Function at 0x1400056c0
Capabilities:
Delete directory
Delete registry value
Enumerate files on windows
Get installed programs
Persist via run registry key
Print debug messages
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x598]
sub rsp, 0x690
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
mov rax, qword [0x140078038]
xor rax, rsp
mov qword [rbp + 0x560], rax
xor r14d, r14d
mov dword [rsp + 0x40], r14d
call fcn.140005150
lea rdx, [0x140078aa8]
lea rcx, [rbp + 8]
call fcn.140009d00
nop
lea rcx, [rbp + 8]
call fcn.140009980
mov r8, rax
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], r14b
cmp qword [rbp + 0x18], rax
cmovb r8, qword [rbp + 0x18]
lea rdx, [rbp + 8]
cmp qword [rbp + 0x20], 0x10
cmovae rdx, qword [rbp + 8]
lea rcx, [rsp + 0x68]
call fcn.14000a5a0
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x14000579d
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005798
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c8e
call fcn.140013ee4
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rbp + 8], xmm0
movups xmm1, xmmword [rsp + 0x78]
movups xmmword [rbp + 0x18], xmm1
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp - 0x68], xmm0
mov byte [rbp - 0x78], 0
mov r8d, 0x21
lea rdx, str._n_____DIAS_installation_folder___
lea rcx, [rbp - 0x78]
call fcn.14000a5a0
nop
cmp byte [0x140078a81], 0
je 0x14000585a
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call fcn.140009d00
nop
mov r8d, 1
lea rdx, [0x14006bbcc]
lea rcx, [rsp + 0x68]
call fcn.14000a720
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x14000585a
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005854
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c94
call fcn.140013ee4
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x140005895
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005890
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c9a
call fcn.140013ee4
lea rcx, [rbp + 8]
call fcn.140007780
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], r14
mov rdi, qword [rbp + 0x18]
lea rsi, [rbp + 8]
cmp qword [rbp + 0x20], 0x10
cmovae rsi, qword [rbp + 8]
cmp rdi, 0x10
jae 0x1400058d4
movups xmm0, xmmword [rsi]
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x40], 0xf
mov ebx, 0xf
jmp 0x140005952
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmova rbx, rax
lea rax, [rbx + 1]
cmp rax, 0x1000
jb 0x140005929
lea rcx, [rax + 0x27]
mov rdx, 0xffffffffffffffff
cmp rcx, rax
cmovbe rcx, rdx
call fcn.1400139a4
mov rcx, rax
test rax, rax
je 0x140006ca0
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000593b
test rax, rax
je 0x140005938
mov rcx, rax
call fcn.1400139a4
jmp 0x14000593b
mov rax, r14
mov qword [rbp - 0x58], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.140021dd0
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x48], rdi
lea rcx, [rbp - 0x58]
call fcn.140009980
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
cmp rdi, rax
cmovb rax, rdi
lea rdx, [rbp - 0x58]
cmp rbx, 0x10
cmovae rdx, qword [rbp - 0x58]
mov r8, rax
lea rcx, [rsp + 0x68]
call fcn.14000a5a0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1400059ce
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400059c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006ca6
call fcn.140013ee4
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rsp + 0x78]
movups xmmword [rbp - 0x48], xmm1
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp - 0x68], xmm0
mov byte [rbp - 0x78], 0
mov r8d, 0x15
lea rdx, str._n_____Canon_folder___
lea rcx, [rbp - 0x78]
call fcn.14000a5a0
nop
cmp byte [0x140078a81], 0
je 0x140005a8b
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call fcn.140009d00
nop
mov r8d, 1
lea rdx, [0x14006bbcc]
lea rcx, [rsp + 0x68]
call fcn.14000a720
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x140005a8b
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006cac
call fcn.140013ee4
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x140005ac7
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ac1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006cb2
call fcn.140013ee4
nop
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov dword [rsp + 0x40], 7
mov rdx, qword [rbp - 0x48]
add rdx, 0xc
lea rcx, [rsp + 0x68]
call fcn.14000ce70
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rdx, str.__del_dir_:
lea rcx, [rsp + 0x68]
call fcn.14000a720
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae rdx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x48]
lea rcx, [rsp + 0x68]
call fcn.14000a720
lea rcx, [rsp + 0x68]
call fcn.140001ec0
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x140005b6e
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005b69
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006cb8
call fcn.140013ee4
xor edx, edx
mov r8d, 0x140
lea rcx, [rbp + 0xf0]
call fcn.1400163a0
lea r8, [0x14006c168]
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0xc8]
call fcn.14000b220
nop
xor dil, dil
lea rcx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 0x10
cmovae rcx, qword [rbp + 0xc8]
lea rdx, [rbp + 0xf0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
test rax, rax
je 0x140005cc1
nop dword [rax]
lea rdx, [0x14006c16c]
lea rcx, [rbp + 0x11c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x140005c26
lea rdx, [0x14006c170]
lea rcx, [rbp + 0x11c]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x140005c26
test byte [rbp + 0xf0], 0x10
je 0x140005c3c
mov r8d, 4
lea rdx, [rbp + 0x11c]
lea rcx, str.DIAS
call fcn.1400226c0
test eax, eax
jne 0x140005c3c
lea rdx, [rbp + 0xf0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x140005c3f
jmp 0x140005bd0
mov dil, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
test dil, dil
je 0x140005cc1
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov r8d, 0x21
lea rdx, str.____not_empty._skipped_deletion.
lea rcx, [rsp + 0x68]
call fcn.14000a5a0
nop
lea rcx, [rsp + 0x68]
call fcn.140001ec0
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x140005ce2
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005cba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006cbe
call fcn.140013ee4
jmp 0x140005ce2
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 0x10
cmovae rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x140005ce2
lea rcx, [rbp - 0x58]
call fcn.140008130
mov rax, qword [0x140078b48]
sub rax, qword [0x140078b40]
sar rax, 5
cmp rax, 1
jbe 0x140005d04
mov ebx, 3
jmp 0x140005f71
lea rdx, [0x140078b28]
lea rcx, [rbp - 0x38]
call fcn.1400096f0
nop
mov qword [rbp - 0x68], r14
mov eax, 0xf
mov qword [rbp - 0x60], rax
mov byte [rbp - 0x78], 0
lea ebx, [rax - 0xc]
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
cmp rcx, rdx
je 0x140005ede
lea rsi, [0x140078ae8]
mov edi, ebx
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], 0
or ebx, 0x10
mov dword [rsp + 0x40], ebx
mov rdx, qword [0x140078af8]
inc rdx
lea rcx, [rsp + 0x68]
call fcn.14000ce70
mov rdx, rsi
cmp qword [0x140078b00], 0x10
cmovae rdx, qword [0x140078ae8]
mov r8, qword [0x140078af8]
lea rcx, [rsp + 0x68]
call fcn.14000a720
mov r8d, 1
lea rdx, [0x14006bbe4]
lea rcx, [rsp + 0x68]
call fcn.14000a720
mov rax, qword [rbp - 0x30]
lea rdx, [rax - 0x20]
cmp qword [rax - 8], 0x10
jb 0x140005dbe
mov rdx, qword [rax - 0x20]
mov r8, qword [rax - 0x10]
lea rcx, [rsp + 0x68]
call fcn.14000a720
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov ebx, edi
or ebx, 0x30
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x140005e22
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e1d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006cca
call fcn.140013ee4
movups xmmword [rbp - 0x78], xmm6
movups xmmword [rbp - 0x68], xmm7
and ebx, 0xffffffef
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x140005e69
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e64
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006cd0
call fcn.140013ee4
lea rcx, [rbp - 0x78]
call fcn.140007560
mov rdi, qword [rbp - 0x30]
mov rdx, qword [rdi - 8]
cmp rdx, 0x10
jb 0x140005eb1
mov rcx, qword [rdi - 0x20]
inc rdx
cmp rdx, 0x1000
jb 0x140005eac
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006cd6
mov rcx, r8
call fcn.140013ee4
mov qword [rdi - 0x10], r14
mov qword [rdi - 8], 0xf
mov byte [rdi - 0x20], 0
mov rdx, qword [rbp - 0x30]
sub rdx, 0x20
mov qword [rbp - 0x30], rdx
mov rcx, qword [rbp - 0x38]
cmp rcx, rdx
jne 0x140005d41
mov rax, qword [rbp - 0x60]
cmp rax, 0x10
jb 0x140005f1e
lea rdx, [rax + 1]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f11
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006cc4
call fcn.140013ee4
mov rdx, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x38]
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], 0
test rcx, rcx
je 0x140005f71
call fcn.14000c640
mov rdx, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x38]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f6c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006cdc
call fcn.140013ee4
mov edi, ebx
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp - 0x68], xmm0
mov byte [rbp - 0x78], 0
mov r8d, 0x1b
lea rdx, str._n_____registry_entries____
lea rcx, [rbp - 0x78]
call fcn.14000a5a0
nop
cmp byte [0x140078a81], 0
je 0x140006022
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call fcn.140009d00
nop
mov r8d, 1
lea rdx, [0x14006bbcc]
lea rcx, [rsp + 0x68]
call fcn.14000a720
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x140006022
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000601c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006ce2
call fcn.140013ee4
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x14000605d
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006058
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006ce8
call fcn.140013ee4
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SOFTWARECanonCBTSETUPCBTUser
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400062c7
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], 0xf
mov byte [rbp - 0x78], al
lea r8d, [rax + 0x20]
lea rdx, str.SOFTWARECanonCBTSETUPCBTUser
lea rcx, [rbp - 0x78]
call fcn.14000a5a0
nop
lea rdx, str.DIAS
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
nop
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp - 0x28], xmm0
mov byte [rbp - 0x38], 0
or ebx, 0x40
mov dword [rsp + 0x40], ebx
mov rbx, qword [rbp - 0x68]
lea rdx, [rbx + 0xf]
lea rcx, [rbp - 0x38]
call fcn.14000ce70
mov r8d, 0xf
lea rdx, [0x14006c1b0]
lea rcx, [rbp - 0x38]
call fcn.14000a720
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rdx, qword [rbp - 0x78]
mov r8, rbx
lea rcx, [rbp - 0x38]
call fcn.14000a720
mov r8d, 9
lea rdx, str.__Value:
lea rcx, [rbp - 0x38]
call fcn.14000a720
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x78], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov eax, edi
or eax, 0xc0
mov dword [rsp + 0x40], eax
mov r8d, 4
lea rdx, str.DIAS
lea rcx, [rsp + 0x68]
call fcn.14000a720
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x38], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
or edi, 0x1c0
mov dword [rsp + 0x40], edi
lea rcx, [rbp + 0x28]
call fcn.140001ec0
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x1400061eb
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400061e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006cee
call fcn.140013ee4
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x140006227
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006222
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006cf4
call fcn.140013ee4
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140006275
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006270
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006cfa
call fcn.140013ee4
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x1400062c7
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400062c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d00
call fcn.140013ee4
mov rax, qword [0x140078b48]
sub rax, qword [0x140078b40]
sar rax, 5
cmp rax, 1
ja 0x1400063c7
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov r8d, 0x12
lea rdx, str.SOFTWARECanonCBT
lea rcx, [rsp + 0x68]
call fcn.14000a5a0
nop
lea rdx, [rsp + 0x68]
call fcn.140007000
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x140006355
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006350
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d06
call fcn.140013ee4
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov r8d, 0x12
lea rdx, str.SOFTWARECanonCBT
lea rcx, [rsp + 0x68]
call fcn.14000a5a0
nop
lea rdx, [rsp + 0x68]
call fcn.140006d60
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x1400063c7
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400063c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d0c
call fcn.140013ee4
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp + 0x78], xmm0
mov byte [rbp + 0x68], 0
mov r8d, 0x13
lea rdx, str.SOFTWARECanonDIAS
lea rcx, [rbp + 0x68]
call fcn.14000a5a0
nop
lea rdx, [rbp + 0x68]
call fcn.140007000
lea rdx, [rbp + 0x68]
call fcn.140006d60
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp - 8], xmm0
mov byte [rbp - 0x18], 0
mov r8d, 0x13
lea rdx, str.SOFTWARECanonDIAS
lea rcx, [rbp - 0x18]
call fcn.14000a5a0
nop
lea rcx, [rbp - 0x18]
call fcn.140009980
mov r8, rax
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp + 0x38], xmm0
mov byte [rbp + 0x28], 0
cmp qword [rbp - 8], rax
cmovb r8, qword [rbp - 8]
lea rdx, [rbp - 0x18]
cmp qword [rbp], 0x10
cmovae rdx, qword [rbp - 0x18]
lea rcx, [rbp + 0x28]
call fcn.14000a5a0
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x1400064a1
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000649c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d12
call fcn.140013ee4
movups xmm0, xmmword [rbp + 0x28]
movups xmmword [rbp - 0x18], xmm0
movdqu xmm1, xmmword [rbp + 0x38]
movups xmmword [rbp - 8], xmm1
lea rdx, [rbp - 0x18]
movq rcx, xmm0
psrldq xmm1, 8
movq rax, xmm1
cmp rax, 0x10
cmovae rdx, rcx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140006594
mov ebx, r14d
mov edi, r14d
mov dword [rsp + 0x40], 0x104
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x40]
lea r8, [rbp + 0x340]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
je 0x14000657c
mov edi, 1
inc ebx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x40]
lea r8, [rbp + 0x340]
mov edx, ebx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x140006541
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x140006594
lea rdx, [rbp - 0x18]
call fcn.140006d60
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp + 0x58], xmm0
mov byte [rbp + 0x48], 0
mov r8d, 0x38
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallDIAS
lea rcx, [rbp + 0x48]
call fcn.14000a5a0
nop
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp - 0x68], xmm0
mov byte [rbp - 0x78], 0
mov r8d, 0x2e
lea rdx, str._n____registry_the_installer_might_have_set___
lea rcx, [rbp - 0x78]
call fcn.14000a5a0
nop
cmp byte [0x140078a81], 0
je 0x14000666b
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call fcn.140009d00
nop
mov r8d, 1
lea rdx, [0x14006bbcc]
lea rcx, [rsp + 0x68]
call fcn.14000a720
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x14000666b
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006665
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d18
call fcn.140013ee4
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x1400066a6
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400066a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d1e
call fcn.140013ee4
lea rdx, [rbp + 0x48]
call fcn.140007000
lea rdx, [rbp + 0x48]
call fcn.140006d60
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp - 0x68], xmm0
mov byte [rbp - 0x78], 0
mov r8d, 0x31
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRunonce
lea rcx, [rbp - 0x78]
call fcn.14000a5a0
nop
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov r8d, 0x49
lea rdx, str._n____registry_for_the_startup_progs___obsolete_for_the_current_DIAS_____
lea rcx, [rsp + 0x68]
call fcn.14000a5a0
nop
lea rcx, [rsp + 0x68]
call fcn.140001ec0
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x140006752
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000674d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d24
call fcn.140013ee4
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rdx, qword [rbp - 0x78]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1400067c7
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x1400068ee
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400068e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c88
jmp 0x1400068e9
mov ebx, r14d
mov dword [rsp + 0x50], 0x104
mov dword [rsp + 0x40], 0x104
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x450]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x50]
lea r8, [rbp + 0x230]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x1400068a7
mov r8d, 8
lea rdx, str.DiasCmd
lea rcx, [rbp + 0x230]
call fcn.140022440
test eax, eax
jne 0x14000684f
lea rdx, [rbp + 0x230]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
inc ebx
mov dword [rsp + 0x50], 0x104
mov dword [rsp + 0x40], 0x104
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x450]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x50]
lea r8, [rbp + 0x230]
mov edx, ebx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
je 0x140006820
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x1400068ee
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400068e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d2a
call fcn.140013ee4
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp + 0xb8], xmm0
mov byte [rbp + 0xa8], 0
mov r8d, 0x35
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRunServices
lea rcx, [rbp + 0xa8]
call fcn.14000a5a0
nop
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp + 0x98], xmm0
mov byte [rbp + 0x88], 0
mov r8d, 9
lea rdx, str.CanonDIAS
lea rcx, [rbp + 0x88]
call fcn.14000a5a0
nop
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov r8d, 0x4f
lea rdx, str._n____registry_for_the_startup_Win9x_progs___obsolete_for_the_current_DIAS_____
lea rcx, [rsp + 0x68]
call fcn.14000a5a0
nop
lea rcx, [rsp + 0x68]
call fcn.140001ec0
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x1400069c2
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400069bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d30
call fcn.140013ee4
lea r8, [rbp + 0x88]
lea rdx, [rbp + 0xa8]
call fcn.1400071a0
nop
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0x10
jb 0x140006a17
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006a12
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d36
call fcn.140013ee4
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp + 0x98], xmm0
mov byte [rbp + 0x88], 0
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0x10
jb 0x140006a6f
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006a6a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d3c
call fcn.140013ee4
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp + 0xb8], xmm0
mov byte [rbp + 0xa8], 0
mov rdx, qword [rbp + 0x60]
cmp rdx, 0x10
jb 0x140006ac1
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006abc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d42
call fcn.140013ee4
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp + 0x58], xmm0
mov byte [rbp + 0x48], 0
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x140006b0d
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d48
call fcn.140013ee4
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp - 8], xmm0
mov byte [rbp - 0x18], 0
mov rdx, qword [rbp + 0x80]
cmp rdx, 0x10
jb 0x140006b5c
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b57
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d4e
call fcn.140013ee4
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp + 0x78], xmm0
mov byte [rbp + 0x68], 0
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0x10
jb 0x140006bae
inc rdx
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006ba9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d54
call fcn.140013ee4
movdqa xmm0, xmmword [0x14006ce90]
movdqu xmmword [rbp + 0xd8], xmm0
mov byte [rbp + 0xc8], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x140006c00
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006bfb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006d5a
call fcn.140013ee4
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
mov rdx, qword [rbp + 0x20]
cmp rdx, 0x10
jb 0x140006c47
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006c42
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006c82
call fcn.140013ee4
mov eax, 1
mov rcx, qword [rbp + 0x560]
xor rcx, rsp
call fcn.140013980
lea r11, [rsp + 0x690]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop rbp
ret
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
int3
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
int3
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
int3
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
int3
call fcn.140022b6c
int3
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
nop
call fcn.140022b6c
int3