, [0x140346ce0]
mov qword [rbp + 0x300], rax
mov qword [rbp + 0x308], 0
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x158], 0
lea rcx, [rbp + 0x300]
test rbx, rbx
jne 0x1401dbf3c
lea edx, [rbx + 4]
mov r12, 0xffffffff80000002
call fcn.1401fcb40
mov eax, dword [rbp + 0x308]
inc eax
movsxd rdx, eax
lea r9d, [rbx + 4]
lea r8, [0x140345fb8]
mov rcx, qword [rbp + 0x300]
call fcn.1402ba94c
lea edx, [rbx + 4]
lea rcx, [rbp + 0x300]
call fcn.1401fde50
mov edx, dword [rbp + 0x15c]
test edx, edx
jle 0x1401dc00c
xor edx, edx
jmp 0x1401dbffa
mov edx, 3
mov r12, 0xffffffff80000003
call fcn.1401fcb40
mov eax, dword [rbp + 0x308]
inc eax
movsxd rdx, eax
mov r9d, 3
lea r8, [0x140345fb0]
mov rcx, qword [rbp + 0x300]
call fcn.1402ba94c
mov edx, 3
lea rcx, [rbp + 0x300]
call fcn.1401fde50
shl rbx, 4
add rbx, qword [rdi + 0x20]
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0x150]
call fcn.1401fcb40
movsxd r9, dword [rbx - 4]
mov eax, dword [rbp + 0x158]
inc eax
movsxd rdx, eax
mov r8, qword [rbx - 0x10]
mov rcx, qword [rbp + 0x150]
call fcn.1402ba94c
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0x150]
call fcn.1401fde50
mov edx, dword [rbp + 0x15c]
inc edx
lea rcx, [rbp + 0x150]
call fcn.1401fcb40
movsxd rcx, dword [rbp + 0x15c]
mov rax, qword [rbp + 0x150]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x15c]
inc edx
lea rcx, [rbp + 0x150]
call fcn.1401fde50
mov edx, dword [rbp + 0x15c]
mov r14d, esi
lea r15, [rbp + 0xd0]
nop word [rax + rax]
mov qword [rbp + 0x2d8], 0
test edx, edx
jne 0x1401dc03f
lea rbx, [0x140346ce0]
mov qword [rbp + 0x2d0], rbx
jmp 0x1401dc07d
lea rcx, [rbp + 0x2d0]
call fcn.1401fcb40
movsxd r9, dword [rbp + 0x15c]
mov eax, dword [rbp + 0x2d8]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x150]
mov rcx, qword [rbp + 0x2d0]
call fcn.1402ba94c
mov edx, dword [rbp + 0x15c]
lea rbx, [0x140346ce0]
lea rcx, [rbp + 0x2d0]
call fcn.1401fde50
nop
lea rdx, str.SOFTWARE
lea rcx, [rbp + 0x2d0]
call fcn.1401fb190
mov rdx, qword [r15]
lea rcx, [rbp + 0x2d0]
call fcn.1401fb190
lea rdx, [0x140345f98]
lea rcx, [rbp + 0x2d0]
call fcn.1401fb190
lea rdx, str.Classes
lea rcx, [rbp + 0x2d0]
call fcn.1401fb190
lea rax, [rbp + 0x4b0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x2d0]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401dc766
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], 0
mov rdx, qword [0x140416ee8]
lea rcx, [rbp + 0x3f0]
call fcn.1401faae0
nop
mov rdx, qword [0x140416ee8]
lea rcx, [rbp + 0x330]
call fcn.1401faae0
nop
mov rdx, qword [0x140416ee8]
lea rcx, [rbp + 0x320]
call fcn.1401faae0
nop
mov dword [rbp + 0xf8], 0x800
mov rsi, qword [r13]
lea r9, [rbp + 0xf8]
lea r8, [rbp + 0x1630]
mov rdx, rsi
mov rcx, qword [rbp + 0x4b0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x1401dc2e6
lea rax, [rbp + 0x1630]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401dc190
test ebx, ebx
jle 0x1401dc1cf
mov edx, ebx
lea rcx, [rbp + 0x3f0]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp + 0x3f8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1630]
mov rcx, qword [rbp + 0x3f0]
call fcn.1402ba94c
jmp 0x1401dc1d8
cmp dword [rbp + 0x3fc], 0
jle 0x1401dc1e6
mov edx, ebx
lea rcx, [rbp + 0x3f0]
call fcn.1401fde50
mov r8, qword [rbp + 0x3f0]
lea rdx, str._s_shellopencommand
lea rcx, [rbp + 0x8f8]
call fcn.1401fcfe0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0x90]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0x98]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x90]
call fcn.1402ba94c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x90]
call fcn.1401fde50
nop
cmp dword [rbp + 0x900], 0
jle 0x1401dc255
mov rcx, qword [rbp + 0x8f8]
call fcn.1402b7350
mov dword [rbp + 0xf8], 0x800
lea r9, [rbp + 0xf8]
lea r8, [rbp + 0x1630]
mov rdx, qword [rbp + 0x90]
mov rcx, qword [rbp + 0x4b0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x1401dc2e6
lea rax, [rbp + 0x1630]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401dc290
test ebx, ebx
jle 0x1401dc2cf
mov edx, ebx
lea rcx, [rbp + 0x330]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp + 0x338]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1630]
mov rcx, qword [rbp + 0x330]
call fcn.1402ba94c
jmp 0x1401dc2d8
cmp dword [rbp + 0x33c], 0
jle 0x1401dc2e6
mov edx, ebx
lea rcx, [rbp + 0x330]
call fcn.1401fde50
mov r8, rsi
lea rdx, str._s_shellopencommand
lea rcx, [rbp + 0x918]
call fcn.1401fcfe0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0x90]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0x98]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x90]
call fcn.1402ba94c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x90]
call fcn.1401fde50
nop
cmp dword [rbp + 0x920], 0
jle 0x1401dc351
mov rcx, qword [rbp + 0x918]
call fcn.1402b7350
mov dword [rbp + 0xf8], 0x800
lea r9, [rbp + 0xf8]
lea r8, [rbp + 0x1630]
mov rdx, qword [rbp + 0x90]
mov rcx, qword [rbp + 0x4b0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
or rdx, 0xffffffffffffffff
test eax, eax
jne 0x1401dc3ea
lea rax, [rbp + 0x1630]
mov rbx, rdx
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401dc390
test ebx, ebx
jle 0x1401dc3cf
mov edx, ebx
lea rcx, [rbp + 0x320]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp + 0x328]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1630]
mov rcx, qword [rbp + 0x320]
call fcn.1402ba94c
jmp 0x1401dc3d8
cmp dword [rbp + 0x32c], 0
jle 0x1401dc3ea
mov edx, ebx
lea rcx, [rbp + 0x320]
call fcn.1401fde50
or rdx, 0xffffffffffffffff
mov rcx, qword [rbp + 0x330]
test rcx, rcx
je 0x1401dc576
mov rax, rdx
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1401dc400
test rax, rax
sete al
test al, al
jne 0x1401dc576
mov r8d, 1
lea rdx, [0x140364a48]
lea rcx, [rbp + 0x330]
call fcn.1401ff2c0
test al, al
jne 0x1401dc576
xor eax, eax
mov qword [rbp + 0x468], rax
mov edx, dword [rbp + 0x33c]
test edx, edx
jne 0x1401dc45c
lea rax, [0x140346ce0]
mov qword [rbp + 0x460], rax
jmp 0x1401dc493
lea rcx, [rbp + 0x460]
call fcn.1401fcb40
movsxd r9, dword [rbp + 0x33c]
mov eax, dword [rbp + 0x468]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x330]
mov rcx, qword [rbp + 0x460]
call fcn.1402ba94c
mov edx, dword [rbp + 0x33c]
lea rcx, [rbp + 0x460]
call fcn.1401fde50
nop
lea rdx, [rbp + 0x460]
call fcn.1401d4ec0
mov r8b, 1
lea rdx, [rbp + 0x460]
mov rcx, qword [rdi + 8]
call fcn.1400f8340
mov rdi, rax
test rax, rax
je 0x1401dc55d
mov rcx, qword [rbp + 0x3f0]
mov qword [rsp + 0x20], rcx
mov r9, qword [rbp + 0x2d0]
mov r8, qword [rbp + 0x300]
lea rdx, str._s_s_s_shellopencommand_
lea rcx, [rbp + 0x938]
call fcn.1401fcfe0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0x90]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0x98]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x90]
call fcn.1402ba94c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x90]
call fcn.1401fde50
nop
cmp dword [rbp + 0x940], 0
jle 0x1401dc54d
mov rcx, qword [rbp + 0x938]
call fcn.1402b7350
lea rdx, [rbp + 0x90]
mov rcx, rdi
call fcn.1400eb2a0
nop
cmp dword [rbp + 0x468], 0
jle 0x1401dc572
mov rcx, qword [rbp + 0x460]
call fcn.1402b7350
mov rdi, qword [rbp - 0x80]
mov rcx, qword [rbp + 0x320]
test rcx, rcx
je 0x1401dc6fb
or rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1401dc590
test rax, rax
sete al
test al, al
jne 0x1401dc6fb
mov r8d, 1
lea rdx, [0x140364a48]
lea rcx, [rbp + 0x320]
call fcn.1401ff2c0
test al, al
jne 0x1401dc6fb
xor eax, eax
mov qword [rbp + 0x488], rax
mov edx, dword [rbp + 0x32c]
test edx, edx
jne 0x1401dc5ec
lea rax, [0x140346ce0]
mov qword [rbp + 0x480], rax
jmp 0x1401dc623
lea rcx, [rbp + 0x480]
call fcn.1401fcb40
movsxd r9, dword [rbp + 0x32c]
mov eax, dword [rbp + 0x488]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x320]
mov rcx, qword [rbp + 0x480]
call fcn.1402ba94c
mov edx, dword [rbp + 0x32c]
lea rcx, [rbp + 0x480]
call fcn.1401fde50
nop
lea rdx, [rbp + 0x480]
call fcn.1401d4ec0
mov r8b, 1
lea rdx, [rbp + 0x480]
mov rcx, qword [rdi + 8]
call fcn.1400f8340
mov rdi, rax
test rax, rax
je 0x1401dc6e6
mov qword [rsp + 0x20], rsi
mov r9, qword [rbp + 0x2d0]
mov r8, qword [rbp + 0x300]
lea rdx, str._s_s_s_shellopencommand_
lea rcx, [rbp + 0x958]
call fcn.1401fcfe0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0x90]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0x98]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x90]
call fcn.1402ba94c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x90]
call fcn.1401fde50
nop
cmp dword [rbp + 0x960], 0
jle 0x1401dc6d6
mov rcx, qword [rbp + 0x958]
call fcn.1402b7350
lea rdx, [rbp + 0x90]
mov rcx, rdi
call fcn.1400eb2a0
nop
cmp dword [rbp + 0x488], 0
jle 0x1401dc6fb
mov rcx, qword [rbp + 0x480]
call fcn.1402b7350
mov rcx, qword [rbp + 0x4b0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0x328], 0
jle 0x1401dc71f
mov rcx, qword [rbp + 0x320]
call fcn.1402b7350
nop
cmp dword [rbp + 0x338], 0
jle 0x1401dc735
mov rcx, qword [rbp + 0x330]
call fcn.1402b7350
nop
cmp dword [rbp + 0x3f8], 0
jle 0x1401dc74b
mov rcx, qword [rbp + 0x3f0]
call fcn.1402b7350
nop
cmp dword [rbp + 0x98], 0
jle 0x1401dc760
mov rcx, qword [rbp + 0x90]
call fcn.1402b7350
xor esi, esi
mov rdi, qword [rbp - 0x80]
cmp dword [rbp + 0x2d8], 0
jle 0x1401dc77b
mov rcx, qword [rbp + 0x2d0]
call fcn.1402b7350
inc r14d
add r15, 8
movsxd rax, r14d
cmp rax, 2
jae 0x1401dc796
mov edx, dword [rbp + 0x15c]
jmp 0x1401dc020
cmp dword [rbp + 0x158], 0
jle 0x1401dc7ac
mov rcx, qword [rbp + 0x150]
call fcn.1402b7350
nop
cmp dword [rbp + 0x308], 0
jle 0x1401dc7c1
mov rcx, qword [rbp + 0x300]
call fcn.1402b7350
mov eax, dword [rsp + 0x60]
inc eax
mov dword [rsp + 0x60], eax
mov rbx, qword [rbp - 0x68]
inc rbx
mov qword [rbp - 0x68], rbx
cmp eax, dword [rdi + 0x18]
jle 0x1401dbeb0
mov eax, dword [rsp + 0x70]
lea r15, str.Wow6432Node
inc eax
mov dword [rsp + 0x70], eax
add r13, 0x10
cdqe
cmp rax, 3
mov eax, dword [rsp + 0x70]
jb 0x1401dbe80
mov r14d, esi
mov r13, qword [rbp - 0x80]
lea r12, [0x140346ce0]
cmp dword [rdi + 0x18], 0
jl 0x1401dcbd6
mov rdi, rsi
or r15, 0xffffffffffffffff
mov qword [rbp + 0x1a0], r12
mov qword [rbp + 0x1a8], 0
test rdi, rdi
jne 0x1401dc846
mov rsi, 0xffffffff80000002
jmp 0x1401dc8d4
mov rsi, 0xffffffff80000003
mov rbx, rdi
shl rbx, 4
add rbx, qword [r13 + 0x20]
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0x1a0]
call fcn.1401fcb40
movsxd r9, dword [rbx - 4]
mov eax, dword [rbp + 0x1a8]
inc eax
movsxd rdx, eax
mov r8, qword [rbx - 0x10]
mov rcx, qword [rbp + 0x1a0]
call fcn.1402ba94c
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0x1a0]
call fcn.1401fde50
mov edx, dword [rbp + 0x1ac]
inc edx
lea rcx, [rbp + 0x1a0]
call fcn.1401fcb40
movsxd rcx, dword [rbp + 0x1ac]
mov rax, qword [rbp + 0x1a0]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x1ac]
inc edx
lea rcx, [rbp + 0x1a0]
call fcn.1401fde50
lea rdx, str.SOFTWAREClasses
lea rcx, [rbp + 0x1a0]
call fcn.1401fb190
lea rax, [rbp + 0x6f0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x1a0]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401dcba8
mov dword [rbp + 0x654], 0x100
lea r9, [rbp + 0x654]
lea r8, [rbp + 0xf00]
lea rdx, [0x14034be40]
mov rcx, qword [rbp + 0x6f0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x1401dcb9a
lea r8, [rbp + 0xf00]
lea rdx, str._s_shellopencommand_
lea rcx, [rbp + 0x730]
call fcn.1401fcfe0
nop
mov dword [rbp + 0x650], 0x400
lea r9, [rbp + 0x650]
lea r8, [rbp + 0x3630]
mov rdx, qword [rbp + 0x730]
mov rcx, qword [rbp + 0x6f0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x1401dcb85
lea rax, [rbp + 0x3630]
mov rbx, r15
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401dc9a1
xor eax, eax
mov qword [rbp + 0x3b0], rax
test ebx, ebx
jne 0x1401dc9c1
mov qword [rbp + 0x3a8], r12
jmp 0x1401dc9f0
mov edx, ebx
lea rcx, [rbp + 0x3a8]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp + 0x3b0]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x3630]
mov rcx, qword [rbp + 0x3a8]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x3a8]
call fcn.1401fde50
nop
mov r8d, 1
lea rdx, [0x140364a48]
lea rcx, [rbp + 0x3a8]
call fcn.1401ff2c0
test al, al
jne 0x1401dcb6f
lea rdx, [rbp + 0x3a8]
call fcn.1401d4ec0
lea rdx, [0x140345fb0]
cmp rsi, 0xffffffff80000002
lea rax, [0x140345fb8]
cmove rdx, rax
lea rcx, [rbp + 0x48]
call fcn.1401faae0
nop
mov edx, dword [rbp + 0x54]
inc edx
lea rcx, [rbp + 0x48]
call fcn.1401fcb40
movsxd rcx, dword [rbp + 0x54]
mov rax, qword [rbp + 0x48]
mov esi, 0x5c
mov word [rax + rcx*2], si
mov edx, dword [rbp + 0x54]
inc edx
lea rcx, [rbp + 0x48]
call fcn.1401fde50
mov ebx, dword [rbp + 0x54]
add ebx, dword [rbp + 0x1ac]
mov edx, ebx
lea rcx, [rbp + 0x48]
call fcn.1401fcb40
movsxd r9, dword [rbp + 0x1ac]
mov ecx, dword [rbp + 0x50]
movsxd rax, dword [rbp + 0x54]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x48]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x1a0]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x48]
call fcn.1401fde50
mov edx, dword [rbp + 0x54]
inc edx
lea rcx, [rbp + 0x48]
call fcn.1401fcb40
movsxd rcx, dword [rbp + 0x54]
mov rax, qword [rbp + 0x48]
mov word [rax + rcx*2], si
mov edx, dword [rbp + 0x54]
inc edx
lea rcx, [rbp + 0x48]
call fcn.1401fde50
mov ebx, dword [rbp + 0x73c]
add ebx, dword [rbp + 0x54]
mov edx, ebx
