Function at 0x140057d20
Capabilities:
Create http request
Delete registry key
Delete registry value
Get disk size
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x3e60
call fcn.1400c78c0
sub rsp, rax
mov qword [rsp + 0xe50], 0xfffffffffffffffe
mov rax, qword [0x1401a1e90]
xor rax, rsp
mov qword [rsp + 0x3e50], rax
mov r15, r8
mov rbx, rdx
mov r13, rcx
mov qword [rsp + 0x368], rcx
mov qword [rsp + 0x370], rdx
mov qword [rsp + 0x398], r8
mov byte [rsp + 0x73], 0
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.140033610
nop
lea rcx, [rsp + 0x3360]
call fcn.14002e890
nop
mov rdx, qword [rbx]
mov qword [rsp + 0xe40], rdx
lea rcx, [rsp + 0x68]
call fcn.140019690
nop
mov rdx, qword [rsp + 0x68]
lea rax, [rdx - 0x18]
mov qword [rsp + 0x838], rax
cmp dword [rax + 0x10], 1
jle 0x140057dd7
mov edx, dword [rax + 8]
lea rcx, [rsp + 0x68]
call fcn.14001a4e0
mov rdx, qword [rsp + 0x68]
xor edi, edi
mov qword [rsp + 0x3200], rdi
mov qword [rsp + 0x3208], rdi
mov qword [rsp + 0x3208], 0xf
mov qword [rsp + 0x3200], rdi
mov byte [rsp + 0x31f0], dil
or r14, 0xffffffffffffffff
cmp byte [rdx], dil
jne 0x140057e13
mov r8d, edi
jmp 0x140057e1f
mov r8, r14
inc r8
cmp byte [rdx + r8], dil
jne 0x140057e16
lea rcx, [rsp + 0x31f0]
call fcn.1400013f0
nop
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x31f0]
lea rcx, [rsp + 0x3360]
call fcn.14002e940
test al, al
jne 0x140057f31
lea rdx, str.json_parse_error
lea rcx, [rsp + 0x2f8]
call fcn.1400030f0
nop
lea rdx, [rsp + 0x2f8]
mov rcx, qword [r13 + 0x40]
call fcn.1400530d0
nop
mov rcx, qword [rsp + 0x2f8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4a0], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140057ea8
mov rdx, qword [rsp + 0x4a0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3208], 0x10
jb 0x140057ec0
mov rcx, qword [rsp + 0x31f0]
call fcn.1400c27f0
mov qword [rsp + 0x3208], 0xf
mov qword [rsp + 0x3200], rdi
mov byte [rsp + 0x31f0], 0
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x670], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140057f0b
mov rdx, qword [rsp + 0x670]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3360]
call fcn.140017870
nop
lea rcx, [rsp + 0x50]
call fcn.140033980
nop
xor bl, bl
mov r12d, 1
jmp 0x14005c877
cmp byte [rsp + 0x58], 0
jne 0x14005801e
lea rdx, str.json_parse_error
lea rcx, [rsp + 0x258]
call fcn.1400030f0
nop
lea rdx, [rsp + 0x258]
mov rcx, qword [r13 + 0x40]
call fcn.1400530d0
nop
mov rcx, qword [rsp + 0x258]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4b0], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140057f95
mov rdx, qword [rsp + 0x4b0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3208], 0x10
jb 0x140057fad
mov rcx, qword [rsp + 0x31f0]
call fcn.1400c27f0
mov qword [rsp + 0x3208], 0xf
mov qword [rsp + 0x3200], rdi
mov byte [rsp + 0x31f0], 0
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x800], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140057ff8
mov rdx, qword [rsp + 0x800]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3360]
call fcn.140017870
nop
lea rcx, [rsp + 0x50]
call fcn.140033980
nop
xor bl, bl
mov r12d, 1
jmp 0x14005c877
lea rdx, str.action
lea rcx, [rsp + 0x50]
call fcn.1400345c0
mov qword [rsp + 0xe60], rax
lea rbx, [0x1401aa3b8]
cmp rax, rbx
je 0x14005c77f
lea rdx, str.action
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xe70], rax
cmp byte [rax + 8], 4
jne 0x14005c77f
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400345c0
lea rdx, str.action
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xe80], rax
mov rdx, qword [rax]
mov qword [rsp + 0x848], rdx
lea rcx, [rsp + 0x40]
call fcn.1400030f0
nop
mov rax, qword [rsp + 0x40]
lea r8, str.injectScript
mov rdx, r14
nop dword [rax]
movzx ecx, word [rax + rdx*2 + 2]
cmp cx, word [r8 + rdx*2 + 2]
jne 0x1400580e8
add rdx, 2
cmp rdx, 0xd
je 0x1400580e4
movzx ecx, word [rax + rdx*2]
cmp cx, word [r8 + rdx*2]
jne 0x1400580e8
jmp 0x1400580c0
mov ecx, edi
jmp 0x1400580ed
sbb ecx, ecx
or ecx, 1
mov dword [rsp + 0x818], ecx
test ecx, ecx
jne 0x140058b09
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xfd8], rax
lea rdx, str.codeMessage
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0x858], rax
cmp byte [rax + 8], 4
jne 0x14005c73b
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xc38], rax
lea rdx, str.codeMessage
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0x868], rax
mov rdx, qword [rax]
mov qword [rsp + 0xe28], rdx
lea rcx, [rsp + 0xa8]
call fcn.1400030f0
nop
mov rax, qword [rsp + 0xa8]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x828], eax
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
call fcn.1400c33dc
mov r12, rax
mov qword [rsp + 0x120], rax
test rax, rax
je 0x140058a0c
mov r8, rax
lea rdx, [rsp + 0xa8]
call fcn.14005c8d0
test al, al
je 0x140058a0c
mov rbx, qword [r13 + 0x40]
add rbx, 0x1b8
mov qword [rsp + 0x878], rbx
mov rcx, qword [rbx]
mov qword [rsp + 0xc48], rcx
mov edx, 0x5c
call fcn.1400c5214
mov rcx, rax
mov qword [rsp + 0x888], rax
test rax, rax
jne 0x140058207
mov ecx, r14d
jmp 0x140058218
mov rax, qword [rbx]
mov qword [rsp + 0xf80], rax
sub rcx, rax
sar rcx, 1
lea r8d, [rcx + 1]
mov rcx, qword [r13 + 0x40]
add rcx, 0x1b8
lea rdx, [rsp + 0xe0]
call fcn.140025310
nop
mov rax, qword [r13 + 0x40]
add rax, 0x1b8
mov qword [rsp + 0x898], rax
mov rcx, qword [rax]
sub rcx, 0x18
mov qword [rsp + 0xc58], rcx
call fcn.1400025b0
mov qword [rsp + 0x8a8], rax
lea rbx, [rax + 0x18]
mov qword [rsp + 0x6b0], rbx
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [r13 + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x214], eax
test eax, eax
je 0x1400583fa
test r15, r15
je 0x1400582b4
mov esi, 0xb
mov word [r15], si
mov word [r15 + 8], di
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x4c0], rbx
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
dec eax
jg 0x1400582de
mov rdx, qword [rsp + 0x4c0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xe0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x680], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140058310
mov rdx, qword [rsp + 0x680]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xa8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4d0], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140058342
mov rdx, qword [rsp + 0x4d0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x40]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x760], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140058371
mov rdx, qword [rsp + 0x760]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3208], 0x10
jb 0x140058389
mov rcx, qword [rsp + 0x31f0]
call fcn.1400c27f0
mov qword [rsp + 0x3208], 0xf
mov qword [rsp + 0x3200], rdi
mov byte [rsp + 0x31f0], 0
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4e0], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400583d4
mov rdx, qword [rsp + 0x4e0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3360]
call fcn.140017870
nop
lea rcx, [rsp + 0x50]
call fcn.140033980
nop
xor bl, bl
mov r12d, 1
jmp 0x14005c877
mov rbx, qword [r13 + 0x40]
add rbx, 0x2d0
mov qword [rsp + 0x300], rbx
mov qword [rsp + 0x200], rbx
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xe38], rax
lea rdx, str.forceOverwrite
mov rcx, rax
call fcn.1400345c0
mov qword [rsp + 0x8b8], rax
lea rcx, [0x1401aa3b8]
cmp rax, rcx
je 0x1400586f6
lea rcx, [0x1401a19a8]
mov rax, qword [0x1401a19a8]
call qword [rax + 0x18]
mov qword [rsp + 0xc68], rax
lea rbx, [rax + 0x18]
mov qword [rsp + 0x118], rbx
mov eax, edi
mov dword [rsp + 0xe8], eax
mov esi, edi
mov dword [rsp + 0xa0], edi
mov r12d, 1
test eax, eax
jne 0x1400586b6
mov dword [rsp + 0x224], 0x7ffe
lea rax, [rbx - 0x18]
mov qword [rsp + 0x8c8], rax
mov ecx, r12d
sub ecx, dword [rax + 0x10]
mov dword [rsp + 0x6c0], ecx
mov eax, dword [rax + 0xc]
sub eax, 0x7ffe
mov dword [rsp + 0x420], eax
or eax, ecx
jge 0x1400584eb
mov edx, 0x7ffe
lea rcx, [rsp + 0x118]
call fcn.140002550
mov rbx, qword [rsp + 0x118]
cmp dword [rbx - 0xc], 0x7ffe
jge 0x1400584fe
mov ecx, 0x80070057
call fcn.140001920
mov dword [rbx - 0x10], 0x7ffe
mov word [rbx + 0xfffc], di
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x224]
mov r8, rbx
mov edx, esi
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov dword [rsp + 0xe8], eax
movsxd rax, dword [rbx - 0xc]
mov dword [rsp + 0x630], eax
mov rdx, rax
mov rcx, rbx
call fcn.1400c3494
mov dword [rsp + 0x430], eax
test eax, eax
js 0x1400586ac
cmp eax, dword [rbx - 0xc]
jg 0x1400586ac
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], di
mov rax, qword [rsp + 0x300]
mov dword [rax], edi
lea r8, str._data
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x690]
call fcn.140019af0
mov qword [rsp + 0xfc0], rax
mov rdx, qword [rax]
mov qword [rsp + 0x8d8], rdx
test rdx, rdx
jne 0x1400585bc
mov eax, r14d
jmp 0x1400585ef
mov eax, dword [rbx - 0x10]
mov dword [rsp + 0x82c], eax
test eax, eax
jns 0x1400585cf
mov eax, r14d
jmp 0x1400585ef
mov rcx, rbx
call fcn.1400c3664
mov qword [rsp + 0xc78], rax
test rax, rax
jne 0x1400585e9
mov eax, r14d
jmp 0x1400585ef
sub rax, rbx
sar rax, 1
mov dword [rsp + 0xb0], eax
cmp eax, 0xffffffff
setne byte [rsp + 0x70]
mov rcx, qword [rsp + 0x690]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4f0], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005862f
mov rdx, qword [rsp + 0x4f0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp byte [rsp + 0x70], 0
je 0x140058678
mov esi, edi
mov dword [rsp + 0xa0], edi
mov rbx, qword [rsp + 0x118]
mov rdx, rbx
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [rsp + 0x214], eax
test eax, eax
je 0x140058690
test r15, r15
je 0x1400586b6
mov esi, 0xb
mov word [r15], si
mov word [r15 + 8], di
jmp 0x1400586bb
mov esi, dword [rsp + 0xa0]
inc esi
mov dword [rsp + 0xa0], esi
mov rbx, qword [rsp + 0x118]
mov rax, qword [rsp + 0x200]
mov qword [rsp + 0x300], rax
mov eax, dword [rsp + 0xe8]
jmp 0x140058492
mov ecx, 0x80070057
call fcn.140001920
mov esi, 0xb
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x7d0], rbx
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
dec eax
jg 0x1400586e4
mov rdx, qword [rsp + 0x7d0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r12, qword [rsp + 0x120]
mov rbx, qword [rsp + 0x200]
jmp 0x1400586fb
mov esi, 0xb
mov rax, qword [rsp + 0xa8]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x440], eax
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov rdx, r12
mov rcx, r12
call fcn.140057c40
mov ecx, dword [0x1401a9d80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x88888889
imul r8d
add edx, r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xf
sub r8d, edx
cmp r8d, 1
jne 0x1400587a5
mov eax, 0xd4
mov dword [rsp + 0x180], eax
mov r8d, 0xe8
mov dword [rsp + 0x21c], r8d
test eax, eax
je 0x14005879c
test r8d, r8d
je 0x14005879c
mov ecx, r8d
mov dword [rsp + 0x640], ecx
cdq
idiv r8d
mov r8d, edx
mov dword [rsp + 0x21c], edx
mov eax, ecx
mov dword [rsp + 0x180], ecx
jmp 0x140058770
add eax, r8d
mov dword [0x1401a9d80], eax
mov edx, dword [rbx]
lea eax, [rdx + 1]
mov dword [rbx], eax
lea rcx, [rsp + 0x3340]
call fcn.140057960
mov qword [rsp + 0x8e8], rax
cmp qword [rax + 0x18], 0x10
jb 0x1400587cb
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x510]
call fcn.1400030f0
mov rbx, rax
lea r8, str._data
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x500]
call fcn.140019af0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x268]
call fcn.14000ea60
nop
mov rcx, qword [rsp + 0x500]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6a0], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140058841
mov rdx, qword [rsp + 0x6a0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x510]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x770], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140058873
mov rdx, qword [rsp + 0x770]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3358], 0x10
jb 0x14005888b
mov rcx, qword [rsp + 0x3340]
call fcn.1400c27f0
mov qword [rsp + 0x3358], 0xf
mov qword [rsp + 0x3350], rdi
mov byte [rsp + 0x3340], 0
mov rbx, qword [rsp + 0x120]
xor al, al
jne 0x1400588f2
mov rax, qword [rsp + 0xa8]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x450], eax
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x268]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea r8, [rsp + 0xd8]
lea rdx, [rsp + 0xe0]
mov rcx, r13
call fcn.14005ca00
mov rcx, rbx
call fcn.1400c3358
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r15, r15
je 0x14005892e
mov word [r15], si
mov word [r15 + 8], r14w
mov rax, qword [r13 + 0x40]
cmp dword [rax + 0x2d8], 3
jne 0x140058945
mov dword [rax + 0x2d8], 4
mov rcx, qword [rsp + 0x268]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x520], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140058977
mov rdx, qword [rsp + 0x520]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x6b0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x530], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400589a9
mov rdx, qword [rsp + 0x530]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xe0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x820], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400589db
mov rdx, qword [rsp + 0x820]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xa8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x540], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005c73b
mov rdx, qword [rsp + 0x540]
jmp 0x14005c731
test r15, r15
je 0x140058a1f
mov esi, 0xb
mov word [r15], si
mov word [r15 + 8], di
mov rcx, qword [rsp + 0xa8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x3b8], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140058a51
mov rdx, qword [rsp + 0x3b8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x40]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x550], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140058a80
mov rdx, qword [rsp + 0x550]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3208], 0x10
jb 0x140058a98
mov rcx, qword [rsp + 0x31f0]
call fcn.1400c27f0
mov qword [rsp + 0x3208], 0xf
mov qword [rsp + 0x3200], rdi
mov byte [rsp + 0x31f0], 0
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x780], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140058ae3
mov rdx, qword [rsp + 0x780]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3360]
call fcn.140017870
nop
lea rcx, [rsp + 0x50]
call fcn.140033980
nop
xor bl, bl
mov r12d, 1
jmp 0x14005c877
lea r8, str.setDLLBinaryReplacment
mov rdx, r14
movzx ecx, word [rax + rdx*2 + 2]
cmp cx, word [r8 + rdx*2 + 2]
jne 0x140058b3b
add rdx, 2
cmp rdx, 0x17
je 0x140058b37
movzx ecx, word [rax + rdx*2]
cmp cx, word [r8 + rdx*2]
jne 0x140058b3b
jmp 0x140058b13
mov eax, edi
jmp 0x140058b40
sbb eax, eax
or eax, 1
mov dword [rsp + 0x740], eax
test eax, eax
jne 0x140059761
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xe48], rax
lea rdx, str.from
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0x8f8], rax
cmp byte [rax + 8], 4
jne 0x14005c73b
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xc88], rax
lea rdx, [0x140139828]
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0x908], rax
cmp byte [rax + 8], 4
jne 0x14005c73b
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xf90], rax
lea rdx, str.offset
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0x918], rax
cmp byte [rax + 8], 1
jne 0x14005c73b
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xc98], rax
lea rdx, str.from
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0x928], rax
mov rdx, qword [rax]
mov qword [rsp + 0xe58], rdx
lea rcx, [rsp + 0x88]
call fcn.1400030f0
nop
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0x938], rax
lea rdx, [0x140139828]
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xca8], rax
mov rdx, qword [rax]
mov qword [rsp + 0x948], rdx
lea rcx, [rsp + 0x78]
call fcn.1400030f0
nop
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xfd0], rax
lea rdx, str.offset
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0x958], rax
mov rcx, rax
call fcn.140033bf0
mov dword [rsp + 0x160], eax
mov rax, qword [rsp + 0x88]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x460], eax
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
call fcn.1400c33dc
mov rsi, rax
mov qword [rsp + 0x5c0], rax
mov rcx, qword [rsp + 0x78]
mov eax, dword [rcx - 0x10]
mov dword [rsp + 0x650], eax
cdq
sub eax, edx
sar eax, 1
movsxd rcx, eax
call fcn.1400c33dc
mov rbx, rax
mov qword [rsp + 0x700], rax
test rsi, rsi
je 0x140059635
test rax, rax
je 0x140059635
mov r8, rsi
lea rdx, [rsp + 0x88]
call fcn.14005c8d0
test al, al
je 0x140059635
mov r8, rbx
lea rdx, [rsp + 0x78]
call fcn.14005c8d0
test al, al
je 0x140059635
mov rax, qword [rsp + 0x88]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x470], eax
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov rdx, rsi
mov rcx, rsi
call fcn.140057c40
mov rax, qword [rsp + 0x78]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x7c0], eax
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov rdx, rbx
mov rcx, rbx
call fcn.140057c40
mov rbx, qword [r13 + 0x40]
add rbx, 0x1b8
mov qword [rsp + 0xcb8], rbx
mov rcx, qword [rbx]
mov qword [rsp + 0x968], rcx
mov edx, 0x5c
call fcn.1400c5214
mov rcx, rax
mov qword [rsp + 0xe68], rax
test rax, rax
jne 0x140058ddf
mov ecx, r14d
jmp 0x140058df0
mov rax, qword [rbx]
mov qword [rsp + 0x978], rax
sub rcx, rax
sar rcx, 1
lea r8d, [rcx + 1]
mov rcx, qword [r13 + 0x40]
add rcx, 0x1b8
lea rdx, [rsp + 0xb8]
call fcn.140025310
nop
mov rax, qword [r13 + 0x40]
add rax, 0x1b8
mov qword [rsp + 0xcc8], rax
mov rcx, qword [rax]
sub rcx, 0x18
mov qword [rsp + 0x988], rcx
call fcn.1400025b0
mov qword [rsp + 0xfa0], rax
add rax, 0x18
mov qword [rsp + 0x178], rax
mov rax, qword [r13 + 0x40]
add rax, 0x2d4
mov qword [rsp + 0x350], rax
mov edx, dword [rax]
lea rcx, [rsp + 0x32a0]
call fcn.140057960
mov qword [rsp + 0x998], rax
cmp qword [rax + 0x18], 0x10
jb 0x140058e7a
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x570]
call fcn.1400030f0
mov rbx, rax
lea r8, str._from
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x560]
call fcn.140019af0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x168]
call fcn.14000ea60
nop
mov rcx, qword [rsp + 0x560]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6d0], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140058ef0
mov rdx, qword [rsp + 0x6d0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x570]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7e0], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140058f22
mov rdx, qword [rsp + 0x7e0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x32b8], 0x10
jb 0x140058f3a
mov rcx, qword [rsp + 0x32a0]
call fcn.1400c27f0
mov qword [rsp + 0x32b8], 0xf
mov qword [rsp + 0x32b0], rdi
mov byte [rsp + 0x32a0], 0
mov rax, qword [rsp + 0x350]
mov edx, dword [rax]
lea rcx, [rsp + 0x32e0]
call fcn.140057960
mov qword [rsp + 0xcd8], rax
cmp qword [rax + 0x18], 0x10
jb 0x140058f7f
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x590]
call fcn.1400030f0
mov rbx, rax
lea r8, [0x140139818]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x580]
call fcn.140019af0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x158]
call fcn.14000ea60
nop
mov rcx, qword [rsp + 0x580]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6e0], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140058ff5
mov rdx, qword [rsp + 0x6e0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x590]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x790], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140059027
mov rdx, qword [rsp + 0x790]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x32f8], 0x10
jb 0x14005903f
mov rcx, qword [rsp + 0x32e0]
call fcn.1400c27f0
mov qword [rsp + 0x32f8], 0xf
mov qword [rsp + 0x32f0], rdi
mov byte [rsp + 0x32e0], 0
mov rcx, qword [rsp + 0x350]
mov edx, dword [rcx]
lea eax, [rdx + 1]
mov dword [rcx], eax
lea rcx, [rsp + 0x3280]
call fcn.140057960
mov qword [rsp + 0x9a8], rax
cmp qword [rax + 0x18], 0x10
jb 0x140059089
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x5b0]
call fcn.1400030f0
mov rbx, rax
lea r8, [0x140139870]
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x5a0]
call fcn.140019af0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x1c0]
call fcn.14000ea60
nop
mov rcx, qword [rsp + 0x5a0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6f0], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400590ff
mov rdx, qword [rsp + 0x6f0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x5b0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x810], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140059131
mov rdx, qword [rsp + 0x810]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3298], 0x10
jb 0x140059149
mov rcx, qword [rsp + 0x3280]
call fcn.1400c27f0
mov qword [rsp + 0x3298], 0xf
mov qword [rsp + 0x3290], rdi
mov byte [rsp + 0x3280], 0
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rdx, qword [rsp + 0x178]
mov rcx, qword [r13 + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005940f
mov rax, qword [rsp + 0x88]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x480], eax
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x28], eax
mov rsi, qword [rsp + 0x5c0]
mov qword [rsp + 0x20], rsi
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x168]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14005940f
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x160]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rdx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14005940f
mov rax, qword [rsp + 0x78]
mov eax, dword [rax - 0x10]
mov dword [rsp + 0x660], eax
cdq
sub eax, edx
sar eax, 1
mov dword [rsp + 0x28], eax
mov rbx, qword [rsp + 0x700]
mov qword [rsp + 0x20], rbx
mov r9d, 3
xor r8d, r8d
mov rdx, qword [rsp + 0x1c0]
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14005940f
lea r8, [rsp + 0xf0]
lea rdx, [rsp + 0xb8]
mov rcx, r13
call fcn.14005ca00
mov rcx, rbx
call fcn.1400c3358
mov rcx, rsi
call fcn.1400c3358
mov rcx, qword [rsp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r15, r15
je 0x1400592b5
mov esi, 0xb
mov word [r15], si
mov word [r15 + 8], r14w
mov rcx, qword [rsp + 0x1c0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5d0], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400592e7
mov rdx, qword [rsp + 0x5d0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x158]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7a0], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140059319
mov rdx, qword [rsp + 0x7a0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x168]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5e0], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005934b
mov rdx, qword [rsp + 0x5e0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x178]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x710], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005937d
mov rdx, qword [rsp + 0x710]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xb8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5f0], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400593af
mov rdx, qword [rsp + 0x5f0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x78]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x7f0], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400593de
mov rdx, qword [rsp + 0x7f0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x88]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x3c0], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005c73b
mov rdx, qword [rsp + 0x3c0]
jmp 0x14005c731
test r15, r15
je 0x140059422
mov esi, 0xb
mov word [r15], si
mov word [r15 + 8], di
mov rcx, qword [rsp + 0x1c0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x3c8], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140059454
mov rdx, qword [rsp + 0x3c8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x158]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x3d8], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140059486
mov rdx, qword [rsp + 0x3d8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x168]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x3e8], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400594b8
mov rdx, qword [rsp + 0x3e8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x178]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x3f8], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400594ea
mov rdx, qword [rsp + 0x3f8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xb8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x408], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005951c
mov rdx, qword [rsp + 0x408]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x78]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x418], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005954b
mov rdx, qword [rsp + 0x418]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x88]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x428], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005957d
mov rdx, qword [rsp + 0x428]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x40]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x438], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400595ac
mov rdx, qword [rsp + 0x438]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3208], 0x10
jb 0x1400595c4
mov rcx, qword [rsp + 0x31f0]
call fcn.1400c27f0
mov qword [rsp + 0x3208], 0xf
mov qword [rsp + 0x3200], rdi
mov byte [rsp + 0x31f0], 0
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x448], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005960f
mov rdx, qword [rsp + 0x448]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3360]
call fcn.140017870
nop
lea rcx, [rsp + 0x50]
call fcn.140033980
nop
xor bl, bl
mov r12d, 1
jmp 0x14005c877
test r15, r15
je 0x140059648
mov esi, 0xb
mov word [r15], si
mov word [r15 + 8], di
mov rcx, qword [rsp + 0x78]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x458], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140059677
mov rdx, qword [rsp + 0x458]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x88]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x468], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400596a9
mov rdx, qword [rsp + 0x468]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x40]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x478], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x1400596d8
mov rdx, qword [rsp + 0x478]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3208], 0x10
jb 0x1400596f0
mov rcx, qword [rsp + 0x31f0]
call fcn.1400c27f0
mov qword [rsp + 0x3208], 0xf
mov qword [rsp + 0x3200], rdi
mov byte [rsp + 0x31f0], 0
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x488], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005973b
mov rdx, qword [rsp + 0x488]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3360]
call fcn.140017870
nop
lea rcx, [rsp + 0x50]
call fcn.140033980
nop
xor bl, bl
mov r12d, 1
jmp 0x14005c877
lea rdx, str.getCurrentCppTime
lea rcx, [rsp + 0x40]
call fcn.140003550
test eax, eax
jne 0x140059944
test r15, r15
je 0x14005c73b
mov ecx, dword [0x1401a9d80]
imul ecx, ecx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0xb
jne 0x1400597bf
mov dword [rsp + 0x2620], edi
mov dword [rsp + 0x1170], edi
mov dword [rsp + 0xfe0], edi
lea rcx, [rsp + 0x498]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov qword [rsp + 0x188], rdi
mov rcx, qword [rsp + 0x498]
mov qword [rsp + 0x188], rcx
movabs rax, 0xcccccccccccccccd
mul rcx
shr rdx, 3
mov qword [rsp + 0x188], rdx
lea rcx, [0x1401a19a8]
mov rax, qword [0x1401a19a8]
call qword [rax + 0x18]
mov qword [rsp + 0xe78], rax
lea rbx, [rax + 0x18]
mov qword [rsp + 0x310], rbx
mov dword [rsp + 0x10c], edi
nop word [rax + rax]
cmp edi, 8
jge 0x1400598e9
lea rcx, [0x1401a19a8]
mov rax, qword [0x1401a19a8]
call qword [rax + 0x18]
mov qword [rsp + 0x9b8], rax
add rax, 0x18
mov qword [rsp + 0x278], rax
movsxd rax, edi
movzx r8d, byte [rsp + rax + 0x188]
lea rdx, str._.2x
lea rcx, [rsp + 0x278]
call fcn.140010db0
mov rbx, qword [rsp + 0x278]
mov r8d, dword [rbx - 0x10]
mov dword [rsp + 0x490], r8d
mov rdx, rbx
lea rcx, [rsp + 0x310]
call fcn.14000f520
nop
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x4a8], rbx
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
dec eax
jg 0x1400598cc
mov rdx, qword [rsp + 0x4a8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edi, dword [rsp + 0x10c]
inc edi
mov dword [rsp + 0x10c], edi
mov rbx, qword [rsp + 0x310]
jmp 0x140059830
mov edx, dword [rbx - 0x10]
mov dword [rsp + 0x750], edx
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xce8], rax
test rax, rax
jne 0x14005990e
call fcn.140002640
mov qword [r15 + 8], rax
mov eax, 8
mov word [r15], ax
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x4b8], rbx
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
dec eax
jg 0x14005c73b
mov rdx, qword [rsp + 0x4b8]
jmp 0x14005c731
lea rdx, str.getChromeVersion
lea rcx, [rsp + 0x40]
call fcn.140003550
test eax, eax
jne 0x140059a57
lea rdx, [rsp + 0x288]
mov rcx, qword [r13 + 0x40]
call fcn.140057a20
nop
mov r8d, dword [0x1401a9d80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x38e38e39
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
sub ecx, eax
cmp ecx, 8
jne 0x1400599ea
mov dword [rsp + 0x150], edi
nop
mov eax, 0x2e8ba2e9
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xb
mov eax, r8d
sub eax, edx
cmp eax, 0x78
je 0x1400599e4
mov eax, r8d
or eax, 0xfffffff6
add r8d, eax
mov dword [0x1401a9d80], r8d
inc edi
mov dword [rsp + 0x150], edi
mov eax, r8d
imul eax, r8d
cmp edi, eax
jg 0x1400599e4
jmp 0x1400599a0
mov dword [0x1401a9d80], edi
test r15, r15
je 0x140059a26
mov rcx, qword [rsp + 0x288]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x830], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0x9c8], rax
test rax, rax
jne 0x140059a19
call fcn.140002640
mov qword [r15 + 8], rax
mov eax, 8
mov word [r15], ax
mov rcx, qword [rsp + 0x288]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4c8], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005c73b
mov rdx, qword [rsp + 0x4c8]
jmp 0x14005c731
lea rdx, str.getDLLVersion
lea rcx, [rsp + 0x40]
call fcn.140003550
test eax, eax
jne 0x140059bc0
lea rdx, [rsp + 0x390]
mov rcx, qword [r13 + 0x40]
call fcn.140057a70
nop
mov ebx, dword [0x1401a9d80]
lea ecx, [rbx + 1]
imul ecx, ebx
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 9
jne 0x140059b53
mov esi, edi
mov dword [rsp + 0x1f0], edi
cmp esi, 0xe
jge 0x140059b53
mov r10d, edi
mov dword [rsp + 0x190], edi
nop dword [rax]
cmp r10d, 0x10
jge 0x140059b45
mov r9d, edi
mov dword [rsp + 0x210], edi
cmp r9d, 9
jge 0x140059b38
lea r11d, [r9 + 1]
lea ecx, [r10 + 1]
mov eax, ebx
cdq
idiv ecx
mov r8d, edx
mov eax, ebx
cdq
idiv r11d
imul r8d, eax
mov eax, ebx
sub eax, esi
imul r8d, eax
movsxd rcx, esi
shl rcx, 4
movsxd rax, r10d
add rcx, rax
lea rdx, [rcx + rcx*8]
movsxd rax, r9d
lea rcx, [rsp + 0x3670]
add rcx, rax
mov byte [rcx + rdx], r8b
mov r9d, r11d
mov dword [rsp + 0x210], r11d
jmp 0x140059ae0
inc r10d
mov dword [rsp + 0x190], r10d
jmp 0x140059ad0
inc esi
mov dword [rsp + 0x1f0], esi
jmp 0x140059ab6
test r15, r15
je 0x140059b8f
mov rcx, qword [rsp + 0x390]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x600], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xf50], rax
test rax, rax
jne 0x140059b82
call fcn.140002640
mov qword [r15 + 8], rax
mov eax, 8
mov word [r15], ax
mov rcx, qword [rsp + 0x390]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4d8], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005c73b
mov rdx, qword [rsp + 0x4d8]
jmp 0x14005c731
lea rdx, str.getCharPref
lea rcx, [rsp + 0x40]
call fcn.140003550
test eax, eax
je 0x14005c241
lea rdx, str.getIntPref
lea rcx, [rsp + 0x40]
call fcn.140003550
test eax, eax
je 0x14005c241
lea rdx, str.setCharPref
lea rcx, [rsp + 0x40]
call fcn.140003550
test eax, eax
jne 0x14005a15a
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0x9d8], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xcf8], rax
cmp byte [rax + 8], 4
jne 0x14005c73b
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0x9e8], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xe88], rax
cmp byte [rax + 8], 4
jne 0x14005c73b
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0x9f8], rax
lea rdx, [0x140139980]
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xd08], rax
cmp byte [rax + 8], 4
jne 0x14005c73b
mov byte [rsp + 0x4a], 0
mov qword [rsp + 0x198], rdi
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xa08], rax
lea rdx, str.hive
mov rcx, rax
call fcn.1400345c0
mov qword [rsp + 0xf58], rax
cmp rax, rbx
je 0x140059f85
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xa18], rax
lea rdx, str.hive
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xd18], rax
mov rdx, qword [rax]
mov qword [rsp + 0xa28], rdx
lea rcx, [rsp + 0x298]
call fcn.1400030f0
nop
mov rbx, qword [r13 + 0x50]
mov qword [rsp + 0x198], rbx
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x298]
call fcn.140003550
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0x198], rbx
mov eax, dword [0x1401a9d80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x6bca1af3
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13
sub ecx, edx
cmp ecx, 5
jne 0x140059daf
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFileType]
nop
mov rcx, qword [rsp + 0x298]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4e8], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140059de0
mov rdx, qword [rsp + 0x4e8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x198]
test rbx, rbx
je 0x140059f85
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xea8], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xa38], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd28], rdx
lea rcx, [rsp + 0x360]
call fcn.1400030f0
nop
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xa48], rax
lea rdx, [0x140139980]
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xf68], rax
mov rdx, qword [rax]
mov qword [rsp + 0xa58], rdx
lea rcx, [rsp + 0x2a8]
call fcn.1400030f0
nop
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xd38], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xa68], rax
mov rdx, qword [rax]
mov qword [rsp + 0xec8], rdx
lea rcx, [rsp + 0x320]
call fcn.1400030f0
nop
mov r9, rbx
lea r8, [rsp + 0x360]
lea rdx, [rsp + 0x2a8]
lea rcx, [rsp + 0x320]
call fcn.1400434c0
mov byte [rsp + 0x4a], al
mov rcx, qword [rsp + 0x320]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x4f8], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140059f22
mov rdx, qword [rsp + 0x4f8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x2a8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x508], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x140059f54
mov rdx, qword [rsp + 0x508]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x360]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x518], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a147
mov rdx, qword [rsp + 0x518]
jmp 0x14005a13e
lea rax, [rsp + 0x528]
mov qword [rsp + 0xa78], rax
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xd48], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xa88], rax
mov rdx, qword [rax]
mov qword [rsp + 0xf78], rdx
lea rcx, [rsp + 0x2c8]
call fcn.1400030f0
nop
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xa98], rax
lea rdx, [0x140139980]
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xd58], rax
mov rdx, qword [rax]
mov qword [rsp + 0xaa8], rdx
lea rcx, [rsp + 0x330]
call fcn.1400030f0
nop
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xee8], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xab8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd68], rdx
lea rcx, [rsp + 0x2b8]
call fcn.1400030f0
nop
lea rdx, [0x140133848]
lea rcx, [rsp + 0x528]
call fcn.1400022a0
nop
mov qword [rsp + 0x20], rax
mov r9, qword [0x1401a4d48]
lea r8, [rsp + 0x2c8]
lea rdx, [rsp + 0x330]
lea rcx, [rsp + 0x2b8]
call fcn.140043050
mov byte [rsp + 0x4a], al
mov rcx, qword [rsp + 0x2b8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x538], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a0e4
mov rdx, qword [rsp + 0x538]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x330]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x548], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a116
mov rdx, qword [rsp + 0x548]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x2c8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x558], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a147
mov rdx, qword [rsp + 0x558]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r15, r15
je 0x14005c73b
movzx eax, byte [rsp + 0x4a]
jmp 0x14005a612
lea rdx, str.setIntPref
lea rcx, [rsp + 0x40]
call fcn.140003550
test eax, eax
jne 0x14005a62a
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xac8], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xf88], rax
cmp byte [rax + 8], 4
jne 0x14005c73b
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xad8], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xd78], rax
cmp byte [rax + 8], 4
jne 0x14005c73b
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xae8], rax
lea rdx, [0x140139980]
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xf08], rax
movzx ecx, byte [rax + 8]
lea eax, [rcx - 1]
cmp al, 2
jbe 0x14005a22b
cmp cl, 5
jne 0x14005c73b
mov byte [rsp + 0x49], 0
mov qword [rsp + 0x1a8], rdi
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xaf8], rax
lea rdx, str.hive
mov rcx, rax
call fcn.1400345c0
mov qword [rsp + 0xd88], rax
cmp rax, rbx
je 0x14005a489
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xb08], rax
lea rdx, str.hive
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xf98], rax
mov rdx, qword [rax]
mov qword [rsp + 0xb18], rdx
lea rcx, [rsp + 0x380]
call fcn.1400030f0
nop
mov rbx, qword [r13 + 0x50]
mov qword [rsp + 0x1a8], rbx
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x380]
call fcn.140003550
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0x1a8], rbx
mov rcx, qword [rsp + 0x380]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x568], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a320
mov rdx, qword [rsp + 0x568]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x1a8]
test rbx, rbx
je 0x14005a489
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xd98], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xb28], rax
mov rdx, qword [rax]
mov qword [rsp + 0xf28], rdx
lea rcx, [rsp + 0x340]
call fcn.1400030f0
nop
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xb38], rax
lea rdx, [0x140139980]
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xda8], rax
mov rcx, rax
call fcn.140033d50
mov dword [rsp + 0x1a0], eax
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xb48], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xfa8], rax
mov rdx, qword [rax]
mov qword [rsp + 0xb58], rdx
lea rcx, [rsp + 0x2d8]
call fcn.1400030f0
nop
mov r9, rbx
lea r8, [rsp + 0x340]
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x2d8]
call fcn.140043620
mov byte [rsp + 0x49], al
mov rcx, qword [rsp + 0x2d8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x578], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a458
mov rdx, qword [rsp + 0x578]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x340]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x588], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a604
mov rdx, qword [rsp + 0x588]
jmp 0x14005a5fb
lea rax, [rsp + 0x598]
mov qword [rsp + 0xdb8], rax
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xb68], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xf48], rax
mov rdx, qword [rax]
mov qword [rsp + 0xb78], rdx
lea rcx, [rsp + 0x2f0]
call fcn.1400030f0
nop
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xdc8], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xb88], rax
mov rdx, qword [rax]
mov qword [rsp + 0xfb8], rdx
lea rcx, [rsp + 0x2e8]
call fcn.1400030f0
nop
lea rdx, [0x140133848]
lea rcx, [rsp + 0x598]
call fcn.1400022a0
mov rbx, rax
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xb98], rax
lea rdx, [0x140139980]
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xdd8], rax
mov rcx, rax
call fcn.140033d50
mov edx, eax
mov qword [rsp + 0x20], rbx
mov r9, qword [0x1401a4d48]
lea r8, [rsp + 0x2f0]
lea rcx, [rsp + 0x2e8]
call fcn.140043fa0
mov byte [rsp + 0x49], al
mov rcx, qword [rsp + 0x2e8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5a8], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a5d3
mov rdx, qword [rsp + 0x5a8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x2f0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5b8], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a604
mov rdx, qword [rsp + 0x5b8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r15, r15
je 0x14005c73b
movzx eax, byte [rsp + 0x49]
neg al
sbb cx, cx
mov word [r15 + 8], cx
mov esi, 0xb
mov word [r15], si
jmp 0x14005c73b
lea rdx, str.removePref
lea rcx, [rsp + 0x40]
call fcn.140003550
test eax, eax
jne 0x14005ac8a
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xba8], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xfc8], rax
cmp byte [rax + 8], 4
jne 0x14005c73b
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xbb8], rax
lea rdx, str.hive
mov rcx, rax
call fcn.1400345c0
mov qword [rsp + 0xde8], rax
lea rdx, str.param
lea rcx, [rsp + 0x50]
cmp rax, rbx
je 0x14005aa87
call fcn.1400343c0
mov qword [rsp + 0xbc8], rax
lea rdx, str.hive
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xf60], rax
mov rdx, qword [rax]
mov qword [rsp + 0xbd8], rdx
lea rcx, [rsp + 0x1c8]
call fcn.1400030f0
nop
mov rbx, qword [r13 + 0x50]
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x1c8]
call fcn.140003550
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0xdf8], rbx
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xbe8], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xfb0], rax
mov rdx, qword [rax]
mov qword [rsp + 0xbf8], rdx
lea rax, [rsp + 0x1b8]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0xf8], eax
test eax, eax
je 0x14005a891
test r15, r15
je 0x14005a7a7
mov dword [r15 + 8], eax
mov eax, 0x16
mov word [r15], ax
mov rcx, qword [rsp + 0x1c8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5c8], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a7d9
mov rdx, qword [rsp + 0x5c8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x40]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5d8], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a808
mov rdx, qword [rsp + 0x5d8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3208], 0x10
jb 0x14005a820
mov rcx, qword [rsp + 0x31f0]
call fcn.1400c27f0
mov qword [rsp + 0x3208], 0xf
mov qword [rsp + 0x3200], rdi
mov byte [rsp + 0x31f0], 0
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5e8], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a86b
mov rdx, qword [rsp + 0x5e8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3360]
call fcn.140017870
nop
lea rcx, [rsp + 0x50]
call fcn.140033980
nop
xor bl, bl
mov r12d, 1
jmp 0x14005c877
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xe08], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xc08], rax
mov rdx, qword [rax]
mov qword [rsp + 0xf70], rdx
lea rcx, [rsp + 0x230]
call fcn.1400030f0
nop
mov rdx, qword [rsp + 0x230]
mov eax, dword [rdx - 0x10]
mov dword [rsp + 0x3d0], eax
mov rcx, qword [rsp + 0x1b8]
test eax, eax
jne 0x14005a924
lea rdx, [0x140133848]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [rsp + 0xf8], eax
test eax, eax
je 0x14005a949
test r15, r15
je 0x14005a95c
mov dword [r15 + 8], eax
mov eax, 0x16
mov word [r15], ax
jmp 0x14005a95c
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [rsp + 0xf8], eax
test eax, eax
je 0x14005a949
test r15, r15
je 0x14005a95c
mov dword [r15 + 8], eax
mov eax, 0x16
mov word [r15], ax
jmp 0x14005a95c
test r15, r15
je 0x14005a95c
mov word [r15 + 8], r14w
mov esi, 0xb
mov word [r15], si
mov rcx, qword [rsp + 0x1b8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0x230]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x5f8], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a99d
mov rdx, qword [rsp + 0x5f8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x1c8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x608], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a9cf
mov rdx, qword [rsp + 0x608]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x40]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x618], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005a9fe
mov rdx, qword [rsp + 0x618]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3208], 0x10
jb 0x14005aa16
mov rcx, qword [rsp + 0x31f0]
call fcn.1400c27f0
mov qword [rsp + 0x3208], 0xf
mov qword [rsp + 0x3200], rdi
mov byte [rsp + 0x31f0], 0
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x628], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005aa61
mov rdx, qword [rsp + 0x628]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3360]
call fcn.140017870
nop
lea rcx, [rsp + 0x50]
call fcn.140033980
nop
xor bl, bl
mov r12d, 1
jmp 0x14005c877
call fcn.1400343c0
mov qword [rsp + 0xc18], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xe18], rax
cmp byte [rax + 8], 4
jne 0x14005aba9
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xc28], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0x840], rax
mov rdx, qword [rax]
mov qword [rsp + 0x850], rdx
lea rcx, [rsp + 0x270]
call fcn.1400030f0
nop
lea rdx, [0x140133848]
lea rcx, [rsp + 0x260]
call fcn.1400022a0
nop
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0x860], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0x870], rax
mov rdx, qword [rax]
mov qword [rsp + 0x880], rdx
lea rcx, [rsp + 0x250]
call fcn.1400030f0
nop
lea r8, [rsp + 0x270]
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x250]
call fcn.140042700
movzx ebx, al
mov byte [rsp + 0x74], al
lea rcx, [rsp + 0x250]
call fcn.140002340
nop
lea rcx, [rsp + 0x260]
call fcn.140002340
nop
lea rcx, [rsp + 0x270]
jmp 0x14005ac64
lea rdx, [0x140133848]
lea rcx, [rsp + 0x2a0]
call fcn.1400022a0
nop
lea rdx, [0x140133848]
lea rcx, [rsp + 0x290]
call fcn.1400022a0
nop
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0x890], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0x8a0], rax
mov rdx, qword [rax]
mov qword [rsp + 0x8b0], rdx
lea rcx, [rsp + 0x280]
call fcn.1400030f0
nop
lea r8, [rsp + 0x2a0]
lea rdx, [rsp + 0x290]
lea rcx, [rsp + 0x280]
call fcn.140042700
movzx ebx, al
mov byte [rsp + 0x74], al
lea rcx, [rsp + 0x280]
call fcn.140002340
nop
lea rcx, [rsp + 0x290]
call fcn.140002340
nop
lea rcx, [rsp + 0x2a0]
call fcn.140002340
test r15, r15
je 0x14005c73b
neg bl
sbb ax, ax
mov word [r15 + 8], ax
mov esi, 0xb
mov word [r15], si
jmp 0x14005c73b
lea rdx, str.getChildValues
lea rcx, [rsp + 0x40]
call fcn.140003550
test eax, eax
je 0x14005bbf8
lea rdx, str.getChildKeys
lea rcx, [rsp + 0x40]
call fcn.140003550
test eax, eax
je 0x14005bbf8
lea rdx, str.requestGet
lea rcx, [rsp + 0x40]
call fcn.140003550
test eax, eax
jne 0x14005b273
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov r12d, 1
mov edx, r12d
lea rcx, [0x140133848]
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
mov qword [rsp + 0x8c0], rax
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0x8d0], rax
lea rdx, [0x1401371fc]
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0x8e0], rax
cmp byte [rax + 8], 4
jne 0x14005b1f6
test rsi, rsi
je 0x14005b1f6
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0x8f0], rax
lea rdx, [0x1401371fc]
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0x900], rax
lea rdx, [rsp + 0x3300]
mov rcx, rax
call fcn.140033ac0
mov qword [rsp + 0x910], rax
cmp qword [rax + 0x18], 0x10
jb 0x14005ad95
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.1400030f0
nop
cmp qword [rsp + 0x3318], 0x10
jb 0x14005adbe
mov rcx, qword [rsp + 0x3300]
call fcn.1400c27f0
mov qword [rsp + 0x3318], 0xf
mov qword [rsp + 0x3310], rdi
mov byte [rsp + 0x3300], 0
xor r8d, r8d
lea rdx, str.error
lea rcx, [rsp + 0x98]
call fcn.140019940
mov ebx, eax
mov dword [rsp + 0x220], eax
test eax, eax
jle 0x14005aeb6
add ebx, 6
mov dword [rsp + 0x220], ebx
mov edx, 0x26
mov rcx, qword [rsp + 0x98]
call fcn.1400c5214
mov qword [rsp + 0x920], rax
test rax, rax
jne 0x14005ae30
mov eax, r14d
jmp 0x14005ae3b
sub rax, qword [rsp + 0x98]
sar rax, 1
sub eax, ebx
mov r9d, eax
mov r8d, ebx
lea rdx, [rsp + 0x638]
lea rcx, [rsp + 0x98]
call fcn.14000e970
mov qword [rsp + 0x930], rax
mov rdx, rax
lea rcx, [rsp + 0x98]
call fcn.1400023c0
nop
lea rcx, [rsp + 0x638]
call fcn.140002340
lea rdx, str.js_code
lea rcx, [rsp + 0x2b0]
call fcn.1400030f0
nop
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x98]
call fcn.14001c380
nop
lea rcx, [rsp + 0x2b0]
call fcn.140002340
xor edx, edx
lea rcx, [rsp + 0x3a0]
call fcn.140033610
nop
lea rdx, [0x140137264]
lea rcx, [rsp + 0xe90]
call fcn.1400336d0
nop
lea rdx, [0x140137238]
lea rcx, [rsp + 0x3a0]
call fcn.1400343c0
mov rcx, rax
lea rdx, [rsp + 0xe90]
call fcn.140033a30
nop
lea rcx, [rsp + 0xe90]
call fcn.140033980
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0x940], rax
lea rdx, [0x1401371fc]
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0x950], rax
lea rdx, [rsp + 0x32c0]
mov rcx, rax
call fcn.140033ac0
nop
mov rdx, rax
lea rcx, [rsp + 0xeb0]
call fcn.140033760
nop
lea rdx, [0x1401371fc]
lea rcx, [rsp + 0x3a0]
call fcn.1400343c0
mov rcx, rax
lea rdx, [rsp + 0xeb0]
call fcn.140033a30
nop
lea rcx, [rsp + 0xeb0]
call fcn.140033980
nop
cmp qword [rsp + 0x32d8], 0x10
jb 0x14005afaa
mov rcx, qword [rsp + 0x32c0]
call fcn.1400c27f0
mov qword [rsp + 0x32d8], 0xf
mov qword [rsp + 0x32d0], rdi
mov byte [rsp + 0x32c0], 0
lea rdx, [0x140137274]
lea rcx, [rsp + 0xed0]
call fcn.1400336d0
nop
lea rdx, str.acceptedStatusCodes
lea rcx, [rsp + 0x3a0]
call fcn.1400343c0
mov rcx, rax
lea rdx, [rsp + 0xed0]
call fcn.1400346e0
nop
lea rcx, [rsp + 0xed0]
call fcn.140033980
lea rdx, [0x140137294]
lea rcx, [rsp + 0xef0]
call fcn.1400336d0
nop
lea rdx, str.acceptTypes
lea rcx, [rsp + 0x3a0]
call fcn.1400343c0
mov rcx, rax
lea rdx, [rsp + 0xef0]
call fcn.140033a30
nop
lea rcx, [rsp + 0xef0]
call fcn.140033980
lea rdx, str.Accept_Encoding:_gzip__deflate_r_n
lea rcx, [rsp + 0xf10]
call fcn.1400336d0
nop
lea rdx, str.additionalRequestHeaders
lea rcx, [rsp + 0x3a0]
call fcn.1400343c0
mov rcx, rax
lea rdx, [rsp + 0xf10]
call fcn.140033a30
nop
lea rcx, [rsp + 0xf10]
call fcn.140033980
mov qword [rsp + 0x648], rdi
lea r9, [rsp + 0x3a0]
lea r8, [rsp + 0x648]
mov rdx, rsi
lea rcx, [rsp + 0xf30]
call fcn.140029bc0
nop
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test r15, r15
je 0x14005b1c8
lea rax, vtable.Json::Writer.0
mov qword [rsp + 0x3250], rax
lea rax, vtable.Json::FastWriter.0
mov qword [rsp + 0x3250], rax
mov qword [rsp + 0x3268], rdi
mov qword [rsp + 0x3270], rdi
mov qword [rsp + 0x3270], 0xf
mov qword [rsp + 0x3268], rdi
mov byte [rsp + 0x3258], 0
mov byte [rsp + 0x3278], 0
lea r8, [rsp + 0xf30]
lea rdx, [rsp + 0x3420]
lea rcx, [rsp + 0x3250]
call fcn.140036c80
mov qword [rsp + 0x960], rax
cmp qword [rax + 0x18], 0x10
jb 0x14005b157
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x2c0]
call fcn.1400030f0
nop
lea rcx, [rsp + 0x3420]
call fcn.1400013b0
mov rcx, qword [rsp + 0x2c0]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x720], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0x970], rax
test rax, rax
jne 0x14005b19f
call fcn.140002640
mov qword [r15 + 8], rax
mov eax, 8
mov word [r15], ax
lea rcx, [rsp + 0x2c0]
call fcn.140002340
nop
lea rcx, [rsp + 0x3250]
call fcn.14000ae00
nop
lea rcx, [rsp + 0xf30]
call fcn.140033980
nop
lea rcx, [rsp + 0x3a0]
call fcn.140033980
nop
lea rcx, [rsp + 0x98]
call fcn.140002340
jmp 0x14005c73b
test r15, r15
je 0x14005b209
mov word [r15 + 8], di
mov esi, 0xb
mov word [r15], si
lea rcx, [rsp + 0x40]
call fcn.140002340
nop
cmp qword [rsp + 0x3208], 0x10
jb 0x14005b22c
mov rcx, qword [rsp + 0x31f0]
call fcn.1400c27f0
mov qword [rsp + 0x3208], 0xf
mov qword [rsp + 0x3200], rdi
mov byte [rsp + 0x31f0], 0
lea rcx, [rsp + 0x68]
call fcn.140002340
nop
lea rcx, [rsp + 0x3360]
call fcn.140017870
nop
lea rcx, [rsp + 0x50]
call fcn.140033980
nop
xor bl, bl
jmp 0x14005c877
lea rdx, str.NVP_IsSupported
lea rcx, [rsp + 0x40]
call fcn.140003550
test eax, eax
jne 0x14005b2a4
test r15, r15
je 0x14005c73b
mov word [r15 + 8], r14w
mov esi, 0xb
mov word [r15], si
jmp 0x14005c73b
lea rdx, str.NVP_Inject
lea rcx, [rsp + 0x40]
call fcn.140003550
test eax, eax
jne 0x14005b7b4
test r15, r15
je 0x14005c73b
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0x980], rax
lea rdx, str.match
mov rcx, rax
call fcn.1400345c0
mov qword [rsp + 0x990], rax
cmp rax, rbx
je 0x14005b76a
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0x9a0], rax
lea rdx, str.inject
mov rcx, rax
call fcn.1400345c0
mov qword [rsp + 0x9b0], rax
cmp rax, rbx
je 0x14005b76a
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0x9c0], rax
lea rdx, str.message
mov rcx, rax
call fcn.1400345c0
mov qword [rsp + 0x9d0], rax
cmp rax, rbx
je 0x14005b76a
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0x9e0], rax
lea rdx, str.match
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0x9f0], rax
cmp byte [rax + 8], 1
jne 0x14005b76a
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xa00], rax
lea rdx, str.inject
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xa10], rax
cmp byte [rax + 8], 1
jne 0x14005b76a
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xa20], rax
lea rdx, str.message
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xa30], rax
cmp byte [rax + 8], 4
jne 0x14005b76a
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xa40], rax
lea rdx, str.message
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xa50], rax
lea rdx, [rsp + 0x3210]
mov rcx, rax
call fcn.140033ac0
nop
mov qword [rsp + 0x2d0], rdi
lea rcx, [rsp + 0x3210]
cmp qword [rsp + 0x3228], 0x10
cmovae rcx, qword [rsp + 0x3210]
mov qword [rsp + 0xa60], rcx
mov rdx, qword [rsp + 0x3220]
test dl, 3
jne 0x14005b712
lea r8, [rsp + 0x2d0]
call fcn.14001ec10
mov byte [rsp + 0x90], al
test al, al
je 0x14005b712
mov qword [rsp + 0x130], rdi
mov qword [rsp + 0x138], rdi
mov qword [rsp + 0x140], rdi
mov rbx, qword [rsp + 0x2d0]
mov rdx, rbx
lea rcx, [rsp + 0x130]
call fcn.14002d150
nop
mov qword [rsp + 0x2e0], rdi
cmp qword [rsp + 0x3228], 0x10
jb 0x14005b51a
mov rcx, qword [rsp + 0x3210]
mov qword [rsp + 0x658], rcx
test rcx, rcx
jne 0x14005b52a
mov rbx, qword [rsp + 0x130]
jmp 0x14005b55d
lea rcx, [rsp + 0x3210]
mov qword [rsp + 0x658], rcx
lea rax, [rsp + 0x2e0]
mov qword [rsp + 0x20], rax
mov r9, rbx
mov rbx, qword [rsp + 0x130]
mov r8, rbx
mov rdx, qword [rsp + 0x3220]
call fcn.14001ec40
mov byte [rsp + 0x80], al
test al, al
jne 0x14005b5da
test rbx, rbx
je 0x14005b582
mov rcx, rbx
call fcn.1400c27f0
mov qword [rsp + 0x130], rdi
mov qword [rsp + 0x138], rdi
mov qword [rsp + 0x140], rdi
lea rcx, [rsp + 0x3210]
call fcn.1400013b0
nop
lea rcx, [rsp + 0x40]
call fcn.140002340
nop
lea rcx, [rsp + 0x31f0]
call fcn.1400013b0
nop
lea rcx, [rsp + 0x68]
call fcn.140002340
nop
lea rcx, [rsp + 0x3360]
call fcn.140017870
nop
lea rcx, [rsp + 0x50]
call fcn.140033980
nop
xor bl, bl
mov r12d, 1
jmp 0x14005c877
mov rdx, qword [rsp + 0x2e0]
lea rcx, [rsp + 0x130]
call fcn.14002d150
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xa70], rax
lea rdx, str.match
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xa80], rax
mov rcx, rax
call fcn.140033d50
mov ebx, eax
mov dword [rsp + 0x3e0], eax
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xa90], rax
lea rdx, str.inject
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xaa0], rax
mov rcx, rax
call fcn.140033d50
mov esi, eax
mov dword [rsp + 0x610], eax
mov eax, dword [0x1401a9d80]
lea r8d, [rax + 1]
imul r8d, eax
mov eax, 0x2e8ba2e9
imul r8d
sar edx, 2
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x16
sub r8d, edx
cmp r8d, 1
jne 0x14005b6b2
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
lea r9, [rsp + 0x130]
mov r8d, esi
mov edx, ebx
mov rcx, qword [r13 + 0x40]
call fcn.140053230
mov word [r15 + 8], r14w
mov esi, 0xb
mov word [r15], si
mov rcx, qword [rsp + 0x130]
test rcx, rcx
je 0x14005b700
call fcn.1400c27f0
mov qword [rsp + 0x130], rdi
mov qword [rsp + 0x138], rdi
mov qword [rsp + 0x140], rdi
lea rcx, [rsp + 0x3210]
call fcn.1400013b0
jmp 0x14005c73b
lea rcx, [rsp + 0x3210]
call fcn.1400013b0
nop
lea rcx, [rsp + 0x40]
call fcn.140002340
nop
lea rcx, [rsp + 0x31f0]
call fcn.1400013b0
nop
lea rcx, [rsp + 0x68]
call fcn.140002340
nop
lea rcx, [rsp + 0x3360]
call fcn.140017870
nop
lea rcx, [rsp + 0x50]
call fcn.140033980
nop
xor bl, bl
mov r12d, 1
jmp 0x14005c877
lea rcx, [rsp + 0x40]
call fcn.140002340
nop
lea rcx, [rsp + 0x31f0]
call fcn.1400013b0
nop
lea rcx, [rsp + 0x68]
call fcn.140002340
nop
lea rcx, [rsp + 0x3360]
call fcn.140017870
nop
lea rcx, [rsp + 0x50]
call fcn.140033980
nop
xor bl, bl
mov r12d, 1
jmp 0x14005c877
lea rdx, str.NVP_UTF8ToUTF16
lea rcx, [rsp + 0x40]
call fcn.140003550
test eax, eax
jne 0x14005ba80
test r15, r15
je 0x14005c73b
xor sil, sil
mov byte [rsp + 0x71], sil
lea rcx, [rsp + 0x1e8]
call fcn.140002260
nop
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xab0], rax
lea rdx, [0x140139a50]
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xac0], rax
cmp byte [rax + 8], 4
jne 0x14005ba60
mov r10d, dword [0x1401a9d80]
mov ecx, r10d
imul ecx, r10d
mov eax, 0x66666667
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub ecx, eax
cmp ecx, 0x12
jne 0x14005b88e
mov r8d, edi
mov dword [rsp + 0x1b0], edi
nop dword [rax]
movsxd r9, r8d
cmp r9, 0x8b
jae 0x14005b88e
lea ecx, [r8 + r10]
mov eax, r10d
sub eax, r8d
cdq
idiv ecx
mov dword [rsp + r9*4 + 0x3440], edx
inc r8d
mov dword [rsp + 0x1b0], r8d
jmp 0x14005b860
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xad0], rax
lea rdx, [0x140139a50]
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xae0], rax
lea rdx, [rsp + 0x3230]
mov rcx, rax
call fcn.140033ac0
nop
mov rax, qword [rsp + 0x3240]
mov qword [rsp + 0xaf0], rax
lea r8, [rsp + 0x3230]
cmp qword [rsp + 0x3248], 0x10
cmovae r8, qword [rsp + 0x3230]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, eax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov dword [rsp + 0x3f0], ebx
test eax, eax
je 0x14005ba15
mov qword [rsp + 0x238], rdi
mov qword [rsp + 0x240], rdi
mov qword [rsp + 0x248], rdi
mov rdx, rbx
add rdx, rdx
lea rcx, [rsp + 0x238]
call fcn.14002d150
nop
mov rax, qword [rsp + 0x3240]
mov qword [rsp + 0xb00], rax
lea r8, [rsp + 0x3230]
cmp qword [rsp + 0x3248], 0x10
cmovae r8, qword [rsp + 0x3230]
mov dword [rsp + 0x28], ebx
mov rbx, qword [rsp + 0x238]
mov qword [rsp + 0x20], rbx
mov r9d, eax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x14005b9f0
mov r8, qword [rsp + 0x240]
sub r8, rbx
mov qword [rsp + 0xb10], r8
mov rdx, rbx
lea rcx, [rsp + 0x668]
call fcn.14001edc0
mov qword [rsp + 0xb20], rax
mov rdx, rax
lea rcx, [rsp + 0x1e8]
call fcn.1400023c0
nop
lea rcx, [rsp + 0x668]
call fcn.140002340
mov sil, 1
mov byte [rsp + 0x71], sil
test rbx, rbx
je 0x14005ba15
mov rcx, rbx
call fcn.1400c27f0
mov qword [rsp + 0x238], rdi
mov qword [rsp + 0x240], rdi
mov qword [rsp + 0x248], rdi
lea rcx, [rsp + 0x3230]
call fcn.1400013b0
test sil, sil
je 0x14005ba60
mov rcx, qword [rsp + 0x1e8]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x7b0], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xb30], rax
test rax, rax
jne 0x14005ba51
call fcn.140002640
mov qword [r15 + 8], rax
mov eax, 8
mov word [r15], ax
jmp 0x14005ba6e
mov word [r15 + 8], di
mov esi, 0xb
mov word [r15], si
lea rcx, [rsp + 0x1e8]
call fcn.140002340
jmp 0x14005c73b
lea rdx, str.reloadBackground
lea rcx, [rsp + 0x40]
call fcn.140003550
test eax, eax
jne 0x14005babd
mov rcx, qword [r13 + 0x40]
add rcx, 0x1f8
call fcn.140061040
test r15, r15
je 0x14005c73b
mov r12d, 1
mov word [r15], r12w
jmp 0x14005c73b
lea rdx, str.debugMessage
lea rcx, [rsp + 0x40]
call fcn.140003550
test eax, eax
jne 0x14005bbdc
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xb40], rax
lea rdx, str.message
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xb50], rax
cmp byte [rax + 8], 4
jne 0x14005bbdc
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xb60], rax
lea rdx, str.message
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xb70], rax
mov rdx, qword [rax]
mov qword [rsp + 0xb80], rdx
lea rcx, [rsp + 0x678]
call fcn.1400030f0
nop
mov r8d, dword [0x1401a9d80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 4
jne 0x14005bbb7
mov r12d, 1
mov dword [rsp + 0x218], r12d
cmp r12d, r8d
jge 0x14005bbb0
mov eax, r8d
cdq
idiv r12d
inc r12d
add r12d, edx
mov dword [rsp + 0x218], r12d
jmp 0x14005bb94
mov dword [0x1401a9d80], r12d
test r15, r15
je 0x14005bbca
mov word [r15 + 8], r14w
mov esi, 0xb
mov word [r15], si
lea rcx, [rsp + 0x678]
call fcn.140002340
jmp 0x14005c73b
test r15, r15
je 0x14005c73b
mov word [r15 + 8], di
mov esi, 0xb
mov word [r15], si
jmp 0x14005c73b
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xb90], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xba0], rax
cmp byte [rax + 8], 4
jne 0x14005c73b
test r15, r15
je 0x14005c73b
mov qword [rsp + 0x1d0], rdi
mov qword [rsp + 0x1d8], rdi
mov qword [rsp + 0x1e0], rdi
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xbb0], rax
lea rdx, str.hive
mov rcx, rax
call fcn.1400345c0
mov qword [rsp + 0xbc0], rax
cmp rax, rbx
je 0x14005bf35
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xbd0], rax
lea rdx, str.hive
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xbe0], rax
mov rdx, qword [rax]
mov qword [rsp + 0xbf0], rdx
lea rcx, [rsp + 0x1f8]
call fcn.1400030f0
nop
mov rbx, qword [r13 + 0x50]
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x1f8]
call fcn.140003550
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0xc00], rbx
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xc10], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xc20], rax
mov rdx, qword [rax]
mov qword [rsp + 0xc30], rdx
lea rax, [rsp + 0x688]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x400], eax
test eax, eax
je 0x14005be04
mov dword [r15 + 8], eax
mov eax, 0x16
mov word [r15], ax
lea rcx, [rsp + 0x1f8]
call fcn.140002340
nop
lea rcx, [rsp + 0x1d0]
call fcn.140019f30
nop
lea rcx, [rsp + 0x40]
call fcn.140002340
nop
cmp qword [rsp + 0x3208], 0x10
jb 0x14005bdb7
mov rcx, qword [rsp + 0x31f0]
call fcn.1400c27f0
mov qword [rsp + 0x3208], 0xf
mov qword [rsp + 0x3200], rdi
mov byte [rsp + 0x31f0], 0
lea rcx, [rsp + 0x68]
call fcn.140002340
nop
lea rcx, [rsp + 0x3360]
call fcn.140017870
nop
lea rcx, [rsp + 0x50]
call fcn.140033980
nop
xor bl, bl
mov r12d, 1
jmp 0x14005c877
mov ebx, edi
mov dword [rsp + 0x170], ebx
mov dword [rsp + 0x110], 0x7ffe
lea rdx, str.getChildValues
lea rcx, [rsp + 0x40]
call fcn.140003550
mov r12, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
cmove r12, qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov qword [rsp + 0xc40], r12
mov ecx, 0x7ffe
call fcn.1400c1e58
mov rsi, rax
mov qword [rsp + 0xc50], rax
xor edx, edx
mov r8d, 0x7ffe
mov rcx, rax
call fcn.1400c7c50
nop word [rax + rax]
mov edx, ebx
inc ebx
mov dword [rsp + 0x170], ebx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x110]
mov r8, rsi
mov rcx, qword [rsp + 0x688]
call r12
mov dword [rsp + 0x620], eax
test eax, eax
jne 0x14005beff
mov rdx, rsi
lea rcx, [rsp + 0x698]
call fcn.1400030f0
nop
mov rdx, rax
lea rcx, [rsp + 0x1d0]
call fcn.140025350
nop
lea rcx, [rsp + 0x698]
call fcn.140002340
xor edx, edx
mov r8d, 0x7ffe
mov rcx, rsi
call fcn.1400c7c50
mov dword [rsp + 0x110], 0x7ffe
jmp 0x14005be70
cmp eax, 0x103
je 0x14005bf22
mov rax, qword [rsp + 0x1d8]
sub rax, qword [rsp + 0x1d0]
test rax, 0xfffffffffffffff8
jne 0x14005bf22
xor bl, bl
jmp 0x14005bf24
mov bl, 1
mov byte [rsp + 0x48], bl
lea rcx, [rsp + 0x1f8]
jmp 0x14005c01a
lea rdx, str.getChildValues
lea rcx, [rsp + 0x40]
call fcn.140003550
lea rdx, str.param
lea rcx, [rsp + 0x50]
test eax, eax
jne 0x14005bfb9
call fcn.1400343c0
mov qword [rsp + 0xc60], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xc70], rax
mov rdx, qword [rax]
mov qword [rsp + 0xc80], rdx
lea rcx, [rsp + 0x228]
call fcn.1400030f0
nop
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0x228]
call fcn.1400447b0
movzx ebx, al
mov byte [rsp + 0x48], al
lea rcx, [rsp + 0x228]
jmp 0x14005c01a
call fcn.1400343c0
mov qword [rsp + 0xc90], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xca0], rax
mov rdx, qword [rax]
mov qword [rsp + 0xcb0], rdx
lea rcx, [rsp + 0x308]
call fcn.1400030f0
nop
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0x308]
call fcn.140044490
movzx ebx, al
mov byte [rsp + 0x48], al
lea rcx, [rsp + 0x308]
call fcn.140002340
test bl, bl
je 0x14005c221
mov ecx, dword [0x1401a9d80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x2e8ba2e9
imul r8d
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xb
sub r8d, edx
mov eax, dword [rsp + 0x1040]
cmp r8d, 3
cmove eax, edi
mov dword [rsp + 0x1040], eax
lea rdx, [0x1401399c4]
lea rcx, [rsp + 0xc0]
call fcn.1400022a0
nop
mov rbx, qword [rsp + 0x1d0]
mov qword [rsp + 0x6c8], rbx
cmp rbx, qword [rsp + 0x1d8]
je 0x14005c163
lea rdx, [0x1401399a0]
lea rcx, [rsp + 0x328]
call fcn.1400030f0
nop
lea rdx, [0x1401399a4]
lea rcx, [rsp + 0x318]
call fcn.1400030f0
nop
mov r8, rbx
lea rdx, [rsp + 0x318]
lea rcx, [rsp + 0x6b8]
call fcn.14000ea60
nop
lea r8, [rsp + 0x328]
mov rdx, rax
lea rcx, [rsp + 0x6a8]
call fcn.14000ea60
mov qword [rsp + 0xcc0], rax
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
mov dword [rsp + 0x410], r8d
mov qword [rsp + 0xcd0], rdx
lea rcx, [rsp + 0xc0]
call fcn.14000f520
nop
lea rcx, [rsp + 0x6a8]
call fcn.140002340
nop
lea rcx, [rsp + 0x6b8]
call fcn.140002340
nop
lea rcx, [rsp + 0x318]
call fcn.140002340
nop
lea rcx, [rsp + 0x328]
call fcn.140002340
add rbx, 8
jmp 0x14005c085
mov rax, qword [rsp + 0xc0]
mov r8d, dword [rax - 0x10]
mov dword [rsp + 0x730], r8d
dec r8d
lea rdx, [rsp + 0x6e8]
lea rcx, [rsp + 0xc0]
call fcn.140019a50
nop
lea r8, [0x1401399e8]
mov rdx, rax
lea rcx, [rsp + 0x6d8]
call fcn.140019af0
mov qword [rsp + 0xce0], rax
mov rdx, rax
lea rcx, [rsp + 0xc0]
call fcn.1400023c0
nop
lea rcx, [rsp + 0x6d8]
call fcn.140002340
nop
lea rcx, [rsp + 0x6e8]
call fcn.140002340
mov rcx, qword [rsp + 0xc0]
mov edx, dword [rcx - 0x10]
mov dword [rsp + 0x7f8], edx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xcf0], rax
test rax, rax
jne 0x14005c205
call fcn.140002640
mov qword [r15 + 8], rax
mov eax, 8
mov word [r15], ax
lea rcx, [rsp + 0xc0]
call fcn.140002340
jmp 0x14005c22f
mov word [r15 + 8], di
mov esi, 0xb
mov word [r15], si
lea rcx, [rsp + 0x1d0]
call fcn.140019f30
jmp 0x14005c73b
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xd00], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xd10], rax
cmp byte [rax + 8], 4
jne 0x14005c73b
test r15, r15
je 0x14005c73b
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xd20], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xd30], rax
cmp byte [rax + 8], 4
jne 0x14005c73b
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xd40], rax
lea rdx, str.keyPath
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xd50], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd60], rdx
lea rcx, [rsp + 0xd0]
call fcn.1400030f0
nop
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xd70], rax
lea rdx, str.valueName
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xd80], rax
mov rdx, qword [rax]
mov qword [rsp + 0xd90], rdx
lea rcx, [rsp + 0xc8]
call fcn.1400030f0
nop
mov rsi, rdi
mov qword [rsp + 0x128], rdi
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xda0], rax
lea rdx, str.hive
mov rcx, rax
call fcn.1400345c0
mov qword [rsp + 0xdb0], rax
cmp rax, rbx
je 0x14005c488
lea rdx, str.param
lea rcx, [rsp + 0x50]
call fcn.1400343c0
mov qword [rsp + 0xdc0], rax
lea rdx, str.hive
mov rcx, rax
call fcn.1400343c0
mov qword [rsp + 0xdd0], rax
mov rdx, qword [rax]
mov qword [rsp + 0xde0], rdx
lea rcx, [rsp + 0x338]
call fcn.1400030f0
nop
mov rbx, qword [r13 + 0x50]
mov qword [rsp + 0x128], rbx
lea rdx, str.HKEY_USERS
lea rcx, [rsp + 0x338]
call fcn.140003550
mov rcx, 0xffffffff80000003
test eax, eax
cmove rbx, rcx
mov qword [rsp + 0x128], rbx
mov ecx, dword [0x1401a9d80]
imul ecx, ecx
mov eax, 0x2aaaaaab
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub ecx, eax
cmp ecx, 0x16
jne 0x14005c44f
mov edx, 0x9c
lea r8d, [rdx + 1]
lea rcx, str._d__d_n
call fcn.1400c3124
nop
mov rcx, qword [rsp + 0x338]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x6f8], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005c480
mov rdx, qword [rsp + 0x6f8]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rsi, qword [rsp + 0x128]
lea rdx, str.getCharPref
lea rcx, [rsp + 0x40]
call fcn.140003550
test eax, eax
jne 0x14005c603
lea rcx, [0x1401a19a8]
mov rax, qword [0x1401a19a8]
call qword [rax + 0x18]
mov qword [rsp + 0xdf0], rax
add rax, 0x18
mov qword [rsp + 0x208], rax
test rsi, rsi
je 0x14005c4f0
mov r9, rsi
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x208]
call fcn.140043760
jmp 0x14005c597
lea rax, [rsp + 0x708]
mov qword [rsp + 0xe00], rax
lea rdx, [0x140133848]
lea rcx, [rsp + 0x708]
call fcn.1400022a0
nop
mov qword [rsp + 0x20], rax
mov r9, qword [0x1401a4d48]
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x718]
call fcn.140042f80
mov qword [rsp + 0xe10], rax
mov rdx, rax
lea rcx, [rsp + 0x208]
call fcn.1400023c0
nop
mov rcx, qword [rsp + 0x718]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x728], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005c589
mov rdx, qword [rsp + 0x728]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x14005c597
mov rbx, qword [rsp + 0x208]
mov edx, dword [rbx - 0x10]
mov dword [rsp + 0x808], edx
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov qword [rsp + 0xe20], rax
test rax, rax
jne 0x14005c5c4
call fcn.140002640
mov qword [r15 + 8], rax
mov eax, 8
mov word [r15], ax
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x748], rbx
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
dec eax
jg 0x14005c6d7
mov rdx, qword [rsp + 0x748]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14005c6d7
mov ebx, r14d
mov dword [rsp + 0xa4], ebx
mov dword [rsp + 0x108], 0xffffffff
test rsi, rsi
je 0x14005c658
mov r9, rsi
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x108]
call fcn.140043950
mov byte [rsp + 0x72], al
mov ecx, dword [rsp + 0x108]
cmp ecx, 0xffffffff
je 0x14005c6b6
mov ebx, ecx
mov dword [rsp + 0xa4], ecx
jmp 0x14005c6b1
lea rax, [rsp + 0x758]
mov qword [rsp + 0xe30], rax
lea rdx, [0x140133848]
lea rcx, [rsp + 0x758]
call fcn.1400022a0
nop
mov qword [rsp + 0x20], rax
mov r9, qword [0x1401a4d48]
lea r8, [rsp + 0xd0]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0xa4]
call fcn.140043c30
mov byte [rsp + 0x72], al
mov ebx, dword [rsp + 0xa4]
cmp ebx, 0xffffffff
jne 0x14005c6ca
test al, al
jne 0x14005c6ca
mov word [r15 + 8], di
mov esi, 0xb
mov word [r15], si
jmp 0x14005c6d7
mov dword [r15 + 8], ebx
mov eax, 0x16
mov word [r15], ax
mov rcx, qword [rsp + 0xc8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x768], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005c709
mov rdx, qword [rsp + 0x768]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0xd0]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x778], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005c73b
mov rdx, qword [rsp + 0x778]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x40]
call fcn.140002340
nop
lea rcx, [rsp + 0x31f0]
call fcn.1400013b0
nop
lea rcx, [rsp + 0x68]
call fcn.140002340
nop
lea rcx, [rsp + 0x3360]
call fcn.140017870
nop
lea rcx, [rsp + 0x50]
call fcn.140033980
nop
mov bl, 1
jmp 0x14005c880
lea rdx, str.json_parse_action_not_found
lea rcx, [rsp + 0x358]
call fcn.1400030f0
nop
lea rdx, [rsp + 0x358]
mov rcx, qword [r13 + 0x40]
call fcn.1400530d0
nop
mov rcx, qword [rsp + 0x358]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x788], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005c7d8
mov rdx, qword [rsp + 0x788]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp qword [rsp + 0x3208], 0x10
jb 0x14005c7f0
mov rcx, qword [rsp + 0x31f0]
call fcn.1400c27f0
mov qword [rsp + 0x3208], 0xf
mov qword [rsp + 0x3200], rdi
mov byte [rsp + 0x31f0], 0
mov rcx, qword [rsp + 0x68]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x798], rcx
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
dec eax
jg 0x14005c83b
mov rdx, qword [rsp + 0x798]
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lea rcx, [rsp + 0x3360]
call fcn.140017870
nop
lea rcx, [rsp + 0x50]
call fcn.140033980
nop
xor bl, bl
mov r12d, 1
jmp 0x14005c877
test r15, r15
je 0x14005c880
mov word [r15], r12w
mov rax, qword [rsp + 0x370]
mov rdx, qword [rax]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], r14d
dec r14d
jg 0x14005c8a4
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, bl
mov rcx, qword [rsp + 0x3e50]
xor rcx, rsp
call fcn.1400c2810
add rsp, 0x3e60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret