Function at 0x1400422f0
Capabilities:
Get graphical window text
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xaa8]
sub rsp, 0xba8
mov rax, qword [0x1400cd548]
xor rax, rsp
mov qword [rbp + 0xa90], rax
mov qword [rsp + 0x58], r9
mov rbx, r8
mov rdi, rdx
mov r12, rcx
xor sil, sil
mov byte [rsp + 0x40], sil
xor r13d, r13d
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x18], 7
mov word [rbp], r13w
lea rdx, str.winword
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
lea r14d, [r13 + 0xa]
test eax, eax
jne 0x14004236c
lea r8d, [r13 + 4]
lea rdx, str.Word
jmp 0x1400423ab
lea rdx, str.excel
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x14004238d
lea r8d, [rax + 5]
lea rdx, str.Excel
jmp 0x1400423ab
lea rdx, str.powerpnt
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x1400423b4
mov r8, r14
lea rdx, str.PowerPoint
lea rcx, [rbp]
call fcn.14000d670
cmp qword [rbp + 0x10], 0
je 0x1400432db
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], 7
mov word [rbp - 0x40], r13w
mov rsi, 0xffffffffffffffff
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x1400423e0
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.14000d670
nop
lea r11, [rbp - 0x40]
mov r14, qword [rbp - 0x40]
mov r15, qword [rbp - 0x28]
cmp r15, 8
cmovae r11, r14
lea rbx, [0x14009f3b0]
mov rdi, qword [rbp - 0x30]
cmp rdi, 1
jb 0x1400424bd
lea r10, [r11 + rdi*2]
mov rdx, r11
nop dword [rax + rax]
mov rax, r10
sub rax, rdx
sar rax, 1
je 0x1400424bd
cmp word [rdx], 0x2e
je 0x14004244f
add rdx, 2
sub rax, 1
jmp 0x140042439
mov r8d, 1
mov rcx, rbx
mov r9, rdx
sub r9, rbx
nop
movzx eax, word [rcx]
cmp word [r9 + rcx], ax
jne 0x14004249c
add rcx, 2
sub r8, 1
jne 0x140042460
sub rdx, r11
sar rdx, 1
cmp rdx, 0xffffffffffffffff
je 0x1400424bd
cmp rdx, rdi
ja 0x1400424a2
mov qword [rbp - 0x30], rdx
lea rax, [rbp - 0x40]
cmp r15, 8
cmovae rax, r14
mov word [rax + rdx*2], r13w
jmp 0x1400424b1
add rdx, 2
jmp 0x140042430
xor r8d, r8d
sub rdx, rdi
lea rcx, [rbp - 0x40]
call fcn.1400443b0
mov r14, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x28]
mov r8, rsi
lea rdx, [0x1400b8b50]
lea rcx, [rbp - 0x40]
call fcn.140044b80
cmp rax, 0xffffffffffffffff
je 0x14004250c
lea rcx, [rbp - 0x40]
cmp rax, rdi
ja 0x1400424f2
mov qword [rbp - 0x30], rax
cmp r15, 8
cmovae rcx, r14
mov word [rcx + rax*2], r13w
jmp 0x140042500
xor r8d, r8d
sub rax, rdi
mov rdx, rax
call fcn.1400443b0
mov r14, qword [rbp - 0x40]
mov rdi, qword [rbp - 0x30]
mov r15, qword [rbp - 0x28]
mov esi, r13d
lea rbx, [rbp - 0x40]
cmp r15, 8
cmovae rbx, r14
movabs r13, 0x7ffffffffffffffe
test rdi, rdi
je 0x14004274d
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x40]
call fcn.140070390
lea rcx, str.Office
lea r8, [0x1400a1614]
mov edx, 0x100
movzx eax, word [rcx]
cmp ax, dx
jae 0x1400425a2
movzx eax, al
mov byte [rbp + rax + 0x40], 1
add rcx, 2
cmp rcx, r8
jne 0x140042552
lea rcx, [rdi - 1]
mov r9, 0xffffffffffffffff
mov rax, r9
cmp rcx, rax
cmovb rax, rcx
lea rcx, [rbx + rax*2]
movzx eax, word [rcx]
cmp ax, dx
jae 0x140042593
cmp byte [rbp + rax + 0x40], sil
jne 0x1400425f0
cmp rcx, rbx
je 0x14004274d
sub rcx, 2
jmp 0x140042584
lea rcx, [rdi - 1]
mov r9, 0xffffffffffffffff
mov rax, r9
cmp rcx, rax
cmovb rax, rcx
lea rcx, [rbx + rax*2]
nop dword [rax + rax]
mov edx, 6
lea rax, str.Office
movzx r8d, word [rcx]
cmp word [rax], r8w
je 0x1400425f0
add rax, 2
sub rdx, 1
jne 0x1400425d0
cmp rcx, rbx
je 0x1400425eb
sub rcx, 2
jmp 0x1400425c0
mov rcx, r9
jmp 0x1400425f6
sub rcx, rbx
sar rcx, 1
cmp rcx, 0xffffffffffffffff
je 0x14004274d
inc rcx
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], ax
cmp rdi, rcx
jb 0x140043344
sub rdi, rcx
mov rsi, r9
cmp rdi, 0xffffffffffffffff
cmovb rsi, rdi
lea rax, [rbp - 0x40]
cmp r15, 8
cmovae rax, r14
lea r14, [rax + rcx*2]
cmp rsi, 7
ja 0x140042668
mov qword [rbp - 0x50], rsi
lea rbx, [rsi + rsi]
mov r8, rbx
mov rdx, r14
lea rcx, [rbp - 0x60]
call fcn.140071350
xor r15d, r15d
mov word [rbp + rbx - 0x60], r15w
lea r13d, [r15 + 0xa]
jmp 0x1400426cc
cmp rsi, r13
ja 0x14004334a
mov rbx, rsi
or rbx, 7
cmp rbx, r13
jbe 0x140042688
mov rbx, r13
mov r13d, 0xa
jmp 0x140042696
cmp rbx, 0xa
mov r13d, 0xa
cmovb rbx, r13
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x60]
call fcn.14000d810
mov rdi, rax
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], rbx
lea rbx, [rsi + rsi]
mov r8, rbx
mov rdx, r14
mov rcx, rax
call fcn.140071350
xor r15d, r15d
mov word [rbx + rdi], r15w
mov qword [rbp - 0x60], rdi
call fcn.14007b7d0
mov rdi, rax
lea rbx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rbx, qword [rbp - 0x60]
mov dword [rax], r15d
mov r8d, r13d
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.14007c9c8
mov esi, eax
cmp rbx, qword [rsp + 0x48]
je 0x140043350
cmp dword [rdi], 0x22
je 0x140043363
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140042750
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042746
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004335d
call fcn.14006ec58
jmp 0x140042750
xor r15d, r15d
lea r9, [rbp]
cmp qword [rbp + 0x18], 8
cmovae r9, qword [rbp]
mov r8d, esi
lea rdx, str.SoftwareMicrosoftOffice_d.0_sUser_MRU
lea rcx, [rbp + 0x880]
call qword [sym.imp.USER32.dll_wsprintfW]
mov qword [rsp + 0x50], r15
mov r9d, 0xf003f
lea r8, [rsp + 0x50]
lea rdx, [rbp + 0x880]
mov rcx, 0xffffffff80000001
call fcn.140059a60
test eax, eax
jne 0x140043296
mov dword [rsp + 0x44], 0x208
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x44]
lea r8, [rbp + 0x460]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14004328a
mov qword [rsp + 0x48], r15
lea rdx, str.File_MRU
lea rcx, [rbp + 0x460]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov r9d, 0xf003f
lea r8, [rsp + 0x48]
lea rdx, [rbp + 0x460]
mov rcx, qword [rsp + 0x50]
call fcn.140059a60
test eax, eax
jne 0x14004328a
mov qword [rbp - 0x70], r15
mov r13d, 7
mov qword [rbp - 0x68], r13
mov word [rbp - 0x80], r15w
mov r8d, 0x104
lea rdx, [rbp + 0x670]
mov rcx, r12
call qword [sym.imp.USER32.dll_GetWindowTextW]
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r13
mov word [rbp - 0x60], r15w
lea rax, [rbp + 0x670]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x140042860
lea rdx, [rbp + 0x670]
lea rcx, [rbp - 0x60]
call fcn.14000d670
nop
lea r10, [rbp - 0x60]
mov rbx, qword [rbp - 0x60]
mov r14, qword [rbp - 0x48]
cmp r14, 8
cmovae r10, rbx
mov r12, qword [rbp - 0x50]
cmp r12, 1
jb 0x140042be1
lea r9, [r10 + r12*2]
mov rdi, r10
nop word [rax + rax]
mov rax, r9
sub rax, rdi
sar rax, 1
je 0x140042be1
cmp word [rdi], 0x2e
je 0x1400428cf
add rdi, 2
sub rax, 1
jmp 0x1400428b9
mov edx, 1
lea rax, [0x14009f3b0]
mov rcx, rax
mov r8, rdi
sub r8, rax
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140042952
add rcx, 2
sub rdx, 1
jne 0x1400428e4
sub rdi, r10
sar rdi, 1
cmp rdi, 0xffffffffffffffff
je 0x140042be1
lea r15, [rbp - 0x60]
cmp r14, 8
cmovae r15, rbx
cmp r12, 7
ja 0x14004295b
mov qword [rbp - 0x70], r12
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.140071350
xor r15d, r15d
mov word [rbp + rbx - 0x80], r15w
mov rsi, qword [rbp - 0x68]
mov r12, qword [rbp - 0x70]
mov r14, qword [rbp - 0x80]
movabs r13, 0x7ffffffffffffffe
jmp 0x1400429c2
add rdi, 2
jmp 0x1400428b0
movabs r13, 0x7ffffffffffffffe
cmp r12, r13
ja 0x14004337c
mov rsi, r12
or rsi, 7
cmp rsi, r13
jbe 0x14004297f
mov rsi, r13
jmp 0x14004298c
cmp rsi, 0xa
mov eax, 0xa
cmovb rsi, rax
lea rdx, [rsi + 1]
lea rcx, [rbp - 0x80]
call fcn.14000d810
mov r14, rax
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], rsi
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r15
mov rcx, rax
call fcn.140071350
xor r15d, r15d
mov word [rbx + r14], r15w
mov qword [rbp - 0x80], r14
lea rbx, [rdi + 1]
cmp rbx, r12
ja 0x1400429e2
mov qword [rbp - 0x70], rbx
lea rax, [rbp - 0x80]
cmp rsi, 8
cmovae rax, r14
mov word [rax + rbx*2], r15w
jmp 0x1400429f4
xor r8d, r8d
mov rdx, rbx
sub rdx, r12
lea rcx, [rbp - 0x80]
call fcn.1400443b0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r15w
mov rax, qword [rbp - 0x50]
cmp rax, rbx
jb 0x140043370
sub rax, rbx
mov rdi, 0xffffffffffffffff
cmp rax, rdi
cmovb rdi, rax
lea rax, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rax, qword [rbp - 0x60]
lea rsi, [rax + rbx*2]
cmp rdi, 7
ja 0x140042a64
mov qword [rsp + 0x70], rdi
lea rbx, [rdi + rdi]
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.140071350
mov word [rsp + rbx + 0x60], r15w
mov r14, qword [rsp + 0x60]
jmp 0x140042ac2
cmp rdi, r13
ja 0x14004337c
mov rbx, rdi
or rbx, 7
cmp rbx, r13
jbe 0x140042a7e
mov rbx, r13
jmp 0x140042a8b
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x60]
call fcn.14000d810
mov r14, rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rbx
lea rbx, [rdi + rdi]
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.140071350
mov word [r14 + rbx], r15w
mov qword [rsp + 0x60], r14
lea r10, [rsp + 0x60]
mov r11, qword [rsp + 0x78]
cmp r11, 8
cmovae r10, r14
mov rbx, qword [rsp + 0x70]
cmp rbx, 1
jb 0x140042b9d
lea rdi, [r10 + rbx*2]
mov rdx, r10
lea rsi, [0x1400b9990]
mov rax, rdi
sub rax, rdx
sar rax, 1
je 0x140042b9d
cmp word [rdx], 0x20
je 0x140042b10
add rdx, 2
sub rax, 1
jmp 0x140042afa
mov r8d, 1
mov rcx, rsi
mov r9, rdx
sub r9, rsi
nop
movzx eax, word [rcx]
cmp word [rcx + r9], ax
jne 0x140042b5e
add rcx, 2
sub r8, 1
jne 0x140042b20
sub rdx, r10
sar rdx, 1
cmp rdx, 0xffffffffffffffff
je 0x140042b9d
cmp rdx, rbx
ja 0x140042b64
mov qword [rsp + 0x70], rdx
lea rax, [rsp + 0x60]
cmp r11, 8
cmovae rax, r14
mov word [rax + rdx*2], r15w
jmp 0x140042b74
add rdx, 2
jmp 0x140042af1
xor r8d, r8d
sub rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.1400443b0
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
lea rcx, [rbp - 0x80]
call fcn.14000ed70
mov r11, qword [rsp + 0x78]
mov r14, qword [rsp + 0x60]
cmp r11, 8
jb 0x140042cec
lea rdx, [r11*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x140042bd4
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140043376
mov rcx, r14
call fcn.14006ec58
jmp 0x140042cec
xor r8d, r8d
lea rdx, [0x1400b9988]
lea rcx, [rbp - 0x60]
call fcn.140044a20
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140043188
lea r15, [rbp - 0x60]
cmp r14, 8
cmovae r15, rbx
cmp r12, 7
ja 0x140042c41
mov qword [rbp - 0x70], r12
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.140071350
xor r15d, r15d
mov word [rbp + rbx - 0x80], r15w
mov rdi, qword [rbp - 0x68]
mov r12, qword [rbp - 0x70]
mov r14, qword [rbp - 0x80]
jmp 0x140042ca8
movabs rax, 0x7ffffffffffffffe
cmp r12, rax
ja 0x140043382
mov rdi, r12
or rdi, 7
cmp rdi, rax
jbe 0x140042c65
mov rdi, rax
jmp 0x140042c72
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rbp - 0x80]
call fcn.14000d810
mov r14, rax
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], rdi
lea rbx, [r12 + r12]
mov r8, rbx
mov rdx, r15
mov rcx, rax
call fcn.140071350
xor r15d, r15d
mov word [rbx + r14], r15w
mov qword [rbp - 0x80], r14
cmp rsi, r12
ja 0x140042cc4
mov qword [rbp - 0x70], rsi
lea rax, [rbp - 0x80]
cmp rdi, 8
cmovae rax, r14
mov word [rax + rsi*2], r15w
jmp 0x140042cd6
xor r8d, r8d
sub rsi, r12
mov rdx, rsi
lea rcx, [rbp - 0x80]
call fcn.1400443b0
mov r8d, 1
lea rdx, [0x14009f3b0]
lea rcx, [rbp - 0x80]
call fcn.14000ed70
mov rsi, qword [rbp - 0x70]
test rsi, rsi
je 0x140043184
mov r12d, 1
mov r8d, r12d
lea rdx, str.Item__d
lea rcx, [rbp + 0x250]
call qword [sym.imp.USER32.dll_wsprintfW]
mov dword [rsp + 0x44], 0x208
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x250]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r13, qword [rbp - 0x68]
test eax, eax
jne 0x1400431ee
lea rbx, [r12 - 2]
nop word [rax + rax]
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], 7
mov word [rbp - 0x20], r15w
lea rax, [rbp + 0x40]
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140042d80
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.14000d670
nop
lea r10, [rbp - 0x80]
cmp r13, 8
cmovae r10, qword [rbp - 0x80]
lea rdi, [rbp - 0x20]
mov r11, qword [rbp - 0x20]
mov r14, qword [rbp - 8]
cmp r14, 8
cmovae rdi, r11
mov r15, qword [rbp - 0x10]
cmp rsi, r15
ja 0x140042dfc
mov rbx, r15
sub rbx, rsi
inc rbx
lea rbx, [rdi + rbx*2]
mov rdx, rdi
mov rax, rbx
sub rax, rdx
sar rax, 1
je 0x140042df5
movzx ecx, word [r10]
cmp word [rdx], cx
je 0x140042ea4
add rdx, 2
sub rax, 1
jne 0x140042de2
mov rbx, 0xffffffffffffffff
mov rdx, rbx
cmp rdx, 0xffffffffffffffff
jne 0x140042ee4
inc r12d
cmp r14, 8
jb 0x140042e47
lea rdx, [r14*2 + 2]
mov rax, r11
cmp rdx, 0x1000
jb 0x140042e3f
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400433a0
mov rcx, r11
call fcn.14006ec58
mov r8d, r12d
lea rdx, str.Item__d
lea rcx, [rbp + 0x250]
call qword [sym.imp.USER32.dll_wsprintfW]
mov dword [rsp + 0x44], 0x208
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x250]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov r15d, 0
je 0x140042d60
jmp 0x1400431ee
mov r8, rsi
mov rcx, r10
test rsi, rsi
je 0x140042ec9
mov r9, rdx
sub r9, r10
movzx eax, word [rcx]
cmp word [rcx + r9], ax
jne 0x140042edb
add rcx, 2
sub r8, 1
jne 0x140042eb5
sub rdx, rdi
sar rdx, 1
mov rbx, 0xffffffffffffffff
jmp 0x140042dff
add rdx, 2
jmp 0x140042dd3
lea r9, [rbp - 0x20]
cmp r14, 8
cmovae r9, r11
cmp r15, 1
jb 0x140042f56
lea r10, [r9 + r15*2]
mov rbx, r9
lea r11, [0x1400a16a0]
mov rax, r10
sub rax, rbx
sar rax, 1
je 0x140042f56
cmp word [rbx], 0x2a
je 0x140042f1f
add rbx, 2
sub rax, 1
jmp 0x140042f0d
mov edx, 1
mov rcx, r11
mov r8, rbx
sub r8, r11
nop dword [rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140042f50
add rcx, 2
sub rdx, 1
jne 0x140042f30
sub rbx, r9
sar rbx, 1
lea r15, [rdx - 1]
jmp 0x140042f60
add rbx, 2
jmp 0x140042f04
mov r15, 0xffffffffffffffff
mov rbx, r15
xor r12d, r12d
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r12w
lea r8d, [r12 + 1]
lea rdx, [0x14009f880]
lea rcx, [rbp + 0x20]
call fcn.14000d670
nop
inc rbx
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r12w
mov rax, qword [rbp - 0x10]
cmp rax, rbx
jb 0x140043388
sub rax, rbx
cmp rax, 0xffffffffffffffff
cmovb r15, rax
lea rax, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rax, qword [rbp - 0x20]
lea rsi, [rax + rbx*2]
cmp r15, 7
ja 0x140043001
mov qword [rsp + 0x70], r15
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.140071350
mov word [rsp + rbx + 0x60], r12w
mov r14, qword [rsp + 0x78]
mov r15, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x60]
jmp 0x140043067
movabs r14, 0x7ffffffffffffffe
cmp r15, r14
ja 0x14004338e
mov rax, r15
or rax, 7
cmp rax, r14
ja 0x140043030
mov r14, rax
cmp rax, 0xa
mov eax, 0xa
cmovb r14, rax
lea rdx, [r14 + 1]
lea rcx, [rsp + 0x60]
call fcn.14000d810
mov rdi, rax
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r14
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, rsi
mov rcx, rax
call fcn.140071350
mov word [rdi + rbx], r12w
mov qword [rsp + 0x60], rdi
lea rdx, [rsp + 0x60]
cmp r14, 8
cmovae rdx, rdi
mov r8, r15
lea rcx, [rbp + 0x20]
call fcn.14000ed70
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x1400430c3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400430be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140043394
call fcn.14006ec58
mov r8d, 1
lea rdx, [0x14009f880]
lea rcx, [rbp + 0x20]
call fcn.14000ed70
lea r8, [rbp + 0x20]
cmp qword [rbp + 0x38], 8
cmovae r8, qword [rbp + 0x20]
mov rdx, qword [rbp + 0xb10]
mov rcx, qword [rsp + 0x58]
call fcn.140004af0
mov byte [rsp + 0x40], 1
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x14004313e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043138
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004339a
call fcn.14006ec58
nop
mov rdx, qword [rbp - 8]
cmp rdx, 8
jb 0x1400431f1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004317d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400433a0
call fcn.14006ec58
jmp 0x1400431f1
mov r13, qword [rbp - 0x68]
mov rcx, qword [rbp + 0xb10]
shr rcx, 1
lea rax, [rcx - 1]
mov edx, 0x7ffffffe
cmp rax, rdx
ja 0x1400431e0
sub rdx, rcx
lea r8, [0x14009df10]
mov r9, qword [rsp + 0x58]
sub r8, r9
lea rax, [rdx + rcx]
test rax, rax
je 0x1400431d3
movzx eax, word [r8 + r9]
test ax, ax
je 0x1400431d3
mov word [r9], ax
add r9, 2
sub rcx, 1
jne 0x1400431b2
lea rax, [r9 - 2]
test rcx, rcx
cmovne rax, r9
jmp 0x1400431ea
test rcx, rcx
je 0x1400431ee
mov rax, qword [rsp + 0x58]
mov word [rax], r15w
xor r12d, r12d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x14004323d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043238
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400433a6
call fcn.14006ec58
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r12w
cmp r13, 8
jb 0x14004328a
lea rdx, [r13*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043285
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400433ac
call fcn.14006ec58
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x1400432d6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400432d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400433b2
call fcn.14006ec58
movzx esi, byte [rsp + 0x40]
mov rdx, qword [rbp + 0x18]
cmp rdx, 8
jb 0x140043317
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043312
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004333e
call fcn.14006ec58
movzx eax, sil
mov rcx, qword [rbp + 0xa90]
xor rcx, rsp
call fcn.14006ed70
add rsp, 0xba8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14007576c
nop
call fcn.14000ee50
nop
call fcn.1400082e0
nop
lea rcx, str.invalid_stoi_argument
call fcn.14006d7a4
nop
call fcn.14007576c
nop
lea rcx, str.stoi_argument_out_of_range
call fcn.14006d7ec
nop
call fcn.14000ee50
int3
call fcn.14007576c
int3
call fcn.1400082e0
int3
call fcn.1400082e0
nop
call fcn.14000ee50
int3
call fcn.1400082e0
int3
call fcn.14007576c
nop
call fcn.14007576c
nop
call fcn.14007576c
nop
call fcn.14007576c
nop
call fcn.14007576c
nop
call fcn.14007576c
int3