lea rcx, [rbp + 0x48]
call fcn.1401fcb40
movsxd r9, dword [rbp + 0x73c]
mov ecx, dword [rbp + 0x50]
movsxd rax, dword [rbp + 0x54]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x48]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x730]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x48]
call fcn.1401fde50
mov r8b, 1
lea rdx, [rbp + 0x3a8]
mov rcx, qword [r13 + 8]
call fcn.1400f8340
test rax, rax
je 0x1401dcb5f
lea rdx, [rbp + 0x48]
mov rcx, rax
call fcn.1400eb2a0
nop
cmp dword [rbp + 0x50], 0
jle 0x1401dcb6f
mov rcx, qword [rbp + 0x48]
call fcn.1402b7350
nop
cmp dword [rbp + 0x3b0], 0
jle 0x1401dcb85
mov rcx, qword [rbp + 0x3a8]
call fcn.1402b7350
nop
cmp dword [rbp + 0x738], 0
jle 0x1401dcb9a
mov rcx, qword [rbp + 0x730]
call fcn.1402b7350
mov rcx, qword [rbp + 0x6f0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0x1a8], 0
jle 0x1401dcbbd
mov rcx, qword [rbp + 0x1a0]
call fcn.1402b7350
inc r14d
inc rdi
cmp r14d, dword [r13 + 0x18]
jle 0x1401dc823
xor esi, esi
lea r15, str.Wow6432Node
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r15
mov r15d, esi
mov dword [rsp + 0x60], esi
lea r12, [rbp + 0xd0]
mov qword [rbp - 0x68], r12
nop word [rax + rax]
lea r8, str.SOFTWARE
mov edx, 0x104
lea rcx, [rbp + 0xae0]
call fcn.1402b6e28
mov r8, qword [r12]
mov edx, 0x104
lea rcx, [rbp + 0xae0]
call fcn.1402b9308
lea r8, str.ClientsStartMenuInternet_
mov edx, 0x104
lea rcx, [rbp + 0xae0]
call fcn.1402b9308
call fcn.1400eb080
mov qword [rbp + 0x790], rsi
lea rcx, [rbp + 0x790]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0xae0]
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401dd037
lea ecx, [rax + 0x10]
call fcn.1402b6dbc
mov r14, rax
mov qword [rbp + 0xc0], rax
lea rbx, vtable.Core::Array_class_Core::String_.0
test rax, rax
je 0x1401dd03e
mov rcx, qword [rbp + 0x790]
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [r14], rax
mov qword [r14 + 8], rcx
mov qword [rbp + 0x9d8], rbx
mov dword [rbp + 0x9e0], esi
mov qword [rbp + 0x9e8], rsi
xor edx, edx
lea rcx, [rbp + 0x9d8]
call fcn.1400c7e30
nop
lea rdx, [rbp + 0x9d8]
mov rcx, r14
call fcn.1400ea910
test al, al
je 0x1401dd012
mov eax, dword [rbp + 0x9e0]
test eax, eax
jle 0x1401dd012
mov rdi, qword [rbp + 0x9e8]
mov esi, eax
xor r14d, r14d
lea r15, [0x140346ce0]
or r12, 0xffffffffffffffff
nop word [rax + rax]
lea r8, [rbp + 0xae0]
mov edx, 0x104
lea rcx, [rbp + 0xcf0]
call fcn.1402b6e28
mov r8, qword [rdi]
mov edx, 0x104
lea rcx, [rbp + 0xcf0]
call fcn.1402b9308
lea r8, str._shellopencommand
mov edx, 0x104
lea rcx, [rbp + 0xcf0]
call fcn.1402b9308
mov dword [rbp + 0x6d8], 0x208
lea r9, [rbp + 0x6d8]
lea r8, [rbp + 0x1420]
lea rdx, [rbp + 0xcf0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x1401dcfee
lea rax, [rbp + 0x1420]
mov rbx, r12
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401dcda2
mov qword [rbp + 0xa8], r14
test ebx, ebx
jne 0x1401dcdc0
mov qword [rbp + 0xa0], r15
jmp 0x1401dcdef
mov edx, ebx
lea rcx, [rbp + 0xa0]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rbp + 0xa8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1420]
mov rcx, qword [rbp + 0xa0]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0xa0]
call fcn.1401fde50
nop
mov r8d, 1
lea rdx, [0x14034f2fc]
lea rcx, [rbp + 0xa0]
call fcn.1401ff2c0
lea rcx, [rbp + 0xa0]
test al, al
je 0x1401dceb3
mov r8d, 1
lea rdx, [0x14034f2fc]
call fcn.1401fd400
test eax, eax
jle 0x1401dcf32
lea r9d, [rax - 1]
mov r8d, 1
lea rdx, [rbp + 0x978]
lea rcx, [rbp + 0xa0]
call fcn.1401fed70
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0xa0]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0xa8]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0xa0]
call fcn.1402ba94c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0xa0]
call fcn.1401fde50
nop
cmp dword [rbp + 0x980], 0
jle 0x1401dcf32
mov rcx, qword [rbp + 0x978]
jmp 0x1401dcf2d
lea rdx, str..exe
call fcn.1401fd2e0
test eax, eax
js 0x1401dcf32
lea r9d, [rax + 4]
xor r8d, r8d
lea rdx, [rbp + 0x998]
lea rcx, [rbp + 0xa0]
call fcn.1401fed70
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0xa0]
call fcn.1401fcb40
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0xa8]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0xa0]
call fcn.1402ba94c
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0xa0]
call fcn.1401fde50
nop
cmp dword [rbp + 0x9a0], 0
jle 0x1401dcf32
mov rcx, qword [rbp + 0x998]
call fcn.1402b7350
lea rdx, [rbp + 0xa0]
call fcn.1401d4ec0
cmp dword [rbp + 0xac], 0
jle 0x1401dcfd9
mov r8b, 1
lea rdx, [rbp + 0xa0]
mov rcx, qword [r13 + 8]
call fcn.1400f8340
mov rbx, rax
test rax, rax
je 0x1401dcfd9
lea rdx, [0x140345fb8]
lea rcx, [rbp + 0x740]
call fcn.1401faae0
nop
lea rdx, [0x140345f98]
lea rcx, [rbp + 0x740]
call fcn.1401fb190
lea rdx, [rbp + 0xcf0]
lea rcx, [rbp + 0x740]
call fcn.1401fb190
lea rdx, [0x140345f98]
lea rcx, [rbp + 0x740]
call fcn.1401fb190
lea rdx, [rbp + 0x740]
mov rcx, rbx
call fcn.1400eb2a0
nop
cmp dword [rbp + 0x748], 0
jle 0x1401dcfd9
mov rcx, qword [rbp + 0x740]
call fcn.1402b7350
nop
cmp dword [rbp + 0xa8], 0
jle 0x1401dcfee
mov rcx, qword [rbp + 0xa0]
call fcn.1402b7350
add rdi, 0x10
dec rsi
jne 0x1401dcd20
mov r14, qword [rbp + 0xc0]
mov r15d, dword [rsp + 0x60]
mov r12, qword [rbp - 0x68]
lea rbx, vtable.Core::Array_class_Core::String_.0
mov rax, qword [r14]
mov edx, 1
mov rcx, r14
call qword [rax]
nop
mov qword [rbp + 0x9d8], rbx
xor edx, edx
lea rcx, [rbp + 0x9d8]
call fcn.1400c7e30
jmp 0x1401dd03e
lea rbx, vtable.Core::Array_class_Core::String_.0
inc r15d
mov dword [rsp + 0x60], r15d
add r12, 8
mov qword [rbp - 0x68], r12
movsxd rax, r15d
cmp rax, 2
jb 0x1401dcc00
lea rdx, str.HKLMSOFTWAREMozillaPlugins
lea rcx, [rbp + 0x6b0]
call fcn.1401faae0
nop
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x6b0]
call fcn.1400eb0d0
mov r12, rax
test rax, rax
je 0x1401dd32a
mov qword [rbp + 0x9d8], rbx
mov dword [rbp + 0x9e0], esi
mov qword [rbp + 0x9e8], rsi
xor edx, edx
lea rcx, [rbp + 0x9d8]
call fcn.1400c7e30
nop
lea rdx, [rbp + 0x9d8]
mov rcx, r12
call fcn.1400ea910
test al, al
je 0x1401dd305
mov eax, dword [rbp + 0x9e0]
test eax, eax
jle 0x1401dd305
mov rsi, qword [rbp + 0x9e8]
mov r15d, eax
lea r14, [0x140346ce0]
nop word [rax + rax]
xor r8d, r8d
mov rdx, qword [rsi]
mov rcx, r12
call fcn.1400ead50
mov rdi, rax
test rax, rax
je 0x1401dd2ef
mov qword [rbp + 0x698], r14
xor ebx, ebx
mov qword [rbp + 0x6a0], rbx
mov qword [rbp + 0x760], r14
mov qword [rbp + 0x768], rbx
lea r8, [rbp + 0x698]
lea rdx, str.Path
mov rcx, rax
call fcn.1400d8ae0
test al, al
je 0x1401dd2b6
xor r8d, r8d
lea rdx, str.disabled
lea rcx, [rbp + 0x698]
call fcn.1401fce20
test al, al
jne 0x1401dd2b6
mov r8b, 1
lea rdx, [rbp + 0x698]
mov rcx, qword [r13 + 8]
call fcn.1400f8340
mov r14, rax
test rax, rax
je 0x1401dd2af
mov qword [rbp + 0x1f8], rbx
mov edx, dword [rbp + 0x6bc]
test edx, edx
jne 0x1401dd1a4
lea rax, [0x140346ce0]
mov qword [rbp + 0x1f0], rax
jmp 0x1401dd1db
lea rcx, [rbp + 0x1f0]
call fcn.1401fcb40
movsxd r9, dword [rbp + 0x6bc]
mov eax, dword [rbp + 0x1f8]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x6b0]
mov rcx, qword [rbp + 0x1f0]
call fcn.1402ba94c
mov edx, dword [rbp + 0x6bc]
lea rcx, [rbp + 0x1f0]
call fcn.1401fde50
nop
lea rdx, [0x140345f98]
lea rcx, [rbp + 0x1f0]
call fcn.1401fb190
mov ebx, dword [rbp + 0x1fc]
add ebx, dword [rsi + 0xc]
mov edx, ebx
lea rcx, [rbp + 0x1f0]
call fcn.1401fcb40
movsxd r9, dword [rsi + 0xc]
mov ecx, dword [rbp + 0x1f8]
movsxd rax, dword [rbp + 0x1fc]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x1f0]
lea rcx, [rax + rcx*2]
mov r8, qword [rsi]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x1f0]
call fcn.1401fde50
lea rdx, [0x140345f98]
lea rcx, [rbp + 0x1f0]
call fcn.1401fb190
lea rdx, [rbp + 0x1f0]
mov rcx, r14
call fcn.1400eb2a0
lea r8, [rbp + 0x760]
lea rdx, str.XPTPath
mov rcx, rdi
call fcn.1400d8ae0
test al, al
je 0x1401dd29a
lea rdx, [rbp + 0x760]
mov rcx, r14
call fcn.1400e4160
nop
cmp dword [rbp + 0x1f8], 0
jle 0x1401dd2af
mov rcx, qword [rbp + 0x1f0]
call fcn.1402b7350
lea r14, [0x140346ce0]
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
nop
cmp dword [rbp + 0x768], 0
jle 0x1401dd2da
mov rcx, qword [rbp + 0x760]
call fcn.1402b7350
nop
cmp dword [rbp + 0x6a0], 0
jle 0x1401dd2ef
mov rcx, qword [rbp + 0x698]
call fcn.1402b7350
add rsi, 0x10
dec r15
jne 0x1401dd0f0
xor esi, esi
lea rbx, vtable.Core::Array_class_Core::String_.0
mov rax, qword [r12]
mov edx, 1
mov rcx, r12
call qword [rax]
nop
mov qword [rbp + 0x9d8], rbx
xor edx, edx
lea rcx, [rbp + 0x9d8]
call fcn.1400c7e30
nop
cmp dword [rbp + 0x6b8], 0
jle 0x1401dd33f
mov rcx, qword [rbp + 0x6b0]
call fcn.1402b7350
lea rdx, str.HKLMSOFTWAREClassesDirectoryShellexCopyHookHandlers
lea rcx, [rbp + 0x6e0]
call fcn.1401faae0
nop
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x6e0]
call fcn.1400eb0d0
mov r15, rax
test rax, rax
je 0x1401dd590
mov qword [rbp + 0x9d8], rbx
mov dword [rbp + 0x9e0], esi
mov qword [rbp + 0x9e8], rsi
xor edx, edx
lea rcx, [rbp + 0x9d8]
call fcn.1400c7e30
nop
lea rdx, [rbp + 0x9d8]
mov rcx, r15
call fcn.1400ea910
test al, al
je 0x1401dd56c
mov eax, dword [rbp + 0x9e0]
test eax, eax
jle 0x1401dd56c
mov rdi, qword [rbp + 0x9e8]
mov r14d, eax
xor r8d, r8d
mov rdx, qword [rdi]
mov rcx, r15
call fcn.1400ead50
mov rsi, rax
test rax, rax
je 0x1401dd556
lea r12, [0x140346ce0]
mov qword [rbp + 0x6c8], r12
xor ebx, ebx
mov qword [rbp + 0x6d0], rbx
lea r8, [rbp + 0x6c8]
xor edx, edx
mov rcx, rax
call fcn.1400d8ae0
test al, al
je 0x1401dd533
lea r8d, [rbx + 1]
lea rdx, [0x140350078]
lea rcx, [rbp + 0x6c8]
call fcn.1401ff2c0
test al, al
je 0x1401dd533
mov qword [rbp + 0x60], rbx
mov edx, dword [rbp + 0x6ec]
test edx, edx
jne 0x1401dd43f
mov qword [rbp + 0x58], r12
jmp 0x1401dd46d
lea rcx, [rbp + 0x58]
call fcn.1401fcb40
movsxd r9, dword [rbp + 0x6ec]
mov eax, dword [rbp + 0x60]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x6e0]
mov rcx, qword [rbp + 0x58]
call fcn.1402ba94c
mov edx, dword [rbp + 0x6ec]
lea rcx, [rbp + 0x58]
call fcn.1401fde50
nop
mov edx, dword [rbp + 0x64]
inc edx
lea rcx, [rbp + 0x58]
call fcn.1401fcb40
movsxd rcx, dword [rbp + 0x64]
mov rax, qword [rbp + 0x58]
mov r12d, 0x5c
mov word [rax + rcx*2], r12w
mov edx, dword [rbp + 0x64]
inc edx
lea rcx, [rbp + 0x58]
call fcn.1401fde50
mov ebx, dword [rbp + 0x64]
add ebx, dword [rdi + 0xc]
mov edx, ebx
lea rcx, [rbp + 0x58]
call fcn.1401fcb40
movsxd r9, dword [rdi + 0xc]
mov ecx, dword [rbp + 0x60]
movsxd rax, dword [rbp + 0x64]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x58]
lea rcx, [rax + rcx*2]
mov r8, qword [rdi]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x58]
call fcn.1401fde50
mov edx, dword [rbp + 0x64]
inc edx
lea rcx, [rbp + 0x58]
call fcn.1401fcb40
movsxd rcx, dword [rbp + 0x64]
mov rax, qword [rbp + 0x58]
mov word [rax + rcx*2], r12w
mov edx, dword [rbp + 0x64]
inc edx
lea rcx, [rbp + 0x58]
call fcn.1401fde50
lea r8, [rbp + 0x58]
lea rdx, [rbp + 0x6c8]
mov rcx, r13
call fcn.1401d1a20
nop
cmp dword [rbp + 0x60], 0
jle 0x1401dd533
mov rcx, qword [rbp + 0x58]
call fcn.1402b7350
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
nop
cmp dword [rbp + 0x6d0], 0
jle 0x1401dd556
mov rcx, qword [rbp + 0x6c8]
call fcn.1402b7350
add rdi, 0x10
dec r14
jne 0x1401dd3c2
xor esi, esi
lea rbx, vtable.Core::Array_class_Core::String_.0
mov rax, qword [r15]
mov edx, 1
mov rcx, r15
call qword [rax]
nop
mov qword [rbp + 0x9d8], rbx
xor edx, edx
lea rcx, [rbp + 0x9d8]
call fcn.1400c7e30
nop
cmp dword [rbp + 0x6e8], 0
jle 0x1401dd5a5
mov rcx, qword [rbp + 0x6e0]
call fcn.1402b7350
lea rdx, str.HKLMSOFTWAREWow6432NodeMozillaFirefoxExtensions
lea rcx, [rbp + 0x6f8]
call fcn.1401faae0
nop
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x6f8]
call fcn.1400eb0d0
mov r12, rax
test rax, rax
je 0x1401dda37
mov qword [rbp + 0x9d8], rbx
mov dword [rbp + 0x9e0], esi
mov qword [rbp + 0x9e8], rsi
xor edx, edx
lea rcx, [rbp + 0x9d8]
call fcn.1400c7e30
nop
lea rdx, [rbp + 0x9d8]
mov rcx, r12
call fcn.1400eabf0
test al, al
je 0x1401dda21
mov ecx, dword [rbp + 0x9e0]
test ecx, ecx
jle 0x1401dda21
mov rsi, qword [rbp + 0x9e8]
add rsi, 0xc
mov r15d, ecx
lea r14, vtable.Core::ByteArray.0
xor ebx, ebx
nop word [rax + rax]
mov qword [rbp + 0x368], 0
mov edx, dword [rsi]
test edx, edx
jne 0x1401dd661
lea rdi, [0x140346ce0]
mov qword [rbp + 0x360], rdi
jmp 0x1401dd692
lea rcx, [rbp + 0x360]
call fcn.1401fcb40
movsxd r9, dword [rsi]
mov eax, dword [rbp + 0x368]
inc eax
movsxd rdx, eax
mov r8, qword [rsi - 0xc]
mov rcx, qword [rbp + 0x360]
call fcn.1402ba94c
lea rdi, [0x140346ce0]
mov edx, dword [rsi]
lea rcx, [rbp + 0x360]
call fcn.1401fde50
nop
mov r8d, 1
lea rdx, [0x140350078]
lea rcx, [rbp + 0x360]
call fcn.1401ff2c0
test al, al
je 0x1401dd9f6
mov qword [rbp + 0x310], rdi
mov qword [rbp + 0x318], 0
lea r8, [rbp + 0x310]
mov rdx, qword [rbp + 0x360]
mov rcx, r12
call fcn.1400d8ae0
test al, al
je 0x1401dd9e0
lea rdx, str.chromecontentoverlay.xul
lea rcx, [rbp + 0x838]
call fcn.1401faae0
nop
lea r8, [rbp + 0x838]
lea rdx, [rbp + 0x310]
lea rcx, [rbp + 0x7f8]
call fcn.1400d2ba0
nop
cmp dword [rbp + 0x840], 0
jle 0x1401dd736
mov rcx, qword [rbp + 0x838]
call fcn.1402b7350
mov qword [rbp + 0xa08], r14
mov dword [rbp + 0xa10], ebx
mov qword [rbp + 0xa18], rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rbp + 0xa20], rax
lea rdx, [rbp + 0xa08]
lea rcx, [rbp + 0x7f8]
call fcn.140206130
mov r14, qword [rbp + 0xa18]
test al, al
je 0x1401dd992
mov qword [rbp + 0xa30], 0
movups xmm0, xmmword [0x140328970]
movups xmmword [rbp + 0xa38], xmm0
movups xmm1, xmmword [0x140328980]
movups xmmword [rbp + 0xa48], xmm1
lea r8, [rbp + 0xa30]
mov edx, dword [rbp + 0xa10]
mov rcx, r14
call fcn.14018c2d0
lea rdx, [rbp + 0xa30]
lea rcx, [rbp + 0xac0]
call fcn.14018c3c0
mov r8b, 1
lea rdx, [rbp + 0x7f8]
mov rcx, qword [r13 + 8]
call fcn.1400f8340
mov rdi, rax
test rax, rax
je 0x1401dd992
mov qword [rbp + 0x248], 0
mov edx, dword [rbp + 0x704]
test edx, edx
jne 0x1401dd80c
lea rax, [0x140346ce0]
mov qword [rbp + 0x240], rax
jmp 0x1401dd843
lea rcx, [rbp + 0x240]
call fcn.1401fcb40
movsxd r9, dword [rbp + 0x704]
mov eax, dword [rbp + 0x248]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x6f8]
mov rcx, qword [rbp + 0x240]
call fcn.1402ba94c
mov edx, dword [rbp + 0x704]
lea rcx, [rbp + 0x240]
call fcn.1401fde50
nop
lea rdx, [0x140345f98]
lea rcx, [rbp + 0x240]
call fcn.1401fb190
mov ebx, dword [rbp + 0x24c]
add ebx, dword [rbp + 0x36c]
mov edx, ebx
lea rcx, [rbp + 0x240]
call fcn.1401fcb40
movsxd r9, dword [rbp + 0x36c]
mov ecx, dword [rbp + 0x248]
movsxd rax, dword [rbp + 0x24c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x240]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x360]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x240]
call fcn.1401fde50
lea rdx, [rbp + 0x240]
mov rcx, rdi
call fcn.1400eb2a0
mov r8d, 1
lea rdx, [0x140345f98]
lea rcx, [rbp + 0x310]
call fcn.1401fc9f0
test al, al
jne 0x1401dd92b
mov edx, dword [rbp + 0x31c]
inc edx
lea rcx, [rbp + 0x310]
call fcn.1401fcb40
movsxd rcx, dword [rbp + 0x31c]
mov rax, qword [rbp + 0x310]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x31c]
inc edx
lea rcx, [rbp + 0x310]
call fcn.1401fde50
lea rdx, [rbp + 0x310]
mov rcx, rdi
call fcn.1400e4160
lea rdx, [rbp + 0xac0]
mov rcx, rdi
call fcn.1401684a0
mov rbx, qword [r13 + 8]
cmp qword [rbx + 0x430], 0
je 0x1401dd97b
mov eax, dword [rdi + 0x40]
shr rax, 0x14
test al, 1
jne 0x1401dd96b
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov rdx, rdi
mov rcx, qword [rbx + 0x430]
call fcn.1401ce0b0
nop
cmp dword [rbp + 0x248], 0
jle 0x1401dd990
mov rcx, qword [rbp + 0x240]
call fcn.1402b7350
xor ebx, ebx
lea rax, vtable.Core::ByteArray.0
mov qword [rbp + 0xa08], rax
test r14, r14
je 0x1401dd9c4
mov r8, r14
xor edx, edx
mov rcx, qword [rbp + 0xa20]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbp + 0xa18], rbx
mov dword [rbp + 0xa10], ebx
cmp dword [rbp + 0x800], 0
jle 0x1401dd9d9
mov rcx, qword [rbp + 0x7f8]
call fcn.1402b7350
lea r14, vtable.Core::ByteArray.0
cmp dword [rbp + 0x318], 0
jle 0x1401dd9f6
mov rcx, qword [rbp + 0x310]
call fcn.1402b7350
nop
cmp dword [rbp + 0x368], 0
jle 0x1401dda0b
mov rcx, qword [rbp + 0x360]
call fcn.1402b7350
add rsi, 0x10
dec r15
jne 0x1401dd640
xor esi, esi
lea rbx, vtable.Core::Array_class_Core::String_.0
mov qword [rbp + 0x9d8], rbx
xor edx, edx
lea rcx, [rbp + 0x9d8]
call fcn.1400c7e30
nop
cmp dword [rbp + 0x700], 0
jle 0x1401dda4c
mov rcx, qword [rbp + 0x6f8]
call fcn.1402b7350
mov rcx, r13
call fcn.1401ddf30
mov rcx, r13
call fcn.1401df8d0
mov rax, qword [r13 + 8]
cmp dword [rax + 0x10], 1
je 0x1401dde5e
lea rax, str.SoftwareMicrosoftWindowsShellNoRoamMUICache
mov qword [rbp + 0xd0], rax
lea rax, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
mov qword [rbp + 0xd8], rax
mov dword [rsp + 0x70], esi
cmp dword [r13 + 0x18], 0
jle 0x1401dde5e
mov r14, rsi
mov qword [rbp + 0xe0], rsi
mov r15, qword [rbp - 0x80]
nop dword [rax]
nop word [rax + rax]
mov r13d, esi
mov dword [rsp + 0x60], esi
lea rsi, [rbp + 0xd0]
mov qword [rbp - 0x68], rsi
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x140345fb0]
lea rcx, [rbp + 0x68]
call fcn.1401faae0
nop
mov edx, dword [rbp + 0x74]
inc edx
lea rcx, [rbp + 0x68]
call fcn.1401fcb40
movsxd rcx, dword [rbp + 0x74]
mov rax, qword [rbp + 0x68]
mov r12d, 0x5c
mov word [rax + rcx*2], r12w
mov edx, dword [rbp + 0x74]
inc edx
lea rcx, [rbp + 0x68]
call fcn.1401fde50
mov rdi, qword [r15 + 0x20]
mov ebx, dword [rbp + 0x74]
add ebx, dword [rdi + r14 + 0xc]
mov edx, ebx
lea rcx, [rbp + 0x68]
call fcn.1401fcb40
movsxd r9, dword [rdi + r14 + 0xc]
mov ecx, dword [rbp + 0x70]
movsxd rax, dword [rbp + 0x74]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x68]
lea rcx, [rax + rcx*2]
mov r8, qword [rdi + r14]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x68]
call fcn.1401fde50
mov edx, dword [rbp + 0x74]
inc edx
lea rcx, [rbp + 0x68]
call fcn.1401fcb40
movsxd rcx, dword [rbp + 0x74]
mov rax, qword [rbp + 0x68]
mov word [rax + rcx*2], r12w
mov edx, dword [rbp + 0x74]
inc edx
lea rcx, [rbp + 0x68]
call fcn.1401fde50
mov rdx, qword [rsi]
lea rcx, [rbp + 0x68]
call fcn.1401fb190
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x68]
call fcn.1400eb0d0
mov r12, rax
mov qword [rbp + 0xc0], rax
test rax, rax
je 0x1401dde0e
lea rax, vtable.Core::Array_class_Core::String_.0
mov qword [rbp + 0x9d8], rax
xor ebx, ebx
mov dword [rbp + 0x9e0], ebx
mov qword [rbp + 0x9e8], rbx
xor edx, edx
lea rcx, [rbp + 0x9d8]
call fcn.1400c7e30
nop
lea rdx, [rbp + 0x9d8]
mov rcx, r12
call fcn.1400eabf0
test al, al
je 0x1401ddde2
mov eax, dword [rbp + 0x9e0]
test eax, eax
jle 0x1401ddde2
mov rsi, qword [rbp + 0x9e8]
lea rdi, [rsi + 0xc]
mov r15d, eax
mov r12, qword [rbp - 0x80]
lea r13, [0x140346ce0]
nop dword [rax]
cmp dword [rdi], 2
jl 0x1401dddb6
mov edx, 1
mov rcx, rsi
call fcn.1401fb010
cmp ax, 0x3a
jne 0x1401dddb6
mov qword [rbp + 0x418], 0
mov edx, dword [rdi]
test edx, edx
jne 0x1401ddc5a
mov qword [rbp + 0x410], r13
jmp 0x1401ddc84
lea rcx, [rbp + 0x410]
call fcn.1401fcb40
movsxd r9, dword [rdi]
mov eax, dword [rbp + 0x418]
inc eax
movsxd rdx, eax
mov r8, qword [rdi - 0xc]
mov rcx, qword [rbp + 0x410]
call fcn.1402ba94c
mov edx, dword [rdi]
lea rcx, [rbp + 0x410]
call fcn.1401fde50
nop
lea rdx, [rbp + 0x410]
call fcn.1401d4ec0
mov r8b, 1
lea rdx, [rbp + 0x410]
mov rcx, qword [r12 + 8]
call fcn.1400f8340
mov r14, rax
test rax, rax
je 0x1401ddda1
mov qword [rbp + 0x228], 0
mov edx, dword [rbp + 0x74]
test edx, edx
jne 0x1401ddcda
mov qword [rbp + 0x220], r13
jmp 0x1401ddd08
lea rcx, [rbp + 0x220]
call fcn.1401fcb40
movsxd r9, dword [rbp + 0x74]
mov eax, dword [rbp + 0x228]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x220]
call fcn.1402ba94c
mov edx, dword [rbp + 0x74]
lea rcx, [rbp + 0x220]
call fcn.1401fde50
nop
lea rdx, [0x140345f98]
lea rcx, [rbp + 0x220]
call fcn.1401fb190
mov ebx, dword [rbp + 0x22c]
add ebx, dword [rdi]
mov edx, ebx
lea rcx, [rbp + 0x220]
call fcn.1401fcb40
movsxd r9, dword [rdi]
mov ecx, dword [rbp + 0x228]
movsxd rax, dword [rbp + 0x22c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x220]
lea rcx, [rax + rcx*2]
mov r8, qword [rdi - 0xc]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rbp + 0x220]
call fcn.1401fde50
lea rdx, [rbp + 0x220]
mov rcx, r14
call fcn.1400e4160
nop
cmp dword [rbp + 0x228], 0
jle 0x1401ddd9f
mov rcx, qword [rbp + 0x220]
call fcn.1402b7350
xor ebx, ebx
cmp dword [rbp + 0x418], 0
jle 0x1401dddb6
mov rcx, qword [rbp + 0x410]
call fcn.1402b7350
add rsi, 0x10
add rdi, 0x10
dec r15
jne 0x1401ddc20
mov r12, qword [rbp + 0xc0]
mov r13d, dword [rsp + 0x60]
mov rsi, qword [rbp - 0x68]
mov r14, qword [rbp + 0xe0]
mov r15, qword [rbp - 0x80]
mov rax, qword [r12]
mov edx, 1
mov rcx, r12
call qword [rax]
nop
lea rbx, vtable.Core::Array_class_Core::String_.0
mov qword [rbp + 0x9d8], rbx
xor edx, edx
lea rcx, [rbp + 0x9d8]
call fcn.1400c7e30
nop
cmp dword [rbp + 0x70], 0
jle 0x1401dde1d
mov rcx, qword [rbp + 0x68]
call fcn.1402b7350
inc r13d
mov dword [rsp + 0x60], r13d
add rsi, 8
mov qword [rbp - 0x68], rsi
movsxd rax, r13d
cmp rax, 2
jb 0x1401ddad0
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
add r14, 0x10
mov qword [rbp + 0xe0], r14
cmp eax, dword [r15 + 0x18]
mov esi, 0
jl 0x1401ddab0
mov r8, qword [rbp + 0x180]
mov r9, r8
mov r8, qword [r8]
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x180]
call fcn.140009b50
mov rcx, qword [rbp + 0x180]
call fcn.1402150f0
nop
mov rdx, qword [rbp + 0x380]
lea rcx, [rbp + 0xc0]
call fcn.140158df0
lea rdx, [rbp + 0x9d0]
lea rcx, [rbp + 0x380]
call fcn.14012d7d0
mov r9, qword [rbp + 0xc0]
mov r8, qword [rax]
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x380]
call fcn.140158e00
lea rcx, [rbp + 0x380]
call fcn.140009260
nop
lea rcx, [rbp + 0x7b8]
call fcn.1400c7d10
nop
lea rcx, [rbp + 0x290]
call fcn.140005eb0
nop
lea rcx, [rbp - 0x78]
call fcn.140005eb0
mov al, 1
mov rcx, qword [rbp + 0xd230]
xor rcx, rsp
call fcn.1402b6d40
lea r11, [rsp + 0xd340]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret