Function at 0x1401c3e40
Capabilities:
Hash data using sha256
Persist via active setup registry key
Persist via appinit_dlls registry key
Persist via winlogon helper dll registry key
Query environment variable
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xd240]
mov eax, 0xd340
call fcn.1402a90d0
sub rsp, rax
mov qword [rbp + 0x9c8], 0xfffffffffffffffe
mov qword [rsp + 0xd378], rbx
mov qword [rsp + 0xd380], rsi
mov qword [rsp + 0xd388], rdi
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rbp + 0xd230], rax
mov r13, rcx
mov qword [rbp - 0x80], rcx
xor r14d, r14d
mov dword [rsp + 0x78], r14d
lea rbx, [0x140323de0]
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], r14
mov qword [rbp + 0x290], rbx
mov qword [rbp + 0x298], r14
lea rax, vtable.Core::Array_class_Core::String_.0
mov qword [rbp + 0x7b8], rax
mov dword [rbp + 0x7c0], r14d
mov qword [rbp + 0x7c8], r14
lea rcx, str.SeTakeOwnershipPrivilege
call fcn.1400ffc40
lea rax, vtable.Core::Collection_class_Core::String_.0
mov qword [rbp + 0xa08], rax
mov edi, r14d
mov dword [rbp + 0xa10], r14d
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xa18], xmm0
mov eax, dword [0x1403fe608]
lea r12, vtable.Core::Win32::RegistryKey.0
test al, 1
jne 0x1401c3f42
or eax, 1
mov dword [0x1403fe608], eax
mov qword [0x1403fe5e0], r12
mov qword [0x1403fe5e8], 0xffffffff80000002
lea rcx, [0x1402de040]
call fcn.140299c6c
mov qword [rbp + 0x7d0], r14
lea rax, [rbp + 0x7d0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x140332a70]
mov rcx, qword [0x1403fe5e8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c417d
lea ecx, [rax + 0x10]
call fcn.14029806c
mov rsi, rax
test rax, rax
je 0x1401c417d
mov rcx, qword [rbp + 0x7d0]
mov qword [rax], r12
mov qword [rax + 8], rcx
lea rax, vtable.Core::Array_class_Core::String_.0
mov qword [rbp + 0x9d8], rax
mov dword [rbp + 0x9e0], r14d
mov qword [rbp + 0x9e8], r14
lea rdx, [rbp + 0x9d8]
mov rcx, rsi
call fcn.1400ec710
mov r14, qword [rbp + 0x9e8]
test al, al
je 0x1401c4015
mov eax, dword [rbp + 0x9e0]
test eax, eax
jle 0x1401c4015
mov rbx, r14
mov edi, eax
xor r8d, r8d
lea rdx, str.ControlSet0
mov rcx, rbx
call fcn.1401eb700
test al, al
je 0x1401c4006
mov rdx, rbx
lea rcx, [rbp + 0xa08]
call fcn.1401187d0
add rbx, 0x10
dec rdi
jne 0x1401c3fe1
mov edi, dword [rbp + 0xa10]
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
nop
test r14, r14
je 0x1401c4049
lea r9, [fcn.140005d80]
mov r8d, dword [r14 - 8]
mov edx, 0x10
mov rcx, r14
call fcn.140298fa4
lea rcx, [r14 - 8]
call fcn.1402983dc
test edi, edi
je 0x1401c4173
mov edx, edi
lea rcx, [rbp + 0x7b8]
call fcn.1400c7710
xor eax, eax
mov r14d, eax
mov r12d, dword [rbp + 0x7c0]
cmp r12d, edi
mov rdi, qword [rbp + 0xa18]
jl 0x1401c424c
mov rbx, rdi
test rdi, rdi
je 0x1401c424c
lea rax, [rbp + 0x280]
mov qword [rbp + 0xc0], rax
mov rsi, qword [rbp + 0x7c8]
xor r15d, r15d
lea r13, [0x140323de0]
nop word [rax + rax]
mov qword [rbp + 0x288], r15
mov edx, dword [rbx + 0x1c]
test edx, edx
jne 0x1401c40c7
mov qword [rbp + 0x280], r13
jmp 0x1401c40f2
lea rcx, [rbp + 0x280]
call fcn.1401e9030
movsxd r9, dword [rbx + 0x1c]
mov eax, dword [rbp + 0x288]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x10]
mov rcx, qword [rbp + 0x280]
call fcn.14029b4d8
mov edx, dword [rbx + 0x1c]
lea rcx, [rbp + 0x280]
call fcn.1401ea290
nop
cmp r14d, r12d
jge 0x1401c4142
mov edx, dword [rbp + 0x28c]
mov rcx, rsi
call fcn.1401e9030
movsxd r9, dword [rbp + 0x28c]
mov eax, dword [rsi + 8]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x280]
mov rcx, qword [rsi]
call fcn.14029b4d8
mov edx, dword [rbp + 0x28c]
mov rcx, rsi
call fcn.1401ea290
nop
cmp dword [rbp + 0x288], 0
jle 0x1401c4157
mov rcx, qword [rbp + 0x280]
call fcn.140298600
inc r14d
add rsi, 0x10
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1401c40b0
mov r13, qword [rbp - 0x80]
jmp 0x1401c424c
xor r14d, r14d
lea rbx, [0x140323de0]
mov qword [rbp + 0x3c0], 0
mov edx, 0x11
lea rcx, [rbp + 0x3b8]
call fcn.1401e9030
mov eax, dword [rbp + 0x3c0]
inc eax
movsxd rdx, eax
mov r9d, 0x11
lea r8, str.CurrentControlSet
mov rcx, qword [rbp + 0x3b8]
call fcn.14029b4d8
mov edx, 0x11
lea rcx, [rbp + 0x3b8]
call fcn.1401ea290
nop
mov ecx, 0x20
call fcn.14029806c
mov rdi, rax
test rax, rax
je 0x1401c41ef
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0
jmp 0x1401c41f2
mov rdi, r14
mov edx, dword [rbp + 0x3c4]
lea rcx, [rdi + 0x10]
call fcn.1401e9030
movsxd r9, dword [rbp + 0x3c4]
mov eax, dword [rdi + 0x18]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x3b8]
mov rcx, qword [rdi + 0x10]
call fcn.14029b4d8
mov edx, dword [rbp + 0x3c4]
lea rcx, [rdi + 0x10]
call fcn.1401ea290
mov qword [rdi], r14
mov qword [rdi + 8], r14
cmp dword [rbp + 0x3c0], 0
jle 0x1401c424c
mov rcx, qword [rbp + 0x3b8]
call fcn.140298600
nop
test rdi, rdi
je 0x1401c4273
mov rbx, qword [rdi]
cmp dword [rdi + 0x18], 0
jle 0x1401c4263
mov rcx, qword [rdi + 0x10]
call fcn.140298600
mov rcx, rdi
call fcn.1402012c0
mov rdi, rbx
test rbx, rbx
jne 0x1401c4251
lea rax, str.SOFTWAREMicrosoftWindowsCurrentVersion
mov qword [rbp + 0xc0], rax
lea rax, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersion
mov qword [rbp + 0xc8], rax
xor ebx, ebx
mov r14d, ebx
mov dword [rsp + 0x70], ebx
lea r12, [rbp + 0xc0]
nop
mov rsi, qword [r12]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c4340
lea edx, [rax + 5]
lea rcx, [rbp + 0x290]
call fcn.1401e9030
mov eax, dword [rbp + 0x298]
inc eax
movsxd rdx, eax
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x290]
call fcn.14029b4d8
mov edx, 5
lea rcx, [rbp + 0x290]
call fcn.1401ea290
mov rdx, rsi
lea rcx, [rbp + 0x290]
call fcn.1401e7680
xor r9d, r9d
lea r8, [rbp + 0x290]
mov rdx, qword [rsp + 0x68]
mov rcx, r13
call fcn.1401c2720
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp + 0x2ec], ebx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
lea rax, [rbp + 0x2ec]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, ebx
cmp dword [rbp + 0x2ec], 0
jbe 0x1401c4543
xor r15d, r15d
lea r14, [0x140323de0]
nop dword [rax]
nop word [rax + rax]
mov r9d, 0x400
lea r8, [rbp + 0x2630]
mov edx, edi
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc edi
test eax, eax
jne 0x1401c4529
lea rax, [rbp + 0x2630]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401c43e1
mov qword [rbp + 0x4e0], r15
test ebx, ebx
jne 0x1401c43ff
mov qword [rbp + 0x4d8], r14
jmp 0x1401c442e
mov edx, ebx
lea rcx, [rbp + 0x4d8]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rbp + 0x4e0]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x2630]
mov rcx, qword [rbp + 0x4d8]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x4d8]
call fcn.1401ea290
nop
lea r8, [0x1403232c8]
mov edx, 0x400
lea rcx, [rbp + 0x2630]
call fcn.14029a500
mov r8, rsi
mov edx, 0x400
lea rcx, [rbp + 0x2630]
call fcn.14029a500
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x2630]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c4512
lea edx, [rax + 4]
lea rcx, [rbp + 0x290]
call fcn.1401e9030
mov eax, dword [rbp + 0x298]
inc eax
movsxd rdx, eax
mov r9d, 4
lea r8, str.HKU_
mov rcx, qword [rbp + 0x290]
call fcn.14029b4d8
mov edx, 4
lea rcx, [rbp + 0x290]
call fcn.1401ea290
lea rdx, [rbp + 0x2630]
lea rcx, [rbp + 0x290]
call fcn.1401e7680
mov r9, qword [rbp + 0x4d8]
lea r8, [rbp + 0x290]
mov rdx, qword [rsp + 0x68]
mov rcx, r13
call fcn.1401c2720
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0x4e0], 0
jle 0x1401c4530
mov rcx, qword [rbp + 0x4d8]
call fcn.140298600
jmp 0x1401c4530
cmp eax, 0x103
je 0x1401c453c
cmp edi, dword [rbp + 0x2ec]
jb 0x1401c43b0
mov r14d, dword [rsp + 0x70]
xor ebx, ebx
inc r14d
mov dword [rsp + 0x70], r14d
add r12, 8
movsxd rax, r14d
cmp rax, 2
jb 0x1401c42a0
lea rax, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
mov qword [rbp + 0xc0], rax
lea rax, str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWindows
mov qword [rbp + 0xc8], rax
mov eax, ebx
mov dword [rbp - 0x60], ebx
lea r15, [rbp + 0xc0]
mov qword [rbp], r15
mov rcx, qword [rbp - 0x80]
nop dword [rax]
mov r14, qword [r15]
mov r13d, ebx
mov rdi, rbx
mov qword [rbp - 0x48], rbx
cmp dword [rcx + 0x18], 0
jl 0x1401c4997
mov r15, qword [rbp - 0x80]
lea r12, [0x140323de0]
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], 0
mov rsi, rbx
test r13d, r13d
setne sil
add rsi, 0xffffffff80000002
test rdi, rdi
jne 0x1401c4641
test r14, r14
je 0x1401c46d7
or rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [r14 + rbx*2], 0
jne 0x1401c45f0
test ebx, ebx
jle 0x1401c46d7
mov edx, ebx
lea rcx, [rbp + 0xb0]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rbp + 0xb8]
inc eax
movsxd rdx, eax
mov r8, r14
mov rcx, qword [rbp + 0xb0]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0xb0]
call fcn.1401ea290
jmp 0x1401c46d7
mov rbx, rdi
shl rbx, 4
add rbx, qword [r15 + 0x20]
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0xb0]
call fcn.1401e9030
movsxd r9, dword [rbx - 4]
mov eax, dword [rbp + 0xb8]
inc eax
movsxd rdx, eax
mov r8, qword [rbx - 0x10]
mov rcx, qword [rbp + 0xb0]
call fcn.14029b4d8
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0xb0]
call fcn.1401ea290
mov edx, dword [rbp + 0xbc]
inc edx
lea rcx, [rbp + 0xb0]
call fcn.1401e9030
movsxd rcx, dword [rbp + 0xbc]
mov rax, qword [rbp + 0xb0]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0xbc]
inc edx
lea rcx, [rbp + 0xb0]
call fcn.1401ea290
mov rdx, r14
lea rcx, [rbp + 0xb0]
call fcn.1401e7680
lea rax, [rbp + 0x770]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0xb0]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c495e
mov dword [rbp + 0x3c8], 0x800
lea rax, [rbp + 0x3c8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x7230]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140328e18]
mov rcx, qword [rbp + 0x770]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401c4950
cmp dword [rbp + 0x3c8], eax
jbe 0x1401c4950
lea rax, [rbp + 0x7230]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401c4760
xor eax, eax
mov qword [rbp + 0x4a8], rax
test ebx, ebx
jne 0x1401c4780
mov qword [rbp + 0x4a0], r12
jmp 0x1401c47af
mov edx, ebx
lea rcx, [rbp + 0x4a0]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rbp + 0x4a8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x7230]
mov rcx, qword [rbp + 0x4a0]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x4a0]
call fcn.1401ea290
nop
lea rdx, [rbp + 0x4a0]
call fcn.1401c36c0
mov r8b, 1
lea rdx, [rbp + 0x4a0]
mov rcx, qword [r15 + 8]
call fcn.1400f9eb0
mov r12, rax
test rax, rax
je 0x1401c4934
lea rdi, [0x1403232e0]
cmp rsi, 0xffffffff80000002
lea rax, [0x1403232e8]
cmove rdi, rax
test rdi, rdi
jne 0x1401c4811
xor eax, eax
mov ebx, eax
mov qword [rbp - 8], rax
jmp 0x1401c4829
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1401c4815
xor eax, eax
mov qword [rbp - 8], rax
test ebx, ebx
jne 0x1401c4836
lea rax, [0x140323de0]
mov qword [rbp - 0x10], rax
jmp 0x1401c4858
mov edx, ebx
lea rcx, [rbp - 0x10]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rbp - 8]
inc eax
movsxd rdx, eax
mov r8, rdi
mov rcx, qword [rbp - 0x10]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp - 0x10]
call fcn.1401ea290
nop
mov edx, dword [rbp - 4]
inc edx
lea rcx, [rbp - 0x10]
call fcn.1401e9030
movsxd rcx, dword [rbp - 4]
mov rax, qword [rbp - 0x10]
mov edi, 0x5c
mov word [rax + rcx*2], di
mov edx, dword [rbp - 4]
inc edx
lea rcx, [rbp - 0x10]
call fcn.1401ea290
mov ebx, dword [rbp - 4]
add ebx, dword [rbp + 0xbc]
mov edx, ebx
lea rcx, [rbp - 0x10]
call fcn.1401e9030
movsxd r9, dword [rbp + 0xbc]
mov ecx, dword [rbp - 8]
movsxd rax, dword [rbp - 4]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp - 0x10]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0xb0]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp - 0x10]
call fcn.1401ea290
mov edx, dword [rbp - 4]
inc edx
lea rcx, [rbp - 0x10]
call fcn.1401e9030
movsxd rcx, dword [rbp - 4]
mov rax, qword [rbp - 0x10]
mov word [rax + rcx*2], di
mov edx, dword [rbp - 4]
inc edx
lea rcx, [rbp - 0x10]
call fcn.1401ea290
lea rdx, [0x140328e18]
lea rcx, [rbp - 0x10]
call fcn.1401e7680
lea rdx, [rbp - 0x10]
mov rcx, r12
call fcn.1400ed120
nop
cmp dword [rbp - 8], 0
jle 0x1401c4930
mov rcx, qword [rbp - 0x10]
call fcn.140298600
mov rdi, qword [rbp - 0x48]
cmp dword [rbp + 0x4a8], 0
jle 0x1401c4949
mov rcx, qword [rbp + 0x4a0]
call fcn.140298600
lea r12, [0x140323de0]
mov rcx, qword [rbp + 0x770]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0xb8], 0
jle 0x1401c4973
mov rcx, qword [rbp + 0xb0]
call fcn.140298600
inc r13d
inc rdi
mov qword [rbp - 0x48], rdi
cmp r13d, dword [r15 + 0x18]
mov ebx, 0
jle 0x1401c45b2
mov r15, qword [rbp]
mov eax, dword [rbp - 0x60]
mov rcx, qword [rbp - 0x80]
inc eax
mov dword [rbp - 0x60], eax
add r15, 8
mov qword [rbp], r15
cdqe
cmp rax, 2
mov eax, dword [rbp - 0x60]
jb 0x1401c4590
lea r13, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov qword [rbp + 0xc0], r13
lea rax, str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWinlogon
mov qword [rbp + 0xc8], rax
mov r14d, ebx
mov dword [rsp + 0x70], ebx
lea r12, [rbp + 0xc0]
mov r15d, dword [rsp + 0x78]
lea r13, [0x140323de0]
nop dword [rax]
lea r9, str.Notify
lea r8, [0x1403232c8]
mov rdx, qword [r12]
lea rcx, [rbp + 0x720]
call fcn.1401e8af0
nop
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x720]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c4d22
mov dword [rbp + 0x2ac], ebx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
lea rax, [rbp + 0x2ac]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, ebx
cmp dword [rbp + 0x2ac], 0
jbe 0x1401c4d16
mov r15, qword [rbp - 0x80]
xor r14d, r14d
nop dword [rax]
mov r9d, 0x400
lea r8, [rbp + 0x4a30]
mov edx, edi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc edi
test eax, eax
jne 0x1401c4cf7
lea rax, [rbp + 0x7a0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x4a30]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c4cfe
mov dword [rbp + 0x658], 0x800
lea rax, [rbp + 0x658]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xa230]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.DLLName
mov rcx, qword [rbp + 0x7a0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401c4ce8
lea rax, [rbp + 0xa230]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401c4b42
mov qword [rbp + 0x498], r14
test ebx, ebx
jne 0x1401c4b60
mov qword [rbp + 0x490], r13
jmp 0x1401c4b8f
mov edx, ebx
lea rcx, [rbp + 0x490]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rbp + 0x498]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0xa230]
mov rcx, qword [rbp + 0x490]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x490]
call fcn.1401ea290
nop
lea rdx, [rbp + 0x490]
call fcn.1401c36c0
mov r8b, 1
lea rdx, [rbp + 0x490]
mov rcx, qword [r15 + 8]
call fcn.1400f9eb0
mov rsi, rax
test rax, rax
je 0x1401c4cd3
mov qword [rbp + 0x1c8], r14
mov edx, 5
lea rcx, [rbp + 0x1c0]
call fcn.1401e9030
mov ecx, dword [rbp + 0x1c8]
inc ecx
movsxd rdx, ecx
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x1c0]
call fcn.14029b4d8
mov edx, 5
lea rcx, [rbp + 0x1c0]
call fcn.1401ea290
nop
mov ebx, dword [rbp + 0x72c]
add ebx, dword [rbp + 0x1cc]
mov edx, ebx
lea rcx, [rbp + 0x1c0]
call fcn.1401e9030
movsxd r9, dword [rbp + 0x72c]
mov ecx, dword [rbp + 0x1c8]
movsxd rax, dword [rbp + 0x1cc]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x1c0]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x720]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x1c0]
call fcn.1401ea290
lea rdx, [0x1403232c8]
lea rcx, [rbp + 0x1c0]
call fcn.1401e7680
lea rdx, [rbp + 0x4a30]
lea rcx, [rbp + 0x1c0]
call fcn.1401e7680
lea rdx, [0x1403232c8]
lea rcx, [rbp + 0x1c0]
call fcn.1401e7680
lea rdx, [rbp + 0x1c0]
mov rcx, rsi
call fcn.1400ed120
nop
cmp dword [rbp + 0x1c8], 0
jle 0x1401c4cd3
mov rcx, qword [rbp + 0x1c0]
call fcn.140298600
nop
cmp dword [rbp + 0x498], 0
jle 0x1401c4ce8
mov rcx, qword [rbp + 0x490]
call fcn.140298600
mov rcx, qword [rbp + 0x7a0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1401c4cfe
cmp eax, 0x103
je 0x1401c4d0a
cmp edi, dword [rbp + 0x2ac]
jb 0x1401c4aa0
mov r15d, dword [rsp + 0x78]
mov r14d, dword [rsp + 0x70]
xor ebx, ebx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0x728], 0
jle 0x1401c4d37
mov rcx, qword [rbp + 0x720]
call fcn.140298600
inc r14d
mov dword [rsp + 0x70], r14d
add r12, 8
movsxd rax, r14d
cmp rax, 2
jb 0x1401c49f0
mov qword [rbp + 0x380], rbx
mov qword [rbp + 0x388], rbx
call fcn.14014ced0
mov qword [rbp + 0x380], rax
lea r13, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
mov qword [rbp + 0xd0], r13
lea rax, str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWinlogon
mov qword [rbp + 0xd8], rax
mov ecx, ebx
mov dword [rsp + 0x60], ebx
mov rax, rbx
mov qword [rbp], rbx
mov r14, qword [rbp - 0x80]
nop word [rax + rax]
mov r12, qword [rbp + rax*8 + 0xd0]
mov qword [rbp + 0xc0], r12
mov esi, ebx
mov dword [rsp + 0x70], ebx
mov r13, rbx
mov qword [rbp - 0x68], rbx
cmp dword [r14 + 0x18], 0
jl 0x1401c5850
nop word [rax + rax]
lea rax, [0x140323de0]
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0xf0], 0
test r13, r13
jne 0x1401c4e61
mov rdi, 0xffffffff80000002
mov qword [rbp + 0xe0], rdi
test r12, r12
je 0x1401c4f07
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [r12 + rbx*2], 0
jne 0x1401c4e10
test ebx, ebx
jle 0x1401c4f05
mov edx, ebx
lea rcx, [rbp + 0xe8]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rbp + 0xf0]
inc eax
movsxd rdx, eax
mov r8, r12
mov rcx, qword [rbp + 0xe8]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0xe8]
call fcn.1401ea290
jmp 0x1401c4f05
mov rdi, 0xffffffff80000003
mov qword [rbp + 0xe0], rdi
mov rbx, r13
shl rbx, 4
add rbx, qword [r14 + 0x20]
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0xe8]
call fcn.1401e9030
movsxd r9, dword [rbx - 4]
mov eax, dword [rbp + 0xf0]
inc eax
movsxd rdx, eax
mov r8, qword [rbx - 0x10]
mov rcx, qword [rbp + 0xe8]
call fcn.14029b4d8
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0xe8]
call fcn.1401ea290
mov edx, dword [rbp + 0xf4]
inc edx
lea rcx, [rbp + 0xe8]
call fcn.1401e9030
movsxd rcx, dword [rbp + 0xf4]
mov rax, qword [rbp + 0xe8]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0xf4]
inc edx
lea rcx, [rbp + 0xe8]
call fcn.1401ea290
mov rdx, r12
lea rcx, [rbp + 0xe8]
call fcn.1401e7680
xor ebx, ebx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0xe8]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c581c
mov r14d, ebx
mov dword [rbp - 0x60], ebx
mov r12, rbx
mov qword [rbp - 0x48], rbx
nop
mov dword [rbp + 0x70c], 0x800
lea rax, [rbp + 0x70c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xb230]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rax, str.Shell
mov rdx, qword [rax + r12*8]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401c57e3
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x9d8], xmm0
mov qword [rbp + 0x9e8], rbx
lea rax, [rbp + 0xb230]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401c4fa3
xor eax, eax
mov qword [rbp + 0x560], rax
test ebx, ebx
jne 0x1401c4fca
lea rax, [0x140323de0]
mov qword [rbp + 0x558], rax
jmp 0x1401c4ff9
mov edx, ebx
lea rcx, [rbp + 0x558]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rbp + 0x560]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0xb230]
mov rcx, qword [rbp + 0x558]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x558]
call fcn.1401ea290
nop
lea rdx, [rbp + 0x9d8]
lea rcx, [rbp + 0x558]
call fcn.1401c0840
mov ebx, eax
cmp dword [rbp + 0x560], 0
jle 0x1401c5032
mov rcx, qword [rbp + 0x558]
call fcn.140298600
mov rdi, qword [rbp + 0x9e0]
test ebx, ebx
je 0x1401c579a
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xa08], xmm0
xor ecx, ecx
mov r14d, ecx
mov qword [rbp + 0xa18], rcx
mov r12, rdi
mov rsi, qword [rbp + 0x9d8]
sub r12, rsi
sar r12, 4
mov rdi, qword [rbp + 0xa10]
mov r13, qword [rbp + 0xa08]
test r12, r12
je 0x1401c528c
add rsi, 0xc
xor r15d, r15d
nop word [rax + rax]
mov qword [rbp + 0x1b8], r15
mov edx, dword [rsi]
test edx, edx
jne 0x1401c50ad
lea rbx, [0x140323de0]
mov qword [rbp + 0x1b0], rbx
jmp 0x1401c50de
lea rcx, [rbp + 0x1b0]
call fcn.1401e9030
movsxd r9, dword [rsi]
mov eax, dword [rbp + 0x1b8]
inc eax
movsxd rdx, eax
mov r8, qword [rsi - 0xc]
mov rcx, qword [rbp + 0x1b0]
call fcn.14029b4d8
lea rbx, [0x140323de0]
mov edx, dword [rsi]
lea rcx, [rbp + 0x1b0]
call fcn.1401ea290
nop
cmp dword [rbp + 0x1bc], 1
jl 0x1401c511c
mov r8d, 1
lea rdx, [0x140329d94]
mov rcx, qword [rbp + 0x1b0]
call fcn.14029ca28
test eax, eax
sete al
test al, al
jne 0x1401c5265
lea rdx, [rbp + 0x1b0]
call fcn.1401c36c0
lea rax, [rbp + 0x1b0]
cmp rax, rdi
jae 0x1401c51d9
lea rax, [rbp + 0x1b0]
cmp r13, rax
ja 0x1401c51d9
lea rbx, [rbp + 0x1b0]
sub rbx, r13
cmp rdi, r14
jne 0x1401c5178
lea rcx, [rbp + 0xa08]
call fcn.1400c8900
mov r14, qword [rbp + 0xa18]
mov rdi, qword [rbp + 0xa10]
mov r13, qword [rbp + 0xa08]
and rbx, 0xfffffffffffffff0
add rbx, r13
mov qword [rbp + 0x7d8], rdi
mov qword [rbp + 0x88], rdi
test rdi, rdi
je 0x1401c51d4
mov qword [rdi + 8], r15
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x1401c51a9
lea rax, [0x140323de0]
mov qword [rdi], rax
jmp 0x1401c51c8
mov rcx, rdi
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rdi + 8]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rdi]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
mov rcx, rdi
call fcn.1401ea290
nop
jmp 0x1401c525a
cmp rdi, r14
jne 0x1401c51ff
lea rcx, [rbp + 0xa08]
call fcn.1400c8900
mov r14, qword [rbp + 0xa18]
mov rdi, qword [rbp + 0xa10]
mov r13, qword [rbp + 0xa08]
mov qword [rbp + 0x7d8], rdi
mov qword [rbp + 0x88], rdi
test rdi, rdi
je 0x1401c525a
mov qword [rdi + 8], r15
mov edx, dword [rbp + 0x1bc]
test edx, edx
jne 0x1401c5225
mov qword [rdi], rbx
jmp 0x1401c524b
mov rcx, rdi
call fcn.1401e9030
movsxd r9, dword [rbp + 0x1bc]
mov eax, dword [rdi + 8]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x1b0]
mov rcx, qword [rdi]
call fcn.14029b4d8
mov edx, dword [rbp + 0x1bc]
mov rcx, rdi
call fcn.1401ea290
nop
add rdi, 0x10
mov qword [rbp + 0xa10], rdi
cmp dword [rbp + 0x1b8], 0
jle 0x1401c527a
mov rcx, qword [rbp + 0x1b0]
call fcn.140298600
add rsi, 0x10
dec r12
jne 0x1401c5090
mov r15d, dword [rsp + 0x78]
mov rax, rdi
sub rax, r13
sar rax, 4
test rax, rax
je 0x1401c573a
lea r12, [r13 + 0xc]
mov rbx, rax
mov qword [rbp + 0x88], rax
mov r13, rax
mov rdi, qword [rbp + 0xe0]
nop word [rax + rax]
mov qword [rbp + 0x378], 0
mov edx, dword [r12]
test edx, edx
jne 0x1401c52e3
lea rax, [0x140323de0]
mov qword [rbp + 0x370], rax
jmp 0x1401c530f
lea rcx, [rbp + 0x370]
call fcn.1401e9030
movsxd r9, dword [r12]
mov eax, dword [rbp + 0x378]
inc eax
movsxd rdx, eax
mov r8, qword [r12 - 0xc]
mov rcx, qword [rbp + 0x370]
call fcn.14029b4d8
mov edx, dword [r12]
lea rcx, [rbp + 0x370]
call fcn.1401ea290
nop
mov r8b, 1
lea rdx, [rbp + 0x370]
mov rax, qword [rbp - 0x80]
mov rcx, qword [rax + 8]
call fcn.1400f9eb0
mov r14, rax
test rax, rax
je 0x1401c5703
lea rsi, [0x1403232e0]
cmp rdi, 0xffffffff80000002
lea rax, [0x1403232e8]
cmove rsi, rax
test rsi, rsi
jne 0x1401c536b
xor eax, eax
mov ebx, eax
mov qword [rbp - 0x38], rax
jmp 0x1401c5384
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1401c5370
xor eax, eax
mov qword [rbp - 0x38], rax
test ebx, ebx
jne 0x1401c5391
lea rax, [0x140323de0]
mov qword [rbp - 0x40], rax
jmp 0x1401c53b3
mov edx, ebx
lea rcx, [rbp - 0x40]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rbp - 0x38]
inc eax
movsxd rdx, eax
mov r8, rsi
mov rcx, qword [rbp - 0x40]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp - 0x40]
call fcn.1401ea290
nop
mov edx, dword [rbp - 0x34]
inc edx
lea rcx, [rbp - 0x40]
call fcn.1401e9030
movsxd rcx, dword [rbp - 0x34]
mov rax, qword [rbp - 0x40]
mov esi, 0x5c
mov word [rax + rcx*2], si
mov edx, dword [rbp - 0x34]
inc edx
lea rcx, [rbp - 0x40]
call fcn.1401ea290
mov ebx, dword [rbp - 0x34]
add ebx, dword [rbp + 0xf4]
mov edx, ebx
lea rcx, [rbp - 0x40]
call fcn.1401e9030
movsxd r9, dword [rbp + 0xf4]
mov ecx, dword [rbp - 0x38]
movsxd rax, dword [rbp - 0x34]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp - 0x40]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0xe8]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp - 0x40]
call fcn.1401ea290
mov edx, dword [rbp - 0x34]
inc edx
lea rcx, [rbp - 0x40]
call fcn.1401e9030
movsxd rcx, dword [rbp - 0x34]
mov rax, qword [rbp - 0x40]
mov word [rax + rcx*2], si
mov edx, dword [rbp - 0x34]
inc edx
lea rcx, [rbp - 0x40]
call fcn.1401ea290
mov rsi, qword [rbp - 0x48]
lea rax, str.Shell
mov rdx, qword [rax + rsi*8]
lea rcx, [rbp - 0x40]
call fcn.1401e7680
lea rdx, [rbp + 0x370]
lea rcx, [rbp + 0x968]
call fcn.1400d2fb0
nop
xor r8d, r8d
lea rdx, str.cmd.exe
mov rcx, rax
call fcn.1401e9310
movzx ebx, al
cmp dword [rbp + 0x970], 0
jle 0x1401c54b5
mov rcx, qword [rbp + 0x968]
call fcn.140298600
test bl, bl
je 0x1401c567b
cmp rdi, 0xffffffff80000002
jne 0x1401c5520
xor eax, eax
mov qword [rbp + 0x590], rax
lea edx, [rax + 4]
lea rcx, [rbp + 0x588]
call fcn.1401e9030
mov eax, dword [rbp + 0x590]
inc eax
movsxd rdx, eax
mov r9d, 4
lea r8, [0x1403232e8]
mov rcx, qword [rbp + 0x588]
call fcn.14029b4d8
mov edx, 4
lea rcx, [rbp + 0x588]
call fcn.1401ea290
lea rbx, [rbp + 0x588]
or r15d, 1
jmp 0x1401c554f
mov eax, dword [rsp + 0x70]
dec eax
movsxd r8, eax
shl r8, 4
mov rax, qword [rbp - 0x80]
add r8, qword [rax + 0x20]
lea rdx, str.HKU_
lea rcx, [rbp + 0x868]
call fcn.1401e7ba0
mov rbx, rax
or r15d, 2
mov dword [rsp + 0x78], r15d
xor eax, eax
mov qword [rbp + 0x500], rax
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x1401c5574
lea rax, [0x140323de0]
mov qword [rbp + 0x4f8], rax
jmp 0x1401c559e
lea rcx, [rbp + 0x4f8]
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rbp + 0x500]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x4f8]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x4f8]
call fcn.1401ea290
nop
test r15b, 2
je 0x1401c55d3
and r15d, 0xfffffffd
mov dword [rsp + 0x78], r15d
cmp dword [rbp + 0x870], 0
jle 0x1401c55d3
mov rcx, qword [rbp + 0x868]
call fcn.140298600
nop
test r15b, 1
je 0x1401c55f7
and r15d, 0xfffffffe
mov dword [rsp + 0x78], r15d
cmp dword [rbp + 0x590], 0
jle 0x1401c55f7
mov rcx, qword [rbp + 0x588]
call fcn.140298600
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0x4f8]
lea rcx, [rbp + 0x9a8]
call fcn.1400e9ab0
nop
mov rdx, rax
lea rcx, [rbp + 0x380]
call fcn.14014cf10
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0xac0]
lea rcx, [rbp + 0x380]
call fcn.1401bdaa0
nop
cmp dword [rbp + 0x9c0], 0
jle 0x1401c5650
mov rcx, qword [rbp + 0x9b8]
call fcn.140298600
cmp dword [rbp + 0x9b0], 0
jle 0x1401c5666
mov rcx, qword [rbp + 0x9a8]
call fcn.140298600
nop
cmp dword [rbp + 0x500], 0
jle 0x1401c567b
mov rcx, qword [rbp + 0x4f8]
call fcn.140298600
lea rdx, [rbp - 0x40]
mov rcx, r14
call fcn.1400ed120
cmp r13, 2
jb 0x1401c56ed
lea rdx, str.shell
lea rbx, str.Shell
mov rcx, qword [rbx + rsi*8]
call fcn.14029848c
test eax, eax
jne 0x1401c56b1
lea rdx, [0x1403286e0]
jmp 0x1401c56cc
lea rdx, str.userinit
mov rcx, qword [rbx + rsi*8]
call fcn.14029848c
test eax, eax
jne 0x1401c56ed
lea rdx, str.userinit.exe
xor r8d, r8d
lea rcx, [rbp + 0x370]
call fcn.1401e8ee0
test al, al
jne 0x1401c56ed
movabs rax, 0x1000000000000
or qword [r14 + 0x40], rax
cmp dword [rbp - 0x38], 0
jle 0x1401c56fc
mov rcx, qword [rbp - 0x40]
call fcn.140298600
mov rbx, qword [rbp + 0x88]
cmp dword [rbp + 0x378], 0
jle 0x1401c5718
mov rcx, qword [rbp + 0x370]
call fcn.140298600
add r12, 0x10
dec rbx
mov qword [rbp + 0x88], rbx
jne 0x1401c52c0
mov rdi, qword [rbp + 0xa10]
mov r13, qword [rbp + 0xa08]
test r13, r13
je 0x1401c578b
mov rbx, r13
cmp r13, rdi
je 0x1401c575e
cmp dword [rbx + 8], 0
jle 0x1401c5755
mov rcx, qword [rbx]
call fcn.140298600
add rbx, 0x10
cmp rbx, rdi
jne 0x1401c5747
mov rcx, r13
call fcn.1402012c0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xa08], xmm0
xor ebx, ebx
mov qword [rbp + 0xa18], rbx
mov rdi, qword [rbp + 0x9e0]
mov r14d, dword [rbp - 0x60]
mov r12, qword [rbp - 0x48]
jmp 0x1401c579c
mov rdi, qword [rbp + 0x9e0]
mov r14d, dword [rbp - 0x60]
mov r12, qword [rbp - 0x48]
xor ebx, ebx
mov rsi, qword [rbp + 0x9d8]
test rsi, rsi
je 0x1401c57e3
mov rbx, rsi
cmp rsi, rdi
je 0x1401c57c7
cmp dword [rbx + 8], 0
jle 0x1401c57be
mov rcx, qword [rbx]
call fcn.140298600
add rbx, 0x10
cmp rbx, rdi
jne 0x1401c57b0
mov rcx, rsi
call fcn.1402012c0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x9d8], xmm0
xor ebx, ebx
mov qword [rbp + 0x9e8], rbx
inc r14d
mov dword [rbp - 0x60], r14d
inc r12
mov qword [rbp - 0x48], r12
movsxd rax, r14d
cmp rax, 4
jb 0x1401c4f40
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [rsp + 0x70]
mov r14, qword [rbp - 0x80]
mov r12, qword [rbp + 0xc0]
mov r13, qword [rbp - 0x68]
cmp dword [rbp + 0xf0], 0
jle 0x1401c5831
mov rcx, qword [rbp + 0xe8]
call fcn.140298600
inc esi
mov dword [rsp + 0x70], esi
inc r13
mov qword [rbp - 0x68], r13
cmp esi, dword [r14 + 0x18]
jle 0x1401c4dd0
mov rax, qword [rbp]
mov ecx, dword [rsp + 0x60]
inc ecx
mov dword [rsp + 0x60], ecx
inc rax
mov qword [rbp], rax
movsxd rax, ecx
cmp rax, 2
mov rax, qword [rbp]
jb 0x1401c4da0
lea rax, str.SOFTWAREMicrosoftCommand_Processor
mov qword [rbp + 0xd0], rax
lea rax, str.SOFTWAREWow6432NodeMicrosoftCommand_Processor
mov qword [rbp + 0xd8], rax
mov ecx, ebx
mov dword [rsp + 0x60], ebx
lea rax, [rbp + 0xd0]
mov qword [rbp + 0x88], rax
mov rsi, qword [rbp - 0x80]
mov r12, qword [rax]
mov r13d, ebx
mov rdi, rbx
mov qword [rbp], rbx
cmp dword [rsi + 0x18], 0
jl 0x1401c5e91
nop dword [rax]
lea rax, [0x140323de0]
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], 0
test rdi, rdi
jne 0x1401c5943
mov r14, 0xffffffff80000002
test r12, r12
je 0x1401c59e0
or rbx, 0xffffffffffffffff
inc rbx
cmp word [r12 + rbx*2], 0
jne 0x1401c58f2
test ebx, ebx
jle 0x1401c59e0
mov edx, ebx
lea rcx, [rbp + 0x100]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rbp + 0x108]
inc eax
movsxd rdx, eax
mov r8, r12
mov rcx, qword [rbp + 0x100]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x100]
call fcn.1401ea290
jmp 0x1401c59e0
mov r14, 0xffffffff80000003
mov rbx, rdi
shl rbx, 4
add rbx, qword [rsi + 0x20]
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0x100]
call fcn.1401e9030
movsxd r9, dword [rbx - 4]
mov eax, dword [rbp + 0x108]
inc eax
movsxd rdx, eax
mov r8, qword [rbx - 0x10]
mov rcx, qword [rbp + 0x100]
call fcn.14029b4d8
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0x100]
call fcn.1401ea290
mov edx, dword [rbp + 0x10c]
inc edx
lea rcx, [rbp + 0x100]
call fcn.1401e9030
movsxd rcx, dword [rbp + 0x10c]
mov rax, qword [rbp + 0x100]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x10c]
inc edx
lea rcx, [rbp + 0x100]
call fcn.1401ea290
mov rdx, r12
lea rcx, [rbp + 0x100]
call fcn.1401e7680
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x100]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c5e5b
mov dword [rbp + 0x660], 0x800
lea rax, [rbp + 0x660]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x5230]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.AutoRun
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401c5e4f
lea rax, [rbp + 0x5230]
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401c5a60
xor eax, eax
mov qword [rbp + 0x478], rax
test ebx, ebx
jne 0x1401c5a87
lea rax, [0x140323de0]
mov qword [rbp + 0x470], rax
jmp 0x1401c5ab6
mov edx, ebx
lea rcx, [rbp + 0x470]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rbp + 0x478]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x5230]
mov rcx, qword [rbp + 0x470]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x470]
call fcn.1401ea290
nop
lea rdx, [rbp + 0x470]
call fcn.1401c36c0
mov r8b, 1
lea rdx, [rbp + 0x470]
mov rcx, qword [rsi + 8]
call fcn.1400f9eb0
mov rsi, rax
test rax, rax
je 0x1401c5e36
lea rdi, [0x1403232e0]
cmp r14, 0xffffffff80000002
lea rax, [0x1403232e8]
cmove rdi, rax
test rdi, rdi
jne 0x1401c5b18
xor eax, eax
mov ebx, eax
mov qword [rbp - 0x18], rax
jmp 0x1401c5b34
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x1401c5b20
xor eax, eax
mov qword [rbp - 0x18], rax
test ebx, ebx
jne 0x1401c5b41
lea rax, [0x140323de0]
mov qword [rbp - 0x20], rax
jmp 0x1401c5b63
mov edx, ebx
lea rcx, [rbp - 0x20]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rbp - 0x18]
inc eax
movsxd rdx, eax
mov r8, rdi
mov rcx, qword [rbp - 0x20]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp - 0x20]
call fcn.1401ea290
nop
mov edx, dword [rbp - 0x14]
inc edx
lea rcx, [rbp - 0x20]
call fcn.1401e9030
movsxd rcx, dword [rbp - 0x14]
mov rax, qword [rbp - 0x20]
mov edi, 0x5c
mov word [rax + rcx*2], di
mov edx, dword [rbp - 0x14]
inc edx
lea rcx, [rbp - 0x20]
call fcn.1401ea290
mov ebx, dword [rbp - 0x14]
add ebx, dword [rbp + 0x10c]
mov edx, ebx
lea rcx, [rbp - 0x20]
call fcn.1401e9030
movsxd r9, dword [rbp + 0x10c]
mov ecx, dword [rbp - 0x18]
movsxd rax, dword [rbp - 0x14]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp - 0x20]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x100]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp - 0x20]
call fcn.1401ea290
mov edx, dword [rbp - 0x14]
inc edx
lea rcx, [rbp - 0x20]
call fcn.1401e9030
movsxd rcx, dword [rbp - 0x14]
mov rax, qword [rbp - 0x20]
mov word [rax + rcx*2], di
mov edx, dword [rbp - 0x14]
inc edx
lea rcx, [rbp - 0x20]
call fcn.1401ea290
lea rdx, str.AutoRun
lea rcx, [rbp - 0x20]
call fcn.1401e7680
lea rdx, [rbp - 0x20]
mov rcx, rsi
call fcn.1400ed120
cmp r14, 0xffffffff80000002
jne 0x1401c5c8a
xor edi, edi
mov qword [rbp + 0x5a0], rdi
lea edx, [rdi + 4]
lea rcx, [rbp + 0x598]
call fcn.1401e9030
mov eax, dword [rbp + 0x5a0]
inc eax
movsxd rdx, eax
lea r9d, [rdi + 4]
lea r8, [0x1403232e8]
mov rcx, qword [rbp + 0x598]
call fcn.14029b4d8
lea edx, [rdi + 4]
lea rcx, [rbp + 0x598]
call fcn.1401ea290
lea rbx, [rbp + 0x598]
or r15d, 4
jmp 0x1401c5cb7
lea eax, [r13 - 1]
movsxd r8, eax
shl r8, 4
mov rax, qword [rbp - 0x80]
add r8, qword [rax + 0x20]
lea rdx, str.HKU_
lea rcx, [rbp + 0x908]
call fcn.1401e7ba0
mov rbx, rax
or r15d, 8
mov dword [rsp + 0x78], r15d
mov qword [rbp + 0x438], 0
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x1401c5cde
lea rax, [0x140323de0]
mov qword [rbp + 0x430], rax
jmp 0x1401c5d08
lea rcx, [rbp + 0x430]
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rbp + 0x438]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x430]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x430]
call fcn.1401ea290
nop
test r15b, 8
je 0x1401c5d3d
and r15d, 0xfffffff7
mov dword [rsp + 0x78], r15d
cmp dword [rbp + 0x910], 0
jle 0x1401c5d3d
mov rcx, qword [rbp + 0x908]
call fcn.140298600
nop
test r15b, 4
je 0x1401c5d61
and r15d, 0xfffffffb
mov dword [rsp + 0x78], r15d
cmp dword [rbp + 0x5a0], 0
jle 0x1401c5d61
mov rcx, qword [rbp + 0x598]
call fcn.140298600
mov rax, qword [rbp + 0x380]
mov rbx, qword [rax + 8]
mov rdi, rax
cmp byte [rbx + 0x19], 0
jne 0x1401c5ddd
nop word [rax + rax]
mov rdx, qword [rbp + 0x430]
mov rcx, qword [rbx + 0x20]
call fcn.14029848c
test eax, eax
jns 0x1401c5d9a
mov rbx, qword [rbx + 0x10]
jmp 0x1401c5da0
mov rdi, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x1401c5d80
mov rax, qword [rbp + 0x380]
cmp rdi, rax
je 0x1401c5ddd
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rbp + 0x430]
call fcn.14029848c
test eax, eax
mov rax, qword [rbp + 0x380]
js 0x1401c5ddd
mov qword [rbp + 0x830], rdi
lea rdx, [rbp + 0x830]
jmp 0x1401c5deb
mov qword [rbp + 0x828], rax
lea rdx, [rbp + 0x828]
mov rdx, qword [rdx]
cmp rdx, rax
je 0x1401c5e0d
add rdx, 0x30
mov rcx, rsi
call fcn.1400ed120
movabs rax, 0x1000000000000
or qword [rsi + 0x40], rax
cmp dword [rbp + 0x438], 0
jle 0x1401c5e23
mov rcx, qword [rbp + 0x430]
call fcn.140298600
nop
cmp dword [rbp - 0x18], 0
jle 0x1401c5e32
mov rcx, qword [rbp - 0x20]
call fcn.140298600
mov rdi, qword [rbp]
cmp dword [rbp + 0x478], 0
jle 0x1401c5e4b
mov rcx, qword [rbp + 0x470]
call fcn.140298600
mov rsi, qword [rbp - 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0x108], 0
jle 0x1401c5e70
mov rcx, qword [rbp + 0x100]
call fcn.140298600
inc r13d
inc rdi
mov qword [rbp], rdi
cmp r13d, dword [rsi + 0x18]
jle 0x1401c58c0
mov rax, qword [rbp + 0x88]
mov ecx, dword [rsp + 0x60]
xor ebx, ebx
inc ecx
mov dword [rsp + 0x60], ecx
add rax, 8
mov qword [rbp + 0x88], rax
movsxd rax, ecx
cmp rax, 2
mov rax, qword [rbp + 0x88]
jb 0x1401c58a2
mov edx, 0x3b
lea rcx, [rbp - 0x78]
call fcn.1401e9030
mov eax, dword [rbp - 0x70]
inc eax
movsxd rdx, eax
mov r9d, 0x3b
lea r8, str.SYSTEMCurrentControlSetControlSession_ManagerSubSystems
mov rcx, qword [rbp - 0x78]
call fcn.14029b4d8
mov edx, 0x3b
lea rcx, [rbp - 0x78]
call fcn.1401ea290
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp - 0x78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c6251
mov dword [rbp + 0x690], 0x800
lea rax, [rbp + 0x690]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x5a30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14032c748]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401c6246
lea rax, [rbp + 0x5a30]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401c5f70
xor r14d, r14d
mov qword [rbp + 0x358], r14
test ebx, ebx
jne 0x1401c5f98
lea r13, [0x140323de0]
mov qword [rbp + 0x350], r13
jmp 0x1401c5fce
mov edx, ebx
lea rcx, [rbp + 0x350]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rbp + 0x358]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x5a30]
mov rcx, qword [rbp + 0x350]
call fcn.14029b4d8
lea r13, [0x140323de0]
mov edx, ebx
lea rcx, [rbp + 0x350]
call fcn.1401ea290
nop
mov edi, r14d
movabs r12, 0x400100100000000
mov r15, qword [rbp - 0x80]
nop
mov r9d, dword [rbp + 0x35c]
sub r9d, edi
mov dword [rsp + 0x20], r14d
mov r8d, edi
lea rdx, str._ServerDll
lea rcx, [rbp + 0x350]
call fcn.1401e9a80
mov edi, eax
test eax, eax
jle 0x1401c6229
add edi, 0xb
mov rsi, qword [0x1403ec168]
test rsi, rsi
jne 0x1401c603a
mov ebx, r14d
mov qword [rbp + 0x198], r14
jmp 0x1401c6055
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x1401c6040
mov qword [rbp + 0x198], r14
test ebx, ebx
jne 0x1401c605e
mov qword [rbp + 0x190], r13
jmp 0x1401c6089
mov edx, ebx
lea rcx, [rbp + 0x190]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rbp + 0x198]
inc eax
movsxd rdx, eax
mov r8, rsi
mov rcx, qword [rbp + 0x190]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x190]
call fcn.1401ea290
nop
cmp edi, dword [rbp + 0x35c]
jge 0x1401c6101
mov edx, edi
lea rcx, [rbp + 0x350]
call fcn.1401e7500
movzx ebx, ax
inc edi
cmp ax, 0x3a
ja 0x1401c60bf
bt r12, rbx
jb 0x1401c6101
mov edx, dword [rbp + 0x19c]
inc edx
lea rcx, [rbp + 0x190]
call fcn.1401e9030
movsxd rcx, dword [rbp + 0x19c]
mov rax, qword [rbp + 0x190]
mov word [rax + rcx*2], bx
mov edx, dword [rbp + 0x19c]
inc edx
lea rcx, [rbp + 0x190]
call fcn.1401ea290
cmp edi, dword [rbp + 0x35c]
jl 0x1401c60a0
cmp dword [rbp + 0x19c], 0
jle 0x1401c6214
lea rdx, [rbp + 0x190]
call fcn.1401c36c0
mov r8b, 1
lea rdx, [rbp + 0x190]
mov rcx, qword [r15 + 8]
call fcn.1400f9eb0
mov rsi, rax
test rax, rax
je 0x1401c6214
mov qword [rbp + 0x2c0], r14
mov edx, 5
lea rcx, [rbp + 0x2b8]
call fcn.1401e9030
mov ecx, dword [rbp + 0x2c0]
inc ecx
movsxd rdx, ecx
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x2b8]
call fcn.14029b4d8
mov edx, 5
lea rcx, [rbp + 0x2b8]
call fcn.1401ea290
nop
mov ebx, dword [rbp + 0x2c4]
add ebx, dword [rbp - 0x6c]
mov edx, ebx
lea rcx, [rbp + 0x2b8]
call fcn.1401e9030
movsxd r9, dword [rbp - 0x6c]
mov ecx, dword [rbp + 0x2c0]
movsxd rax, dword [rbp + 0x2c4]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x2b8]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp - 0x78]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x2b8]
call fcn.1401ea290
lea rdx, [0x14033f120]
lea rcx, [rbp + 0x2b8]
call fcn.1401e7680
lea rdx, [rbp + 0x2b8]
mov rcx, rsi
call fcn.1400ed120
nop
cmp dword [rbp + 0x2c0], 0
jle 0x1401c6214
mov rcx, qword [rbp + 0x2b8]
call fcn.140298600
nop
cmp dword [rbp + 0x198], 0
jle 0x1401c6229
mov rcx, qword [rbp + 0x190]
call fcn.140298600
test edi, edi
jns 0x1401c5ff0
cmp dword [rbp + 0x358], 0
jle 0x1401c6246
mov rcx, qword [rbp + 0x350]
call fcn.140298600
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
mov qword [rbp + 0xd0], rax
lea rax, str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionWindows
mov qword [rbp + 0xd8], rax
xor esi, esi
mov r12d, esi
lea r13, [rbp + 0xd0]
nop dword [rax]
mov r14, qword [r13]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r14
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c6592
mov word [rbp + 0x8230], si
xor edx, edx
mov r8d, 0x7fe
lea rcx, [rbp + 0x8232]
call fcn.1402a04b0
mov dword [rbp + 0x65c], 0x800
lea rax, [rbp + 0x65c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x8230]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14033f270]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401c6587
lea rdi, [rbp + 0x8230]
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x14032862c]
mov rcx, rdi
call fcn.14029ca54
mov rsi, rax
mov r8, rdi
mov edx, 0x400
lea rcx, [rbp + 0x1e30]
test rax, rax
je 0x1401c6379
mov rbx, rax
sub rbx, rdi
sar rbx, 1
mov r9, rbx
call fcn.14029ca8c
add rbx, rbx
cmp rbx, 0x800
jae 0x1401c65a7
xor eax, eax
mov word [rbp + rbx + 0x1e30], ax
lea rdi, [rsi + 2]
xor esi, esi
jmp 0x1401c6382
call fcn.1402980d8
xor esi, esi
mov edi, esi
lea rcx, [rbp + 0x1e30]
or rdx, 0xffffffffffffffff
mov rax, rdx
inc rax
cmp word [rcx + rax*2], 0
jne 0x1401c6390
test rax, rax
je 0x1401c657e
lea rax, [rbp + 0x1e30]
mov rbx, rdx
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401c63b0
mov qword [rbp + 0x4c0], 0
test ebx, ebx
jne 0x1401c63d9
lea rax, [0x140323de0]
mov qword [rbp + 0x4b8], rax
jmp 0x1401c6408
mov edx, ebx
lea rcx, [rbp + 0x4b8]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rbp + 0x4c0]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1e30]
mov rcx, qword [rbp + 0x4b8]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x4b8]
call fcn.1401ea290
nop
lea rdx, [rbp + 0x4b8]
call fcn.1401c36c0
lea rax, [rbp + 0x1e30]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401c6430
mov qword [rbp + 0x540], 0
test ebx, ebx
jne 0x1401c6459
lea rax, [0x140323de0]
mov qword [rbp + 0x538], rax
jmp 0x1401c6488
mov edx, ebx
lea rcx, [rbp + 0x538]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rbp + 0x540]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1e30]
mov rcx, qword [rbp + 0x538]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x538]
call fcn.1401ea290
nop
mov r8b, 1
lea rdx, [rbp + 0x538]
mov rax, qword [rbp - 0x80]
mov rcx, qword [rax + 8]
call fcn.1400f9eb0
mov rbx, rax
cmp dword [rbp + 0x540], 0
jle 0x1401c64c6
mov rcx, qword [rbp + 0x538]
call fcn.140298600
test rbx, rbx
je 0x1401c6569
mov qword [rbp + 0x458], 0
mov edx, 5
lea rcx, [rbp + 0x450]
call fcn.1401e9030
mov eax, dword [rbp + 0x458]
inc eax
movsxd rdx, eax
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x450]
call fcn.14029b4d8
mov edx, 5
lea rcx, [rbp + 0x450]
call fcn.1401ea290
nop
mov rdx, r14
lea rcx, [rbp + 0x450]
call fcn.1401e7680
lea rdx, [0x14033f250]
lea rcx, [rbp + 0x450]
call fcn.1401e7680
lea rdx, [rbp + 0x450]
mov rcx, rbx
call fcn.1400ed120
nop
cmp dword [rbp + 0x458], 0
jle 0x1401c6569
mov rcx, qword [rbp + 0x450]
call fcn.140298600
nop
cmp dword [rbp + 0x4c0], 0
jle 0x1401c657e
mov rcx, qword [rbp + 0x4b8]
call fcn.140298600
test rdi, rdi
jne 0x1401c6320
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r12d
add r13, 8
movsxd rax, r12d
cmp rax, 2
jae 0x1401c65ad
jmp 0x1401c6280
call fcn.140299f18
int3
mov eax, dword [rbp + 0x7c0]
test eax, eax
jle 0x1401c68c1
mov r14, qword [rbp + 0x7c8]
mov r12d, eax
mov r15, qword [rbp - 0x80]
nop dword [rax]
mov r8, qword [r14]
lea rdx, str.SYSTEM_sControlSession_ManagerAppCertDlls
lea rcx, [rbp + 0x888]
call fcn.1401e94c0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp - 0x78]
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp - 0x70]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp - 0x78]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
lea rcx, [rbp - 0x78]
call fcn.1401ea290
nop
cmp dword [rbp + 0x890], 0
jle 0x1401c662f
mov rcx, qword [rbp + 0x888]
call fcn.140298600
mov eax, dword [0x1403fe608]
lea rbx, vtable.Core::Win32::RegistryKey.0
test al, 1
jne 0x1401c6667
or eax, 1
mov dword [0x1403fe608], eax
mov qword [0x1403fe5e0], rbx
mov qword [0x1403fe5e8], 0xffffffff80000002
lea rcx, [0x1402de040]
call fcn.140299c6c
mov qword [rbp + 0x788], rsi
lea rax, [rbp + 0x788]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp - 0x78]
mov rcx, qword [0x1403fe5e8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c68b4
lea ecx, [rax + 0x10]
call fcn.14029806c
mov rdi, rax
test rax, rax
je 0x1401c66bc
mov rax, qword [rbp + 0x788]
mov qword [rdi], rbx
mov qword [rdi + 8], rax
jmp 0x1401c66bf
mov rdi, rsi
test rdi, rdi
je 0x1401c68b4
lea rbx, [0x140323de0]
mov qword [rbp + 0x4c8], rbx
mov qword [rbp + 0x4d0], 0
lea r8, [rbp + 0x4c8]
lea rdx, str.AppSecDll
mov rcx, rdi
call fcn.1400d5720
test al, al
je 0x1401c6891
mov qword [rbp + 0x408], 0
mov edx, dword [rbp + 0x4d4]
test edx, edx
jne 0x1401c671d
mov qword [rbp + 0x400], rbx
jmp 0x1401c6754
lea rcx, [rbp + 0x400]
call fcn.1401e9030
movsxd r9, dword [rbp + 0x4d4]
mov eax, dword [rbp + 0x408]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x4c8]
mov rcx, qword [rbp + 0x400]
call fcn.14029b4d8
mov edx, dword [rbp + 0x4d4]
lea rcx, [rbp + 0x400]
call fcn.1401ea290
nop
lea rdx, [rbp + 0x400]
call fcn.1401c36c0
mov r8b, 1
lea rdx, [rbp + 0x400]
mov rcx, qword [r15 + 8]
call fcn.1400f9eb0
mov rsi, rax
test rax, rax
je 0x1401c687a
xor eax, eax
mov qword [rbp + 0x268], rax
lea edx, [rax + 5]
lea rcx, [rbp + 0x260]
call fcn.1401e9030
mov ecx, dword [rbp + 0x268]
inc ecx
movsxd rdx, ecx
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x260]
call fcn.14029b4d8
mov edx, 5
lea rcx, [rbp + 0x260]
call fcn.1401ea290
nop
mov ebx, dword [rbp + 0x26c]
add ebx, dword [rbp - 0x6c]
mov edx, ebx
lea rcx, [rbp + 0x260]
call fcn.1401e9030
movsxd r9, dword [rbp - 0x6c]
mov ecx, dword [rbp + 0x268]
movsxd rax, dword [rbp + 0x26c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x260]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp - 0x78]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x260]
call fcn.1401ea290
lea rdx, [0x1403232c8]
lea rcx, [rbp + 0x260]
call fcn.1401e7680
lea rdx, str.AppSecDll
lea rcx, [rbp + 0x260]
call fcn.1401e7680
lea rdx, [rbp + 0x260]
mov rcx, rsi
call fcn.1400ed120
nop
cmp dword [rbp + 0x268], 0
jle 0x1401c687a
mov rcx, qword [rbp + 0x260]
call fcn.140298600
nop
cmp dword [rbp + 0x408], 0
jle 0x1401c688f
mov rcx, qword [rbp + 0x400]
call fcn.140298600
xor esi, esi
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
nop
cmp dword [rbp + 0x4d0], 0
jle 0x1401c68b4
mov rcx, qword [rbp + 0x4c8]
call fcn.140298600
add r14, 0x10
dec r12
jne 0x1401c65d0
lea rax, str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
mov qword [rbp + 0xd0], rax
lea rax, str.SOFTWAREWow6432NodeMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
mov qword [rbp + 0xd8], rax
xor r14d, r14d
mov ebx, r14d
mov dword [rsp + 0x60], ebx
lea rdi, [rbp + 0xd0]
mov qword [rbp - 0x68], rdi
mov r13, qword [rdi]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r13
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c6e15
mov dword [rbp + 0x2c8], r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea rax, [rbp + 0x2c8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov r12d, r14d
cmp dword [rbp + 0x2c8], 0
jbe 0x1401c6e0a
mov r15, qword [rbp - 0x80]
nop dword [rax]
mov r9d, 0x400
lea r8, [rbp + 0x3a30]
mov edx, r12d
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc r12d
test eax, eax
jne 0x1401c6dee
lea edx, [rax + 0x2e]
lea rcx, [rbp + 0x3a30]
call fcn.14029b070
test rax, rax
je 0x1401c6df5
lea rax, [rbp + 0x7b0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x3a30]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c6ddf
mov dword [rbp + 0x648], 0x800
lea rax, [rbp + 0x648]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x6a30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14033c4a0]
mov rcx, qword [rbp + 0x7b0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401c6ddf
lea rax, [rbp + 0x6a30]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401c6a40
mov qword [rbp + 0x428], 0
test ebx, ebx
jne 0x1401c6a69
lea rax, [0x140323de0]
mov qword [rbp + 0x420], rax
jmp 0x1401c6a98
mov edx, ebx
lea rcx, [rbp + 0x420]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rbp + 0x428]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x6a30]
mov rcx, qword [rbp + 0x420]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x420]
call fcn.1401ea290
nop
lea rdx, [rbp + 0x420]
call fcn.1401c36c0
mov r8b, 1
lea rdx, [rbp + 0x420]
mov rcx, qword [r15 + 8]
call fcn.1400f9eb0
mov rbx, rax
test rax, rax
je 0x1401c6dca
mov qword [rbp + 0x348], 0
mov edx, 5
lea rcx, [rbp + 0x340]
call fcn.1401e9030
mov ecx, dword [rbp + 0x348]
inc ecx
movsxd rdx, ecx
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x340]
call fcn.14029b4d8
mov edx, 5
lea rcx, [rbp + 0x340]
call fcn.1401ea290
nop
mov rdx, r13
lea rcx, [rbp + 0x340]
call fcn.1401e7680
lea rdx, [0x1403232c8]
lea rcx, [rbp + 0x340]
call fcn.1401e7680
lea rdx, [rbp + 0x3a30]
lea rcx, [rbp + 0x340]
call fcn.1401e7680
lea rdx, str.Debugger
lea rcx, [rbp + 0x340]
call fcn.1401e7680
lea rdx, [rbp + 0x340]
mov rcx, rbx
call fcn.1400ed120
mov rbx, qword [r15 + 8]
mov eax, dword [0x1403ee430]
cmp eax, 0xffffffff
jne 0x1401c6bc1
call fcn.140112dc0
test al, al
je 0x1401c6b9f
mov dword [0x1403ee430], 1
jmp 0x1401c6bca
cmp qword [rbx + 0x2f0], 0
je 0x1401c6bb5
mov dword [0x1403ee430], 1
jmp 0x1401c6bca
mov dword [0x1403ee430], r14d
jmp 0x1401c6db4
cmp eax, 1
jne 0x1401c6db4
lea r8, str.ImageFileExecutionOptions
lea rdx, str.Policies__s_Title
lea rcx, [rbp + 0x988]
call fcn.1401e94c0
nop
mov rdx, rax
lea rcx, [rbp + 0x808]
call fcn.1400f6370
nop
cmp dword [rbp + 0x990], 0
jle 0x1401c6c0a
mov rcx, qword [rbp + 0x988]
call fcn.140298600
lea r8, [rbp + 0x3a30]
mov rdx, qword [rbp + 0x808]
lea rcx, [rbp + 0x818]
call fcn.1401e94c0
nop
mov ecx, 0x90
call fcn.14029806c
mov qword [rbp + 0xc0], rax
test rax, rax
je 0x1401c6c56
lea r9, [rbp + 0x818]
lea rdx, [rbp + 0x340]
mov rcx, rax
call fcn.1401e1d70
mov rbx, rax
jmp 0x1401c6c59
mov rbx, r14
lea rdx, [rbx + 8]
mov rcx, qword [r15 + 8]
call fcn.1401119b0
movzx edi, al
test al, al
sete r14b
movzx edx, r14b
mov rcx, rbx
call fcn.1400d4640
mov rdx, rbx
mov rcx, qword [r15 + 8]
call fcn.1400fa0f0
mov rcx, rbx
call fcn.1400d61e0
mov rsi, rax
mov rcx, rax
call fcn.1400e0450
mov dword [rsp + 0x70], 7
movzx edx, byte [0x1403fdd76]
mov byte [rsp + 0x20], dl
lea r9, [rsp + 0x70]
lea rdx, [rbp + 0xac0]
lea rcx, [rsi + 0x18]
call fcn.1400e06b0
mov dword [rsp + 0x70], 8
movzx edx, byte [0x1403fdd76]
mov byte [rsp + 0x20], dl
lea r9, [rsp + 0x70]
lea rdx, [rbp + 0x7d8]
lea rcx, [rsi + 0x18]
call fcn.1400e06b0
xor eax, eax
mov edx, eax
test dil, dil
setne dl
add edx, 7
mov rcx, rsi
call fcn.1400e0370
cmp byte [rsi + 0xa], 1
je 0x1401c6d3d
mov byte [rsi + 0xa], 1
cmp byte [rsi + 8], 0
je 0x1401c6d3d
mov rax, qword [rsi]
mov rdx, qword [0x1403fd7a8]
mov qword [rbp + 0x8a8], rax
mov dword [rbp + 0x8b0], 1
lea rcx, [rdx + 0x388]
lea r8, [rbp + 0x8a8]
call fcn.140119670
cmp byte [rsi + 9], r14b
je 0x1401c6d7b
mov byte [rsi + 9], r14b
cmp byte [rsi + 8], 0
je 0x1401c6d7b
mov rax, qword [rsi]
mov rdx, qword [0x1403fd7a8]
mov qword [rbp + 0x928], rax
mov dword [rbp + 0x930], 2
lea rcx, [rdx + 0x388]
lea r8, [rbp + 0x928]
call fcn.140119670
mov dl, 1
mov rcx, rsi
call fcn.1400e03e0
nop
cmp dword [rbp + 0x820], 0
jle 0x1401c6d9c
mov rcx, qword [rbp + 0x818]
call fcn.140298600
nop
cmp dword [rbp + 0x810], 0
jle 0x1401c6db1
mov rcx, qword [rbp + 0x808]
call fcn.140298600
xor r14d, r14d
cmp dword [rbp + 0x348], 0
jle 0x1401c6dca
mov rcx, qword [rbp + 0x340]
call fcn.140298600
nop
cmp dword [rbp + 0x428], 0
jle 0x1401c6ddf
mov rcx, qword [rbp + 0x420]
call fcn.140298600
mov rcx, qword [rbp + 0x7b0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1401c6df5
cmp eax, 0x103
je 0x1401c6e02
cmp r12d, dword [rbp + 0x2c8]
jb 0x1401c6980
mov ebx, dword [rsp + 0x60]
mov rdi, qword [rbp - 0x68]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
mov dword [rsp + 0x60], ebx
add rdi, 8
mov qword [rbp - 0x68], rdi
movsxd rax, ebx
cmp rax, 2
jb 0x1401c68f2
lea rax, str.SOFTWARE_
mov qword [rbp + 0xd0], rax
lea rax, str.SOFTWAREWow6432Node_
mov qword [rbp + 0xd8], rax
mov dword [rbp - 0x60], r14d
lea rax, str.ShellServiceObjectDelayLoad
mov qword [rbp + 0xc0], rax
lea rax, str.SharedTaskScheduler
mov qword [rbp + 0xc8], rax
lea rcx, [rbp + 0xd0]
mov qword [rbp + 0x88], rcx
nop word [rax + rax]
mov rsi, qword [rcx]
mov qword [rbp], rsi
lea r8, str.MicrosoftWindowsCurrentVersionExplorerBrowser_Helper_Objects
mov rdx, rsi
lea rcx, [rbp - 0x30]
call fcn.1401e7ee0
nop
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp - 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c710d
mov dword [rbp + 0x2a0], r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, r14d
cmp dword [rbp + 0x2a0], 0
jbe 0x1401c7102
mov rsi, qword [rbp - 0x80]
nop dword [rax]
nop dword [rax + rax]
mov r9d, 0x400
lea r8, [rbp + 0x9230]
mov edx, edi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc edi
test eax, eax
jne 0x1401c70eb
mov qword [rbp + 0x1d8], 0
lea edx, [rax + 5]
lea rcx, [rbp + 0x1d0]
call fcn.1401e9030
mov eax, dword [rbp + 0x1d8]
inc eax
movsxd rdx, eax
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x1d0]
call fcn.14029b4d8
mov edx, 5
lea rcx, [rbp + 0x1d0]
call fcn.1401ea290
nop
mov ebx, dword [rbp - 0x24]
add ebx, dword [rbp + 0x1dc]
mov edx, ebx
lea rcx, [rbp + 0x1d0]
call fcn.1401e9030
movsxd r9, dword [rbp - 0x24]
mov ecx, dword [rbp + 0x1d8]
movsxd rax, dword [rbp + 0x1dc]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x1d0]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp - 0x30]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x1d0]
call fcn.1401ea290
lea rdx, [0x1403232c8]
lea rcx, [rbp + 0x1d0]
call fcn.1401e7680
lea rdx, [rbp + 0x9230]
lea rcx, [rbp + 0x1d0]
call fcn.1401e7680
lea rdx, [0x1403232c8]
lea rcx, [rbp + 0x1d0]
call fcn.1401e7680
lea rax, [rbp + 0x9230]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401c7040
mov qword [rbp + 0x4f0], 0
test ebx, ebx
jne 0x1401c7069
lea rax, [0x140323de0]
mov qword [rbp + 0x4e8], rax
jmp 0x1401c7098
mov edx, ebx
lea rcx, [rbp + 0x4e8]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rbp + 0x4f0]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x9230]
mov rcx, qword [rbp + 0x4e8]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x4e8]
call fcn.1401ea290
nop
lea r8, [rbp + 0x1d0]
lea rdx, [rbp + 0x4e8]
mov rcx, rsi
call fcn.1401c1680
nop
cmp dword [rbp + 0x4f0], 0
jle 0x1401c70d4
mov rcx, qword [rbp + 0x4e8]
call fcn.140298600
nop
cmp dword [rbp + 0x1d8], 0
jle 0x1401c70f2
mov rcx, qword [rbp + 0x1d0]
call fcn.140298600
jmp 0x1401c70f2
cmp eax, 0x103
je 0x1401c70fe
cmp edi, dword [rbp + 0x2a0]
jb 0x1401c6f30
mov rsi, qword [rbp]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, str.MicrosoftWindowsCurrentVersionShell_ExtensionsApproved
mov rdx, rsi
lea rcx, [rbp + 0x8c8]
call fcn.1401e7ee0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp - 0x30]
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp - 0x28]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp - 0x30]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
lea rcx, [rbp - 0x30]
call fcn.1401ea290
nop
cmp dword [rbp + 0x8d0], 0
jle 0x1401c716c
mov rcx, qword [rbp + 0x8c8]
call fcn.140298600
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp - 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c73ed
mov dword [rbp + 0x2a4], r14d
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
lea rax, [rbp + 0x2a4]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, r14d
cmp dword [rbp + 0x2a4], 0
jbe 0x1401c73e2
mov rsi, qword [rbp - 0x80]
nop word [rax + rax]
mov dword [rbp + 0x708], 0x400
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x708]
lea r8, [rbp + 0x6230]
mov edx, edi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc edi
test eax, eax
jne 0x1401c73cb
mov qword [rbp + 0x238], 0
lea edx, [rax + 5]
lea rcx, [rbp + 0x230]
call fcn.1401e9030
mov eax, dword [rbp + 0x238]
inc eax
movsxd rdx, eax
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x230]
call fcn.14029b4d8
mov edx, 5
lea rcx, [rbp + 0x230]
call fcn.1401ea290
nop
mov ebx, dword [rbp + 0x23c]
add ebx, dword [rbp - 0x24]
mov edx, ebx
lea rcx, [rbp + 0x230]
call fcn.1401e9030
movsxd r9, dword [rbp - 0x24]
mov ecx, dword [rbp + 0x238]
movsxd rax, dword [rbp + 0x23c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x230]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp - 0x30]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x230]
call fcn.1401ea290
lea rdx, [0x1403232c8]
lea rcx, [rbp + 0x230]
call fcn.1401e7680
lea rdx, [rbp + 0x6230]
lea rcx, [rbp + 0x230]
call fcn.1401e7680
lea rax, [rbp + 0x6230]
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401c7320
mov qword [rbp + 0x510], 0
test ebx, ebx
jne 0x1401c7349
lea rax, [0x140323de0]
mov qword [rbp + 0x508], rax
jmp 0x1401c7378
mov edx, ebx
lea rcx, [rbp + 0x508]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rbp + 0x510]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x6230]
mov rcx, qword [rbp + 0x508]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x508]
call fcn.1401ea290
nop
lea r8, [rbp + 0x230]
lea rdx, [rbp + 0x508]
mov rcx, rsi
call fcn.1401c1680
nop
cmp dword [rbp + 0x510], 0
jle 0x1401c73b4
mov rcx, qword [rbp + 0x508]
call fcn.140298600
nop
cmp dword [rbp + 0x238], 0
jle 0x1401c73d2
mov rcx, qword [rbp + 0x230]
call fcn.140298600
jmp 0x1401c73d2
cmp eax, 0x103
je 0x1401c73de
cmp edi, dword [rbp + 0x2a4]
jb 0x1401c7200
mov rsi, qword [rbp]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r13d, r14d
mov dword [rsp + 0x70], r14d
lea r15, [rbp + 0xc0]
mov qword [rbp + 0xe0], r15
mov rdi, qword [rbp - 0x80]
nop word [rax + rax]
mov r8, qword [r15]
lea rdx, str.MicrosoftWindowsCurrentVersion_s
lea rcx, [rbp + 0x848]
call fcn.1401e94c0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp - 0x30]
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp - 0x28]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp - 0x30]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
lea rcx, [rbp - 0x30]
call fcn.1401ea290
nop
cmp dword [rbp + 0x850], 0
jle 0x1401c746f
mov rcx, qword [rbp + 0x848]
call fcn.140298600
lea r8, [rbp - 0x30]
mov rdx, rsi
lea rcx, [rbp + 0x8e8]
call fcn.1401e7ba0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp - 0x30]
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp - 0x28]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp - 0x30]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
lea rcx, [rbp - 0x30]
call fcn.1401ea290
nop
cmp dword [rbp + 0x8f0], 0
jle 0x1401c74cb
mov rcx, qword [rbp + 0x8e8]
call fcn.140298600
xor ebx, ebx
mov r12d, ebx
mov dword [rsp + 0x60], ebx
mov r14d, ebx
mov qword [rbp - 0x68], rbx
cmp dword [rdi + 0x18], ebx
jl 0x1401c78f2
lea rax, [0x140323de0]
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x30], 0
lea rcx, [rbp + 0x28]
test r14, r14
jne 0x1401c753d
mov rsi, 0xffffffff80000002
mov edx, dword [rbp - 0x24]
call fcn.1401e9030
movsxd r9, dword [rbp - 0x24]
mov eax, dword [rbp + 0x30]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x30]
mov rcx, qword [rbp + 0x28]
call fcn.14029b4d8
mov edx, dword [rbp - 0x24]
lea rcx, [rbp + 0x28]
call fcn.1401ea290
lea r15d, [r14 + 0x5c]
jmp 0x1401c75ef
mov rsi, 0xffffffff80000003
mov rbx, r14
shl rbx, 4
add rbx, qword [rdi + 0x20]
mov edx, dword [rbx - 4]
call fcn.1401e9030
movsxd r9, dword [rbx - 4]
mov eax, dword [rbp + 0x30]
inc eax
movsxd rdx, eax
mov r8, qword [rbx - 0x10]
mov rcx, qword [rbp + 0x28]
call fcn.14029b4d8
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0x28]
call fcn.1401ea290
mov edx, dword [rbp + 0x34]
inc edx
lea rcx, [rbp + 0x28]
call fcn.1401e9030
movsxd rcx, dword [rbp + 0x34]
mov rax, qword [rbp + 0x28]
mov r15d, 0x5c
mov word [rax + rcx*2], r15w
mov edx, dword [rbp + 0x34]
inc edx
lea rcx, [rbp + 0x28]
call fcn.1401ea290
mov ebx, dword [rbp + 0x34]
add ebx, dword [rbp - 0x24]
mov edx, ebx
lea rcx, [rbp + 0x28]
call fcn.1401e9030
movsxd r9, dword [rbp - 0x24]
mov ecx, dword [rbp + 0x30]
movsxd rax, dword [rbp + 0x34]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x28]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp - 0x30]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x28]
call fcn.1401ea290
xor ebx, ebx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x28]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c78ba
mov dword [rbp + 0x2e4], ebx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], rbx
lea rax, [rbp + 0x2e4]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, ebx
cmp dword [rbp + 0x2e4], 0
jbe 0x1401c78ab
mov r13, qword [rbp - 0x80]
lea r12, [0x140323de0]
lea r14, [0x1403232e8]
mov dword [rbp + 0x710], 0x400
mov dword [rbp + 0x678], 0x800
lea rax, [rbp + 0x678]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x7a30]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x710]
lea r8, [rbp + 0xba30]
mov edx, edi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc edi
test eax, eax
jne 0x1401c7885
lea rdx, [0x1403232e0]
cmp rsi, 0xffffffff80000002
cmove rdx, r14
lea rcx, [rbp + 0x120]
call fcn.1401e6fd0
nop
mov edx, dword [rbp + 0x12c]
inc edx
lea rcx, [rbp + 0x120]
call fcn.1401e9030
movsxd rcx, dword [rbp + 0x12c]
mov rax, qword [rbp + 0x120]
mov word [rax + rcx*2], r15w
mov edx, dword [rbp + 0x12c]
inc edx
lea rcx, [rbp + 0x120]
call fcn.1401ea290
mov ebx, dword [rbp + 0x12c]
add ebx, dword [rbp + 0x34]
mov edx, ebx
lea rcx, [rbp + 0x120]
call fcn.1401e9030
movsxd r9, dword [rbp + 0x34]
mov ecx, dword [rbp + 0x128]
movsxd rax, dword [rbp + 0x12c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x120]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x28]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x120]
call fcn.1401ea290
mov edx, dword [rbp + 0x12c]
inc edx
lea rcx, [rbp + 0x120]
call fcn.1401e9030
movsxd rcx, dword [rbp + 0x12c]
mov rax, qword [rbp + 0x120]
mov word [rax + rcx*2], r15w
mov edx, dword [rbp + 0x12c]
inc edx
lea rcx, [rbp + 0x120]
call fcn.1401ea290
lea rdx, [rbp + 0xba30]
lea rcx, [rbp + 0x120]
call fcn.1401e7680
lea rax, [rbp + 0x7a30]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401c77e2
xor r15d, r15d
mov qword [rbp + 0x530], r15
test ebx, ebx
jne 0x1401c7803
mov qword [rbp + 0x528], r12
jmp 0x1401c7832
mov edx, ebx
lea rcx, [rbp + 0x528]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rbp + 0x530]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x7a30]
mov rcx, qword [rbp + 0x528]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x528]
call fcn.1401ea290
nop
lea r8, [rbp + 0x120]
lea rdx, [rbp + 0x528]
mov rcx, r13
call fcn.1401c1680
nop
cmp dword [rbp + 0x530], 0
jle 0x1401c786e
mov rcx, qword [rbp + 0x528]
call fcn.140298600
nop
cmp dword [rbp + 0x128], 0
jle 0x1401c788e
mov rcx, qword [rbp + 0x120]
call fcn.140298600
jmp 0x1401c788e
cmp eax, 0x103
je 0x1401c78a2
jmp 0x1401c7890
xor ebx, ebx
cmp edi, dword [rbp + 0x2e4]
mov r15d, 0x5c
jb 0x1401c7680
mov r14, qword [rbp - 0x68]
mov r12d, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rbp - 0x80]
cmp dword [rbp + 0x30], 0
jle 0x1401c78c9
mov rcx, qword [rbp + 0x28]
call fcn.140298600
inc r12d
mov dword [rsp + 0x60], r12d
inc r14
mov qword [rbp - 0x68], r14
cmp r12d, dword [rdi + 0x18]
jle 0x1401c74e4
mov r13d, dword [rsp + 0x70]
mov r15, qword [rbp + 0xe0]
mov rsi, qword [rbp]
inc r13d
mov dword [rsp + 0x70], r13d
add r15, 8
mov qword [rbp + 0xe0], r15
movsxd rax, r13d
cmp rax, 2
jb 0x1401c7410
cmp dword [rbp - 0x28], 0
jle 0x1401c7921
mov rcx, qword [rbp - 0x30]
call fcn.140298600
mov ebx, dword [rbp - 0x60]
inc ebx
mov dword [rbp - 0x60], ebx
mov rcx, qword [rbp + 0x88]
add rcx, 8
mov qword [rbp + 0x88], rcx
movsxd rax, ebx
cmp rax, 2
mov r14d, 0
jb 0x1401c6e80
lea rax, str.F3130CDB_AA52_4C3A_AB32_85FFC23AF9C1
mov qword [rbp + 0xa30], rax
lea rax, str._SystemRoot__system32wbemwbemess.dll
mov qword [rbp + 0xa38], rax
mov byte [rbp + 0xa40], r14b
lea rax, str.42AEDC87_2188_41FD_B9A3_0C966FEABEC1
mov qword [rbp + 0xa48], rax
lea rcx, str._SystemRoot__system32_shell32.dll
mov qword [rbp + 0xa50], rcx
mov byte [rbp + 0xa58], 1
lea rax, str.5839FCA9_774D_42A1_ACDA_D6A79037F57F
mov qword [rbp + 0xa60], rax
lea rax, str._SystemRoot__system32wbem_fastprox.dll
mov qword [rbp + 0xa68], rax
mov byte [rbp + 0xa70], r14b
lea rax, str.FBEB8A05_BEEE_4442_804E_409D6C4515E9
mov qword [rbp + 0xa78], rax
mov qword [rbp + 0xa80], rcx
mov byte [rbp + 0xa88], r14b
lea rax, [0x14033f840]
mov qword [rbp + 0xa90], rax
lea rax, str._SystemRoot__system32_thumbcache.dll
mov qword [rbp + 0xa98], rax
mov byte [rbp + 0xaa0], r14b
lea rax, [0x14033f7a0]
mov qword [rbp + 0xaa8], rax
lea rax, str._systemroot__system32wbemwmiprvse.exe
mov qword [rbp + 0xab0], rax
mov byte [rbp + 0xab8], r14b
xor esi, esi
mov r13d, esi
mov dword [rsp + 0x60], esi
cmp dword [rdi + 0x18], esi
mov r15d, dword [rsp + 0x78]
jl 0x1401c8104
test r13d, r13d
jne 0x1401c7a8f
mov qword [rbp + 0x5f0], 0
lea edx, [r13 + 4]
lea rcx, [rbp + 0x5e8]
call fcn.1401e9030
mov eax, dword [rbp + 0x5f0]
inc eax
movsxd rdx, eax
lea r9d, [r13 + 4]
lea r8, [0x1403232e8]
mov rcx, qword [rbp + 0x5e8]
call fcn.14029b4d8
lea edx, [r13 + 4]
lea rcx, [rbp + 0x5e8]
call fcn.1401ea290
lea rbx, [rbp + 0x5e8]
or r15d, 0x10
jmp 0x1401c7ab8
lea eax, [r13 - 1]
movsxd r8, eax
shl r8, 4
add r8, qword [rdi + 0x20]
lea rdx, str.HKU_
lea rcx, [rbp + 0x948]
call fcn.1401e7ba0
mov rbx, rax
or r15d, 0x20
mov dword [rsp + 0x78], r15d
mov qword [rbp + 0x398], 0
mov edx, dword [rbx + 0xc]
test edx, edx
jne 0x1401c7adf
lea rax, [0x140323de0]
mov qword [rbp + 0x390], rax
jmp 0x1401c7b09
lea rcx, [rbp + 0x390]
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov eax, dword [rbp + 0x398]
inc eax
movsxd rdx, eax
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x390]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x390]
call fcn.1401ea290
nop
test r15b, 0x20
je 0x1401c7b3e
and r15d, 0xffffffdf
mov dword [rsp + 0x78], r15d
cmp dword [rbp + 0x950], 0
jle 0x1401c7b3e
mov rcx, qword [rbp + 0x948]
call fcn.140298600
nop
test r15b, 0x10
je 0x1401c7b62
and r15d, 0xffffffef
mov dword [rsp + 0x78], r15d
cmp dword [rbp + 0x5f0], 0
jle 0x1401c7b62
mov rcx, qword [rbp + 0x5e8]
call fcn.140298600
lea rdx, str.SOFTWAREClassesCLSID_
lea rcx, [rbp + 0x390]
call fcn.1401e7680
mov r8b, 1
xor edx, edx
lea rcx, [rbp + 0x390]
call fcn.1400ecf50
mov r12, rax
test rax, rax
je 0x1401c80dd
mov r14d, esi
lea rsi, [rbp + 0xa30]
mov r13, qword [rbp - 0x80]
xor r15d, r15d
mov rbx, qword [rsi]
lea r8, str.LocalServer32_
mov rdx, rbx
lea rcx, [rbp + 0x548]
call fcn.1401e7ee0
nop
mov qword [rbp + 0x780], r15
lea rax, [rbp + 0x780]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x548]
mov rcx, qword [r12 + 8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c7c16
lea ecx, [rax + 0x10]
call fcn.14029806c
mov rdi, rax
test rax, rax
je 0x1401c7c16
mov rax, qword [rbp + 0x780]
lea rcx, vtable.Core::Win32::RegistryKey.0
mov qword [rdi], rcx
mov qword [rdi + 8], rax
jmp 0x1401c7c19
mov rdi, r15
test rdi, rdi
jne 0x1401c7cf1
lea r8, str.InprocServer32_
mov rdx, rbx
lea rcx, [rbp + 0x858]
call fcn.1401e7ee0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0x548]
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0x550]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x548]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x548]
call fcn.1401ea290
nop
cmp dword [rbp + 0x860], edi
jle 0x1401c7c8c
mov rcx, qword [rbp + 0x858]
call fcn.140298600
mov qword [rbp + 0x7a8], r15
lea rax, [rbp + 0x7a8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x548]
mov rcx, qword [r12 + 8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c7ce5
lea ecx, [rax + 0x10]
call fcn.14029806c
mov rdi, rax
test rax, rax
je 0x1401c7ce5
mov rax, qword [rbp + 0x7a8]
lea rcx, vtable.Core::Win32::RegistryKey.0
mov qword [rdi], rcx
mov qword [rdi + 8], rax
jmp 0x1401c7ce8
mov rdi, r15
test rdi, rdi
je 0x1401c8096
lea rax, [0x140323de0]
mov qword [rbp + 0x140], rax
mov qword [rbp + 0x148], r15
lea r8, [rbp + 0x140]
xor edx, edx
mov rcx, rdi
call fcn.1400d5720
test al, al
je 0x1401c806d
cmp dword [rbp + 0x14c], 0
jle 0x1401c806d
mov r8d, 0x104
lea rdx, [rbp + 0x1000]
mov rcx, qword [rsi + 8]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rax, [rbp + 0x1000]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401c7d50
mov qword [rbp + 0x1e8], r15
test ebx, ebx
jne 0x1401c7d75
lea rax, [0x140323de0]
mov qword [rbp + 0x1e0], rax
jmp 0x1401c7da4
mov edx, ebx
lea rcx, [rbp + 0x1e0]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rbp + 0x1e8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1000]
mov rcx, qword [rbp + 0x1e0]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x1e0]
call fcn.1401ea290
nop
mov edx, 0x25
mov rcx, qword [rbp + 0x140]
call fcn.14029b070
test rax, rax
je 0x1401c7e46
mov r8d, 0x104
lea rdx, [rbp + 0x1210]
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rax, [rbp + 0x1210]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401c7df0
test ebx, ebx
jle 0x1401c7e2f
mov edx, ebx
lea rcx, [rbp + 0x140]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rbp + 0x148]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1210]
mov rcx, qword [rbp + 0x140]
call fcn.14029b4d8
jmp 0x1401c7e38
cmp dword [rbp + 0x14c], 0
jle 0x1401c7e46
mov edx, ebx
lea rcx, [rbp + 0x140]
call fcn.1401ea290
mov eax, dword [rbp + 0x14c]
cmp dword [rbp + 0x1ec], eax
jne 0x1401c7e74
mov rdx, qword [rbp + 0x140]
mov rcx, qword [rbp + 0x1e0]
call fcn.14029848c
test eax, eax
sete al
test al, al
jne 0x1401c8058
cmp byte [rsi + 0x10], 0
je 0x1401c7fb2
call fcn.1401acf80
test al, al
jne 0x1401c7fb2
mov qword [rbp + 0x630], r15
mov edx, 0xb
lea rcx, [rbp + 0x628]
call fcn.1401e9030
mov eax, dword [rbp + 0x630]
inc eax
movsxd rdx, eax
mov r9d, 0xb
lea r8, str.shdocvw.dll
mov rcx, qword [rbp + 0x628]
call fcn.14029b4d8
mov edx, 0xb
lea rcx, [rbp + 0x628]
call fcn.1401ea290
nop
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x898]
call fcn.1400d1ab0
nop
lea r8, [rbp + 0x628]
mov rdx, rax
lea rcx, [rbp + 0x878]
call fcn.1400d1690
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0x1e0]
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0x1e8]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x1e0]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x1e0]
call fcn.1401ea290
nop
cmp dword [rbp + 0x880], 0
jle 0x1401c7f59
mov rcx, qword [rbp + 0x878]
call fcn.140298600
nop
cmp dword [rbp + 0x8a0], 0
jle 0x1401c7f6f
mov rcx, qword [rbp + 0x898]
call fcn.140298600
nop
cmp dword [rbp + 0x630], 0
jle 0x1401c7f84
mov rcx, qword [rbp + 0x628]
call fcn.140298600
mov eax, dword [rbp + 0x14c]
cmp dword [rbp + 0x1ec], eax
jne 0x1401c7fb2
mov rdx, qword [rbp + 0x140]
mov rcx, qword [rbp + 0x1e0]
call fcn.14029848c
test eax, eax
sete al
test al, al
jne 0x1401c8058
lea r8, [rbp + 0x548]
lea rdx, [rbp + 0x390]
lea rcx, [rbp + 0x7e8]
call fcn.1401e7af0
nop
mov eax, dword [rbp + 0x14c]
add eax, eax
lea rcx, [rbp + 0x1000]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x140]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [0x140323de0]
lea rdx, [rbp + 0x7e8]
mov rcx, r13
call fcn.1401c0c10
test al, al
jne 0x1401c8042
lea rdx, [rbp + 0x140]
call fcn.1401c36c0
mov r8b, 1
lea rdx, [rbp + 0x140]
mov rcx, qword [r13 + 8]
call fcn.1400f9eb0
test rax, rax
je 0x1401c8042
lea rdx, [rbp + 0x7e8]
mov rcx, rax
call fcn.1400ed120
nop
cmp dword [rbp + 0x7f0], 0
jle 0x1401c8058
mov rcx, qword [rbp + 0x7e8]
call fcn.140298600
nop
cmp dword [rbp + 0x1e8], 0
jle 0x1401c806d
mov rcx, qword [rbp + 0x1e0]
call fcn.140298600
test rdi, rdi
je 0x1401c8080
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
nop
cmp dword [rbp + 0x148], 0
jle 0x1401c8096
mov rcx, qword [rbp + 0x140]
call fcn.140298600
nop
cmp dword [rbp + 0x550], 0
jle 0x1401c80ab
mov rcx, qword [rbp + 0x548]
call fcn.140298600
inc r14d
add rsi, 0x18
movsxd rax, r14d
cmp rax, 6
jb 0x1401c7ba3
mov rax, qword [r12]
mov edx, 1
mov rcx, r12
call qword [rax]
mov r15d, dword [rsp + 0x78]
mov r13d, dword [rsp + 0x60]
mov rdi, qword [rbp - 0x80]
xor esi, esi
cmp dword [rbp + 0x398], 0
jle 0x1401c80f2
mov rcx, qword [rbp + 0x390]
call fcn.140298600
inc r13d
mov dword [rsp + 0x60], r13d
cmp r13d, dword [rdi + 0x18]
jle 0x1401c7a30
mov edx, 0x34
lea rcx, [rbp - 0x78]
call fcn.1401e9030
mov eax, dword [rbp - 0x70]
inc eax
movsxd rdx, eax
mov r9d, 0x34
lea r8, str.SOFTWAREMicrosoftActive_SetupInstalled_Components
mov rcx, qword [rbp - 0x78]
call fcn.14029b4d8
mov edx, 0x34
lea rcx, [rbp - 0x78]
call fcn.1401ea290
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp - 0x78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c850e
mov dword [rbp + 0x2e0], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea rax, [rbp + 0x2e0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov r14d, esi
cmp dword [rbp + 0x2e0], 0
jbe 0x1401c8503
nop dword [rax]
nop word [rax + rax]
mov r9d, 0x400
lea r8, [rbp + 0x8a30]
mov edx, r14d
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc r14d
test eax, eax
jne 0x1401c84ef
lea rax, [rbp + 0x778]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x8a30]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c84e0
mov dword [rbp + 0x6a8], 0x800
lea rax, [rbp + 0x6a8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xc230]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.StubPath
mov rcx, qword [rbp + 0x778]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401c84e0
lea rbx, [rbp + 0xc230]
cmp word [rbx], 0x22
jne 0x1401c8289
add rbx, 2
mov edx, 0x22
mov rcx, rbx
call fcn.14029b070
jmp 0x1401c8298
lea rdx, [0x14033f9b8]
mov rcx, rbx
call fcn.14029ca54
mov rdi, rax
test rax, rax
je 0x1401c82b2
cmp word [rax], 0x2c
mov word [rax], si
jne 0x1401c82ae
mov rdi, rsi
jmp 0x1401c82b2
add rdi, 2
mov rdx, rbx
lea rcx, [rbp + 0x5a8]
call fcn.1401e6fd0
nop
lea rdx, [rbp + 0x5a8]
call fcn.1401c36c0
cmp dword [rbp + 0x5b4], 3
jl 0x1401c8425
mov rcx, qword [rbp + 0x5a8]
add rcx, 2
mov r8d, 2
lea rdx, [0x14033c4b4]
call fcn.14029ca28
test eax, eax
jne 0x1401c8425
mov r8b, 1
lea rdx, [rbp + 0x5a8]
mov rax, qword [rbp - 0x80]
mov rcx, qword [rax + 8]
call fcn.1400f9eb0
mov rsi, rax
test rax, rax
je 0x1401c8423
xor eax, eax
mov qword [rbp + 0x208], rax
lea edx, [rax + 5]
lea rcx, [rbp + 0x200]
call fcn.1401e9030
mov ecx, dword [rbp + 0x208]
inc ecx
movsxd rdx, ecx
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x200]
call fcn.14029b4d8
mov edx, 5
lea rcx, [rbp + 0x200]
call fcn.1401ea290
nop
mov ebx, dword [rbp + 0x20c]
add ebx, dword [rbp - 0x6c]
mov edx, ebx
lea rcx, [rbp + 0x200]
call fcn.1401e9030
movsxd r9, dword [rbp - 0x6c]
mov ecx, dword [rbp + 0x208]
movsxd rax, dword [rbp + 0x20c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x200]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp - 0x78]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x200]
call fcn.1401ea290
lea rdx, [0x1403232c8]
lea rcx, [rbp + 0x200]
call fcn.1401e7680
lea rdx, [rbp + 0x8a30]
lea rcx, [rbp + 0x200]
call fcn.1401e7680
lea rdx, [0x1403232c8]
lea rcx, [rbp + 0x200]
call fcn.1401e7680
lea rdx, [rbp + 0x200]
mov rcx, rsi
call fcn.1400ed120
nop
cmp dword [rbp + 0x208], 0
jle 0x1401c8423
mov rcx, qword [rbp + 0x200]
call fcn.140298600
xor esi, esi
test rdi, rdi
je 0x1401c84cb
lea rdx, [0x14033f9b0]
mov rcx, rdi
call fcn.14029ca54
mov rbx, rax
test rax, rax
jne 0x1401c84ab
lea edx, [rax + 0x3a]
mov rcx, rdi
call fcn.14029aea8
mov rbx, rax
test rax, rax
jne 0x1401c8466
movzx ecx, word [rdi]
call fcn.14029c334
test eax, eax
je 0x1401c84ab
jmp 0x1401c84a8
cmp word [rax], 0x3a
jne 0x1401c84a8
movzx eax, word [rax - 4]
test ax, ax
jne 0x1401c847b
sub rbx, 2
jmp 0x1401c84ab
cmp ax, 0x20
jne 0x1401c8487
add rbx, 0xfffffffffffffffc
jmp 0x1401c84ab
cmp ax, 0x2f
jne 0x1401c84ab
mov edx, 0x20
mov rcx, rbx
call fcn.14029aea8
mov rbx, rax
test rax, rax
je 0x1401c84ab
add rbx, 2
jmp 0x1401c84ab
mov rbx, rdi
cmp dword [rbp + 0x5b0], 0
jle 0x1401c84c0
mov rcx, qword [rbp + 0x5a8]
call fcn.140298600
test rbx, rbx
jne 0x1401c8270
jmp 0x1401c84e0
cmp dword [rbp + 0x5b0], 0
jle 0x1401c84e0
mov rcx, qword [rbp + 0x5a8]
call fcn.140298600
mov rcx, qword [rbp + 0x778]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1401c84f6
cmp eax, 0x103
je 0x1401c8503
cmp r14d, dword [rbp + 0x2e0]
jb 0x1401c81d0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 0x74
lea rcx, [rbp - 0x78]
call fcn.1401e9030
mov eax, dword [rbp - 0x70]
inc eax
movsxd rdx, eax
mov r9d, 0x74
lea r8, str.SYSTEMCurrentControlSetServicesSharedAccessParametersFirewallPolicyStandardProfileAuthorizedApplicationsList
mov rcx, qword [rbp - 0x78]
call fcn.14029b4d8
mov edx, 0x74
lea rcx, [rbp - 0x78]
call fcn.1401ea290
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp - 0x78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c87dd
mov dword [rbp + 0x2e8], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x2e8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, esi
cmp dword [rbp + 0x2e8], 0
jbe 0x1401c87d2
nop dword [rax + rax]
mov dword [rbp + 0x718], 0x400
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp + 0x718]
lea r8, [rbp + 0xaa30]
mov edx, edi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc edi
test eax, eax
jne 0x1401c87bb
lea rax, [rbp + 0xaa30]
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401c8620
mov qword [rbp + 0x448], 0
test ebx, ebx
jne 0x1401c8649
lea rax, [0x140323de0]
mov qword [rbp + 0x440], rax
jmp 0x1401c8678
mov edx, ebx
lea rcx, [rbp + 0x440]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rbp + 0x448]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0xaa30]
mov rcx, qword [rbp + 0x440]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x440]
call fcn.1401ea290
nop
lea rdx, [rbp + 0x440]
call fcn.1401c36c0
mov r8b, 1
lea rdx, [rbp + 0x440]
mov rax, qword [rbp - 0x80]
mov rcx, qword [rax + 8]
call fcn.1400f9eb0
mov rsi, rax
test rax, rax
je 0x1401c87a4
xor eax, eax
mov qword [rbp + 0x258], rax
lea edx, [rax + 5]
lea rcx, [rbp + 0x250]
call fcn.1401e9030
mov ecx, dword [rbp + 0x258]
inc ecx
movsxd rdx, ecx
mov r9d, 5
lea r8, str.HKLM_
mov rcx, qword [rbp + 0x250]
call fcn.14029b4d8
mov edx, 5
lea rcx, [rbp + 0x250]
call fcn.1401ea290
nop
mov ebx, dword [rbp + 0x25c]
add ebx, dword [rbp - 0x6c]
mov edx, ebx
lea rcx, [rbp + 0x250]
call fcn.1401e9030
movsxd r9, dword [rbp - 0x6c]
mov ecx, dword [rbp + 0x258]
movsxd rax, dword [rbp + 0x25c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x250]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp - 0x78]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x250]
call fcn.1401ea290
lea rdx, [0x1403232c8]
lea rcx, [rbp + 0x250]
call fcn.1401e7680
lea rdx, [rbp + 0xaa30]
lea rcx, [rbp + 0x250]
call fcn.1401e7680
lea rdx, [rbp + 0x250]
mov rcx, rsi
call fcn.1400ed120
nop
cmp dword [rbp + 0x258], 0
jle 0x1401c87a4
mov rcx, qword [rbp + 0x250]
call fcn.140298600
nop
cmp dword [rbp + 0x448], 0
jle 0x1401c87c4
mov rcx, qword [rbp + 0x440]
call fcn.140298600
jmp 0x1401c87c4
cmp eax, 0x103
je 0x1401c87d2
jmp 0x1401c87c6
xor esi, esi
cmp edi, dword [rbp + 0x2e8]
jb 0x1401c85d0
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 0x32
lea rcx, [rbp - 0x78]
call fcn.1401e9030
mov eax, dword [rbp - 0x70]
inc eax
movsxd rdx, eax
mov r9d, 0x32
lea r8, str.SYSTEMCurrentControlSetControlSecurityProviders
mov rcx, qword [rbp - 0x78]
call fcn.14029b4d8
mov edx, 0x32
lea rcx, [rbp - 0x78]
call fcn.1401ea290
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp - 0x78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c8977
mov dword [rbp + 0x6c0], 0x800
lea rax, [rbp + 0x6c0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xca30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SecurityProviders
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401c896c
lea rdi, [rbp + 0xca30]
nop dword [rax]
mov edx, 0x20
mov rcx, rdi
call fcn.14029b070
mov rbx, rax
test rax, rax
je 0x1401c88bc
mov rcx, rsi
cmp word [rax - 2], 0x2c
mov rax, 0xffffffffffffffff
cmove rcx, rax
mov word [rbx + rcx*2], si
mov rdx, rdi
lea rcx, [rbp + 0x750]
call fcn.1401e6fd0
nop
lea rdx, [rbp + 0x750]
call fcn.1401c36c0
mov r8b, 1
lea rdx, [rbp + 0x750]
mov rax, qword [rbp - 0x80]
mov rcx, qword [rax + 8]
call fcn.1400f9eb0
mov rdi, rax
test rax, rax
je 0x1401c8930
mov r8, qword [rbp - 0x78]
lea rdx, str.HKLM_wsSecurityProviders
lea rcx, [rbp + 0x8b8]
call fcn.1401e94c0
nop
mov rdx, rax
mov rcx, rdi
call fcn.1400ed120
nop
cmp dword [rbp + 0x8c0], 0
jle 0x1401c8930
mov rcx, qword [rbp + 0x8b8]
call fcn.140298600
test rbx, rbx
je 0x1401c8957
lea rdi, [rbx + 2]
cmp dword [rbp + 0x758], 0
jle 0x1401c8890
mov rcx, qword [rbp + 0x750]
call fcn.140298600
jmp 0x1401c8890
cmp dword [rbp + 0x758], 0
jle 0x1401c896c
mov rcx, qword [rbp + 0x750]
call fcn.140298600
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x180], rsi
mov qword [rbp + 0x188], rsi
call fcn.14000a210
mov qword [rbp + 0x180], rax
mov qword [rbp + 0x5c0], 0
mov edx, 0x2c
lea rcx, [rbp + 0x5b8]
call fcn.1401e9030
mov eax, dword [rbp + 0x5c0]
inc eax
movsxd rdx, eax
mov r9d, 0x2c
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerToolbar
mov rcx, qword [rbp + 0x5b8]
call fcn.14029b4d8
mov edx, 0x2c
lea rcx, [rbp + 0x5b8]
call fcn.1401ea290
nop
movzx eax, byte [0x1403fdd77]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x5b8]
lea rdx, [rbp + 0xac0]
lea rcx, [rbp + 0x180]
call fcn.1400e9d70
nop
cmp dword [rbp + 0x5c0], 0
jle 0x1401c8a1e
mov rcx, qword [rbp + 0x5b8]
call fcn.140298600
mov qword [rbp + 0x5d0], 0
mov edx, 0x35
lea rcx, [rbp + 0x5c8]
call fcn.1401e9030
mov eax, dword [rbp + 0x5d0]
inc eax
movsxd rdx, eax
mov r9d, 0x35
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerToolbarExplorer
mov rcx, qword [rbp + 0x5c8]
call fcn.14029b4d8
mov edx, 0x35
lea rcx, [rbp + 0x5c8]
call fcn.1401ea290
nop
movzx eax, byte [0x1403fdd77]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x5c8]
lea rdx, [rbp + 0xac0]
lea rcx, [rbp + 0x180]
call fcn.1400e9d70
nop
cmp dword [rbp + 0x5d0], 0
jle 0x1401c8aab
mov rcx, qword [rbp + 0x5c8]
call fcn.140298600
mov qword [rbp + 0x5e0], 0
mov edx, 0x39
lea rcx, [rbp + 0x5d8]
call fcn.1401e9030
mov eax, dword [rbp + 0x5e0]
inc eax
movsxd rdx, eax
mov r9d, 0x39
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerToolbarShellBrowser
mov rcx, qword [rbp + 0x5d8]
call fcn.14029b4d8
mov edx, 0x39
lea rcx, [rbp + 0x5d8]
call fcn.1401ea290
nop
movzx eax, byte [0x1403fdd77]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x5d8]
lea rdx, [rbp + 0xac0]
lea rcx, [rbp + 0x180]
call fcn.1400e9d70
nop
cmp dword [rbp + 0x5e0], 0
jle 0x1401c8b38
mov rcx, qword [rbp + 0x5d8]
call fcn.140298600
mov qword [rbp + 0x600], 0
mov edx, 0x37
lea rcx, [rbp + 0x5f8]
call fcn.1401e9030
mov eax, dword [rbp + 0x600]
inc eax
movsxd rdx, eax
mov r9d, 0x37
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerToolbarWebBrowser
mov rcx, qword [rbp + 0x5f8]
call fcn.14029b4d8
mov edx, 0x37
lea rcx, [rbp + 0x5f8]
call fcn.1401ea290
nop
movzx eax, byte [0x1403fdd77]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x5f8]
lea rdx, [rbp + 0xac0]
lea rcx, [rbp + 0x180]
call fcn.1400e9d70
nop
cmp dword [rbp + 0x600], 0
jle 0x1401c8bc5
mov rcx, qword [rbp + 0x5f8]
call fcn.140298600
mov qword [rbp + 0x620], 0
mov edx, 0x33
lea rcx, [rbp + 0x618]
call fcn.1401e9030
mov eax, dword [rbp + 0x620]
inc eax
movsxd rdx, eax
mov r9d, 0x33
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerUrlSearchHooks
mov rcx, qword [rbp + 0x618]
call fcn.14029b4d8
mov edx, 0x33
lea rcx, [rbp + 0x618]
call fcn.1401ea290
nop
movzx eax, byte [0x1403fdd77]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x618]
lea rdx, [rbp + 0xac0]
lea rcx, [rbp + 0x180]
call fcn.1400e9d70
nop
cmp dword [rbp + 0x620], 0
jle 0x1401c8c52
mov rcx, qword [rbp + 0x618]
call fcn.140298600
mov r12d, esi
mov dword [rsp + 0x60], esi
mov r13, qword [rbp - 0x80]
cmp dword [r13 + 0x18], 0
jl 0x1401c9118
mov r15, rsi
mov qword [rbp - 0x68], rsi
mov rax, qword [rbp + 0x180]
mov r14, rsi
test r12d, r12d
setne r14b
add r14, 0xffffffff80000002
mov rbx, qword [rax]
mov qword [rbp - 0x48], rbx
cmp rbx, rax
je 0x1401c90ff
nop word [rax + rax]
mov edx, dword [rbx + 0x2c]
lea rcx, [rbp - 0x78]
call fcn.1401e9030
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rbp - 0x70]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rbp - 0x78]
call fcn.14029b4d8
mov edx, dword [rbx + 0x2c]
lea rcx, [rbp - 0x78]
call fcn.1401ea290
lea rax, [0x140323de0]
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], 0
lea rcx, [rbp + 0x18]
test r15, r15
jne 0x1401c8d16
mov edx, dword [rbp - 0x6c]
call fcn.1401e9030
movsxd r9, dword [rbp - 0x6c]
mov eax, dword [rbp + 0x20]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x78]
mov rcx, qword [rbp + 0x18]
call fcn.14029b4d8
mov edx, dword [rbp - 0x6c]
jmp 0x1401c8db4
mov rdi, r15
shl rdi, 4
add rdi, qword [r13 + 0x20]
mov edx, dword [rdi - 4]
call fcn.1401e9030
movsxd r9, dword [rdi - 4]
mov eax, dword [rbp + 0x20]
inc eax
movsxd rdx, eax
mov r8, qword [rdi - 0x10]
mov rcx, qword [rbp + 0x18]
call fcn.14029b4d8
mov edx, dword [rdi - 4]
lea rcx, [rbp + 0x18]
call fcn.1401ea290
mov edx, dword [rbp + 0x24]
inc edx
lea rcx, [rbp + 0x18]
call fcn.1401e9030
movsxd rcx, dword [rbp + 0x24]
mov rax, qword [rbp + 0x18]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x24]
inc edx
lea rcx, [rbp + 0x18]
call fcn.1401ea290
mov edi, dword [rbp + 0x24]
add edi, dword [rbp - 0x6c]
mov edx, edi
lea rcx, [rbp + 0x18]
call fcn.1401e9030
movsxd r9, dword [rbp - 0x6c]
mov ecx, dword [rbp + 0x20]
movsxd rax, dword [rbp + 0x24]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x18]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp - 0x78]
call fcn.14029b4d8
mov edx, edi
lea rcx, [rbp + 0x18]
call fcn.1401ea290
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x18]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c907e
mov dword [rbp + 0x2b0], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [rbp + 0x2b0], 0
jbe 0x1401c9071
xor r12d, r12d
lea r15, [0x140323de0]
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
mov dword [rbp + 0x714], 0x400
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x714]
lea r8, [rbp + 0x2e30]
mov edx, esi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
inc esi
test eax, eax
jne 0x1401c9056
cmp word [rbp + 0x2e30], 0x7b
jne 0x1401c905d
lea rdx, [0x1403232e0]
cmp r14, 0xffffffff80000002
lea rax, [0x1403232e8]
cmove rdx, rax
lea rcx, [rbp + 0x110]
call fcn.1401e6fd0
nop
mov edx, dword [rbp + 0x11c]
inc edx
lea rcx, [rbp + 0x110]
call fcn.1401e9030
movsxd rcx, dword [rbp + 0x11c]
mov rax, qword [rbp + 0x110]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x11c]
inc edx
lea rcx, [rbp + 0x110]
call fcn.1401ea290
mov edi, dword [rbp + 0x11c]
add edi, dword [rbp + 0x24]
mov edx, edi
lea rcx, [rbp + 0x110]
call fcn.1401e9030
movsxd r9, dword [rbp + 0x24]
mov ecx, dword [rbp + 0x118]
movsxd rax, dword [rbp + 0x11c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x110]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x18]
call fcn.14029b4d8
mov edx, edi
lea rcx, [rbp + 0x110]
call fcn.1401ea290
mov edx, dword [rbp + 0x11c]
inc edx
lea rcx, [rbp + 0x110]
call fcn.1401e9030
movsxd rcx, dword [rbp + 0x11c]
mov rax, qword [rbp + 0x110]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x11c]
inc edx
lea rcx, [rbp + 0x110]
call fcn.1401ea290
lea rdx, [rbp + 0x2e30]
lea rcx, [rbp + 0x110]
call fcn.1401e7680
lea rax, [rbp + 0x2e30]
mov rdi, rbx
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1401c8fb6
mov qword [rbp + 0x570], r12
test edi, edi
jne 0x1401c8fd4
mov qword [rbp + 0x568], r15
jmp 0x1401c9003
mov edx, edi
lea rcx, [rbp + 0x568]
call fcn.1401e9030
movsxd r9, edi
mov eax, dword [rbp + 0x570]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x2e30]
mov rcx, qword [rbp + 0x568]
call fcn.14029b4d8
mov edx, edi
lea rcx, [rbp + 0x568]
call fcn.1401ea290
nop
lea r8, [rbp + 0x110]
lea rdx, [rbp + 0x568]
mov rcx, r13
call fcn.1401c1680
nop
cmp dword [rbp + 0x570], 0
jle 0x1401c903f
mov rcx, qword [rbp + 0x568]
call fcn.140298600
nop
cmp dword [rbp + 0x118], 0
jle 0x1401c905d
mov rcx, qword [rbp + 0x110]
call fcn.140298600
jmp 0x1401c905d
cmp eax, 0x103
je 0x1401c9069
cmp esi, dword [rbp + 0x2b0]
jb 0x1401c8e50
mov rbx, qword [rbp - 0x48]
mov r15, qword [rbp - 0x68]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
cmp dword [rbp + 0x20], 0
jle 0x1401c908d
mov rcx, qword [rbp + 0x18]
call fcn.140298600
cmp byte [rbx + 0x19], 0
jne 0x1401c90ea
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401c90c2
mov rbx, rax
mov qword [rbp - 0x48], rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401c90ea
nop dword [rax]
mov rbx, rax
mov qword [rbp - 0x48], rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401c90b0
jmp 0x1401c90ea
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401c90e3
nop dword [rax]
cmp rbx, qword [rax + 0x10]
jne 0x1401c90e3
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401c90d0
mov rbx, rax
mov qword [rbp - 0x48], rax
mov rax, qword [rbp + 0x180]
cmp rbx, rax
jne 0x1401c8ca0
mov r12d, dword [rsp + 0x60]
inc r12d
mov dword [rsp + 0x60], r12d
inc r15
mov qword [rbp - 0x68], r15
cmp r12d, dword [r13 + 0x18]
jle 0x1401c8c76
lea rcx, [rbp + 0x180]
call fcn.140009d00
mov qword [rbp + 0x640], 0
mov edx, 0x32
lea rcx, [rbp + 0x638]
call fcn.1401e9030
mov eax, dword [rbp + 0x640]
inc eax
movsxd rdx, eax
mov r9d, 0x32
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerExplorer_Bars
mov rcx, qword [rbp + 0x638]
call fcn.14029b4d8
mov edx, 0x32
lea rcx, [rbp + 0x638]
call fcn.1401ea290
nop
movzx eax, byte [0x1403fdd77]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x638]
lea rdx, [rbp + 0xac0]
lea rcx, [rbp + 0x180]
call fcn.1400e9d70
nop
cmp dword [rbp + 0x640], 0
jle 0x1401c91b1
mov rcx, qword [rbp + 0x638]
call fcn.140298600
mov qword [rbp + 0x610], 0
mov edx, 0x2f
lea rcx, [rbp + 0x608]
call fcn.1401e9030
mov eax, dword [rbp + 0x610]
inc eax
movsxd rdx, eax
mov r9d, 0x2f
lea r8, str.SOFTWAREMicrosoftInternet_ExplorerExtensions
mov rcx, qword [rbp + 0x608]
call fcn.14029b4d8
mov edx, 0x2f
lea rcx, [rbp + 0x608]
call fcn.1401ea290
nop
movzx eax, byte [0x1403fdd77]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x608]
lea rdx, [rbp + 0xac0]
lea rcx, [rbp + 0x180]
call fcn.1400e9d70
nop
cmp dword [rbp + 0x610], 0
jle 0x1401c923e
mov rcx, qword [rbp + 0x608]
call fcn.140298600
mov r12d, esi
mov dword [rsp + 0x60], esi
cmp dword [r13 + 0x18], 0
jl 0x1401c96f8
mov r15, rsi
mov qword [rbp - 0x68], rsi
mov rax, qword [rbp + 0x180]
nop
mov r14, rsi
test r12d, r12d
setne r14b
add r14, 0xffffffff80000002
mov rbx, qword [rax]
mov qword [rbp - 0x48], rbx
cmp rbx, rax
je 0x1401c96df
mov edx, dword [rbx + 0x2c]
lea rcx, [rbp - 0x78]
call fcn.1401e9030
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rbp - 0x70]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rbp - 0x78]
call fcn.14029b4d8
mov edx, dword [rbx + 0x2c]
lea rcx, [rbp - 0x78]
call fcn.1401ea290
lea rax, [0x140323de0]
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], 0
lea rcx, [rbp + 8]
test r15, r15
jne 0x1401c92f7
mov edx, dword [rbp - 0x6c]
call fcn.1401e9030
movsxd r9, dword [rbp - 0x6c]
mov eax, dword [rbp + 0x10]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x78]
mov rcx, qword [rbp + 8]
call fcn.14029b4d8
mov edx, dword [rbp - 0x6c]
jmp 0x1401c9395
mov rdi, r15
shl rdi, 4
add rdi, qword [r13 + 0x20]
mov edx, dword [rdi - 4]
call fcn.1401e9030
movsxd r9, dword [rdi - 4]
mov eax, dword [rbp + 0x10]
inc eax
movsxd rdx, eax
mov r8, qword [rdi - 0x10]
mov rcx, qword [rbp + 8]
call fcn.14029b4d8
mov edx, dword [rdi - 4]
lea rcx, [rbp + 8]
call fcn.1401ea290
mov edx, dword [rbp + 0x14]
inc edx
lea rcx, [rbp + 8]
call fcn.1401e9030
movsxd rcx, dword [rbp + 0x14]
mov rax, qword [rbp + 8]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x14]
inc edx
lea rcx, [rbp + 8]
call fcn.1401ea290
mov edi, dword [rbp + 0x14]
add edi, dword [rbp - 0x6c]
mov edx, edi
lea rcx, [rbp + 8]
call fcn.1401e9030
movsxd r9, dword [rbp - 0x6c]
mov ecx, dword [rbp + 0x10]
movsxd rax, dword [rbp + 0x14]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 8]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp - 0x78]
call fcn.14029b4d8
mov edx, edi
lea rcx, [rbp + 8]
call fcn.1401ea290
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 8]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c965e
mov dword [rbp + 0x2a8], esi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea rax, [rbp + 0x2a8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [rbp + 0x2a8], 0
jbe 0x1401c9651
xor r12d, r12d
lea r15, [0x140323de0]
or rbx, 0xffffffffffffffff
nop dword [rax]
mov dword [rbp + 0x64c], 0x800
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x64c]
lea r8, [rbp + 0x4230]
mov edx, esi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
inc esi
test eax, eax
jne 0x1401c9636
cmp word [rbp + 0x4230], 0x7b
jne 0x1401c963d
lea rdx, [0x1403232e0]
cmp r14, 0xffffffff80000002
lea rax, [0x1403232e8]
cmove rdx, rax
lea rcx, [rbp + 0x130]
call fcn.1401e6fd0
nop
mov edx, dword [rbp + 0x13c]
inc edx
lea rcx, [rbp + 0x130]
call fcn.1401e9030
movsxd rcx, dword [rbp + 0x13c]
mov rax, qword [rbp + 0x130]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x13c]
inc edx
lea rcx, [rbp + 0x130]
call fcn.1401ea290
mov edi, dword [rbp + 0x13c]
add edi, dword [rbp + 0x14]
mov edx, edi
lea rcx, [rbp + 0x130]
call fcn.1401e9030
movsxd r9, dword [rbp + 0x14]
mov ecx, dword [rbp + 0x138]
movsxd rax, dword [rbp + 0x13c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x130]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 8]
call fcn.14029b4d8
mov edx, edi
lea rcx, [rbp + 0x130]
call fcn.1401ea290
mov edx, dword [rbp + 0x13c]
inc edx
lea rcx, [rbp + 0x130]
call fcn.1401e9030
movsxd rcx, dword [rbp + 0x13c]
mov rax, qword [rbp + 0x130]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x13c]
inc edx
lea rcx, [rbp + 0x130]
call fcn.1401ea290
lea rdx, [rbp + 0x4230]
lea rcx, [rbp + 0x130]
call fcn.1401e7680
lea rax, [rbp + 0x4230]
mov rdi, rbx
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1401c9596
mov qword [rbp + 0x520], r12
test edi, edi
jne 0x1401c95b4
mov qword [rbp + 0x518], r15
jmp 0x1401c95e3
mov edx, edi
lea rcx, [rbp + 0x518]
call fcn.1401e9030
movsxd r9, edi
mov eax, dword [rbp + 0x520]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x4230]
mov rcx, qword [rbp + 0x518]
call fcn.14029b4d8
mov edx, edi
lea rcx, [rbp + 0x518]
call fcn.1401ea290
nop
lea r8, [rbp + 0x130]
lea rdx, [rbp + 0x518]
mov rcx, r13
call fcn.1401c1680
nop
cmp dword [rbp + 0x520], 0
jle 0x1401c961f
mov rcx, qword [rbp + 0x518]
call fcn.140298600
nop
cmp dword [rbp + 0x138], 0
jle 0x1401c963d
mov rcx, qword [rbp + 0x130]
call fcn.140298600
jmp 0x1401c963d
cmp eax, 0x103
je 0x1401c9649
cmp esi, dword [rbp + 0x2a8]
jb 0x1401c9430
mov rbx, qword [rbp - 0x48]
mov r15, qword [rbp - 0x68]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
cmp dword [rbp + 0x10], 0
jle 0x1401c966d
mov rcx, qword [rbp + 8]
call fcn.140298600
cmp byte [rbx + 0x19], 0
jne 0x1401c96ca
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401c96a2
mov rbx, rax
mov qword [rbp - 0x48], rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401c96ca
nop dword [rax]
mov rbx, rax
mov qword [rbp - 0x48], rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401c9690
jmp 0x1401c96ca
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401c96c3
nop dword [rax]
cmp rbx, qword [rax + 0x10]
jne 0x1401c96c3
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401c96b0
mov rbx, rax
mov qword [rbp - 0x48], rax
mov rax, qword [rbp + 0x180]
cmp rbx, rax
jne 0x1401c9281
mov r12d, dword [rsp + 0x60]
inc r12d
mov dword [rsp + 0x60], r12d
inc r15
mov qword [rbp - 0x68], r15
cmp r12d, dword [r13 + 0x18]
jle 0x1401c9260
lea rax, str.ControlPanel
mov qword [rbp + 0xa08], rax
lea rax, str.Desktop
mov qword [rbp + 0xa10], rax
lea rax, str.MyComputer
mov qword [rbp + 0xa18], rax
lea rax, str.NetworkNeighborhood
mov qword [rbp + 0xa20], rax
mov ebx, esi
mov dword [rsp + 0x60], ebx
lea rdi, [rbp + 0xa08]
mov qword [rbp + 0xe0], rdi
mov r14d, 0x5c
nop word [rax + rax]
mov qword [rbp + 0x80], 0
mov edx, 0x32
lea rcx, [rbp + 0x78]
call fcn.1401e9030
mov eax, dword [rbp + 0x80]
inc eax
movsxd rdx, eax
mov r9d, 0x32
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorer
mov rcx, qword [rbp + 0x78]
call fcn.14029b4d8
mov edx, 0x32
lea rcx, [rbp + 0x78]
call fcn.1401ea290
nop
mov edx, dword [rbp + 0x84]
inc edx
lea rcx, [rbp + 0x78]
call fcn.1401e9030
movsxd rcx, dword [rbp + 0x84]
mov rax, qword [rbp + 0x78]
mov word [rax + rcx*2], r14w
mov edx, dword [rbp + 0x84]
inc edx
lea rcx, [rbp + 0x78]
call fcn.1401ea290
mov rdx, qword [rdi]
lea rcx, [rbp + 0x78]
call fcn.1401e7680
mov edx, dword [rbp + 0x84]
inc edx
lea rcx, [rbp + 0x78]
call fcn.1401e9030
movsxd rcx, dword [rbp + 0x84]
mov rax, qword [rbp + 0x78]
mov word [rax + rcx*2], r14w
mov edx, dword [rbp + 0x84]
inc edx
lea rcx, [rbp + 0x78]
call fcn.1401ea290
lea rdx, str.NameSpace
lea rcx, [rbp + 0x78]
call fcn.1401e7680
mov eax, dword [0x1403fe608]
lea r15, vtable.Core::Win32::RegistryKey.0
test al, 1
jne 0x1401c9851
or eax, 1
mov dword [0x1403fe608], eax
mov qword [0x1403fe5e0], r15
mov qword [0x1403fe5e8], 0xffffffff80000002
lea rcx, [0x1402de040]
call fcn.140299c6c
mov qword [rbp + 0x798], rsi
lea rax, [rbp + 0x798]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x78]
mov rcx, qword [0x1403fe5e8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401c9d00
lea ecx, [rax + 0x10]
call fcn.14029806c
mov r13, rax
mov qword [rbp - 0x68], rax
test rax, rax
je 0x1401c98ab
mov rax, qword [rbp + 0x798]
mov qword [r13], r15
mov qword [r13 + 8], rax
jmp 0x1401c98b2
mov r13, rsi
mov qword [rbp - 0x68], rsi
lea r15, vtable.Core::Array_class_Core::String_.0
test r13, r13
je 0x1401c9d07
mov qword [rbp + 0x9d8], r15
mov dword [rbp + 0x9e0], esi
mov qword [rbp + 0x9e8], rsi
xor edx, edx
lea rcx, [rbp + 0x9d8]
call fcn.1400c7710
nop
lea rdx, [rbp + 0x9d8]
mov rcx, r13
call fcn.1400ec710
test al, al
je 0x1401c9cda
mov eax, dword [rbp + 0x9e0]
test eax, eax
jle 0x1401c9cda
mov rsi, qword [rbp + 0x9e8]
mov r15, rsi
mov r12d, eax
mov r13, qword [rbp - 0x80]
nop dword [rax + rax]
mov r8d, 1
lea rdx, [0x14032cde8]
mov rcx, r15
call fcn.1401eb700
test al, al
je 0x1401c9cac
mov r8, qword [rsi]
lea rdx, str.HKLMSOFTWAREClassesCLSID_s_
lea rcx, [rbp + 0x668]
call fcn.1401e94c0
nop
xor ebx, ebx
mov qword [rbp + 0x3e8], rbx
mov edx, dword [rbp + 0x674]
test edx, edx
jne 0x1401c9977
lea r14, [0x140323de0]
mov qword [rbp + 0x3e0], r14
jmp 0x1401c99b5
lea rcx, [rbp + 0x3e0]
call fcn.1401e9030
movsxd r9, dword [rbp + 0x674]
mov eax, dword [rbp + 0x3e8]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x668]
mov rcx, qword [rbp + 0x3e0]
call fcn.14029b4d8
mov edx, dword [rbp + 0x674]
lea r14, [0x140323de0]
lea rcx, [rbp + 0x3e0]
call fcn.1401ea290
nop
lea rdx, str.ShellOpenCommand
lea rcx, [rbp + 0x3e0]
call fcn.1401e7680
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x3e0]
call fcn.1400ecf50
mov rdi, rax
test rax, rax
je 0x1401c9c81
mov qword [rbp + 0x2f0], r14
mov qword [rbp + 0x2f8], rbx
lea r8, [rbp + 0x2f0]
mov rdx, qword [0x1403ec168]
mov rcx, rax
call fcn.1400d5720
test al, al
je 0x1401c9c5d
lea rdx, [rbp + 0x2f0]
call fcn.1401c36c0
cmp dword [rbp + 0x2fc], 2
jle 0x1401c9c5d
mov r8d, 2
lea rdx, [0x140323be0]
lea rcx, [rbp + 0x2f0]
call fcn.1401e9840
test eax, eax
jle 0x1401c9ac0
lea r8d, [rax - 1]
lea rdx, [rbp + 0x8d8]
lea rcx, [rbp + 0x2f0]
call fcn.1401eaef0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0x2f0]
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0x2f8]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x2f0]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x2f0]
call fcn.1401ea290
nop
cmp dword [rbp + 0x8e0], 0
jle 0x1401c9ac0
mov rcx, qword [rbp + 0x8d8]
call fcn.140298600
mov r8b, 1
lea rdx, [rbp + 0x2f0]
mov rcx, qword [r13 + 8]
call fcn.1400f9eb0
mov r14, rax
test rax, rax
je 0x1401c9c5d
lea rdx, [rbp + 0x668]
mov rcx, rax
call fcn.1400e0da0
mov qword [rbp - 0x50], 0
mov edx, 4
lea rcx, [rbp - 0x58]
call fcn.1401e9030
mov ecx, dword [rbp - 0x50]
inc ecx
movsxd rdx, ecx
mov r9d, 4
lea r8, [0x1403232e8]
mov rcx, qword [rbp - 0x58]
call fcn.14029b4d8
mov edx, 4
lea rcx, [rbp - 0x58]
call fcn.1401ea290
nop
mov edx, dword [rbp - 0x4c]
inc edx
lea rcx, [rbp - 0x58]
call fcn.1401e9030
movsxd rcx, dword [rbp - 0x4c]
mov rax, qword [rbp - 0x58]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp - 0x4c]
inc edx
lea rcx, [rbp - 0x58]
call fcn.1401ea290
mov ebx, dword [rbp - 0x4c]
add ebx, dword [rbp + 0x84]
mov edx, ebx
lea rcx, [rbp - 0x58]
call fcn.1401e9030
movsxd r9, dword [rbp + 0x84]
mov ecx, dword [rbp - 0x50]
movsxd rax, dword [rbp - 0x4c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp - 0x58]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x78]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp - 0x58]
call fcn.1401ea290
mov edx, dword [rbp - 0x4c]
inc edx
lea rcx, [rbp - 0x58]
call fcn.1401e9030
movsxd rcx, dword [rbp - 0x4c]
mov rax, qword [rbp - 0x58]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp - 0x4c]
inc edx
lea rcx, [rbp - 0x58]
call fcn.1401ea290
mov ebx, dword [rbp - 0x4c]
add ebx, dword [rsi + 0xc]
mov edx, ebx
lea rcx, [rbp - 0x58]
call fcn.1401e9030
movsxd r9, dword [rsi + 0xc]
mov ecx, dword [rbp - 0x50]
movsxd rax, dword [rbp - 0x4c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp - 0x58]
lea rcx, [rax + rcx*2]
mov r8, qword [rsi]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp - 0x58]
call fcn.1401ea290
mov edx, dword [rbp - 0x4c]
inc edx
lea rcx, [rbp - 0x58]
call fcn.1401e9030
movsxd rcx, dword [rbp - 0x4c]
mov rax, qword [rbp - 0x58]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp - 0x4c]
inc edx
lea rcx, [rbp - 0x58]
call fcn.1401ea290
lea rdx, [rbp - 0x58]
mov rcx, r14
call fcn.1400e0da0
nop
cmp dword [rbp - 0x50], 0
jle 0x1401c9c5d
mov rcx, qword [rbp - 0x58]
call fcn.140298600
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
nop
cmp dword [rbp + 0x2f8], 0
jle 0x1401c9c81
mov rcx, qword [rbp + 0x2f0]
call fcn.140298600
nop
cmp dword [rbp + 0x3e8], 0
jle 0x1401c9c97
mov rcx, qword [rbp + 0x3e0]
call fcn.140298600
nop
cmp dword [rbp + 0x670], 0
jle 0x1401c9cac
mov rcx, qword [rbp + 0x668]
call fcn.140298600
add r15, 0x10
add rsi, 0x10
dec r12
jne 0x1401c9920
mov r13, qword [rbp - 0x68]
mov ebx, dword [rsp + 0x60]
mov rdi, qword [rbp + 0xe0]
xor esi, esi
lea r14d, [r12 + 0x5c]
lea r15, vtable.Core::Array_class_Core::String_.0
mov rax, qword [r13]
mov edx, 1
mov rcx, r13
call qword [rax]
nop
mov qword [rbp + 0x9d8], r15
xor edx, edx
lea rcx, [rbp + 0x9d8]
call fcn.1400c7710
jmp 0x1401c9d07
lea r15, vtable.Core::Array_class_Core::String_.0
cmp dword [rbp + 0x80], 0
jle 0x1401c9d19
mov rcx, qword [rbp + 0x78]
call fcn.140298600
inc ebx
mov dword [rsp + 0x60], ebx
add rdi, 8
mov qword [rbp + 0xe0], rdi
movsxd rax, ebx
cmp rax, 4
jb 0x1401c9750
mov qword [rbp + 0x278], 0
mov edx, 0x54
lea rcx, [rbp + 0x270]
call fcn.1401e9030
mov eax, dword [rbp + 0x278]
inc eax
movsxd rdx, eax
mov r9d, 0x54
lea r8, str.HKLMSOFTWAREMicrosoftWindowsCurrentVersionexplorerShellIconOverlayIdentifiers_
mov rcx, qword [rbp + 0x270]
call fcn.14029b4d8
mov edx, 0x54
lea rcx, [rbp + 0x270]
call fcn.1401ea290
nop
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x270]
call fcn.1400ecf50
mov r12, rax
test rax, rax
je 0x1401ca137
mov qword [rbp + 0x9d8], r15
mov dword [rbp + 0x9e0], esi
mov qword [rbp + 0x9e8], rsi
xor edx, edx
lea rcx, [rbp + 0x9d8]
call fcn.1400c7710
nop
lea rdx, [rbp + 0x9d8]
mov rcx, r12
call fcn.1400ec710
mov r13, qword [rbp - 0x80]
test al, al
je 0x1401ca111
mov eax, dword [rbp + 0x9e0]
test eax, eax
jle 0x1401ca111
mov r14, qword [rbp + 0x9e8]
lea rdi, [r14 + 0xc]
mov r15d, eax
mov r8d, 1
lea rdx, [0x14032cde8]
mov rcx, r14
call fcn.1401eb700
test al, al
je 0x1401c9f48
mov qword [rbp + 0x168], 0
mov edx, dword [rbp + 0x27c]
test edx, edx
jne 0x1401c9e42
lea rax, [0x140323de0]
mov qword [rbp + 0x160], rax
jmp 0x1401c9e79
lea rcx, [rbp + 0x160]
call fcn.1401e9030
movsxd r9, dword [rbp + 0x27c]
mov eax, dword [rbp + 0x168]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x270]
mov rcx, qword [rbp + 0x160]
call fcn.14029b4d8
mov edx, dword [rbp + 0x27c]
lea rcx, [rbp + 0x160]
call fcn.1401ea290
nop
mov ebx, dword [rbp + 0x16c]
add ebx, dword [rdi]
mov edx, ebx
lea rcx, [rbp + 0x160]
call fcn.1401e9030
movsxd r9, dword [rdi]
mov ecx, dword [rbp + 0x168]
movsxd rax, dword [rbp + 0x16c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x160]
lea rcx, [rax + rcx*2]
mov r8, qword [rdi - 0xc]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x160]
call fcn.1401ea290
mov edx, dword [rbp + 0x16c]
inc edx
lea rcx, [rbp + 0x160]
call fcn.1401e9030
movsxd rcx, dword [rbp + 0x16c]
mov rax, qword [rbp + 0x160]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x16c]
inc edx
lea rcx, [rbp + 0x160]
call fcn.1401ea290
lea r8, [rbp + 0x160]
mov rdx, r14
mov rcx, r13
call fcn.1401c1680
nop
cmp dword [rbp + 0x168], 0
jle 0x1401ca0f9
mov rcx, qword [rbp + 0x160]
call fcn.140298600
jmp 0x1401ca0f9
xor r8d, r8d
mov rdx, qword [rdi - 0xc]
mov rcx, r12
call fcn.1400ecbd0
mov rsi, rax
test rax, rax
je 0x1401ca0f7
lea rax, [0x140323de0]
mov qword [rbp + 0x680], rax
xor ebx, ebx
mov qword [rbp + 0x688], rbx
lea r8, [rbp + 0x680]
xor edx, edx
mov rcx, rsi
call fcn.1400d5720
test al, al
je 0x1401ca0d4
lea r8d, [rbx + 1]
lea rdx, [0x14032cde8]
lea rcx, [rbp + 0x680]
call fcn.1401eb700
test al, al
je 0x1401ca0d4
mov qword [rbp + 0x178], rbx
mov edx, dword [rbp + 0x27c]
test edx, edx
jne 0x1401c9fd3
lea rax, [0x140323de0]
mov qword [rbp + 0x170], rax
jmp 0x1401ca00a
lea rcx, [rbp + 0x170]
call fcn.1401e9030
movsxd r9, dword [rbp + 0x27c]
mov eax, dword [rbp + 0x178]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x270]
mov rcx, qword [rbp + 0x170]
call fcn.14029b4d8
mov edx, dword [rbp + 0x27c]
lea rcx, [rbp + 0x170]
call fcn.1401ea290
nop
mov ebx, dword [rbp + 0x17c]
add ebx, dword [rdi]
mov edx, ebx
lea rcx, [rbp + 0x170]
call fcn.1401e9030
movsxd r9, dword [rdi]
mov ecx, dword [rbp + 0x178]
movsxd rax, dword [rbp + 0x17c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x170]
lea rcx, [rax + rcx*2]
mov r8, qword [rdi - 0xc]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x170]
call fcn.1401ea290
mov edx, dword [rbp + 0x17c]
inc edx
lea rcx, [rbp + 0x170]
call fcn.1401e9030
movsxd rcx, dword [rbp + 0x17c]
mov rax, qword [rbp + 0x170]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x17c]
inc edx
lea rcx, [rbp + 0x170]
call fcn.1401ea290
lea r8, [rbp + 0x170]
lea rdx, [rbp + 0x680]
mov rcx, r13
call fcn.1401c1680
nop
cmp dword [rbp + 0x178], 0
jle 0x1401ca0d4
mov rcx, qword [rbp + 0x170]
call fcn.140298600
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
nop
cmp dword [rbp + 0x688], 0
jle 0x1401ca0f7
mov rcx, qword [rbp + 0x680]
call fcn.140298600
xor esi, esi
add r14, 0x10
add rdi, 0x10
dec r15
jne 0x1401c9e00
lea r15, vtable.Core::Array_class_Core::String_.0
mov rax, qword [r12]
mov edx, 1
mov rcx, r12
call qword [rax]
nop
mov qword [rbp + 0x9d8], r15
xor edx, edx
lea rcx, [rbp + 0x9d8]
call fcn.1400c7710
jmp 0x1401ca13b
mov r13, qword [rbp - 0x80]
cmp dword [rbp + 0x278], 0
jle 0x1401ca150
mov rcx, qword [rbp + 0x270]
call fcn.140298600
lea rcx, [rbp + 0x180]
call fcn.140009d00
mov qword [rbp + 0x580], 0
mov edx, 0x35
lea rcx, [rbp + 0x578]
call fcn.1401e9030
mov eax, dword [rbp + 0x580]
inc eax
movsxd rdx, eax
mov r9d, 0x35
lea r8, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows_
mov rcx, qword [rbp + 0x578]
call fcn.14029b4d8
mov edx, 0x35
lea rcx, [rbp + 0x578]
call fcn.1401ea290
nop
movzx eax, byte [0x1403fdd77]
mov byte [rsp + 0x20], al
lea r9, [rbp + 0x578]
lea rdx, [rbp + 0xac0]
lea rcx, [rbp + 0x180]
call fcn.1400e9d70
nop
cmp dword [rbp + 0x580], 0
jle 0x1401ca1e9
mov rcx, qword [rbp + 0x578]
call fcn.140298600
mov r15d, esi
mov dword [rsp + 0x60], esi
cmp dword [r13 + 0x18], 0
jl 0x1401ca5fd
mov r14, rsi
mov rax, qword [rbp + 0x180]
nop word [rax + rax]
test r15d, r15d
setne sil
add rsi, 0xffffffff80000002
mov rbx, qword [rax]
cmp rbx, rax
je 0x1401ca5e3
xor r12d, r12d
lea r15, [0x140323de0]
mov edx, dword [rbx + 0x2c]
lea rcx, [rbp - 0x78]
call fcn.1401e9030
movsxd r9, dword [rbx + 0x2c]
mov eax, dword [rbp - 0x70]
inc eax
movsxd rdx, eax
mov r8, qword [rbx + 0x20]
mov rcx, qword [rbp - 0x78]
call fcn.14029b4d8
mov edx, dword [rbx + 0x2c]
lea rcx, [rbp - 0x78]
call fcn.1401ea290
mov qword [rbp + 0x38], r15
mov qword [rbp + 0x40], r12
lea rcx, [rbp + 0x38]
test r14, r14
jne 0x1401ca29f
mov edx, dword [rbp - 0x6c]
call fcn.1401e9030
movsxd r9, dword [rbp - 0x6c]
mov eax, dword [rbp + 0x40]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x78]
mov rcx, qword [rbp + 0x38]
call fcn.14029b4d8
mov edx, dword [rbp - 0x6c]
jmp 0x1401ca33d
mov rdi, r14
shl rdi, 4
add rdi, qword [r13 + 0x20]
mov edx, dword [rdi - 4]
call fcn.1401e9030
movsxd r9, dword [rdi - 4]
mov eax, dword [rbp + 0x40]
inc eax
movsxd rdx, eax
mov r8, qword [rdi - 0x10]
mov rcx, qword [rbp + 0x38]
call fcn.14029b4d8
mov edx, dword [rdi - 4]
lea rcx, [rbp + 0x38]
call fcn.1401ea290
mov edx, dword [rbp + 0x44]
inc edx
lea rcx, [rbp + 0x38]
call fcn.1401e9030
movsxd rcx, dword [rbp + 0x44]
mov rax, qword [rbp + 0x38]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x44]
inc edx
lea rcx, [rbp + 0x38]
call fcn.1401ea290
mov edi, dword [rbp + 0x44]
add edi, dword [rbp - 0x6c]
mov edx, edi
lea rcx, [rbp + 0x38]
call fcn.1401e9030
movsxd r9, dword [rbp - 0x6c]
mov ecx, dword [rbp + 0x40]
movsxd rax, dword [rbp + 0x44]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x38]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp - 0x78]
call fcn.14029b4d8
mov edx, edi
lea rcx, [rbp + 0x38]
call fcn.1401ea290
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x38]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401ca570
mov dword [rbp + 0x3a0], 0x800
lea rax, [rbp + 0x3a0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x9a30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.load
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401ca564
cmp dword [rbp + 0x3a0], eax
jbe 0x1401ca564
lea rax, [rbp + 0x9a30]
or rdi, 0xffffffffffffffff
nop word [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x1401ca3d0
mov qword [rbp + 0x3d8], r12
test edi, edi
jne 0x1401ca3ee
mov qword [rbp + 0x3d0], r15
jmp 0x1401ca41d
mov edx, edi
lea rcx, [rbp + 0x3d0]
call fcn.1401e9030
movsxd r9, edi
mov eax, dword [rbp + 0x3d8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x9a30]
mov rcx, qword [rbp + 0x3d0]
call fcn.14029b4d8
mov edx, edi
lea rcx, [rbp + 0x3d0]
call fcn.1401ea290
nop
cmp dword [rbp + 0x3dc], 0
jle 0x1401ca54f
lea rdx, [rbp + 0x3d0]
call fcn.1401c36c0
lea rdx, [0x1403232e0]
cmp rsi, 0xffffffff80000002
lea rax, [0x1403232e8]
cmove rdx, rax
lea rcx, [rbp + 0x210]
call fcn.1401e6fd0
nop
mov edx, dword [rbp + 0x21c]
inc edx
lea rcx, [rbp + 0x210]
call fcn.1401e9030
movsxd rcx, dword [rbp + 0x21c]
mov rax, qword [rbp + 0x210]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x21c]
inc edx
lea rcx, [rbp + 0x210]
call fcn.1401ea290
mov edi, dword [rbp + 0x21c]
add edi, dword [rbp + 0x44]
mov edx, edi
lea rcx, [rbp + 0x210]
call fcn.1401e9030
movsxd r9, dword [rbp + 0x44]
mov ecx, dword [rbp + 0x218]
movsxd rax, dword [rbp + 0x21c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x210]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x38]
call fcn.14029b4d8
mov edx, edi
lea rcx, [rbp + 0x210]
call fcn.1401ea290
lea rdx, str.load
lea rcx, [rbp + 0x210]
call fcn.1401e7680
mov r8b, 1
lea rdx, [rbp + 0x3d0]
mov rcx, qword [r13 + 8]
call fcn.1400f9eb0
test rax, rax
je 0x1401ca539
lea rdx, [rbp + 0x210]
mov rcx, rax
call fcn.1400ed120
nop
cmp dword [rbp + 0x218], 0
jle 0x1401ca54f
mov rcx, qword [rbp + 0x210]
call fcn.140298600
nop
cmp dword [rbp + 0x3d8], 0
jle 0x1401ca564
mov rcx, qword [rbp + 0x3d0]
call fcn.140298600
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0x40], 0
jle 0x1401ca57f
mov rcx, qword [rbp + 0x38]
call fcn.140298600
cmp byte [rbx + 0x19], 0
jne 0x1401ca5ce
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
jne 0x1401ca5ae
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
jne 0x1401ca5ce
nop dword [rax + rax]
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1401ca5a0
jmp 0x1401ca5ce
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x1401ca5cb
cmp rbx, qword [rax + 0x10]
jne 0x1401ca5cb
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x1401ca5b8
mov rbx, rax
mov rax, qword [rbp + 0x180]
cmp rbx, rax
jne 0x1401ca234
mov r15d, dword [rsp + 0x60]
inc r15d
mov dword [rsp + 0x60], r15d
inc r14
cmp r15d, dword [r13 + 0x18]
mov esi, 0
jle 0x1401ca210
lea rax, [0x140328b70]
mov qword [rbp + 0x9d8], rax
lea rax, str.exefile
mov qword [rbp + 0x9e0], rax
lea rax, str..pif
mov qword [rbp + 0x9e8], rax
lea rax, str.piffile
mov qword [rbp + 0x9f0], rax
lea rax, str..com
mov qword [rbp + 0x9f8], rax
lea rax, str.comfile
mov qword [rbp + 0xa00], rax
mov eax, esi
mov dword [rsp + 0x70], eax
lea r13, [rbp + 0x9d8]
lea r15, str.Wow6432Node
mov rdi, qword [rbp - 0x80]
nop dword [rax]
mov dword [rsp + 0x60], esi
mov rbx, rsi
mov qword [rbp - 0x68], rbx
cmp dword [rdi + 0x18], 0
jl 0x1401cafda
lea rax, [0x140323de0]
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], r15
jmp 0x1401ca6a7
lea rax, [0x140323de0]
mov qword [rbp + 0x300], rax
mov qword [rbp + 0x308], 0
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x158], 0
lea rcx, [rbp + 0x300]
test rbx, rbx
jne 0x1401ca72c
lea edx, [rbx + 4]
mov r12, 0xffffffff80000002
call fcn.1401e9030
mov eax, dword [rbp + 0x308]
inc eax
movsxd rdx, eax
lea r9d, [rbx + 4]
lea r8, [0x1403232e8]
mov rcx, qword [rbp + 0x300]
call fcn.14029b4d8
lea edx, [rbx + 4]
lea rcx, [rbp + 0x300]
call fcn.1401ea290
mov edx, dword [rbp + 0x15c]
test edx, edx
jle 0x1401ca7fc
xor edx, edx
jmp 0x1401ca7ea
mov edx, 3
mov r12, 0xffffffff80000003
call fcn.1401e9030
mov eax, dword [rbp + 0x308]
inc eax
movsxd rdx, eax
mov r9d, 3
lea r8, [0x1403232e0]
mov rcx, qword [rbp + 0x300]
call fcn.14029b4d8
mov edx, 3
lea rcx, [rbp + 0x300]
call fcn.1401ea290
shl rbx, 4
add rbx, qword [rdi + 0x20]
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0x150]
call fcn.1401e9030
movsxd r9, dword [rbx - 4]
mov eax, dword [rbp + 0x158]
inc eax
movsxd rdx, eax
mov r8, qword [rbx - 0x10]
mov rcx, qword [rbp + 0x150]
call fcn.14029b4d8
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0x150]
call fcn.1401ea290
mov edx, dword [rbp + 0x15c]
inc edx
lea rcx, [rbp + 0x150]
call fcn.1401e9030
movsxd rcx, dword [rbp + 0x15c]
mov rax, qword [rbp + 0x150]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x15c]
inc edx
lea rcx, [rbp + 0x150]
call fcn.1401ea290
mov edx, dword [rbp + 0x15c]
mov r14d, esi
lea r15, [rbp + 0xd0]
nop word [rax + rax]
mov qword [rbp + 0x2d8], 0
test edx, edx
jne 0x1401ca82f
lea rbx, [0x140323de0]
mov qword [rbp + 0x2d0], rbx
jmp 0x1401ca86d
lea rcx, [rbp + 0x2d0]
call fcn.1401e9030
movsxd r9, dword [rbp + 0x15c]
mov eax, dword [rbp + 0x2d8]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x150]
mov rcx, qword [rbp + 0x2d0]
call fcn.14029b4d8
mov edx, dword [rbp + 0x15c]
lea rbx, [0x140323de0]
lea rcx, [rbp + 0x2d0]
call fcn.1401ea290
nop
lea rdx, str.SOFTWARE
lea rcx, [rbp + 0x2d0]
call fcn.1401e7680
mov rdx, qword [r15]
lea rcx, [rbp + 0x2d0]
call fcn.1401e7680
lea rdx, [0x1403232c8]
lea rcx, [rbp + 0x2d0]
call fcn.1401e7680
lea rdx, str.Classes
lea rcx, [rbp + 0x2d0]
call fcn.1401e7680
lea rax, [rbp + 0x4b0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x2d0]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401caf56
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], 0
mov rdx, qword [0x1403ec168]
lea rcx, [rbp + 0x3f0]
call fcn.1401e6fd0
nop
mov rdx, qword [0x1403ec168]
lea rcx, [rbp + 0x330]
call fcn.1401e6fd0
nop
mov rdx, qword [0x1403ec168]
lea rcx, [rbp + 0x320]
call fcn.1401e6fd0
nop
mov dword [rbp + 0xf8], 0x800
mov rsi, qword [r13]
lea r9, [rbp + 0xf8]
lea r8, [rbp + 0x1630]
mov rdx, rsi
mov rcx, qword [rbp + 0x4b0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x1401caad6
lea rax, [rbp + 0x1630]
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401ca980
test ebx, ebx
jle 0x1401ca9bf
mov edx, ebx
lea rcx, [rbp + 0x3f0]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rbp + 0x3f8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1630]
mov rcx, qword [rbp + 0x3f0]
call fcn.14029b4d8
jmp 0x1401ca9c8
cmp dword [rbp + 0x3fc], 0
jle 0x1401ca9d6
mov edx, ebx
lea rcx, [rbp + 0x3f0]
call fcn.1401ea290
mov r8, qword [rbp + 0x3f0]
lea rdx, str._s_shellopencommand
lea rcx, [rbp + 0x8f8]
call fcn.1401e94c0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0x90]
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0x98]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x90]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x90]
call fcn.1401ea290
nop
cmp dword [rbp + 0x900], 0
jle 0x1401caa45
mov rcx, qword [rbp + 0x8f8]
call fcn.140298600
mov dword [rbp + 0xf8], 0x800
lea r9, [rbp + 0xf8]
lea r8, [rbp + 0x1630]
mov rdx, qword [rbp + 0x90]
mov rcx, qword [rbp + 0x4b0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x1401caad6
lea rax, [rbp + 0x1630]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401caa80
test ebx, ebx
jle 0x1401caabf
mov edx, ebx
lea rcx, [rbp + 0x330]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rbp + 0x338]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1630]
mov rcx, qword [rbp + 0x330]
call fcn.14029b4d8
jmp 0x1401caac8
cmp dword [rbp + 0x33c], 0
jle 0x1401caad6
mov edx, ebx
lea rcx, [rbp + 0x330]
call fcn.1401ea290
mov r8, rsi
lea rdx, str._s_shellopencommand
lea rcx, [rbp + 0x918]
call fcn.1401e94c0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0x90]
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0x98]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x90]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x90]
call fcn.1401ea290
nop
cmp dword [rbp + 0x920], 0
jle 0x1401cab41
mov rcx, qword [rbp + 0x918]
call fcn.140298600
mov dword [rbp + 0xf8], 0x800
lea r9, [rbp + 0xf8]
lea r8, [rbp + 0x1630]
mov rdx, qword [rbp + 0x90]
mov rcx, qword [rbp + 0x4b0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
or rdx, 0xffffffffffffffff
test eax, eax
jne 0x1401cabda
lea rax, [rbp + 0x1630]
mov rbx, rdx
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401cab80
test ebx, ebx
jle 0x1401cabbf
mov edx, ebx
lea rcx, [rbp + 0x320]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rbp + 0x328]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1630]
mov rcx, qword [rbp + 0x320]
call fcn.14029b4d8
jmp 0x1401cabc8
cmp dword [rbp + 0x32c], 0
jle 0x1401cabda
mov edx, ebx
lea rcx, [rbp + 0x320]
call fcn.1401ea290
or rdx, 0xffffffffffffffff
mov rcx, qword [rbp + 0x330]
test rcx, rcx
je 0x1401cad66
mov rax, rdx
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1401cabf0
test rax, rax
sete al
test al, al
jne 0x1401cad66
mov r8d, 1
lea rdx, [0x1403401c0]
lea rcx, [rbp + 0x330]
call fcn.1401eb700
test al, al
jne 0x1401cad66
xor eax, eax
mov qword [rbp + 0x468], rax
mov edx, dword [rbp + 0x33c]
test edx, edx
jne 0x1401cac4c
lea rax, [0x140323de0]
mov qword [rbp + 0x460], rax
jmp 0x1401cac83
lea rcx, [rbp + 0x460]
call fcn.1401e9030
movsxd r9, dword [rbp + 0x33c]
mov eax, dword [rbp + 0x468]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x330]
mov rcx, qword [rbp + 0x460]
call fcn.14029b4d8
mov edx, dword [rbp + 0x33c]
lea rcx, [rbp + 0x460]
call fcn.1401ea290
nop
lea rdx, [rbp + 0x460]
call fcn.1401c36c0
mov r8b, 1
lea rdx, [rbp + 0x460]
mov rcx, qword [rdi + 8]
call fcn.1400f9eb0
mov rdi, rax
test rax, rax
je 0x1401cad4d
mov rcx, qword [rbp + 0x3f0]
mov qword [rsp + 0x20], rcx
mov r9, qword [rbp + 0x2d0]
mov r8, qword [rbp + 0x300]
lea rdx, str._s_s_s_shellopencommand_
lea rcx, [rbp + 0x938]
call fcn.1401e94c0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0x90]
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0x98]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x90]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x90]
call fcn.1401ea290
nop
cmp dword [rbp + 0x940], 0
jle 0x1401cad3d
mov rcx, qword [rbp + 0x938]
call fcn.140298600
lea rdx, [rbp + 0x90]
mov rcx, rdi
call fcn.1400ed120
nop
cmp dword [rbp + 0x468], 0
jle 0x1401cad62
mov rcx, qword [rbp + 0x460]
call fcn.140298600
mov rdi, qword [rbp - 0x80]
mov rcx, qword [rbp + 0x320]
test rcx, rcx
je 0x1401caeeb
or rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1401cad80
test rax, rax
sete al
test al, al
jne 0x1401caeeb
mov r8d, 1
lea rdx, [0x1403401c0]
lea rcx, [rbp + 0x320]
call fcn.1401eb700
test al, al
jne 0x1401caeeb
xor eax, eax
mov qword [rbp + 0x488], rax
mov edx, dword [rbp + 0x32c]
test edx, edx
jne 0x1401caddc
lea rax, [0x140323de0]
mov qword [rbp + 0x480], rax
jmp 0x1401cae13
lea rcx, [rbp + 0x480]
call fcn.1401e9030
movsxd r9, dword [rbp + 0x32c]
mov eax, dword [rbp + 0x488]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x320]
mov rcx, qword [rbp + 0x480]
call fcn.14029b4d8
mov edx, dword [rbp + 0x32c]
lea rcx, [rbp + 0x480]
call fcn.1401ea290
nop
lea rdx, [rbp + 0x480]
call fcn.1401c36c0
mov r8b, 1
lea rdx, [rbp + 0x480]
mov rcx, qword [rdi + 8]
call fcn.1400f9eb0
mov rdi, rax
test rax, rax
je 0x1401caed6
mov qword [rsp + 0x20], rsi
mov r9, qword [rbp + 0x2d0]
mov r8, qword [rbp + 0x300]
lea rdx, str._s_s_s_shellopencommand_
lea rcx, [rbp + 0x958]
call fcn.1401e94c0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0x90]
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0x98]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0x90]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0x90]
call fcn.1401ea290
nop
cmp dword [rbp + 0x960], 0
jle 0x1401caec6
mov rcx, qword [rbp + 0x958]
call fcn.140298600
lea rdx, [rbp + 0x90]
mov rcx, rdi
call fcn.1400ed120
nop
cmp dword [rbp + 0x488], 0
jle 0x1401caeeb
mov rcx, qword [rbp + 0x480]
call fcn.140298600
mov rcx, qword [rbp + 0x4b0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0x328], 0
jle 0x1401caf0f
mov rcx, qword [rbp + 0x320]
call fcn.140298600
nop
cmp dword [rbp + 0x338], 0
jle 0x1401caf25
mov rcx, qword [rbp + 0x330]
call fcn.140298600
nop
cmp dword [rbp + 0x3f8], 0
jle 0x1401caf3b
mov rcx, qword [rbp + 0x3f0]
call fcn.140298600
nop
cmp dword [rbp + 0x98], 0
jle 0x1401caf50
mov rcx, qword [rbp + 0x90]
call fcn.140298600
xor esi, esi
mov rdi, qword [rbp - 0x80]
cmp dword [rbp + 0x2d8], 0
jle 0x1401caf6b
mov rcx, qword [rbp + 0x2d0]
call fcn.140298600
inc r14d
add r15, 8
movsxd rax, r14d
cmp rax, 2
jae 0x1401caf86
mov edx, dword [rbp + 0x15c]
jmp 0x1401ca810
cmp dword [rbp + 0x158], 0
jle 0x1401caf9c
mov rcx, qword [rbp + 0x150]
call fcn.140298600
nop
cmp dword [rbp + 0x308], 0
jle 0x1401cafb1
mov rcx, qword [rbp + 0x300]
call fcn.140298600
mov eax, dword [rsp + 0x60]
inc eax
mov dword [rsp + 0x60], eax
mov rbx, qword [rbp - 0x68]
inc rbx
mov qword [rbp - 0x68], rbx
cmp eax, dword [rdi + 0x18]
jle 0x1401ca6a0
mov eax, dword [rsp + 0x70]
lea r15, str.Wow6432Node
inc eax
mov dword [rsp + 0x70], eax
add r13, 0x10
cdqe
cmp rax, 3
mov eax, dword [rsp + 0x70]
jb 0x1401ca670
mov r14d, esi
mov r13, qword [rbp - 0x80]
lea r12, [0x140323de0]
cmp dword [rdi + 0x18], 0
jl 0x1401cb3c6
mov rdi, rsi
or r15, 0xffffffffffffffff
mov qword [rbp + 0x1a0], r12
mov qword [rbp + 0x1a8], 0
test rdi, rdi
jne 0x1401cb036
mov rsi, 0xffffffff80000002
jmp 0x1401cb0c4
mov rsi, 0xffffffff80000003
mov rbx, rdi
shl rbx, 4
add rbx, qword [r13 + 0x20]
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0x1a0]
call fcn.1401e9030
movsxd r9, dword [rbx - 4]
mov eax, dword [rbp + 0x1a8]
inc eax
movsxd rdx, eax
mov r8, qword [rbx - 0x10]
mov rcx, qword [rbp + 0x1a0]
call fcn.14029b4d8
mov edx, dword [rbx - 4]
lea rcx, [rbp + 0x1a0]
call fcn.1401ea290
mov edx, dword [rbp + 0x1ac]
inc edx
lea rcx, [rbp + 0x1a0]
call fcn.1401e9030
movsxd rcx, dword [rbp + 0x1ac]
mov rax, qword [rbp + 0x1a0]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x1ac]
inc edx
lea rcx, [rbp + 0x1a0]
call fcn.1401ea290
lea rdx, str.SOFTWAREClasses
lea rcx, [rbp + 0x1a0]
call fcn.1401e7680
lea rax, [rbp + 0x6f0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0x1a0]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401cb398
mov dword [rbp + 0x654], 0x100
lea r9, [rbp + 0x654]
lea r8, [rbp + 0xf00]
lea rdx, [0x140328b70]
mov rcx, qword [rbp + 0x6f0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x1401cb38a
lea r8, [rbp + 0xf00]
lea rdx, str._s_shellopencommand_
lea rcx, [rbp + 0x730]
call fcn.1401e94c0
nop
mov dword [rbp + 0x650], 0x400
lea r9, [rbp + 0x650]
lea r8, [rbp + 0x3630]
mov rdx, qword [rbp + 0x730]
mov rcx, qword [rbp + 0x6f0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x1401cb375
lea rax, [rbp + 0x3630]
mov rbx, r15
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401cb191
xor eax, eax
mov qword [rbp + 0x3b0], rax
test ebx, ebx
jne 0x1401cb1b1
mov qword [rbp + 0x3a8], r12
jmp 0x1401cb1e0
mov edx, ebx
lea rcx, [rbp + 0x3a8]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rbp + 0x3b0]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x3630]
mov rcx, qword [rbp + 0x3a8]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x3a8]
call fcn.1401ea290
nop
mov r8d, 1
lea rdx, [0x1403401c0]
lea rcx, [rbp + 0x3a8]
call fcn.1401eb700
test al, al
jne 0x1401cb35f
lea rdx, [rbp + 0x3a8]
call fcn.1401c36c0
lea rdx, [0x1403232e0]
cmp rsi, 0xffffffff80000002
lea rax, [0x1403232e8]
cmove rdx, rax
lea rcx, [rbp + 0x48]
call fcn.1401e6fd0
nop
mov edx, dword [rbp + 0x54]
inc edx
lea rcx, [rbp + 0x48]
call fcn.1401e9030
movsxd rcx, dword [rbp + 0x54]
mov rax, qword [rbp + 0x48]
mov esi, 0x5c
mov word [rax + rcx*2], si
mov edx, dword [rbp + 0x54]
inc edx
lea rcx, [rbp + 0x48]
call fcn.1401ea290
mov ebx, dword [rbp + 0x54]
add ebx, dword [rbp + 0x1ac]
mov edx, ebx
lea rcx, [rbp + 0x48]
call fcn.1401e9030
movsxd r9, dword [rbp + 0x1ac]
mov ecx, dword [rbp + 0x50]
movsxd rax, dword [rbp + 0x54]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x48]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x1a0]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x48]
call fcn.1401ea290
mov edx, dword [rbp + 0x54]
inc edx
lea rcx, [rbp + 0x48]
call fcn.1401e9030
movsxd rcx, dword [rbp + 0x54]
mov rax, qword [rbp + 0x48]
mov word [rax + rcx*2], si
mov edx, dword [rbp + 0x54]
inc edx
lea rcx, [rbp + 0x48]
call fcn.1401ea290
mov ebx, dword [rbp + 0x73c]
add ebx, dword [rbp + 0x54]
mov edx, ebx
lea rcx, [rbp + 0x48]
call fcn.1401e9030
movsxd r9, dword [rbp + 0x73c]
mov ecx, dword [rbp + 0x50]
movsxd rax, dword [rbp + 0x54]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x48]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x730]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x48]
call fcn.1401ea290
mov r8b, 1
lea rdx, [rbp + 0x3a8]
mov rcx, qword [r13 + 8]
call fcn.1400f9eb0
test rax, rax
je 0x1401cb34f
lea rdx, [rbp + 0x48]
mov rcx, rax
call fcn.1400ed120
nop
cmp dword [rbp + 0x50], 0
jle 0x1401cb35f
mov rcx, qword [rbp + 0x48]
call fcn.140298600
nop
cmp dword [rbp + 0x3b0], 0
jle 0x1401cb375
mov rcx, qword [rbp + 0x3a8]
call fcn.140298600
nop
cmp dword [rbp + 0x738], 0
jle 0x1401cb38a
mov rcx, qword [rbp + 0x730]
call fcn.140298600
mov rcx, qword [rbp + 0x6f0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp dword [rbp + 0x1a8], 0
jle 0x1401cb3ad
mov rcx, qword [rbp + 0x1a0]
call fcn.140298600
inc r14d
inc rdi
cmp r14d, dword [r13 + 0x18]
jle 0x1401cb013
xor esi, esi
lea r15, str.Wow6432Node
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r15
mov r15d, esi
mov dword [rsp + 0x60], esi
lea r12, [rbp + 0xd0]
mov qword [rbp - 0x68], r12
nop word [rax + rax]
lea r8, str.SOFTWARE
mov edx, 0x104
lea rcx, [rbp + 0xae0]
call fcn.1402980d8
mov r8, qword [r12]
mov edx, 0x104
lea rcx, [rbp + 0xae0]
call fcn.14029a500
lea r8, str.ClientsStartMenuInternet_
mov edx, 0x104
lea rcx, [rbp + 0xae0]
call fcn.14029a500
call fcn.1400ecf00
mov qword [rbp + 0x790], rsi
lea rcx, [rbp + 0x790]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0xae0]
mov rcx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401cb827
lea ecx, [rax + 0x10]
call fcn.14029806c
mov r14, rax
mov qword [rbp + 0xc0], rax
lea rbx, vtable.Core::Array_class_Core::String_.0
test rax, rax
je 0x1401cb82e
mov rcx, qword [rbp + 0x790]
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [r14], rax
mov qword [r14 + 8], rcx
mov qword [rbp + 0x9d8], rbx
mov dword [rbp + 0x9e0], esi
mov qword [rbp + 0x9e8], rsi
xor edx, edx
lea rcx, [rbp + 0x9d8]
call fcn.1400c7710
nop
lea rdx, [rbp + 0x9d8]
mov rcx, r14
call fcn.1400ec710
test al, al
je 0x1401cb802
mov eax, dword [rbp + 0x9e0]
test eax, eax
jle 0x1401cb802
mov rdi, qword [rbp + 0x9e8]
mov esi, eax
xor r14d, r14d
lea r15, [0x140323de0]
or r12, 0xffffffffffffffff
nop word [rax + rax]
lea r8, [rbp + 0xae0]
mov edx, 0x104
lea rcx, [rbp + 0xcf0]
call fcn.1402980d8
mov r8, qword [rdi]
mov edx, 0x104
lea rcx, [rbp + 0xcf0]
call fcn.14029a500
lea r8, str._shellopencommand
mov edx, 0x104
lea rcx, [rbp + 0xcf0]
call fcn.14029a500
mov dword [rbp + 0x6d8], 0x208
lea r9, [rbp + 0x6d8]
lea r8, [rbp + 0x1420]
lea rdx, [rbp + 0xcf0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x1401cb7de
lea rax, [rbp + 0x1420]
mov rbx, r12
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1401cb592
mov qword [rbp + 0xa8], r14
test ebx, ebx
jne 0x1401cb5b0
mov qword [rbp + 0xa0], r15
jmp 0x1401cb5df
mov edx, ebx
lea rcx, [rbp + 0xa0]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rbp + 0xa8]
inc eax
movsxd rdx, eax
lea r8, [rbp + 0x1420]
mov rcx, qword [rbp + 0xa0]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0xa0]
call fcn.1401ea290
nop
mov r8d, 1
lea rdx, [0x14032c0d4]
lea rcx, [rbp + 0xa0]
call fcn.1401eb700
lea rcx, [rbp + 0xa0]
test al, al
je 0x1401cb6a3
mov r8d, 1
lea rdx, [0x14032c0d4]
call fcn.1401e9840
test eax, eax
jle 0x1401cb722
lea r9d, [rax - 1]
mov r8d, 1
lea rdx, [rbp + 0x978]
lea rcx, [rbp + 0xa0]
call fcn.1401eb1b0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0xa0]
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0xa8]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0xa0]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0xa0]
call fcn.1401ea290
nop
cmp dword [rbp + 0x980], 0
jle 0x1401cb722
mov rcx, qword [rbp + 0x978]
jmp 0x1401cb71d
lea rdx, str..exe
call fcn.1401e9720
test eax, eax
js 0x1401cb722
lea r9d, [rax + 4]
xor r8d, r8d
lea rdx, [rbp + 0x998]
lea rcx, [rbp + 0xa0]
call fcn.1401eb1b0
mov rbx, rax
mov edx, dword [rax + 0xc]
lea rcx, [rbp + 0xa0]
call fcn.1401e9030
movsxd r9, dword [rbx + 0xc]
mov ecx, dword [rbp + 0xa8]
inc ecx
movsxd rdx, ecx
mov r8, qword [rbx]
mov rcx, qword [rbp + 0xa0]
call fcn.14029b4d8
mov edx, dword [rbx + 0xc]
lea rcx, [rbp + 0xa0]
call fcn.1401ea290
nop
cmp dword [rbp + 0x9a0], 0
jle 0x1401cb722
mov rcx, qword [rbp + 0x998]
call fcn.140298600
lea rdx, [rbp + 0xa0]
call fcn.1401c36c0
cmp dword [rbp + 0xac], 0
jle 0x1401cb7c9
mov r8b, 1
lea rdx, [rbp + 0xa0]
mov rcx, qword [r13 + 8]
call fcn.1400f9eb0
mov rbx, rax
test rax, rax
je 0x1401cb7c9
lea rdx, [0x1403232e8]
lea rcx, [rbp + 0x740]
call fcn.1401e6fd0
nop
lea rdx, [0x1403232c8]
lea rcx, [rbp + 0x740]
call fcn.1401e7680
lea rdx, [rbp + 0xcf0]
lea rcx, [rbp + 0x740]
call fcn.1401e7680
lea rdx, [0x1403232c8]
lea rcx, [rbp + 0x740]
call fcn.1401e7680
lea rdx, [rbp + 0x740]
mov rcx, rbx
call fcn.1400ed120
nop
cmp dword [rbp + 0x748], 0
jle 0x1401cb7c9
mov rcx, qword [rbp + 0x740]
call fcn.140298600
nop
cmp dword [rbp + 0xa8], 0
jle 0x1401cb7de
mov rcx, qword [rbp + 0xa0]
call fcn.140298600
add rdi, 0x10
dec rsi
jne 0x1401cb510
mov r14, qword [rbp + 0xc0]
mov r15d, dword [rsp + 0x60]
mov r12, qword [rbp - 0x68]
lea rbx, vtable.Core::Array_class_Core::String_.0
mov rax, qword [r14]
mov edx, 1
mov rcx, r14
call qword [rax]
nop
mov qword [rbp + 0x9d8], rbx
xor edx, edx
lea rcx, [rbp + 0x9d8]
call fcn.1400c7710
jmp 0x1401cb82e
lea rbx, vtable.Core::Array_class_Core::String_.0
inc r15d
mov dword [rsp + 0x60], r15d
add r12, 8
mov qword [rbp - 0x68], r12
movsxd rax, r15d
cmp rax, 2
jb 0x1401cb3f0
lea rdx, str.HKLMSOFTWAREMozillaPlugins
lea rcx, [rbp + 0x6b0]
call fcn.1401e6fd0
nop
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x6b0]
call fcn.1400ecf50
mov r12, rax
test rax, rax
je 0x1401cbb1a
mov qword [rbp + 0x9d8], rbx
mov dword [rbp + 0x9e0], esi
mov qword [rbp + 0x9e8], rsi
xor edx, edx
lea rcx, [rbp + 0x9d8]
call fcn.1400c7710
nop
lea rdx, [rbp + 0x9d8]
mov rcx, r12
call fcn.1400ec710
test al, al
je 0x1401cbaf5
mov eax, dword [rbp + 0x9e0]
test eax, eax
jle 0x1401cbaf5
mov rsi, qword [rbp + 0x9e8]
mov r15d, eax
lea r14, [0x140323de0]
nop word [rax + rax]
xor r8d, r8d
mov rdx, qword [rsi]
mov rcx, r12
call fcn.1400ecbd0
mov rdi, rax
test rax, rax
je 0x1401cbadf
mov qword [rbp + 0x698], r14
xor ebx, ebx
mov qword [rbp + 0x6a0], rbx
mov qword [rbp + 0x760], r14
mov qword [rbp + 0x768], rbx
lea r8, [rbp + 0x698]
lea rdx, str.Path
mov rcx, rax
call fcn.1400d5720
test al, al
je 0x1401cbaa6
xor r8d, r8d
lea rdx, str.disabled
lea rcx, [rbp + 0x698]
call fcn.1401e9310
test al, al
jne 0x1401cbaa6
mov r8b, 1
lea rdx, [rbp + 0x698]
mov rcx, qword [r13 + 8]
call fcn.1400f9eb0
mov r14, rax
test rax, rax
je 0x1401cba9f
mov qword [rbp + 0x1f8], rbx
mov edx, dword [rbp + 0x6bc]
test edx, edx
jne 0x1401cb994
lea rax, [0x140323de0]
mov qword [rbp + 0x1f0], rax
jmp 0x1401cb9cb
lea rcx, [rbp + 0x1f0]
call fcn.1401e9030
movsxd r9, dword [rbp + 0x6bc]
mov eax, dword [rbp + 0x1f8]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x6b0]
mov rcx, qword [rbp + 0x1f0]
call fcn.14029b4d8
mov edx, dword [rbp + 0x6bc]
lea rcx, [rbp + 0x1f0]
call fcn.1401ea290
nop
lea rdx, [0x1403232c8]
lea rcx, [rbp + 0x1f0]
call fcn.1401e7680
mov ebx, dword [rbp + 0x1fc]
add ebx, dword [rsi + 0xc]
mov edx, ebx
lea rcx, [rbp + 0x1f0]
call fcn.1401e9030
movsxd r9, dword [rsi + 0xc]
mov ecx, dword [rbp + 0x1f8]
movsxd rax, dword [rbp + 0x1fc]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x1f0]
lea rcx, [rax + rcx*2]
mov r8, qword [rsi]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x1f0]
call fcn.1401ea290
lea rdx, [0x1403232c8]
lea rcx, [rbp + 0x1f0]
call fcn.1401e7680
lea rdx, [rbp + 0x1f0]
mov rcx, r14
call fcn.1400ed120
lea r8, [rbp + 0x760]
lea rdx, str.XPTPath
mov rcx, rdi
call fcn.1400d5720
test al, al
je 0x1401cba8a
lea rdx, [rbp + 0x760]
mov rcx, r14
call fcn.1400e0da0
nop
cmp dword [rbp + 0x1f8], 0
jle 0x1401cba9f
mov rcx, qword [rbp + 0x1f0]
call fcn.140298600
lea r14, [0x140323de0]
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
nop
cmp dword [rbp + 0x768], 0
jle 0x1401cbaca
mov rcx, qword [rbp + 0x760]
call fcn.140298600
nop
cmp dword [rbp + 0x6a0], 0
jle 0x1401cbadf
mov rcx, qword [rbp + 0x698]
call fcn.140298600
add rsi, 0x10
dec r15
jne 0x1401cb8e0
xor esi, esi
lea rbx, vtable.Core::Array_class_Core::String_.0
mov rax, qword [r12]
mov edx, 1
mov rcx, r12
call qword [rax]
nop
mov qword [rbp + 0x9d8], rbx
xor edx, edx
lea rcx, [rbp + 0x9d8]
call fcn.1400c7710
nop
cmp dword [rbp + 0x6b8], 0
jle 0x1401cbb2f
mov rcx, qword [rbp + 0x6b0]
call fcn.140298600
lea rdx, str.HKLMSOFTWAREClassesDirectoryShellexCopyHookHandlers
lea rcx, [rbp + 0x6e0]
call fcn.1401e6fd0
nop
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x6e0]
call fcn.1400ecf50
mov r15, rax
test rax, rax
je 0x1401cbd80
mov qword [rbp + 0x9d8], rbx
mov dword [rbp + 0x9e0], esi
mov qword [rbp + 0x9e8], rsi
xor edx, edx
lea rcx, [rbp + 0x9d8]
call fcn.1400c7710
nop
lea rdx, [rbp + 0x9d8]
mov rcx, r15
call fcn.1400ec710
test al, al
je 0x1401cbd5c
mov eax, dword [rbp + 0x9e0]
test eax, eax
jle 0x1401cbd5c
mov rdi, qword [rbp + 0x9e8]
mov r14d, eax
xor r8d, r8d
mov rdx, qword [rdi]
mov rcx, r15
call fcn.1400ecbd0
mov rsi, rax
test rax, rax
je 0x1401cbd46
lea r12, [0x140323de0]
mov qword [rbp + 0x6c8], r12
xor ebx, ebx
mov qword [rbp + 0x6d0], rbx
lea r8, [rbp + 0x6c8]
xor edx, edx
mov rcx, rax
call fcn.1400d5720
test al, al
je 0x1401cbd23
lea r8d, [rbx + 1]
lea rdx, [0x14032cde8]
lea rcx, [rbp + 0x6c8]
call fcn.1401eb700
test al, al
je 0x1401cbd23
mov qword [rbp + 0x60], rbx
mov edx, dword [rbp + 0x6ec]
test edx, edx
jne 0x1401cbc2f
mov qword [rbp + 0x58], r12
jmp 0x1401cbc5d
lea rcx, [rbp + 0x58]
call fcn.1401e9030
movsxd r9, dword [rbp + 0x6ec]
mov eax, dword [rbp + 0x60]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x6e0]
mov rcx, qword [rbp + 0x58]
call fcn.14029b4d8
mov edx, dword [rbp + 0x6ec]
lea rcx, [rbp + 0x58]
call fcn.1401ea290
nop
mov edx, dword [rbp + 0x64]
inc edx
lea rcx, [rbp + 0x58]
call fcn.1401e9030
movsxd rcx, dword [rbp + 0x64]
mov rax, qword [rbp + 0x58]
mov r12d, 0x5c
mov word [rax + rcx*2], r12w
mov edx, dword [rbp + 0x64]
inc edx
lea rcx, [rbp + 0x58]
call fcn.1401ea290
mov ebx, dword [rbp + 0x64]
add ebx, dword [rdi + 0xc]
mov edx, ebx
lea rcx, [rbp + 0x58]
call fcn.1401e9030
movsxd r9, dword [rdi + 0xc]
mov ecx, dword [rbp + 0x60]
movsxd rax, dword [rbp + 0x64]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x58]
lea rcx, [rax + rcx*2]
mov r8, qword [rdi]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x58]
call fcn.1401ea290
mov edx, dword [rbp + 0x64]
inc edx
lea rcx, [rbp + 0x58]
call fcn.1401e9030
movsxd rcx, dword [rbp + 0x64]
mov rax, qword [rbp + 0x58]
mov word [rax + rcx*2], r12w
mov edx, dword [rbp + 0x64]
inc edx
lea rcx, [rbp + 0x58]
call fcn.1401ea290
lea r8, [rbp + 0x58]
lea rdx, [rbp + 0x6c8]
mov rcx, r13
call fcn.1401c1680
nop
cmp dword [rbp + 0x60], 0
jle 0x1401cbd23
mov rcx, qword [rbp + 0x58]
call fcn.140298600
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax]
nop
cmp dword [rbp + 0x6d0], 0
jle 0x1401cbd46
mov rcx, qword [rbp + 0x6c8]
call fcn.140298600
add rdi, 0x10
dec r14
jne 0x1401cbbb2
xor esi, esi
lea rbx, vtable.Core::Array_class_Core::String_.0
mov rax, qword [r15]
mov edx, 1
mov rcx, r15
call qword [rax]
nop
mov qword [rbp + 0x9d8], rbx
xor edx, edx
lea rcx, [rbp + 0x9d8]
call fcn.1400c7710
nop
cmp dword [rbp + 0x6e8], 0
jle 0x1401cbd95
mov rcx, qword [rbp + 0x6e0]
call fcn.140298600
lea rdx, str.HKLMSOFTWAREWow6432NodeMozillaFirefoxExtensions
lea rcx, [rbp + 0x6f8]
call fcn.1401e6fd0
nop
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x6f8]
call fcn.1400ecf50
mov r12, rax
test rax, rax
je 0x1401cc227
mov qword [rbp + 0x9d8], rbx
mov dword [rbp + 0x9e0], esi
mov qword [rbp + 0x9e8], rsi
xor edx, edx
lea rcx, [rbp + 0x9d8]
call fcn.1400c7710
nop
lea rdx, [rbp + 0x9d8]
mov rcx, r12
call fcn.1400eca70
test al, al
je 0x1401cc211
mov ecx, dword [rbp + 0x9e0]
test ecx, ecx
jle 0x1401cc211
mov rsi, qword [rbp + 0x9e8]
add rsi, 0xc
mov r15d, ecx
lea r14, vtable.Core::ByteArray.0
xor ebx, ebx
nop word [rax + rax]
mov qword [rbp + 0x368], 0
mov edx, dword [rsi]
test edx, edx
jne 0x1401cbe51
lea rdi, [0x140323de0]
mov qword [rbp + 0x360], rdi
jmp 0x1401cbe82
lea rcx, [rbp + 0x360]
call fcn.1401e9030
movsxd r9, dword [rsi]
mov eax, dword [rbp + 0x368]
inc eax
movsxd rdx, eax
mov r8, qword [rsi - 0xc]
mov rcx, qword [rbp + 0x360]
call fcn.14029b4d8
lea rdi, [0x140323de0]
mov edx, dword [rsi]
lea rcx, [rbp + 0x360]
call fcn.1401ea290
nop
mov r8d, 1
lea rdx, [0x14032cde8]
lea rcx, [rbp + 0x360]
call fcn.1401eb700
test al, al
je 0x1401cc1e6
mov qword [rbp + 0x310], rdi
mov qword [rbp + 0x318], 0
lea r8, [rbp + 0x310]
mov rdx, qword [rbp + 0x360]
mov rcx, r12
call fcn.1400d5720
test al, al
je 0x1401cc1d0
lea rdx, str.chromecontentoverlay.xul
lea rcx, [rbp + 0x838]
call fcn.1401e6fd0
nop
lea r8, [rbp + 0x838]
lea rdx, [rbp + 0x310]
lea rcx, [rbp + 0x7f8]
call fcn.1400d1690
nop
cmp dword [rbp + 0x840], 0
jle 0x1401cbf26
mov rcx, qword [rbp + 0x838]
call fcn.140298600
mov qword [rbp + 0xa08], r14
mov dword [rbp + 0xa10], ebx
mov qword [rbp + 0xa18], rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rbp + 0xa20], rax
lea rdx, [rbp + 0xa08]
lea rcx, [rbp + 0x7f8]
call fcn.1401f2430
mov r14, qword [rbp + 0xa18]
test al, al
je 0x1401cc182
mov qword [rbp + 0xa30], 0
movups xmm0, xmmword [0x1403072e8]
movups xmmword [rbp + 0xa38], xmm0
movups xmm1, xmmword [0x1403072f8]
movups xmmword [rbp + 0xa48], xmm1
lea r8, [rbp + 0xa30]
mov edx, dword [rbp + 0xa10]
mov rcx, r14
call fcn.14017c780
lea rdx, [rbp + 0xa30]
lea rcx, [rbp + 0xac0]
call fcn.14017c870
mov r8b, 1
lea rdx, [rbp + 0x7f8]
mov rcx, qword [r13 + 8]
call fcn.1400f9eb0
mov rdi, rax
test rax, rax
je 0x1401cc182
mov qword [rbp + 0x248], 0
mov edx, dword [rbp + 0x704]
test edx, edx
jne 0x1401cbffc
lea rax, [0x140323de0]
mov qword [rbp + 0x240], rax
jmp 0x1401cc033
lea rcx, [rbp + 0x240]
call fcn.1401e9030
movsxd r9, dword [rbp + 0x704]
mov eax, dword [rbp + 0x248]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x6f8]
mov rcx, qword [rbp + 0x240]
call fcn.14029b4d8
mov edx, dword [rbp + 0x704]
lea rcx, [rbp + 0x240]
call fcn.1401ea290
nop
lea rdx, [0x1403232c8]
lea rcx, [rbp + 0x240]
call fcn.1401e7680
mov ebx, dword [rbp + 0x24c]
add ebx, dword [rbp + 0x36c]
mov edx, ebx
lea rcx, [rbp + 0x240]
call fcn.1401e9030
movsxd r9, dword [rbp + 0x36c]
mov ecx, dword [rbp + 0x248]
movsxd rax, dword [rbp + 0x24c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x240]
lea rcx, [rax + rcx*2]
mov r8, qword [rbp + 0x360]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x240]
call fcn.1401ea290
lea rdx, [rbp + 0x240]
mov rcx, rdi
call fcn.1400ed120
mov r8d, 1
lea rdx, [0x1403232c8]
lea rcx, [rbp + 0x310]
call fcn.1401e8ee0
test al, al
jne 0x1401cc11b
mov edx, dword [rbp + 0x31c]
inc edx
lea rcx, [rbp + 0x310]
call fcn.1401e9030
movsxd rcx, dword [rbp + 0x31c]
mov rax, qword [rbp + 0x310]
mov edx, 0x5c
mov word [rax + rcx*2], dx
mov edx, dword [rbp + 0x31c]
inc edx
lea rcx, [rbp + 0x310]
call fcn.1401ea290
lea rdx, [rbp + 0x310]
mov rcx, rdi
call fcn.1400e0da0
lea rdx, [rbp + 0xac0]
mov rcx, rdi
call fcn.14015c0d0
mov rbx, qword [r13 + 8]
cmp qword [rbx + 0x430], 0
je 0x1401cc16b
mov eax, dword [rdi + 0x40]
shr rax, 0x14
test al, 1
jne 0x1401cc15b
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov rdx, rdi
mov rcx, qword [rbx + 0x430]
call fcn.1401be260
nop
cmp dword [rbp + 0x248], 0
jle 0x1401cc180
mov rcx, qword [rbp + 0x240]
call fcn.140298600
xor ebx, ebx
lea rax, vtable.Core::ByteArray.0
mov qword [rbp + 0xa08], rax
test r14, r14
je 0x1401cc1b4
mov r8, r14
xor edx, edx
mov rcx, qword [rbp + 0xa20]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbp + 0xa18], rbx
mov dword [rbp + 0xa10], ebx
cmp dword [rbp + 0x800], 0
jle 0x1401cc1c9
mov rcx, qword [rbp + 0x7f8]
call fcn.140298600
lea r14, vtable.Core::ByteArray.0
cmp dword [rbp + 0x318], 0
jle 0x1401cc1e6
mov rcx, qword [rbp + 0x310]
call fcn.140298600
nop
cmp dword [rbp + 0x368], 0
jle 0x1401cc1fb
mov rcx, qword [rbp + 0x360]
call fcn.140298600
add rsi, 0x10
dec r15
jne 0x1401cbe30
xor esi, esi
lea rbx, vtable.Core::Array_class_Core::String_.0
mov qword [rbp + 0x9d8], rbx
xor edx, edx
lea rcx, [rbp + 0x9d8]
call fcn.1400c7710
nop
cmp dword [rbp + 0x700], 0
jle 0x1401cc23c
mov rcx, qword [rbp + 0x6f8]
call fcn.140298600
mov rcx, r13
call fcn.1401cc720
mov rcx, r13
call fcn.1401ce0c0
mov rax, qword [r13 + 8]
cmp dword [rax + 0x10], 1
je 0x1401cc64e
lea rax, str.SoftwareMicrosoftWindowsShellNoRoamMUICache
mov qword [rbp + 0xd0], rax
lea rax, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsShellMuiCache
mov qword [rbp + 0xd8], rax
mov dword [rsp + 0x70], esi
cmp dword [r13 + 0x18], 0
jle 0x1401cc64e
mov r14, rsi
mov qword [rbp + 0xe0], rsi
mov r15, qword [rbp - 0x80]
nop dword [rax]
nop word [rax + rax]
mov r13d, esi
mov dword [rsp + 0x60], esi
lea rsi, [rbp + 0xd0]
mov qword [rbp - 0x68], rsi
nop dword [rax]
nop word [rax + rax]
lea rdx, [0x1403232e0]
lea rcx, [rbp + 0x68]
call fcn.1401e6fd0
nop
mov edx, dword [rbp + 0x74]
inc edx
lea rcx, [rbp + 0x68]
call fcn.1401e9030
movsxd rcx, dword [rbp + 0x74]
mov rax, qword [rbp + 0x68]
mov r12d, 0x5c
mov word [rax + rcx*2], r12w
mov edx, dword [rbp + 0x74]
inc edx
lea rcx, [rbp + 0x68]
call fcn.1401ea290
mov rdi, qword [r15 + 0x20]
mov ebx, dword [rbp + 0x74]
add ebx, dword [rdi + r14 + 0xc]
mov edx, ebx
lea rcx, [rbp + 0x68]
call fcn.1401e9030
movsxd r9, dword [rdi + r14 + 0xc]
mov ecx, dword [rbp + 0x70]
movsxd rax, dword [rbp + 0x74]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x68]
lea rcx, [rax + rcx*2]
mov r8, qword [rdi + r14]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x68]
call fcn.1401ea290
mov edx, dword [rbp + 0x74]
inc edx
lea rcx, [rbp + 0x68]
call fcn.1401e9030
movsxd rcx, dword [rbp + 0x74]
mov rax, qword [rbp + 0x68]
mov word [rax + rcx*2], r12w
mov edx, dword [rbp + 0x74]
inc edx
lea rcx, [rbp + 0x68]
call fcn.1401ea290
mov rdx, qword [rsi]
lea rcx, [rbp + 0x68]
call fcn.1401e7680
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x68]
call fcn.1400ecf50
mov r12, rax
mov qword [rbp + 0xc0], rax
test rax, rax
je 0x1401cc5fe
lea rax, vtable.Core::Array_class_Core::String_.0
mov qword [rbp + 0x9d8], rax
xor ebx, ebx
mov dword [rbp + 0x9e0], ebx
mov qword [rbp + 0x9e8], rbx
xor edx, edx
lea rcx, [rbp + 0x9d8]
call fcn.1400c7710
nop
lea rdx, [rbp + 0x9d8]
mov rcx, r12
call fcn.1400eca70
test al, al
je 0x1401cc5d2
mov eax, dword [rbp + 0x9e0]
test eax, eax
jle 0x1401cc5d2
mov rsi, qword [rbp + 0x9e8]
lea rdi, [rsi + 0xc]
mov r15d, eax
mov r12, qword [rbp - 0x80]
lea r13, [0x140323de0]
nop dword [rax]
cmp dword [rdi], 2
jl 0x1401cc5a6
mov edx, 1
mov rcx, rsi
call fcn.1401e7500
cmp ax, 0x3a
jne 0x1401cc5a6
mov qword [rbp + 0x418], 0
mov edx, dword [rdi]
test edx, edx
jne 0x1401cc44a
mov qword [rbp + 0x410], r13
jmp 0x1401cc474
lea rcx, [rbp + 0x410]
call fcn.1401e9030
movsxd r9, dword [rdi]
mov eax, dword [rbp + 0x418]
inc eax
movsxd rdx, eax
mov r8, qword [rdi - 0xc]
mov rcx, qword [rbp + 0x410]
call fcn.14029b4d8
mov edx, dword [rdi]
lea rcx, [rbp + 0x410]
call fcn.1401ea290
nop
lea rdx, [rbp + 0x410]
call fcn.1401c36c0
mov r8b, 1
lea rdx, [rbp + 0x410]
mov rcx, qword [r12 + 8]
call fcn.1400f9eb0
mov r14, rax
test rax, rax
je 0x1401cc591
mov qword [rbp + 0x228], 0
mov edx, dword [rbp + 0x74]
test edx, edx
jne 0x1401cc4ca
mov qword [rbp + 0x220], r13
jmp 0x1401cc4f8
lea rcx, [rbp + 0x220]
call fcn.1401e9030
movsxd r9, dword [rbp + 0x74]
mov eax, dword [rbp + 0x228]
inc eax
movsxd rdx, eax
mov r8, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x220]
call fcn.14029b4d8
mov edx, dword [rbp + 0x74]
lea rcx, [rbp + 0x220]
call fcn.1401ea290
nop
lea rdx, [0x1403232c8]
lea rcx, [rbp + 0x220]
call fcn.1401e7680
mov ebx, dword [rbp + 0x22c]
add ebx, dword [rdi]
mov edx, ebx
lea rcx, [rbp + 0x220]
call fcn.1401e9030
movsxd r9, dword [rdi]
mov ecx, dword [rbp + 0x228]
movsxd rax, dword [rbp + 0x22c]
sub ecx, eax
inc ecx
movsxd rdx, ecx
mov rcx, rax
mov rax, qword [rbp + 0x220]
lea rcx, [rax + rcx*2]
mov r8, qword [rdi - 0xc]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rbp + 0x220]
call fcn.1401ea290
lea rdx, [rbp + 0x220]
mov rcx, r14
call fcn.1400e0da0
nop
cmp dword [rbp + 0x228], 0
jle 0x1401cc58f
mov rcx, qword [rbp + 0x220]
call fcn.140298600
xor ebx, ebx
cmp dword [rbp + 0x418], 0
jle 0x1401cc5a6
mov rcx, qword [rbp + 0x410]
call fcn.140298600
add rsi, 0x10
add rdi, 0x10
dec r15
jne 0x1401cc410
mov r12, qword [rbp + 0xc0]
mov r13d, dword [rsp + 0x60]
mov rsi, qword [rbp - 0x68]
mov r14, qword [rbp + 0xe0]
mov r15, qword [rbp - 0x80]
mov rax, qword [r12]
mov edx, 1
mov rcx, r12
call qword [rax]
nop
lea rbx, vtable.Core::Array_class_Core::String_.0
mov qword [rbp + 0x9d8], rbx
xor edx, edx
lea rcx, [rbp + 0x9d8]
call fcn.1400c7710
nop
cmp dword [rbp + 0x70], 0
jle 0x1401cc60d
mov rcx, qword [rbp + 0x68]
call fcn.140298600
inc r13d
mov dword [rsp + 0x60], r13d
add rsi, 8
mov qword [rbp - 0x68], rsi
movsxd rax, r13d
cmp rax, 2
jb 0x1401cc2c0
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
add r14, 0x10
mov qword [rbp + 0xe0], r14
cmp eax, dword [r15 + 0x18]
mov esi, 0
jl 0x1401cc2a0
mov r8, qword [rbp + 0x180]
mov r9, r8
mov r8, qword [r8]
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x180]
call fcn.140009a20
mov rcx, qword [rbp + 0x180]
call fcn.1402012c0
nop
mov rdx, qword [rbp + 0x380]
lea rcx, [rbp + 0xc0]
call fcn.14014c9e0
lea rdx, [rbp + 0x9d0]
lea rcx, [rbp + 0x380]
call fcn.1400e94a0
mov r9, qword [rbp + 0xc0]
mov r8, qword [rax]
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x380]
call fcn.14014c9f0
lea rcx, [rbp + 0x380]
call fcn.140009130
nop
lea rcx, [rbp + 0x7b8]
call fcn.1400c75f0
nop
lea rcx, [rbp + 0x290]
call fcn.140005d80
nop
lea rcx, [rbp - 0x78]
call fcn.140005d80
mov al, 1
mov rcx, qword [rbp + 0xd230]
xor rcx, rsp
call fcn.140297ff0
lea r11, [rsp + 0xd340]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret