Function at 0x1401026a0
Capabilities:
Get common file path
Get program files directory
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xad0]
sub rsp, 0xbd0
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rbp + 0xac0], rax
movzx r13d, cl
mov byte [rsp + 0x64], cl
xor r14d, r14d
mov dword [rsp + 0x60], r14d
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x188], xmm1
mov qword [rbp + 0x198], r14
lea rax, vtable.AutoLock.0
mov qword [rbp + 0x70], rax
lea rsi, [0x140686c78]
mov qword [rbp + 0x78], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov r8, qword [0x140687dc0]
mov rdx, qword [0x140687db8]
lea rcx, [rbp + 0x188]
call fcn.1400eeb30
mov rdi, qword [rbp + 0x190]
mov rbx, qword [rbp + 0x188]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rdi, rbx
jne 0x140102757
xor bl, bl
jmp 0x140103bd6
mov r12, qword [rbp + 0x188]
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
mov edi, 0x104
mov r15, 0xffffffffffffffff
cmp r12, rax
mov esi, 0x5c
mov qword [rbp - 0x70], r12
je 0x1401034d8
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x58], r14
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r14w
lea r8d, [rsi - 0x43]
lea rdx, str.ClientsStartMenuInternet
lea rcx, [rbp - 0x68]
call fcn.1400739a0
nop
mov qword [rbp + 0x138], r14
mov rcx, r14
mov qword [rbp + 0x148], rcx
mov edx, 7
mov qword [rbp + 0x150], rdx
mov word [rbp + 0x138], r14w
cmp qword [r12 + 0x18], 0
jbe 0x1401028a5
lea r9, [r12 + 8]
mov rbx, qword [r9 + 0x10]
cmp qword [r9 + 0x18], 8
jb 0x1401027f5
mov r9, qword [r9]
lea rcx, [rbp + 0x138]
cmp rbx, 7
ja 0x140102820
mov qword [rbp + 0x148], rbx
lea r8, [rbx + rbx]
mov rdx, r9
call fcn.14035bc80
mov word [rbp + rbx*2 + 0x138], r14w
jmp 0x140102830
lfence
mov qword [rsp + 0x20], rbx
mov rdx, rbx
call fcn.1400735a0
mov rdx, qword [rbp + 0x148]
mov r8, qword [rbp + 0x150]
mov rax, r8
sub rax, rdx
cmp rax, 1
jb 0x140102873
lea rcx, [rdx + 1]
mov qword [rbp + 0x148], rcx
lea rax, [rbp + 0x138]
cmp r8, 8
cmovae rax, qword [rbp + 0x138]
mov word [rax + rdx*2], si
mov word [rax + rcx*2], r14w
jmp 0x140102897
lfence
mov qword [rsp + 0x20], 1
lea r9, [0x1405e45bc]
mov edx, 1
lea rcx, [rbp + 0x138]
call fcn.1400735a0
mov rcx, qword [rbp + 0x148]
mov rdx, qword [rbp + 0x150]
lea r9, [rbp - 0x68]
mov rsi, qword [rbp - 0x68]
mov r14, qword [rbp - 0x50]
cmp r14, 8
cmovae r9, rsi
mov rax, rdx
sub rax, rcx
mov r8, qword [rbp - 0x58]
cmp r8, rax
ja 0x140102902
lea rdi, [r8 + rcx]
mov qword [rbp + 0x148], rdi
lea rbx, [rbp + 0x138]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x138]
lea rcx, [rbx + rcx*2]
add r8, r8
mov rdx, r9
call fcn.14035bc80
xor eax, eax
mov word [rbx + rdi*2], ax
mov edi, 0x104
jmp 0x140102922
lfence
mov rdx, qword [rbp - 0x58]
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0x138]
call fcn.1400735a0
mov r14, qword [rbp - 0x50]
mov rsi, qword [rbp - 0x68]
lea rdx, [rbp + 0x138]
cmp qword [rbp + 0x150], 8
cmovae rdx, qword [rbp + 0x138]
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rcx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
sete bl
mov rdx, qword [rbp + 0x150]
cmp rdx, 8
jb 0x1401029a3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010299e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140103c52
call fcn.140359090
xor eax, eax
mov word [rbp + 0x138], ax
cmp r14, 8
jb 0x1401029e7
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1401029df
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140103c58
mov rcx, rsi
call fcn.140359090
xor r14d, r14d
mov word [rbp - 0x68], r14w
test bl, bl
je 0x1401034cb
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea rax, [rbp + 0x158]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1401034be
mov esi, r14d
mov dword [rsp + 0x6c], r14d
cmp dword [rbp + 0x158], r14d
jbe 0x1401034be
nop dword [rax + rax]
mov r9d, edi
lea r8, [rbp + 0x280]
mov edx, esi
mov rcx, qword [rbp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x1401034ac
mov qword [rbp + 0x160], r14
mov qword [rbp + 0x170], r14
mov qword [rbp + 0x178], 7
mov word [rbp + 0x160], r14w
lea rax, [rbp + 0x280]
mov r8, r15
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140102ab0
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x160]
call fcn.1400739a0
nop
mov rcx, qword [rbp + 0x170]
mov rdx, qword [rbp + 0x178]
mov rax, rdx
sub rax, rcx
cmp rax, 0x13
jb 0x140102b29
lea rdi, [rcx + 0x13]
mov qword [rbp + 0x170], rdi
lea rbx, [rbp + 0x160]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x160]
lea rcx, [rbx + rcx*2]
mov r8d, 0x26
lea rdx, str._shellopencommand
call fcn.14035bc80
mov word [rbx + rdi*2], r14w
mov edi, 0x104
jmp 0x140102b4d
lfence
mov qword [rsp + 0x20], 0x13
lea r9, str._shellopencommand
mov edx, 0x13
lea rcx, [rbp + 0x160]
call fcn.1400735a0
mov dword [rbp + 0x180], 0x208
lea rdx, [rbp + 0x160]
cmp qword [rbp + 0x178], 8
cmovae rdx, qword [rbp + 0x160]
lea r9, [rbp + 0x180]
lea r8, [rbp + 0x490]
mov rcx, qword [rbp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x140103459
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r14w
lea rax, [rbp + 0x490]
mov r8, r15
inc r8
cmp word [rax + r8*2], 0
jne 0x140102bb2
lea rdx, [rbp + 0x490]
lea rcx, [rsp + 0x70]
call fcn.1400739a0
nop
mov rbx, qword [rbp - 0x80]
mov qword [rbp - 0x40], rbx
test rbx, rbx
jne 0x140102c30
mov qword [rbp + 0x118], r14
mov qword [rbp + 0x128], r14
mov qword [rbp + 0x130], r14
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
cmovae rax, rcx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x118], xmm0
mov rbx, r14
mov qword [rbp + 0x128], rbx
mov qword [rbp + 0x130], 7
or dword [rsp + 0x60], 1
jmp 0x140103216
lea rsi, [rbx + 1]
cmp rsi, rdi
cmovb rsi, rdi
mov qword [rbp - 0x48], rsi
mov eax, 2
mul rsi
cmovo rax, r15
mov rcx, rax
call fcn.140368330
mov r14, rax
test rax, rax
jne 0x140102d2f
mov qword [rbp + 0x118], rax
mov qword [rbp + 0x128], rax
mov qword [rbp + 0x130], rax
mov rbx, qword [rbp - 0x80]
lea rsi, [rsp + 0x70]
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
cmovae rsi, rcx
cmp rbx, 8
jae 0x140102cba
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x118], xmm0
mov qword [rbp + 0x130], 7
mov qword [rbp + 0x128], rbx
or dword [rsp + 0x60], 1
jmp 0x140103212
mov rdi, rbx
or rdi, 7
movabs rax, 0x7ffffffffffffffe
cmp rdi, rax
cmova rdi, rax
lea rcx, [rdi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140103c5e
lfence
add rcx, rcx
call fcn.140073800
mov qword [rbp + 0x118], rax
lea r8, [rbx*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.14035bc80
mov qword [rbp + 0x130], rdi
mov rdx, qword [rbp - 0x78]
mov rcx, qword [rsp + 0x70]
mov qword [rbp + 0x128], rbx
or dword [rsp + 0x60], 1
jmp 0x140103212
lea r13, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
jb 0x140102d45
mov r13, qword [rsp + 0x70]
test r13, r13
je 0x140102d79
cmp word [r13], 0x22
jne 0x140102d79
lea rdi, [r13 + 2]
mov edx, 0x22
mov rcx, rdi
call fcn.14035b3bc
test rax, rax
je 0x140102e40
sub rax, rdi
sar rax, 1
lea rbx, [rax + rax]
mov rdx, rdi
jmp 0x140102e53
mov r12, r13
test r13, r13
je 0x140102e3c
mov ecx, 0x2e
call fcn.140383514
movzx edi, ax
mov word [rsp + 0x66], ax
mov ecx, 0x2e
call fcn.140375d24
mov word [rsp + 0x68], ax
movzx ecx, word [r13]
test cx, cx
je 0x140102e3c
lea r15, [r13 + 2]
cmp cx, di
je 0x140102dc2
cmp cx, ax
jne 0x140102e1b
lea rdi, [0x140607b3a]
test r15, r15
je 0x140102e16
mov rsi, r15
cmp word [rsi], 0
je 0x140102e07
test rdi, rdi
je 0x140102e07
movzx ecx, word [rdi]
test cx, cx
je 0x140102f14
call fcn.140383514
movzx ebx, ax
movzx ecx, word [rsi]
call fcn.140383514
cmp ax, bx
jne 0x140102e07
add rdi, 2
add rsi, 2
jne 0x140102dd1
cmp word [rdi], 0
je 0x140102f14
movzx eax, word [rsp + 0x68]
movzx edi, word [rsp + 0x66]
add r12, 2
add r15, 2
movzx ecx, word [r12]
test cx, cx
jne 0x140102db8
mov rbx, qword [rbp - 0x40]
mov r15, 0xffffffffffffffff
mov rsi, qword [rbp - 0x48]
mov r12, qword [rbp - 0x70]
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rdx, qword [rsp + 0x70]
add rbx, rbx
mov r8, rbx
mov rcx, r14
call fcn.14035bc80
xor r13d, r13d
mov word [r14 + rbx], r13w
mov qword [rbp + 0xf8], r13
mov qword [rbp + 0x108], r13
mov qword [rbp + 0x110], 7
mov word [rbp + 0xf8], r13w
cmp word [r14], 0x25
jne 0x140102ff1
lea rax, str._ProgramFiles_
mov qword [rbp + 0x260], rax
lea rax, str._ProgramW6432_
mov qword [rbp + 0x268], rax
lea rax, str._CommonProgramFiles_
mov qword [rbp + 0x270], rax
lea rax, str._CommonProgramW6432_
mov qword [rbp + 0x278], rax
lea rdi, [rbp + 0x260]
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rdi]
mov rbx, r15
inc rbx
cmp word [rdx + rbx*2], 0
jne 0x140102ee6
mov r8, rbx
mov rcx, r14
call fcn.14036ef28
test eax, eax
je 0x140102f26
add rdi, 0x10
lea rax, [rbp + 0x280]
cmp rdi, rax
jne 0x140102ee0
jmp 0x140102fe6
mov rbx, r12
sub rbx, r13
sar rbx, 1
add rbx, 4
jmp 0x140102e31
mov rdx, qword [rdi + 8]
mov r8, r15
nop dword [rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x140102f30
lea rcx, [rbp + 0xf8]
call fcn.1400739a0
lea r9, [r14 + rbx*2]
mov rdx, r15
nop
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x140102f50
mov rcx, qword [rbp + 0x108]
mov rax, qword [rbp + 0x110]
sub rax, rcx
lfence
cmp rdx, rax
ja 0x140102fb3
mov rdi, qword [rbp + 0x108]
add rdi, rdx
mov qword [rbp + 0x108], rdi
lea rbx, [rbp + 0xf8]
cmp qword [rbp + 0x110], 8
cmovae rbx, qword [rbp + 0xf8]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
mov rdx, r9
call fcn.14035bc80
mov word [rbx + rdi*2], r13w
jmp 0x140102fc4
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0xf8]
call fcn.1400735a0
lea r8, [rbp + 0xf8]
cmp qword [rbp + 0x110], 8
cmovae r8, qword [rbp + 0xf8]
mov rdx, rsi
mov rcx, r14
call fcn.140368338
mov edx, esi
mov rcx, r14
call qword [sym.imp.SHELL32.dll_DoEnvironmentSubstW]
mov rax, r15
inc rax
cmp word [r14 + rax*2], 0
jne 0x140102ff4
cmp rax, 1
jbe 0x140103054
lfence
nop dword [rax + rax]
movzx ecx, word [r14 + rax*2 - 2]
cmp cx, 0x20
jne 0x140103026
dec rax
mov word [r14 + rax*2], r13w
jmp 0x14010304e
cmp cx, 0x22
jne 0x140103054
mov word [r14 + rax*2 - 2], r13w
mov edx, 0x22
mov rcx, r14
call fcn.14035b2dc
test rax, rax
je 0x140103054
mov word [rax], r13w
sub rax, r14
sar rax, 1
cmp rax, 1
ja 0x140103010
mov r8, r15
nop word [rax + rax]
inc r8
cmp word [r14 + r8*2], 0
jne 0x140103060
mov rdx, r14
lea rcx, [rbp + 0xf8]
call fcn.1400739a0
mov rcx, r14
call fcn.1403683a0
lea rcx, [rbp + 0xf8]
call fcn.1401d4ac0
test al, al
je 0x140103132
lea rcx, [rbp + 0xf8]
cmp qword [rbp + 0x110], 8
cmovae rcx, qword [rbp + 0xf8]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov edi, eax
test eax, eax
je 0x140103132
lfence
mov eax, 2
mul rdi
cmovo rax, r15
mov rcx, rax
call fcn.140368330
mov rbx, rax
test rax, rax
je 0x140103132
lfence
lea rcx, [rbp + 0xf8]
cmp qword [rbp + 0x110], 8
cmovae rcx, qword [rbp + 0xf8]
mov r8d, edi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x14010312a
lfence
mov r8, r15
nop dword [rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x140103110
mov rdx, rbx
lea rcx, [rbp + 0xf8]
call fcn.1400739a0
mov rcx, rbx
call fcn.1403683a0
lea rdx, [rbp + 0xf8]
cmp qword [rbp + 0x110], 8
cmovae rdx, qword [rbp + 0xf8]
xor r14d, r14d
mov qword [rbp + 0x30], r14
mov qword [rbp + 0x40], r14
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], r14w
mov r8, qword [rbp + 0x108]
lea rcx, [rbp + 0x30]
call fcn.1400739a0
nop
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x30]
call fcn.1401d7750
nop
mov rdx, rax
lea rcx, [rbp + 0x118]
call fcn.1400733c0
or dword [rsp + 0x60], 0xf
lea rcx, [rbp + 0xb0]
call fcn.140073b90
nop
lea rcx, [rbp + 0x30]
call fcn.140073b90
nop
mov rdx, qword [rbp + 0x110]
cmp rdx, 8
jb 0x1401031f4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401031ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140103c64
call fcn.140359090
mov word [rbp + 0xf8], r14w
mov rdx, qword [rbp - 0x78]
mov rcx, qword [rsp + 0x70]
mov rbx, qword [rbp + 0x128]
movzx r13d, byte [rsp + 0x64]
mov esi, dword [rsp + 0x6c]
cmp rdx, 8
jb 0x140103255
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140103249
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140103c6a
call fcn.140359090
mov rbx, qword [rbp + 0x128]
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r14w
lea rdx, [rbp + 0x118]
cmp qword [rbp + 0x130], 8
cmovae rdx, qword [rbp + 0x118]
test rbx, rbx
je 0x1401032b3
mov rax, rdx
mov rcx, r14
cmp word [rdx], 0x5c
je 0x1401032a3
nop
cmp rbx, 1
je 0x1401032a6
dec rbx
add rax, 2
cmp word [rax], 0x5c
jne 0x140103290
mov rcx, rax
test rcx, rcx
je 0x1401032b3
sub rcx, rdx
sar rcx, 1
jmp 0x1401032b6
mov rcx, r15
cmp rcx, 0xffffffffffffffff
jne 0x140103364
lea r8, [rbp + 0x118]
mov rdx, r12
lea rcx, [rbp + 0x90]
call fcn.1400e2060
mov rbx, rax
lea rax, [rbp + 0x118]
cmp rax, rbx
je 0x140103316
lea rcx, [rbp + 0x118]
call fcn.140073b90
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x118], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x128], xmm1
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov rdx, qword [rbp + 0xa8]
cmp rdx, 8
jb 0x14010335c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140103357
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140103c70
call fcn.140359090
mov word [rbp + 0x90], r14w
lea rcx, [rbp + 0x118]
call fcn.140104180
test al, al
je 0x14010340b
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x20], 7
mov word [rbp - 0x38], r14w
mov r8d, 8
lea rdx, str.Browsers
lea rcx, [rbp - 0x38]
call fcn.1400739a0
nop
movzx r8d, r13b
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0x118]
call fcn.140100de0
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x1401033f9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401033f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140103c76
call fcn.140359090
mov word [rbp - 0x38], r14w
lea rcx, [rbp + 0x118]
call fcn.140103ca0
nop
mov rdx, qword [rbp + 0x130]
cmp rdx, 8
jb 0x140103451
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010344c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140103c7c
call fcn.140359090
mov word [rbp + 0x118], r14w
mov rdx, qword [rbp + 0x178]
cmp rdx, 8
jb 0x14010349f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010349a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140103c82
call fcn.140359090
mov word [rbp + 0x160], r14w
mov edi, 0x104
inc esi
mov dword [rsp + 0x6c], esi
cmp esi, dword [rbp + 0x158]
jb 0x140102a60
mov rcx, qword [rbp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add r12, 0x48
cmp r12, qword [rbp + 0x28]
jmp 0x140102778
lea rax, [rbp + 0x8b0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x2a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x140103932
lea r8, str.Internet_Explorer
lea rdx, [rbp + 0x8b0]
lea rcx, [rbp + 0x220]
call fcn.1401d48a0
nop
lea rdi, [rbp + 0x220]
cmp qword [rbp + 0x238], 8
cmovae rdi, qword [rbp + 0x220]
test rdi, rdi
je 0x14010359c
mov rbx, r15
nop dword [rax + rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x140103540
mov qword [rbp + 0xd8], r14
mov qword [rbp + 0xe8], r14
mov qword [rbp + 0xf0], 7
mov word [rbp + 0xd8], r14w
or dword [rsp + 0x60], 0x40
test rbx, rbx
je 0x1401035c5
lfence
mov r8, r15
nop dword [rax + rax]
inc r8
cmp word [rdi + r8*2], 0
jne 0x140103580
mov rdx, rdi
lea rcx, [rbp + 0xd8]
call fcn.1400739a0
jmp 0x1401035c5
mov rbx, r14
mov qword [rbp + 0xd8], r14
mov qword [rbp + 0xe8], r14
mov qword [rbp + 0xf0], 7
mov word [rbp + 0xd8], r14w
or dword [rsp + 0x60], 0x40
lfence
test rbx, rbx
je 0x14010363c
cmp word [rdi + rbx*2 - 2], 0x5c
je 0x14010363c
mov rdx, qword [rbp + 0xe8]
mov r8, qword [rbp + 0xf0]
mov rax, r8
sub rax, rdx
cmp rax, 1
jb 0x140103618
lea rcx, [rdx + 1]
mov qword [rbp + 0xe8], rcx
lea rax, [rbp + 0xd8]
cmp r8, 8
cmovae rax, qword [rbp + 0xd8]
mov word [rax + rdx*2], si
mov word [rax + rcx*2], r14w
jmp 0x14010363c
lfence
mov qword [rsp + 0x20], 1
lea r9, [0x1405e45bc]
mov edx, 1
lea rcx, [rbp + 0xd8]
call fcn.1400735a0
mov rcx, qword [rbp + 0xe8]
mov rax, qword [rbp + 0xf0]
sub rax, rcx
lfence
cmp rax, 0xc
jb 0x14010369c
mov rdi, qword [rbp + 0xe8]
add rdi, 0xc
mov qword [rbp + 0xe8], rdi
lea rbx, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 8
cmovae rbx, qword [rbp + 0xd8]
lea rcx, [rbx + rcx*2]
mov r8d, 0x18
lea rdx, str.iexplore.exe
call fcn.14035bc80
mov word [rbx + rdi*2], r14w
jmp 0x1401036be
mov qword [rsp + 0x20], 0xc
lea r9, str.iexplore.exe
mov edx, 0xc
lea rcx, [rbp + 0xd8]
call fcn.1400735a0
nop
lea rcx, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 8
cmovae rcx, qword [rbp + 0xd8]
call fcn.1401d4f70
test al, al
je 0x1401038af
mov qword [rbp + 0x200], r14
mov qword [rbp + 0x210], r14
mov qword [rbp + 0x218], 7
mov word [rbp + 0x200], r14w
xor eax, eax
lock cmpxchg dword [0x140687cf0], r14d
je 0x1401037e6
lea rax, vtable.AutoLock.0
mov qword [rbp + 0x80], rax
lea rbx, [0x140686c18]
mov qword [rbp + 0x88], rbx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdi, str.0cg_
mov rcx, qword [str.0cg_]
cmp rcx, rdi
je 0x140103785
test byte [rcx + 0x1c], 1
je 0x140103785
cmp byte [rcx + 0x19], 4
jb 0x140103785
lea r9, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 8
cmovae r9, qword [rbp + 0xd8]
mov edx, 0x2a
lea r8, [0x1405f7168]
mov rcx, qword [rcx + 0x10]
call fcn.1400786c0
lea rdx, [rbp + 0xd8]
call fcn.1400e4730
test rax, rax
jne 0x140103c15
mov rcx, qword [str.0cg_]
cmp rcx, rdi
je 0x1401037dd
test byte [rcx + 0x1c], 1
je 0x1401037dd
cmp byte [rcx + 0x19], 4
jb 0x1401037dd
lea r9, [rbp + 0xd8]
cmp qword [rbp + 0xf0], 8
cmovae r9, qword [rbp + 0xd8]
lea edx, [rax + 0x2b]
lea r8, [0x1405f7168]
mov rcx, qword [rcx + 0x10]
call fcn.1400786c0
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x60], r14
mov qword [rbp + 0x68], 7
mov word [rbp + 0x50], r14w
mov r8d, 8
lea rdx, str.Browsers
lea rcx, [rbp + 0x50]
call fcn.1400739a0
nop
movzx r8d, r13b
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0xd8]
call fcn.140100de0
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 8
jb 0x140103868
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140103862
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140103c88
call fcn.140359090
nop
mov rdx, qword [rbp + 0x218]
cmp rdx, 8
jb 0x1401038af
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401038a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140103c8e
call fcn.140359090
nop
mov rdx, qword [rbp + 0xf0]
cmp rdx, 8
jb 0x1401038f5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401038f0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140103c4c
call fcn.140359090
mov qword [rbp + 0xe8], r14
mov qword [rbp + 0xf0], 7
mov word [rbp + 0xd8], r14w
mov r8, qword [rbp + 0x238]
cmp r8, 8
jb 0x140103932
inc r8
mov rdx, qword [rbp + 0x220]
lea rcx, [rbp + 0x220]
call fcn.140073b50
call fcn.1401d6120
test al, al
je 0x140103bd4
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x6a0]
call fcn.14035c350
mov edx, 0x104
lea rcx, [rbp + 0x6a0]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x140103983
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea rdx, str.Failed_to_get_windows_directory_with_error_code__lu
mov ecx, 3
call fcn.140109e80
lea r8, str.SystemApps
lea rdx, [rbp + 0x6a0]
lea rcx, [rbp + 0x240]
call fcn.1401d48a0
nop
lea rdx, [rbp + 0x240]
cmp qword [rbp + 0x258], 8
cmovae rdx, qword [rbp + 0x240]
lea r8, str.Microsoft.MicrosoftEdge_8wekyb3d8bbwe
lea rcx, [rbp + 0x1a0]
call fcn.1401d48a0
nop
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 8
cmovae rdx, qword [rbp + 0x1a0]
lea r8, str.MicrosoftEdge.exe
lea rcx, [rbp + 0x1c0]
call fcn.1401d48a0
nop
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 8
cmovae rdx, qword [rbp + 0x1a0]
lea r8, str.MicrosoftEdgeCP.exe
lea rcx, [rbp + 0x1e0]
call fcn.1401d48a0
nop
lea rcx, [rbp + 0x1c0]
cmp qword [rbp + 0x1d8], 8
cmovae rcx, qword [rbp + 0x1c0]
call fcn.1401d4f70
test al, al
je 0x140103afa
mov qword [rbp - 0x18], r14
mov qword [rbp - 8], r14
mov qword [rbp], 7
mov word [rbp - 0x18], r14w
mov r8d, 8
lea rdx, str.Browsers
lea rcx, [rbp - 0x18]
call fcn.1400739a0
nop
movzx r8d, r13b
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x1c0]
call fcn.140100de0
nop
mov r8, qword [rbp]
cmp r8, 8
jb 0x140103a9e
inc r8
mov rdx, qword [rbp - 0x18]
lea rcx, [rbp - 0x18]
call fcn.140073b50
mov qword [rbp + 8], r14
mov qword [rbp + 0x18], r14
mov qword [rbp + 0x20], 7
mov word [rbp + 8], r14w
mov r8d, 8
lea rdx, str.Browsers
lea rcx, [rbp + 8]
call fcn.1400739a0
nop
movzx r8d, r13b
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x1e0]
call fcn.140100de0
nop
mov r8, qword [rbp + 0x20]
cmp r8, 8
jb 0x140103afa
inc r8
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 8]
call fcn.140073b50
nop
mov r8, qword [rbp + 0x1f8]
cmp r8, 8
jb 0x140103b1d
inc r8
mov rdx, qword [rbp + 0x1e0]
lea rcx, [rbp + 0x1e0]
call fcn.140073b50
mov qword [rbp + 0x1f0], r14
mov qword [rbp + 0x1f8], 7
mov word [rbp + 0x1e0], r14w
mov r8, qword [rbp + 0x1d8]
cmp r8, 8
jb 0x140103b5a
inc r8
mov rdx, qword [rbp + 0x1c0]
lea rcx, [rbp + 0x1c0]
call fcn.140073b50
mov qword [rbp + 0x1d0], r14
mov qword [rbp + 0x1d8], 7
mov word [rbp + 0x1c0], r14w
mov r8, qword [rbp + 0x1b8]
cmp r8, 8
jb 0x140103b97
inc r8
mov rdx, qword [rbp + 0x1a0]
lea rcx, [rbp + 0x1a0]
call fcn.140073b50
mov qword [rbp + 0x1b0], r14
mov qword [rbp + 0x1b8], 7
mov word [rbp + 0x1a0], r14w
mov r8, qword [rbp + 0x258]
cmp r8, 8
jb 0x140103bd4
inc r8
mov rdx, qword [rbp + 0x240]
lea rcx, [rbp + 0x240]
call fcn.140073b50
mov bl, 1
lea rcx, [rbp + 0x188]
call fcn.14006ead0
movzx eax, bl
mov rcx, qword [rbp + 0xac0]
xor rcx, rsp
call fcn.140359070
lea r11, [rsp + 0xbd0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rdx, [rax + 0x58]
cmp qword [rdx + 0x18], 8
jb 0x140103c23
mov rdx, qword [rdx]
inc r15
cmp word [rdx + r15*2], 0
jne 0x140103c23
mov r8, r15
lea rcx, [rbp + 0x200]
call fcn.1400739a0
nop
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x140103868
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140073980
int3
call fcn.140368068
nop
call fcn.140368068
int3
call fcn.140368068
int3
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
int3