Function at 0x140072908
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov byte [rax + 0x18], r8b
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x138
mov rdi, rcx
lea rcx, [rax - 0x68]
mov qword [rsp + 0xf0], rdx
call fcn.14004be6c
xor r11d, r11d
mov r14b, 0xff
lea r12d, [r11 + 2]
mov qword [rsp + 0x118], rdi
mov qword [rsp + 0x120], r11
mov byte [rsp + 0x85], r14b
mov byte [rsp + 0x70], r11b
mov byte [rsp + 0x63], r11b
mov qword [rsp + 0x100], r11
mov rbp, r11
mov qword [rsp + 0xc0], r11
mov qword [rsp + 0x90], r11
mov r10d, 0xd
lea rcx, [rsp + 0x188]
lea r8d, [r10 + 0x20]
lea r9d, [r10 + 0x1d]
lea edi, [r10 + 0x17]
call fcn.140044ef4
mov rbx, qword [rsp + 0x188]
mov byte [rsp + 0x198], r11b
cmp r8w, word [rbx]
movzx eax, r9b
movabs r15, 0xfffffff000000000
cmove eax, r8d
mov byte [rsp + 0x64], r11b
mov byte [rsp + 0x61], r11b
movsx esi, al
movzx eax, word [rbx]
mov qword [rsp + 0xa8], r15
mov byte [rsp + 0x60], r11b
mov byte [rsp + 0x84], r11b
mov byte [rsp + 0x62], r11b
mov r13d, r11d
mov dword [rsp + 0x98], r11d
cmp esi, eax
jne 0x140072d91
lea ebp, [rdi - 4]
lea r14d, [r10 - 4]
jmp 0x140072a16
mov r10d, 0xd
movzx eax, word [rbx + 2]
cmp esi, eax
jne 0x140072d7c
mov ecx, 0xffdf
lea rdi, [rbx + 4]
movzx eax, word [rdi]
and ax, cx
mov ecx, 0x48
cmp cx, ax
je 0x140072d7c
cmp r14w, word [rdi]
ja 0x140072a4f
cmp word [rdi], r10w
jbe 0x140072d7c
cmp bp, word [rdi]
je 0x140072d7c
mov ebx, 1
lea rcx, [0x1400df950]
mov rdx, rdi
mov r8d, ebx
mov qword [rsp + 0x188], rdi
call fcn.140045fc8
cmp al, r11b
je 0x140072b25
movzx eax, word [rdi]
lea r8, [rdi + 2]
cmp ax, r11w
je 0x140072abe
lea r15d, [rbx + 0xc]
cmp r14w, ax
ja 0x140072a9d
cmp ax, r15w
jbe 0x140072ab6
cmp bp, ax
je 0x140072ab6
add rdi, r12
mov qword [rsp + 0x188], rdi
mov ax, word [rdi]
cmp ax, r11w
jne 0x140072a91
mov r15, qword [rsp + 0xa8]
lea rcx, [rsp + 0x188]
call fcn.140044ef4
mov ecx, 0x3a
cmp cx, word [r8]
je 0x140072adc
or r13d, 7
jmp 0x140072b18
add r8, r12
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0xe0]
mov dword [rsp + 0x80], r11d
mov qword [rsp + 0xe0], r8
call fcn.14004fc04
xor r11d, r11d
cmp eax, r11d
jle 0x140072d69
or r13d, dword [rsp + 0x80]
mov dword [rsp + 0x98], r13d
jmp 0x140072d69
lea rcx, [0x1400df94c]
mov r8d, r12d
mov rdx, rdi
call fcn.140045fc8
cmp al, r11b
je 0x140072bd3
lea rax, [rdi + 4]
mov qword [rsp + 0xe0], rax
movzx eax, word [rdi]
cmp ax, r11w
je 0x140072b88
mov r13d, 0xd
cmp r14w, ax
ja 0x140072b67
cmp ax, r13w
jbe 0x140072b80
cmp bp, ax
je 0x140072b80
add rdi, r12
mov qword [rsp + 0x188], rdi
mov ax, word [rdi]
cmp ax, r11w
jne 0x140072b5b
mov r13d, dword [rsp + 0x98]
lea rcx, [rsp + 0x188]
call fcn.140044ef4
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0xe0]
mov dword [rsp + 0x80], r11d
call fcn.14004fc04
xor r11d, r11d
cmp eax, r11d
jle 0x140072d69
mov r15d, dword [rsp + 0x80]
mov qword [rsp + 0xa8], r15
jmp 0x140072d69
lea rdx, [rsp + 0x188]
lea rcx, [0x1400df948]
mov r8d, r12d
call fcn.14004e558
xor r11d, r11d
cmp al, r11b
je 0x140072bfb
mov byte [rsp + 0x61], bl
jmp 0x140072d69
lea rdx, [rsp + 0x188]
lea rcx, str.byte
mov r8d, 4
call fcn.14004e558
xor r11d, r11d
cmp al, r11b
je 0x140072c26
mov byte [rsp + 0x62], bl
jmp 0x140072d69
lea rdx, [rsp + 0x188]
lea rcx, [0x1400d9a20]
mov r8d, ebx
call fcn.14004e558
xor r11d, r11d
cmp al, r11b
je 0x140072c4f
mov byte [rsp + 0x60], 3
jmp 0x140072d69
lea rdx, [rsp + 0x188]
lea rcx, [0x1400df944]
mov r8d, r12d
call fcn.14004e558
xor r11d, r11d
cmp al, r11b
je 0x140072c77
or byte [rsp + 0x60], bl
jmp 0x140072d69
lea rdx, [rsp + 0x188]
lea rcx, [0x1400df940]
mov r8d, r12d
call fcn.14004e558
xor r11d, r11d
cmp al, r11b
je 0x140072ca0
or byte [rsp + 0x60], r12b
jmp 0x140072d69
lea rdx, [rsp + 0x188]
lea rcx, str.name
mov r8d, 4
call fcn.14004e558
xor r11d, r11d
cmp al, r11b
je 0x140072cce
mov byte [rsp + 0x84], bl
jmp 0x140072d69
lea rdx, [rsp + 0x188]
lea rcx, [0x1400df934]
mov r8d, ebx
call fcn.14004e558
xor r11d, r11d
cmp al, r11b
je 0x140072cf3
add byte [rsp + 0x70], bl
jmp 0x140072d69
lea rdx, [rsp + 0x188]
lea rcx, [0x1400df930]
mov r8d, ebx
call fcn.14004e558
xor r11d, r11d
cmp al, r11b
je 0x140072d18
add byte [rsp + 0x63], bl
jmp 0x140072d69
mov rcx, qword [rsp + 0x188]
movzx eax, word [rcx]
cmp ax, r11w
je 0x140072d5c
mov r15d, 0xd
cmp r14w, ax
ja 0x140072d3b
cmp ax, r15w
jbe 0x140072d4c
cmp bp, ax
je 0x140072d4c
add rcx, r12
mov ax, word [rcx]
cmp ax, r11w
jne 0x140072d2f
mov r15, qword [rsp + 0xa8]
mov qword [rsp + 0x188], rcx
lea rcx, [rsp + 0x188]
call fcn.140044ef4
mov rbx, qword [rsp + 0x188]
movzx eax, word [rbx]
cmp esi, eax
je 0x140072a10
mov rbp, qword [rsp + 0xc0]
mov r14b, byte [rsp + 0x85]
mov edi, 0x24
lea rcx, [rsp + 0xc8]
call fcn.14004be6c
lea rcx, [rsp + 0x108]
call fcn.14004be6c
lea rcx, [rsp + 0xa0]
call fcn.14004be6c
lea rcx, [rsp + 0xd0]
call fcn.14004be6c
lea rcx, [rsp + 0xe8]
call fcn.14004be6c
movzx eax, word [rbx]
mov esi, 0x20
lea ecx, [rsi + 0x4e]
or ax, si
cmp cx, ax
je 0x140072e42
lea ecx, [rsi + 0x55]
cmp cx, ax
je 0x140072e42
lea ecx, [rsi + 0x42]
cmp cx, ax
je 0x140072e42
lea eax, [rsi + 0x3e]
cmp ax, word [rbx]
je 0x140072e42
lea eax, [rsi + 0xb]
cmp ax, word [rbx]
je 0x140072e42
lea eax, [rsi + 3]
cmp ax, word [rbx]
je 0x140072e42
lea eax, [rsi + 0x20]
cmp ax, word [rbx]
je 0x140072e42
cmp di, word [rbx]
je 0x140072e42
lea eax, [rsi + 0xa]
cmp ax, word [rbx]
je 0x140072e42
lea eax, [rsi + 0x5e]
cmp ax, word [rbx]
je 0x140072e42
cmp word [rbx], 0x2e
je 0x140072e42
lea eax, [rsi + 0x1f]
cmp ax, word [rbx]
je 0x140072e42
mov dil, byte [rsp + 0x198]
jmp 0x140072e58
mov dil, byte [rbx]
add rbx, r12
mov byte [rsp + 0x198], dil
mov qword [rsp + 0x188], rbx
xor eax, eax
cmp dil, al
je 0x140072e76
lea rcx, [rsp + 0x198]
call fcn.14004b91c
movsx ecx, byte [rax]
movzx eax, word [rbx]
cmp ecx, eax
je 0x140072e80
mov eax, 0x24
cmp ax, word [rbx]
jne 0x140072e91
mov al, byte [rbx]
add rbx, r12
mov byte [rsp + 0x64], al
mov qword [rsp + 0x188], rbx
lea eax, [rdi - 0x41]
cmp al, 0x19
ja 0x140072ea3
or dil, sil
mov byte [rsp + 0x198], dil
lea rcx, [rsp + 0x188]
call fcn.140044ef4
mov r13, qword [rsp + 0x188]
lea rdx, [0x1400df928]
mov rcx, r13
mov qword [rsp + 0xe0], r13
mov rbx, r13
call qword [sym.imp.SHLWAPI.dll_StrStrW]
xor r8d, r8d
mov rsi, rax
cmp rax, r8
je 0x140072ee2
lea rbx, [rax + 4]
mov qword [rsp + 0xb8], rbx
mov rdi, rbx
cmp word [rbx], r8w
je 0x140072f58
mov ebp, 0x21
lea r15d, [rbp + 0x1c]
lea r9d, [rbp + 0xb]
cmp r9w, word [rdi]
je 0x140072f4d
cmp r15w, word [rdi]
je 0x140072f4d
cmp bp, word [rdi]
jne 0x140072f3c
lea rax, [rdi + 2]
lea rcx, [rsp + 0x188]
mov qword [rsp + 0x188], rax
call fcn.140044ef4
mov rcx, qword [rsp + 0x188]
cmp word [rcx], r8w
je 0x140072f4d
lea rdi, [rcx - 2]
add rdi, r12
mov qword [rsp + 0xb8], rdi
cmp word [rdi], r8w
jne 0x140072f00
mov r15, qword [rsp + 0xa8]
mov rbp, r8
mov eax, 0x2c
cmp ax, word [rdi]
je 0x140072f76
mov eax, 0x3d
cmp ax, word [rdi]
je 0x140072f76
mov eax, 0x21
cmp ax, word [rdi]
jne 0x140072f97
mov al, byte [rdi]
mov word [rdi], r8w
add qword [rsp + 0xb8], r12
mov byte [rsp + 0x188], al
mov dil, al
cmp al, r8b
jne 0x140073029
inc r14b
cmp r14b, r8b
mov byte [rsp + 0x85], r14b
jg 0x1400731c4
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0x180]
lea r8, [rsp + 0x100]
xor r9d, r9d
mov byte [rsp + 0x20], 1
call fcn.140056690
mov rdx, qword [rsp + 0x100]
lea rcx, [rsp + 0xe8]
mov qword [rsp + 0x188], rdx
call fcn.140044f24
lea rcx, [rsp + 0xd0]
call fcn.140044f24
lea rcx, [rsp + 0xa0]
call fcn.140044f24
lea rcx, [rsp + 0x108]
call fcn.140044f24
lea rcx, [rsp + 0xc8]
call fcn.140044f24
xor r11d, r11d
jmp 0x140072985
mov qword [rsp + 0xf0], r8
mov r14d, 0x5c
cmp rsi, r8
jne 0x140073175
mov r8d, r14d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
xor r8d, r8d
mov rsi, rax
cmp rax, r8
jne 0x140073175
lea r8d, [r14 - 0x30]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x110]
mov r9b, 1
call fcn.14005add0
lea rdx, [rsp + 0xc8]
xor r8d, r8d
mov rcx, rax
call fcn.14004f5d4
mov rbx, qword [rsp + 0xc8]
mov edx, r14d
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrChrW]
xor esi, esi
mov r13, rax
cmp rax, rsi
je 0x1400731b7
add r13, r12
lea rdx, [0x1400df928]
mov word [rax], si
mov rcx, r13
mov qword [rsp + 0xc0], r13
call qword [sym.imp.SHLWAPI.dll_StrStrW]
mov r14, rax
cmp byte [rsp + 0x60], sil
je 0x1400730ec
cmp rax, rsi
jne 0x14007310c
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea r14, [r13 + rcx*2]
cmp r14, rsi
jne 0x14007310c
xor edx, edx
mov rcx, r13
lea r8d, [rdx + 0x5c]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov r14, rax
cmp rax, rsi
je 0x1400731b7
cmp word [r14], si
je 0x140073119
mov word [r14], si
add r14, r12
mov rsi, qword [rsp + 0x180]
mov eax, 0x5c
cmp ax, word [r14]
jne 0x14007312f
add r14, r12
xor ecx, ecx
mov qword [rsp + 0xe0], rcx
cmp byte [rsp + 0x84], cl
je 0x14007326a
lea r8, [rsp + 0xe0]
lea rdx, [rsp + 0xb8]
mov rcx, rsi
call fcn.140062c94
mov rdx, qword [rsp + 0xe0]
xor ecx, ecx
mov qword [rsp + 0xb8], rdx
jmp 0x140073272
mov rcx, qword [rsp + 0x180]
mov word [rsi], r8w
lea r8, [rsp + 0xc8]
xor r9d, r9d
mov rdx, r13
mov byte [rsp + 0x20], 1
call fcn.140056690
mov rbx, qword [rsp + 0xc8]
mov edx, r14d
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov r13, rax
xor eax, eax
cmp r13, rax
jne 0x140073229
lea rcx, [rsp + 0xf0]
call fcn.140044f24
lea rcx, [rsp + 0xe8]
call fcn.140044f24
lea rcx, [rsp + 0xd0]
call fcn.140044f24
lea rcx, [rsp + 0xa0]
call fcn.140044f24
lea rcx, [rsp + 0x108]
call fcn.140044f24
lea rcx, [rsp + 0xc8]
call fcn.140044f24
lea rcx, [rsp + 0x100]
call fcn.140044f24
lea rcx, [rsp + 0x110]
call fcn.140044f24
mov eax, 0x80070057
jmp 0x1400747da
lea rdx, [rsi + 2]
mov rsi, qword [rsp + 0x180]
mov word [r13], ax
add r13, r12
lea r8, [rsp + 0xf0]
xor r9d, r9d
mov rcx, rsi
mov byte [rsp + 0x20], 1
mov qword [rsp + 0xc0], r13
call fcn.140056690
mov r14, qword [rsp + 0xf0]
jmp 0x140073121
mov rdx, qword [rsp + 0xb8]
mov eax, 0x2c
cmp dil, al
jne 0x140073355
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x110]
mov r8d, eax
mov r9b, 1
call fcn.14005add0
lea rdx, [rsp + 0xa0]
xor r8d, r8d
mov rcx, rax
call fcn.14004f5d4
lea rdx, [rsp + 0xa0]
xor r8d, r8d
mov rcx, rsi
call fcn.1400035d0
cmp byte [rsp + 0x198], 0x2e
jne 0x140073329
mov rax, qword [rsp + 0xb8]
mov ecx, 0x2c
cmp cx, word [rax]
jne 0x140073329
mov r8d, ecx
add rax, r12
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x110]
mov r9b, 1
mov qword [rsp + 0xb8], rax
call fcn.14005add0
lea rdx, [rsp + 0xe8]
xor r8d, r8d
mov rcx, rax
call fcn.14004f5d4
lea rdx, [rsp + 0xe8]
xor r8d, r8d
mov rcx, rsi
call fcn.1400035d0
mov rsi, qword [rsp + 0xa0]
xor eax, eax
cmp word [rsi], ax
jne 0x1400734ed
lea rdx, str.RegDat
lea rcx, [rsp + 0xa0]
call fcn.1400589a0
jmp 0x1400734e5
mov eax, 0x21
cmp dil, al
je 0x1400734e5
mov al, byte [rsp + 0x198]
cmp word [rdx], cx
jne 0x1400733a1
cmp al, 0x24
je 0x1400733ce
mov r8d, 0x2a
lea r9d, [r8 + 0x54]
cmp al, r8b
je 0x1400733ab
cmp al, r9b
je 0x1400733ab
cmp byte [rsp + 0x63], cl
je 0x1400734e5
mov rbp, rdx
mov qword [rsp + 0x90], rdx
jmp 0x1400734e5
mov r8d, 0x2a
lea r9d, [r8 + 0x54]
cmp al, 0x24
je 0x1400733ce
cmp al, r8b
je 0x1400733ce
cmp al, r9b
je 0x1400733ce
lea rcx, [rsp + 0xb8]
call fcn.140044ef4
mov rdx, qword [rsp + 0xb8]
lea rcx, [rsp + 0x78]
call fcn.140058920
mov rdi, qword [rsp + 0x78]
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x88], rdi
call fcn.140044ef4
xor eax, eax
mov rdx, rdi
cmp byte [rsp + 0x190], al
je 0x14007340f
lea rcx, [rsp + 0xd0]
call fcn.1400589a0
jmp 0x140073427
lea r8, [rsp + 0xd0]
xor r9d, r9d
mov rcx, rsi
mov byte [rsp + 0x20], 1
call fcn.140054c4c
mov rbp, qword [rsp + 0xd0]
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0xb0], rbp
call fcn.140044ef4
mov cl, byte [rsp + 0x198]
xor edi, edi
cmp cl, dil
jne 0x1400734a5
mov rdx, qword [rsp + 0x88]
lea rcx, [0x1400df90c]
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
cmp eax, edi
jne 0x14007347c
lea rbp, [0x1400d63f4]
jmp 0x1400734cb
mov rax, qword [rsp + 0xb0]
mov ecx, 0x23
cmp cx, word [rax]
je 0x140073498
mov ecx, 0x40
cmp cx, word [rax]
jne 0x1400734d3
mov rbp, rax
mov qword [rsp + 0x90], rax
jmp 0x1400734d3
mov eax, 0x23
cmp cl, al
je 0x1400734b7
mov eax, 0x40
cmp cl, al
jne 0x1400734d3
mov rcx, qword [rsp + 0xb0]
movzx eax, word [rcx]
neg ax
sbb rbp, rbp
and rbp, rcx
mov qword [rsp + 0x90], rbp
lea rcx, [rsp + 0x78]
call fcn.140044f24
mov dil, byte [rsp + 0x188]
mov rsi, qword [rsp + 0xa0]
lea rdx, str.HKLM
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor r9d, r9d
cmp eax, r9d
je 0x140073607
lea rdx, str.HKEY_LOCAL_MACHINE
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor ecx, ecx
cmp eax, ecx
je 0x140073607
lea rdx, str.HKCU
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor ecx, ecx
cmp eax, ecx
je 0x1400735fe
lea rdx, str.HKEY_CURRENT_USER
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor ecx, ecx
cmp eax, ecx
je 0x1400735fe
lea rdx, str.HKCR
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor ecx, ecx
cmp eax, ecx
je 0x1400735f5
lea rdx, str.HKEY_CLASSES_ROOT
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor ecx, ecx
cmp eax, ecx
je 0x1400735f5
lea rdx, [0x1400df860]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor ecx, ecx
cmp eax, ecx
je 0x1400735ec
lea rdx, str.HKEY_USERS
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor ecx, ecx
cmp eax, ecx
je 0x1400735ec
lea rdx, str.HKCC
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor ecx, ecx
cmp eax, ecx
je 0x1400735e3
lea rdx, str.HKEY_CURRENT_CONFIG
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor ecx, ecx
cmp eax, ecx
jne 0x140073b0e
mov rbx, 0xffffffff80000005
jmp 0x14007360e
mov rbx, 0xffffffff80000003
jmp 0x14007360e
mov rbx, 0xffffffff80000000
jmp 0x14007360e
mov rbx, 0xffffffff80000001
jmp 0x14007360e
mov rbx, 0xffffffff80000002
xor edx, edx
cmp word [rsi], dx
je 0x140074024
mov al, byte [rsp + 0x198]
lea ecx, [rdx + 0x3f]
cmp al, 0x2e
je 0x14007362d
mov ebp, edx
cmp al, cl
jne 0x140073636
mov ebp, 1
cmp al, cl
je 0x140073644
cmp ebp, edx
je 0x14007363f
cmp word [rsi], dx
je 0x140073644
mov r15d, edx
jmp 0x14007364a
mov r15d, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
lea rcx, [rsp + 0x78]
lea edx, [rdi + 0x64]
mov dword [rsp + 0xd8], edi
call fcn.14004bedc
lea rcx, [rsp + 0x90]
call fcn.14004be6c
cmp byte [rsp + 0x198], 0x2e
lea rax, [rsp + 0x78]
lea r13, [rsp + 0x90]
lea rcx, [rsp + 0x88]
mov edx, 0x1000
cmovne r13, rax
mov qword [rsp + 0xb0], r13
call fcn.14004bc80
mov rdx, qword [rsp + 0xc0]
mov dword [rsp + 0x80], 0xfff
mov dword [rsp + 0x188], edi
mov dword [rsp + 0x68], edi
mov rcx, rbx
cmp byte [rsp + 0x60], dil
je 0x140073976
lea rax, [rsp + 0xb0]
lea r9d, [rdi + 9]
xor r8d, r8d
mov dword [rsp + 0x98], edi
mov dword [rsp + 0xdc], edi
mov dword [rsp + 0x188], edi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xa8], edi
mov dword [rsp + 0xf8], edi
mov qword [rsp + 0xb0], rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x188]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xdc]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
lea rax, [rsp + 0xf8]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0xa8]
xor edx, edx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x188]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xdc]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ecx, dword [rsp + 0x188]
cmp ecx, dword [rsp + 0xf8]
mov ebx, eax
cmovb ecx, dword [rsp + 0xf8]
mov dword [rsp + 0x188], ecx
lea r15d, [rcx*4 + 0x20]
lea rcx, [rsp + 0xc0]
movsxd rdx, r15d
shr rdx, 1
add edx, 8
call fcn.14004bedc
mov rdi, qword [rsp + 0xc0]
mov eax, 0xd
lea r8d, [rax - 3]
mov word [rdi], ax
lea rax, [rdi + 4]
mov word [rdi + 2], r8w
lea ecx, [r8 + 0x6c]
lea r14, [rdi + 8]
mov word [rax], cx
lea ecx, [r8 + 0x16]
xor r8d, r8d
mov word [rdi + 6], cx
mov cl, byte [rsp + 0x60]
mov word [r14], r8w
cmp cl, 3
mov rbp, rax
cmovne r14, rax
cmp ebx, r8d
jne 0x14007394f
test cl, 1
je 0x1400738d1
cmp dword [rsp + 0xa8], r8d
mov ebx, r8d
jle 0x1400738d1
xor esi, esi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x98], r15d
mov word [r14], si
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x98]
mov r8, r14
mov edx, ebx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, esi
jne 0x1400738b3
lea rcx, [rsp + 0x78]
mov rdx, rbp
call fcn.14004bfa8
mov rbp, rdi
inc ebx
cmp ebx, dword [rsp + 0xa8]
jl 0x140073864
mov rsi, qword [rsp + 0xa0]
mov cl, byte [rsp + 0x60]
lea rax, [rdi + 4]
xor r8d, r8d
mov edx, 0x6b
mov word [rax], dx
test r12b, cl
je 0x14007394f
cmp dword [rsp + 0xdc], r8d
mov ebx, r8d
jle 0x14007394f
xor esi, esi
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x98], r15d
mov word [r14], si
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0x30], rsi
lea r9, [rsp + 0x98]
mov r8, r14
mov edx, ebx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, esi
jne 0x14007393c
lea rcx, [rsp + 0x78]
mov rdx, rbp
call fcn.14004bfa8
mov rbp, rdi
inc ebx
cmp ebx, dword [rsp + 0xdc]
jl 0x1400738ed
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0xb0]
xor eax, eax
cmp rcx, rax
je 0x140073964
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0xc0]
call fcn.140044f24
jmp 0x140073fab
lea rax, [rsp + 0x188]
lea r9, [rsp + 0x88]
mov r8, r14
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call fcn.140050ee8
mov edi, dword [rsp + 0x188]
xor r9d, r9d
mov ebx, eax
cmp edi, r9d
je 0x140073a3b
cmp word [r14], r9w
jne 0x1400739ed
cmp edi, r12d
jne 0x1400739ed
cmp ebx, 0xfffffffe
jne 0x1400739ed
cmp ebp, r9d
je 0x1400739e5
or r8d, 0xffffffff
lea rdx, [0x1400df80c]
mov rcx, r13
mov r9d, r8d
call fcn.14004c024
jmp 0x140073fab
mov ebx, r9d
jmp 0x140073fb5
mov ebx, edi
cmp ebp, r9d
je 0x140073a12
or r8d, 0xffffffff
lea rdx, str.ERROR
mov rcx, r13
mov r9d, r8d
call fcn.14004c024
xor r9d, r9d
jmp 0x140073fb5
lea rcx, [rsp + 0x88]
call fcn.140044f24
lea rcx, [rsp + 0x90]
call fcn.140044f24
lea rcx, [rsp + 0x78]
call fcn.140044f24
jmp 0x140074763
mov r8, qword [rsp + 0xa8]
cmp r8, r9
jl 0x140073a53
mov r14d, 1
cmp r8, rbx
jne 0x140073a56
mov r14d, r9d
or eax, 0xffffffff
mov cl, r9b
lea rdx, str.REG_SZ
mov dil, al
cmp ebx, 1
jne 0x140073a73
mov dil, r9b
lea ebx, [rax + 0x25]
jmp 0x140073a95
cmp ebx, 6
jne 0x140073a83
lea rdx, str.REG_LINK
mov bl, 0x5e
jmp 0x140073a95
cmp ebx, 0x15
jne 0x140073b18
lea rdx, str.REG_MUI_SZ
mov bl, 0x75
cmp ebp, r9d
je 0x140073abc
mov r9d, eax
mov r8d, eax
mov rcx, r13
call fcn.14004c024
xor r9d, r9d
cmp r15d, r9d
jne 0x140073fae
mov r8, qword [rsp + 0xa8]
cmp r14d, r9d
jne 0x140073aea
cmp r8, r9
jge 0x140073d0e
mov al, byte [rsp + 0x198]
cmp bl, al
je 0x140073d0e
cmp al, 0x2e
je 0x140073d0e
cmp dil, al
je 0x140073d0e
lea rcx, [rsp + 0x88]
call fcn.140044f24
lea rcx, [rsp + 0x90]
call fcn.140044f24
lea rcx, [rsp + 0x78]
call fcn.140044f24
mov edi, 0x80070057
jmp 0x140074763
cmp ebx, 0xb
jne 0x140073b85
cmp ebp, r9d
je 0x140073b4b
lea rdx, str.REG_QWORD
mov r9d, eax
mov r8d, eax
mov rcx, r13
call fcn.14004c024
xor r9d, r9d
cmp r15d, r9d
jne 0x140073fae
mov r8, qword [rsp + 0xa8]
cmp r14d, r9d
jne 0x140073aea
cmp r8, r9
jge 0x140073b64
mov al, byte [rsp + 0x198]
cmp al, 0x2b
je 0x140073b64
cmp al, 0x2e
jne 0x140073aea
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x78]
lea r8, str.0x_I64x
mov rdx, qword [rdx]
call fcn.1400a9320
jmp 0x140073fab
mov rdi, qword [rsp + 0x88]
cmp ebx, 4
jne 0x140073beb
cmp ebp, r9d
je 0x140073bc0
lea rdx, str.REG_DWORD
mov r9d, eax
mov r8d, eax
mov rcx, r13
call fcn.14004c024
xor r9d, r9d
cmp r15d, r9d
jne 0x140073fae
mov r8, qword [rsp + 0xa8]
cmp r14d, r9d
jne 0x140073aea
cmp r8, r9
jge 0x140073c5e
mov al, byte [rsp + 0x198]
mov ecx, 0x23
cmp al, cl
je 0x140073c5e
cmp al, 0x2e
je 0x140073c5e
jmp 0x140073aea
cmp ebx, 5
jne 0x140073c78
cmp ebp, r9d
je 0x140073c22
lea rdx, str.REG_DWORD_BIG_ENDIAN
mov r9d, eax
mov r8d, eax
mov rcx, r13
call fcn.14004c024
xor r9d, r9d
cmp r15d, r9d
jne 0x140073fae
mov r8, qword [rsp + 0xa8]
cmp r14d, r9d
jne 0x140073aea
cmp r8, r9
jge 0x140073c48
mov al, byte [rsp + 0x198]
mov ecx, 0x62
cmp al, cl
je 0x140073c48
cmp al, 0x2e
jne 0x140073aea
mov al, byte [rdi + 3]
mov cl, byte [rdi]
mov byte [rdi], al
mov byte [rdi + 3], cl
mov al, byte [rdi + 2]
mov cl, byte [rdi + 1]
mov byte [rdi + 1], al
mov byte [rdi + 2], cl
mov r8d, dword [rdi]
mov rcx, qword [rsp + 0x78]
lea rdx, str.0x_x
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x140073fab
cmp ebx, r12d
jne 0x140073d2d
cmp ebp, r9d
je 0x140073caf
lea rdx, str.REG_EXPAND_SZ
mov r9d, eax
mov r8d, eax
mov rcx, r13
call fcn.14004c024
xor r9d, r9d
cmp r15d, r9d
jne 0x140073fae
mov r8, qword [rsp + 0xa8]
cmp r14d, r9d
jne 0x140073aea
cmp r8, r9
jge 0x140073cd5
mov al, byte [rsp + 0x198]
mov ecx, 0x7e
cmp al, cl
je 0x140073cd5
cmp al, 0x2e
jne 0x140073aea
mov r15b, byte [rsp + 0x64]
cmp r15b, r9b
je 0x140073d0e
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x180]
lea r8, [rsp + 0x78]
xor r9d, r9d
mov qword [rsp + 0xb8], rdx
mov byte [rsp + 0x20], 1
call fcn.140056690
jmp 0x140073fab
mov rcx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x88], rcx
jmp 0x140073fae
cmp ebx, 7
jne 0x140073e6f
cmp ebp, r9d
je 0x140073d64
lea rdx, str.REG_MULTI_SZ
mov r9d, eax
mov r8d, eax
mov rcx, r13
call fcn.14004c024
xor r9d, r9d
cmp r15d, r9d
jne 0x140073fae
mov r8, qword [rsp + 0xa8]
cmp r14d, r9d
jne 0x140073aea
cmp r8, r9
mov ebx, 0x2a
jge 0x140073d8a
mov al, byte [rsp + 0x198]
cmp al, bl
je 0x140073d8a
cmp al, 0x2e
jne 0x140073aea
movsxd rdi, dword [rsp + 0x80]
lea rcx, [rsp + 0x78]
shr rdi, 1
lea edx, [rdi*4 + 6]
call fcn.14004bf70
mov rcx, qword [rsp + 0x88]
mov r11, qword [rsp + 0x78]
mov eax, edi
lea rdi, [rcx + rax*2]
cmp rcx, rdi
jae 0x140073e63
mov r15b, byte [rsp + 0x64]
mov edx, 0x30
xor r9d, r9d
lea r8d, [rdx - 0x26]
lea r13d, [rdx + 0x2c]
cmp r15b, bl
jne 0x140073e0b
cmp r13w, word [rcx]
jne 0x140073e0b
lea rax, [rcx + 2]
cmp dx, word [rax]
je 0x140073df7
cmp r13w, word [rax]
je 0x140073df7
cmp word [rax], r9w
jne 0x140073e0b
mov word [r11], r13w
lea rcx, [r12 + rax]
movzx eax, word [rax]
add r11, r12
mov word [r11], ax
jmp 0x140073e4b
movzx eax, word [rcx]
cmp ax, r9w
je 0x140073e20
mov word [r11], ax
add r11, r12
add rcx, r12
jmp 0x140073e4e
add rcx, r12
cmp r15b, 0x24
jne 0x140073e40
cmp rcx, rdi
jae 0x140073e53
mov eax, 0xd
mov word [r11], ax
add r11, r12
mov word [r11], r8w
jmp 0x140073e4b
mov word [r11], r13w
add r11, r12
mov word [r11], dx
add r11, r12
cmp rcx, rdi
jb 0x140073dd7
mov rsi, qword [rsp + 0xa0]
mov r13, qword [rsp + 0xb0]
xor r9d, r9d
mov word [r11], r9w
jmp 0x140073fae
mov r12d, 0xa
cmp ebx, 3
jne 0x140073e83
lea rdx, str.REG_BINARY
jmp 0x140073ebd
cmp ebx, r9d
jne 0x140073e91
lea rdx, str.REG_NONE
jmp 0x140073ebd
cmp ebx, 8
jne 0x140073e9f
lea rdx, str.REG_RESOURCE_LIST
jmp 0x140073ebd
mov edx, 9
cmp ebx, edx
jne 0x140073eb1
lea rdx, str.REG_FULL_RESOURCE_DESCRIPTOR
jmp 0x140073ebd
cmp ebx, r12d
jne 0x140073ee5
lea rdx, str.REG_RESOURCE_REQUIREMENTS_LIST
cmp ebp, r9d
je 0x140073edc
mov r9d, eax
mov r8d, eax
mov rcx, r13
call fcn.14004c024
xor r9d, r9d
cmp r15d, r9d
jne 0x140073fae
mov eax, 0x40
mov cl, al
jmp 0x140073f1a
cmp ebp, r9d
je 0x140073f1a
mov edx, 0x32
mov rcx, r13
call fcn.14004bf70
mov rcx, qword [r13]
lea rdx, str.0x_lx
mov r8d, ebx
call qword [sym.imp.USER32.dll_wsprintfW]
xor r9d, r9d
cmp r15d, r9d
jne 0x140073fae
mov cl, r9b
mov r15, qword [rsp + 0xa8]
cmp r15, r9
jge 0x140073f3a
mov al, byte [rsp + 0x198]
cmp cl, al
je 0x140073f3a
cmp al, 0x2e
jne 0x140073aea
cmp r14d, r9d
jne 0x140073aea
mov eax, dword [rsp + 0x80]
lea rcx, [rsp + 0x78]
lea edx, [rax + rax*4 + 7]
call fcn.14004bf70
mov rdi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x88]
xor r9d, r9d
mov dword [rsp + 0x68], 1
mov word [rdi], r9w
mov word [rdi + 2], r9w
cmp dword [rsp + 0x80], r9d
mov ebp, r9d
jle 0x140073fae
movzx r8d, byte [rbx]
lea rdx, str._0x_02X
mov rcx, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
inc ebp
inc rbx
add rdi, r12
cmp ebp, dword [rsp + 0x80]
jl 0x140073f86
xor r9d, r9d
mov ebx, dword [rsp + 0xd8]
mov rdi, qword [rsp + 0x180]
cmp word [rsi], r9w
je 0x140073fdf
movsxd rcx, dword [rsp + 0x68]
mov rax, qword [rsp + 0x78]
mov rdx, rsi
lea r8, [rax + rcx*2]
mov rcx, rdi
call fcn.14004b578
xor r9d, r9d
mov rdx, qword [rsp + 0xe8]
cmp word [rdx], r9w
je 0x140073ff9
mov r8, qword [r13]
mov rcx, rdi
call fcn.14004b578
lea rcx, [rsp + 0x88]
call fcn.140044f24
lea rcx, [rsp + 0x90]
call fcn.140044f24
lea rcx, [rsp + 0x78]
call fcn.140044f24
mov edi, ebx
jmp 0x140074763
cmp rbp, rdx
je 0x1400746b8
mov sil, byte [rsp + 0x70]
mov qword [rsp + 0x68], rdx
cmp sil, dl
jne 0x140074042
cmp byte [rsp + 0x63], dl
je 0x1400740af
mov qword [rsp + 0x40], rdx
mov eax, edx
cmp sil, dl
setne al
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0xb0], rdx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rdx
xor r9d, r9d
mov rdx, r13
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], 0x2001b
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0xb0]
xor edx, edx
mov edi, eax
cmp rcx, rdx
je 0x1400740a0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
cmp sil, r12b
jge 0x14007412d
cmp byte [rsp + 0x63], dl
jne 0x14007412d
mov al, byte [rsp + 0x198]
mov ecx, 0x2b
cmp al, cl
je 0x1400740d8
cmp al, dl
jne 0x14007425f
cmp cx, word [rbp]
jne 0x14007413c
add rbp, r12
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0xc0], rdx
lea rdi, [rsp + 0xc0]
cmp byte [rsp + 0x62], dl
je 0x140074617
movsx r8d, byte [rsp + 0x61]
lea rdx, [rsp + 0x68]
mov rcx, rbp
call fcn.14005105c
mov rdi, qword [rsp + 0x68]
mov dword [rsp + 0x28], 8
mov r9d, 0xb
mov qword [rsp + 0x20], rdi
mov r8, r14
mov rdx, r13
mov rcx, rbx
call fcn.140045e70
mov edi, eax
lea rcx, [rsp + 0x68]
call fcn.140044f24
jmp 0x140074763
mov ecx, 0x23
cmp cx, word [rbp]
jne 0x140074188
add rbp, r12
mov qword [rsp + 0x90], rbp
mov dword [rsp + 0x180], edx
lea rdi, [rsp + 0x180]
cmp byte [rsp + 0x62], dl
je 0x14007457b
movsx r8d, byte [rsp + 0x61]
lea rdx, [rsp + 0x68]
mov rcx, rbp
call fcn.14005105c
mov rdi, qword [rsp + 0x68]
jmp 0x140074604
mov ecx, 0x2a
cmp cx, word [rbp]
jne 0x1400741cf
add rbp, r12
mov r15d, 7
cmp byte [rsp + 0x62], dl
je 0x140074434
movsx r8d, byte [rsp + 0x61]
lea rdx, [rsp + 0x68]
mov rcx, rbp
call fcn.14005105c
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, r15d
jmp 0x14007411d
mov ecx, 0x7e
cmp cx, word [rbp]
jne 0x140074242
add rbp, r12
mov r15, r12
cmp byte [rsp + 0x62], dl
jne 0x1400741a6
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x68]
lea edx, [rax + 1]
call fcn.14004bf70
mov rax, qword [rsp + 0x68]
xor r8d, r8d
mov rcx, rax
cmp word [rbp], r8w
je 0x140074421
lea edx, [r8 + 0x30]
lea r9d, [r8 + 0x5c]
movzx edi, word [rbp]
cmp r9w, di
jne 0x14007440d
cmp dx, word [rbp + 2]
jne 0x14007440d
mov word [rcx], r8w
add rcx, r12
add rbp, 4
jmp 0x140074416
mov ecx, 0x40
cmp cx, word [rbp]
jne 0x1400743b4
add rbp, r12
mov r15d, 3
jmp 0x1400741a6
mov ecx, 0x23
cmp al, cl
je 0x140074152
mov ecx, 0x62
cmp al, cl
jne 0x14007437c
mov dword [rsp + 0x188], edx
lea rdi, [rsp + 0x188]
cmp byte [rsp + 0x62], dl
je 0x1400742ab
movsx r8d, byte [rsp + 0x61]
lea rdx, [rsp + 0x68]
mov rcx, rbp
call fcn.14005105c
mov rdi, qword [rsp + 0x68]
jmp 0x140074371
cmp byte [rsp + 0x61], dl
je 0x14007431b
mov edx, 0x30
cmp word [rbp], dx
jb 0x1400742c3
cmp word [rbp], 0x39
jbe 0x1400742ea
movzx eax, word [rbp]
mov ecx, 0x20
or ax, cx
cmp ax, 0x61
jb 0x1400742db
cmp ax, 0x66
jbe 0x1400742ef
lea rcx, [rsp + 0x68]
call fcn.140044f24
jmp 0x140073b0e
mov ecx, 0x20
cmp dx, word [rbp]
jne 0x14007430a
movzx eax, word [rbp + 2]
or ax, cx
mov ecx, 0x78
cmp cx, ax
jne 0x14007430a
add rbp, 4
mov rcx, rbp
call fcn.14004cf6c
mov dword [rsp + 0x188], eax
jmp 0x140074339
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x90]
call fcn.14004fc04
cmp eax, 1
jl 0x1400746a4
mov cl, byte [rsp + 0x188]
mov al, byte [rsp + 0x18b]
mov byte [rsp + 0x188], al
mov al, byte [rsp + 0x18a]
mov byte [rsp + 0x18b], cl
mov cl, byte [rsp + 0x189]
mov byte [rsp + 0x189], al
mov byte [rsp + 0x18a], cl
mov r9d, 5
jmp 0x14007460a
mov ecx, 0x2a
cmp al, cl
je 0x140074196
mov ecx, 0x7e
cmp al, cl
je 0x1400741dd
mov ecx, 0x40
cmp al, cl
je 0x140074254
mov ecx, 0x6e
cmp al, cl
jne 0x1400743b4
mov r15, rdx
jmp 0x1400741a6
cmp r15, rdx
jge 0x1400741a6
cmp al, 0x5e
jne 0x1400743c9
mov r15d, 6
jmp 0x1400743ea
mov ecx, 0x75
cmp al, cl
jne 0x1400743d8
lea r15d, [rcx - 0x60]
jmp 0x1400743ea
cmp al, dl
je 0x1400743e4
cmp al, 0x24
jne 0x1400742db
mov r15d, 1
cmp byte [rsp + 0x62], dl
jne 0x1400741a6
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
jmp 0x1400741c7
mov word [rcx], di
add rcx, r12
add rbp, r12
cmp word [rbp], r8w
jne 0x14007421a
sub ecx, eax
mov r9d, r12d
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
jmp 0x14007411d
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rsp + 0x68]
movsxd rsi, eax
xor eax, eax
lea edx, [rsi + 0x10]
mov dword [rsp + 0x188], esi
mov edi, eax
call fcn.14004bf70
mov r11, qword [rsp + 0x68]
lea r10, [rbp + rsi*2]
xor r9d, r9d
mov r8, r11
mov rcx, rsi
cmp rbp, r10
jae 0x140074538
mov r15b, byte [rsp + 0x64]
lea eax, [r9 + 0xa]
lea r13d, [r9 + 0x2a]
lea edx, [rax + 0x26]
lea esi, [rax + 0x52]
lea r11d, [r9 + 0xd]
mov word [r8], r9w
cmp r15b, r13b
jne 0x1400744b8
cmp si, word [rbp]
jne 0x1400744eb
lea rcx, [rbp + 2]
cmp si, word [rcx]
jne 0x1400744eb
movzx eax, word [rcx]
lea rbp, [r12 + rcx]
mov word [r8], ax
add r8, r12
mov eax, 0xa
jmp 0x140074513
cmp r15b, 0x24
jne 0x1400744eb
movzx ecx, word [rbp]
cmp r11w, cx
jne 0x1400744da
cmp ax, word [rbp + 2]
jne 0x1400744d7
add rbp, 2
xor r9d, r9d
jmp 0x1400744df
xor r9d, r9d
cmp ax, cx
jne 0x140074509
add rbp, r12
mov word [r8], r9w
add r8, r12
jmp 0x140074505
mov cx, word [rbp]
cmp si, cx
jne 0x140074509
cmp dx, word [rbp + 2]
jne 0x140074509
mov word [r8], r9w
add r8, r12
add rbp, 4
inc edi
jmp 0x140074516
mov word [r8], cx
add r8, r12
add rbp, r12
mov edi, r9d
cmp rbp, r10
jb 0x14007448b
cmp edi, 1
mov r11, qword [rsp + 0x68]
mov r13, qword [rsp + 0xc0]
mov esi, dword [rsp + 0x188]
jge 0x140074541
inc edi
mov word [r8], r9w
add r8, r12
cmp esi, r9d
jle 0x14007455f
cmp edi, r12d
jge 0x14007455f
sub r12d, edi
mov rdi, r8
movzx eax, r9w
mov ecx, r12d
lea r8, [r8 + r12*2]
rep stosw word [rdi], ax
mov word [r8], r9w
sub r8d, r11d
mov r9d, 7
mov dword [rsp + 0x28], r8d
mov qword [rsp + 0x20], r11
jmp 0x14007411d
cmp byte [rsp + 0x61], dl
je 0x1400745e6
mov edx, 0x30
cmp word [rbp], dx
jb 0x140074593
cmp word [rbp], 0x39
jbe 0x1400745b5
movzx eax, word [rbp]
mov ecx, 0x20
or ax, cx
cmp ax, 0x61
jb 0x1400742db
cmp ax, 0x66
ja 0x1400742db
jmp 0x1400745ba
mov ecx, 0x20
cmp dx, word [rbp]
jne 0x1400745d5
movzx eax, word [rbp + 2]
or ax, cx
mov ecx, 0x78
cmp cx, ax
jne 0x1400745d5
add rbp, 4
mov rcx, rbp
call fcn.14004cf6c
mov dword [rsp + 0x180], eax
jmp 0x140074604
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x90]
call fcn.14004fc04
cmp eax, 1
jl 0x1400746a4
mov r9d, 4
mov dword [rsp + 0x28], 4
jmp 0x140074118
cmp byte [rsp + 0x61], dl
je 0x140074686
mov edx, 0x30
cmp word [rbp], dx
jb 0x14007462f
cmp word [rbp], 0x39
jbe 0x140074651
movzx eax, word [rbp]
mov ecx, 0x20
or ax, cx
cmp ax, 0x61
jb 0x1400742db
cmp ax, 0x66
ja 0x1400742db
jmp 0x140074656
mov ecx, 0x20
cmp dx, word [rbp]
jne 0x140074671
movzx eax, word [rbp + 2]
or ax, cx
mov ecx, 0x78
cmp cx, ax
jne 0x140074671
add rbp, 4
mov rcx, rbp
call fcn.14004cf6c
mov qword [rsp + 0xc0], rax
jmp 0x14007410a
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x90]
call fcn.14004fbd8
cmp eax, 1
jge 0x14007410a
lea rcx, [rsp + 0x68]
call fcn.140044f24
mov edi, 1
jmp 0x140074763
mov eax, 0x21
cmp dil, al
jne 0x1400746ea
cmp word [r14], dx
jne 0x1400746ea
mov eax, dword [rsp + 0x98]
mov rcx, rbx
cmp eax, edx
mov rdx, r13
je 0x1400746e3
mov r8d, eax
call fcn.14004e340
jmp 0x140074756
call fcn.140059edc
jmp 0x140074756
mov eax, dword [rsp + 0x98]
mov rcx, rbx
cmp eax, edx
je 0x14007474b
mov qword [rsp + 0x40], rdx
lea rax, [rsp + 0x188]
mov qword [rsp + 0x188], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0x2001b
mov dword [rsp + 0x20], edx
xor r9d, r9d
xor r8d, r8d
mov rdx, r13
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rsp + 0x188]
mov edi, eax
xor eax, eax
cmp rcx, rax
je 0x140074758
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140074758
mov r8, r14
mov rdx, r13
call fcn.140045ee4
mov edi, eax
cmp edi, r12d
mov ecx, 0
cmove edi, ecx
lea rcx, [rsp + 0xe0]
call fcn.140044f24
lea rcx, [rsp + 0xf0]
call fcn.140044f24
lea rcx, [rsp + 0xe8]
call fcn.140044f24
lea rcx, [rsp + 0xd0]
call fcn.140044f24
lea rcx, [rsp + 0xa0]
call fcn.140044f24
lea rcx, [rsp + 0x108]
call fcn.140044f24
lea rcx, [rsp + 0xc8]
call fcn.140044f24
lea rcx, [rsp + 0x100]
call fcn.140044f24
lea rcx, [rsp + 0x110]
call fcn.140044f24
mov eax, edi
add rsp, 0x138
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret