Function at 0x1957f44
Capabilities:
Encode data using xor
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4d0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x0195c138]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
xor edx, edx
mov r13, rcx
mov qword [rsp + 0x98], rcx
lea r8d, [rdx + 0x50]
add rcx, 0xdc
call sub.msvcrt.dll_memset
mov r12d, 0x1e0
lea rcx, [r13 + 0x130]
mov r8, r12
xor edx, edx
call sub.msvcrt.dll_memset
lea rcx, [r13 + 0x310]
xor edx, edx
mov r8d, 0x1a40
call sub.msvcrt.dll_memset
xor r14d, r14d
lea r9, [r13 + 0x41c]
mov dword [r13 + 0xdc], r14d
mov dword [r13 + 0xe4], r14d
mov dword [r13 + 0x10c], r14d
lea ebx, [r14 + 0xe]
mov dword [r13 + 0x128], r14d
mov edi, 0x7fff
mov r11d, r14d
lea r10, [r9 - 0x9e]
mov eax, r11d
mov word [r10 + 2], 0x16a
mov word [r10 + 4], r14w
cdq
sub eax, edx
sar eax, 1
mov r8d, eax
mov eax, r11d
add r11d, 1
cdq
and eax, 1
xor eax, edx
sub eax, edx
mov edx, 0x100
mov ecx, eax
mov eax, 0x1f
shl dx, cl
movzx ecx, r8w
shl cx, 4
or dx, cx
mov ecx, r8d
shl ax, cl
mov word [r10 - 2], dx
mov word [r10], ax
add r10, 8
cmp r11d, 0x14
jl 0x1957ffa
mov dword [r9], edi
mov dword [r9 + 4], edi
lea rax, [r9 + 0x20]
mov ecx, 8
mov word [rax], 3
add rax, 0x14
sub rcx, 1
jne 0x1958063
add r9, r12
sub rbx, 1
jne 0x1957ff0
lea edi, [rcx + 1]
lea rbx, [r13 + 0x4f8]
lea r15d, [rcx + 4]
lea rbp, [0x01965a38]
mov eax, dword [r13 + 0x1d90]
lea r9, [0x018e7190]
lea rcx, [rsp + 0xa0]
mov edx, 0x402
mov r8d, 0x201
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
mov sil, 1
call sub.msvcrt.dll__snwprintf_s
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0xa0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, r14d
jne 0x195853e
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, [0x018e7218]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958533
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x40]
lea rdx, [0x018e7228]
mov dword [rbx - 4], eax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958533
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x40]
lea rdx, [0x018e7238]
mov dword [rbx], eax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958533
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x40]
lea rdx, [0x018e7240]
mov dword [rbx + 4], eax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958533
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x40]
lea rdx, [0x018e7258]
mov dword [rbx + 8], eax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958533
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x40]
lea rdx, [0x018e7278]
mov dword [rbx + 0xc], eax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958533
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x40]
lea rdx, [0x018e7298]
mov dword [rbx + 0x10], eax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958533
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x40]
lea rdx, [0x018e72c0]
mov dword [rbx + 0x14], eax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958533
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x40]
lea rdx, [0x018e72d8]
mov dword [rbx + 0x18], eax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958533
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x40]
lea rdx, [0x018e72e8]
mov dword [rbx + 0x1c], eax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958533
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x40]
lea rdx, [0x018e7308]
mov dword [rbx + 0x20], eax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958533
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x40]
lea rdx, [0x018e7330]
mov dword [rbx + 0x24], eax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958533
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x40]
lea rdx, [0x018e7348]
mov dword [rbx + 0x28], eax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958533
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x40]
lea rdx, [0x018e7358]
mov dword [rbx + 0x2c], eax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958533
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x40]
lea rdx, [0x018e7368]
mov dword [rbx + 0x30], eax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958533
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x40]
lea rdx, [0x018e7378]
mov dword [rbx + 0x34], eax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958533
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x40]
lea rdx, [0x018e7398]
mov dword [rbx + 0x38], eax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958533
mov eax, dword [rsp + 0x34]
mov sil, r14b
mov dword [rbx + 0x3c], eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [r13 + 0x1d90]
mov r8d, edi
mov rcx, r13
call fcn.0195b680
cmp sil, r14b
je 0x19585a1
mov rcx, qword [0x01965a38]
cmp rcx, rbp
je 0x1958585
bt dword [rcx + 0x1c], 0x1b
jae 0x1958585
cmp byte [rcx + 0x19], 2
jb 0x1958585
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4320]
mov r9d, edi
mov dx, 0xd
call fcn.018ec0a0
xor edx, edx
mov eax, edi
lea r8d, [rdx + 0x68]
imul rax, rax, 0x1e0
lea rcx, [rax + r13 + 0x310]
call sub.msvcrt.dll_memset
add edi, 1
add rbx, r12
cmp edi, 0xd
jbe 0x1958094
mov ebx, 1
lea rsi, [r13 + 0x608]
mov rdi, 0xffffffff80000002
mov eax, dword [r13 + 0x1d90]
lea r9, [0x018e73c0]
lea rcx, [rsp + 0xa0]
mov edx, 0x402
mov r8d, 0x201
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call sub.msvcrt.dll__snwprintf_s
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0xa0]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, r14d
jne 0x1958a0f
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, [0x018e7448]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, r14d
lea rdx, [0x018e7468]
cmp eax, r14d
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], r15d
cmove ecx, dword [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov dword [rsi - 4], ecx
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958a04
mov ecx, dword [rsp + 0x38]
lea eax, [rcx - 1]
cmp eax, 7
ja 0x1958a04
cmp ecx, r14d
mov dword [rsi], ecx
mov edi, r14d
jbe 0x19589fd
lea r12d, [rdi + 1]
lea r9, [0x018e7488]
lea rcx, [rsp + 0xa0]
mov edx, 0x402
mov r8d, 0x201
mov dword [rsp + 0x20], r12d
call sub.msvcrt.dll__snwprintf_s
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0xa0]
mov bpl, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, r14d
jne 0x19589f7
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
lea rdx, [0x018e7498]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x195894f
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x018e74a8]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x195894f
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x018e74b8]
mov dword [rsp + 0x74], eax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x195894f
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x018e74d0]
mov dword [rsp + 0x78], eax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x195894f
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x018e74e8]
mov dword [rsp + 0x7c], eax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x195894f
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x018e74f8]
mov dword [rsp + 0x80], eax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x195894f
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x018e7508]
mov dword [rsp + 0x84], eax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x195894f
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x018e7518]
mov dword [rsp + 0x88], eax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x195894f
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x50]
lea rdx, [0x018e7530]
mov dword [rsp + 0x8c], eax
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x195894f
mov eax, dword [rsp + 0x34]
mov bpl, r14b
mov dword [rsp + 0x90], eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp bpl, r14b
jne 0x1958986
mov eax, ebx
lea rdx, [rsp + 0x70]
lea rcx, [rax + rax*2]
mov eax, edi
lea rcx, [rax + rcx*8]
lea rax, [rcx + rcx*4]
mov rcx, r13
lea r8, [r13 + rax*4 + 0x42c]
call fcn.0195b600
jmp 0x19589eb
mov rcx, qword [0x01965a38]
lea rax, [0x01965a38]
cmp rcx, rax
je 0x19589c1
bt dword [rcx + 0x1c], 0x1b
jae 0x19589c1
cmp byte [rcx + 0x19], 2
jb 0x19589c1
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4320]
mov r9d, edi
mov dx, 0xf
mov dword [rsp + 0x20], ebx
call fcn.018fc70c
mov eax, ebx
lea rcx, [rax + rax*2]
mov eax, edi
lea rcx, [rax + rcx*8]
lea rax, [rcx + rcx*4]
xor ecx, ecx
mov qword [r13 + rax*4 + 0x42c], rcx
mov qword [r13 + rax*4 + 0x434], rcx
mov dword [r13 + rax*4 + 0x43c], ecx
cmp r12d, dword [rsi]
mov edi, r12d
jb 0x19586a7
mov r12d, 0x1e0
mov rdi, 0xffffffff80000002
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add ebx, 1
add rsi, r12
cmp ebx, 0xd
jbe 0x19585c3
lea r8, [rsp + 0x40]
lea rdx, [0x018e7540]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, r14d
jne 0x1958cdf
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, [0x018e74d0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958a7f
movzx eax, word [rsp + 0x38]
mov word [r13 + 0x120], ax
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, [0x018e75b0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958ac2
movzx eax, word [rsp + 0x34]
mov word [r13 + 0x122], ax
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, [0x018e75c8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958b03
mov eax, dword [rsp + 0x34]
mov dword [r13 + 0xe0], eax
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, [0x018e75f0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
xor r9d, r9d
xor r8d, r8d
mov ebx, r14d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958b4c
mov eax, dword [rsp + 0x34]
mov ebx, 1
mov dword [r13 + 0x114], eax
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, [0x018e7608]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958b90
mov eax, dword [rsp + 0x38]
add ebx, 1
mov dword [r13 + 0x118], eax
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, [0x018e7628]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958bd4
mov eax, dword [rsp + 0x38]
add ebx, 1
mov dword [r13 + 0x11c], eax
mov rcx, qword [rsp + 0x40]
mov eax, r14d
cmp ebx, 3
sete al
lea rdx, [0x018e7648]
xor r9d, r9d
mov dword [r13 + 0x110], eax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958c5c
mov r9d, dword [rsp + 0x38]
mov dword [r13 + 0x124], r9d
mov rcx, qword [0x01965a38]
lea rbp, [0x01965a38]
cmp rcx, rbp
je 0x1958c63
bt dword [rcx + 0x1c], 0x1b
jae 0x1958c63
cmp byte [rcx + 0x19], 3
jb 0x1958c63
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4320]
mov dx, 0x12
call fcn.018ec0a0
jmp 0x1958c63
lea rbp, [0x01965a38]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, [0x018e7670]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958cd2
mov r9d, dword [rsp + 0x38]
mov dword [r13 + 0x128], r9d
mov rcx, qword [0x01965a38]
cmp rcx, rbp
je 0x1958cd2
bt dword [rcx + 0x1c], 0x1b
jae 0x1958cd2
cmp byte [rcx + 0x19], 3
jb 0x1958cd2
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4320]
mov dx, 0x13
call fcn.018ec0a0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1958ce6
lea rbp, [0x01965a38]
lea r8, [rsp + 0x40]
lea rdx, [0x018e7690]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov r12b, 6
cmp eax, r14d
movss xmm6, dword [0x018e7b2c]
jne 0x1959213
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, [0x018e76f8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958d88
movss xmm0, dword [rsp + 0x48]
mulss xmm0, xmm6
cvttss2si r9d, xmm0
mov dword [r13 + 0xe8], r9d
mov rcx, qword [0x01965a38]
cmp rcx, rbp
je 0x1958d88
bt dword [rcx + 0x1c], 0x1b
jae 0x1958d88
cmp byte [rcx + 0x19], r12b
jb 0x1958d88
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4320]
mov dx, 0x14
call fcn.018ec0a0
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, [0x018e74d0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958e01
movss xmm0, dword [rsp + 0x48]
mulss xmm0, xmm6
cvttss2si r9d, xmm0
mov dword [r13 + 0xec], r9d
mov rcx, qword [0x01965a38]
cmp rcx, rbp
je 0x1958e01
bt dword [rcx + 0x1c], 0x1b
jae 0x1958e01
cmp byte [rcx + 0x19], r12b
jb 0x1958e01
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4320]
mov dx, 0x15
call fcn.018ec0a0
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, [0x018e7710]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958e7a
movss xmm0, dword [rsp + 0x48]
mulss xmm0, xmm6
cvttss2si r9d, xmm0
mov dword [r13 + 0xf0], r9d
mov rcx, qword [0x01965a38]
cmp rcx, rbp
je 0x1958e7a
bt dword [rcx + 0x1c], 0x1b
jae 0x1958e7a
cmp byte [rcx + 0x19], r12b
jb 0x1958e7a
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4320]
mov dx, 0x16
call fcn.018ec0a0
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, [0x018e7730]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958ef3
movss xmm0, dword [rsp + 0x48]
mulss xmm0, xmm6
cvttss2si r9d, xmm0
mov dword [r13 + 0xf4], r9d
mov rcx, qword [0x01965a38]
cmp rcx, rbp
je 0x1958ef3
bt dword [rcx + 0x1c], 0x1b
jae 0x1958ef3
cmp byte [rcx + 0x19], r12b
jb 0x1958ef3
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4320]
mov dx, 0x17
call fcn.018ec0a0
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, [0x018e7750]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958f6c
movss xmm0, dword [rsp + 0x48]
mulss xmm0, xmm6
cvttss2si r9d, xmm0
mov dword [r13 + 0x104], r9d
mov rcx, qword [0x01965a38]
cmp rcx, rbp
je 0x1958f6c
bt dword [rcx + 0x1c], 0x1b
jae 0x1958f6c
cmp byte [rcx + 0x19], r12b
jb 0x1958f6c
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4320]
mov dx, 0x18
call fcn.018ec0a0
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, [0x018e7770]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1958fe5
movss xmm0, dword [rsp + 0x48]
mulss xmm0, xmm6
cvttss2si r9d, xmm0
mov dword [r13 + 0x100], r9d
mov rcx, qword [0x01965a38]
cmp rcx, rbp
je 0x1958fe5
bt dword [rcx + 0x1c], 0x1b
jae 0x1958fe5
cmp byte [rcx + 0x19], r12b
jb 0x1958fe5
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4320]
mov dx, 0x19
call fcn.018ec0a0
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, [0x018e7790]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x195904a
mov eax, dword [rsp + 0x38]
mov word [r13 + 0xf8], ax
mov rcx, qword [0x01965a38]
cmp rcx, rbp
je 0x19590bd
bt dword [rcx + 0x1c], 0x1b
jae 0x19590bd
cmp byte [rcx + 0x19], r12b
jb 0x19590bd
mov dx, 0x1a
jmp 0x19590a9
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, [0x018e77b0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x19590bd
mov eax, dword [rsp + 0x38]
mov word [r13 + 0xf8], ax
mov rcx, qword [0x01965a38]
cmp rcx, rbp
je 0x19590bd
bt dword [rcx + 0x1c], 0x1b
jae 0x19590bd
cmp byte [rcx + 0x19], r12b
jb 0x19590bd
mov dx, 0x1b
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4320]
movzx r9d, ax
call fcn.018ec0a0
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, [0x018e77c8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1959122
mov eax, dword [rsp + 0x38]
mov word [r13 + 0xfa], ax
mov rcx, qword [0x01965a38]
cmp rcx, rbp
je 0x1959195
bt dword [rcx + 0x1c], 0x1b
jae 0x1959195
cmp byte [rcx + 0x19], r12b
jb 0x1959195
mov dx, 0x1c
jmp 0x1959181
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, [0x018e77e8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1959195
mov eax, dword [rsp + 0x38]
mov word [r13 + 0xfa], ax
mov rcx, qword [0x01965a38]
cmp rcx, rbp
je 0x1959195
bt dword [rcx + 0x1c], 0x1b
jae 0x1959195
cmp byte [rcx + 0x19], r12b
jb 0x1959195
mov dx, 0x1d
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4320]
movzx r9d, ax
call fcn.018ec0a0
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea rdx, [0x018e7800]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1959208
mov eax, dword [rsp + 0x38]
mov word [r13 + 0xfc], ax
mov rcx, qword [0x01965a38]
cmp rcx, rbp
je 0x1959208
bt dword [rcx + 0x1c], 0x1b
jae 0x1959208
cmp byte [rcx + 0x19], r12b
jb 0x1959208
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4320]
movzx r9d, ax
mov dx, 0x1e
call fcn.018ec0a0
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [r13 + 0x98], r14d
lea r8, [rsp + 0x40]
mov rcx, rdi
lea rdx, [0x018e7820]
jne 0x1959232
lea rdx, [0x018e7880]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, r14d
jne 0x19597d8
mov edi, 1
lea rbx, [r13 + 0x6b0]
mov eax, dword [r13 + 0x1d90]
lea r9, [0x018e78e0]
lea rcx, [rsp + 0xa0]
mov edx, 0x402
mov r8d, 0x201
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], eax
call sub.msvcrt.dll__snwprintf_s
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, r14d
jne 0x19597b1
mov rcx, qword [0x01965a38]
cmp rcx, rbp
je 0x19592d1
bt dword [rcx + 0x1c], 0x1b
jae 0x19592d1
cmp byte [rcx + 0x19], r12b
lea rsi, [0x018e4320]
jb 0x19592d8
mov rcx, qword [rcx + 0x10]
mov r9d, edi
mov r8, rsi
mov dx, 0x1f
call fcn.018ec0a0
jmp 0x19592d8
lea rsi, [0x018e4320]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
lea rdx, [0x018e76f8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x19597a6
movss xmm0, dword [rsp + 0x48]
mulss xmm0, xmm6
cvttss2si r9d, xmm0
mov dword [rbx - 4], r9d
mov rcx, qword [0x01965a38]
cmp rcx, rbp
je 0x195934e
bt dword [rcx + 0x1c], 0x1b
jae 0x195934e
cmp byte [rcx + 0x19], r12b
jb 0x195934e
mov rcx, qword [rcx + 0x10]
mov r8, rsi
mov dx, 0x20
call fcn.018ec0a0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
lea rdx, [0x018e74d0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x19597a6
movss xmm0, dword [rsp + 0x48]
mulss xmm0, xmm6
cvttss2si r9d, xmm0
mov dword [rbx], r9d
mov rcx, qword [0x01965a38]
cmp rcx, rbp
je 0x19593c3
bt dword [rcx + 0x1c], 0x1b
jae 0x19593c3
cmp byte [rcx + 0x19], r12b
jb 0x19593c3
mov rcx, qword [rcx + 0x10]
mov r8, rsi
mov dx, 0x21
call fcn.018ec0a0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
lea rdx, [0x018e7710]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x19597a6
movss xmm0, dword [rsp + 0x48]
mulss xmm0, xmm6
cvttss2si r9d, xmm0
mov dword [rbx + 4], r9d
mov rcx, qword [0x01965a38]
cmp rcx, rbp
je 0x1959439
bt dword [rcx + 0x1c], 0x1b
jae 0x1959439
cmp byte [rcx + 0x19], r12b
jb 0x1959439
mov rcx, qword [rcx + 0x10]
mov r8, rsi
mov dx, 0x22
call fcn.018ec0a0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
lea rdx, [0x018e7730]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x19597a6
movss xmm0, dword [rsp + 0x48]
mulss xmm0, xmm6
cvttss2si r9d, xmm0
mov dword [rbx + 8], r9d
mov rcx, qword [0x01965a38]
cmp rcx, rbp
je 0x19594af
bt dword [rcx + 0x1c], 0x1b
jae 0x19594af
cmp byte [rcx + 0x19], r12b
jb 0x19594af
mov rcx, qword [rcx + 0x10]
mov r8, rsi
mov dx, 0x23
call fcn.018ec0a0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
lea rdx, [0x018e7750]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x19597a6
movss xmm0, dword [rsp + 0x48]
mulss xmm0, xmm6
cvttss2si r9d, xmm0
mov dword [rbx + 0x18], r9d
mov rcx, qword [0x01965a38]
cmp rcx, rbp
je 0x1959525
bt dword [rcx + 0x1c], 0x1b
jae 0x1959525
cmp byte [rcx + 0x19], r12b
jb 0x1959525
mov rcx, qword [rcx + 0x10]
mov r8, rsi
mov dx, 0x24
call fcn.018ec0a0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
lea rdx, [0x018e7770]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x19597a6
movss xmm0, dword [rsp + 0x48]
mulss xmm0, xmm6
cvttss2si r9d, xmm0
mov dword [rbx + 0x14], r9d
mov rcx, qword [0x01965a38]
cmp rcx, rbp
je 0x195959b
bt dword [rcx + 0x1c], 0x1b
jae 0x195959b
cmp byte [rcx + 0x19], r12b
jb 0x195959b
mov rcx, qword [rcx + 0x10]
mov r8, rsi
mov dx, 0x25
call fcn.018ec0a0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
lea rdx, [0x018e7790]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x19595fc
mov eax, dword [rsp + 0x38]
mov word [rbx + 0xc], ax
mov rcx, qword [0x01965a38]
cmp rcx, rbp
je 0x195966b
bt dword [rcx + 0x1c], 0x1b
jae 0x195966b
cmp byte [rcx + 0x19], r12b
jb 0x195966b
mov dx, 0x26
jmp 0x195965b
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
lea rdx, [0x018e77b0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x19597a6
mov eax, dword [rsp + 0x38]
mov word [rbx + 0xc], ax
mov rcx, qword [0x01965a38]
cmp rcx, rbp
je 0x195966b
bt dword [rcx + 0x1c], 0x1b
jae 0x195966b
cmp byte [rcx + 0x19], r12b
jb 0x195966b
mov dx, 0x27
mov rcx, qword [rcx + 0x10]
movzx r9d, ax
mov r8, rsi
call fcn.018ec0a0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
lea rdx, [0x018e78f0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x19596cc
mov eax, dword [rsp + 0x38]
mov word [rbx + 0xe], ax
mov rcx, qword [0x01965a38]
cmp rcx, rbp
je 0x195973b
bt dword [rcx + 0x1c], 0x1b
jae 0x195973b
cmp byte [rcx + 0x19], r12b
jb 0x195973b
mov dx, 0x28
jmp 0x195972b
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
lea rdx, [0x018e77e8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x19597a6
mov eax, dword [rsp + 0x38]
mov word [rbx + 0xe], ax
mov rcx, qword [0x01965a38]
cmp rcx, rbp
je 0x195973b
bt dword [rcx + 0x1c], 0x1b
jae 0x195973b
cmp byte [rcx + 0x19], r12b
jb 0x195973b
mov dx, 0x29
mov rcx, qword [rcx + 0x10]
movzx r9d, ax
mov r8, rsi
call fcn.018ec0a0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
lea rdx, [0x018e7800]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x19597a6
mov eax, dword [rsp + 0x38]
mov word [rbx + 0x10], ax
mov rcx, qword [0x01965a38]
cmp rcx, rbp
je 0x19597a6
bt dword [rcx + 0x1c], 0xb
jae 0x19597a6
cmp byte [rcx + 0x19], r12b
jb 0x19597a6
mov rcx, qword [rcx + 0x10]
movzx r9d, ax
mov r8, rsi
mov dx, 0x2a
call fcn.018ec0a0
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add edi, 1
add rbx, 0x1e0
cmp edi, 0xd
jbe 0x195924d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, 0xffffffff80000002
jmp 0x19597e3
mov dword [r13 + 0x9c], 1
cmp dword [r13 + 0x98], r14d
lea r8, [rsp + 0x40]
mov rcx, rdi
lea rdx, [0x018e7820]
jne 0x1959802
lea rdx, [0x018e7880]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, r14d
jne 0x1959fc0
mov r15d, 1
lea rbp, [r13 + 0x558]
lea esi, [r15 + 0x1d]
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x68], rsi
mov eax, dword [r13 + 0x1d90]
lea r9, [0x018e78e0]
lea rcx, [rsp + 0xa0]
mov edx, 0x402
mov r8d, 0x201
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], eax
call sub.msvcrt.dll__snwprintf_s
mov rcx, qword [rsp + 0x40]
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
cmp eax, r14d
jne 0x1959f92
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
lea rdx, [0x018e7910]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov edi, 4
xor r9d, r9d
xor r8d, r8d
mov ebx, r14d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x19598fc
mov r9d, dword [rsp + 0x38]
lea ebx, [rdi - 3]
mov dword [rbp + 0xa4], r9d
mov rcx, qword [0x01965a38]
lea rax, [0x01965a38]
cmp rcx, rax
je 0x19598fc
bt dword [rcx + 0x1c], 0x1b
jae 0x19598fc
cmp byte [rcx + 0x19], r12b
jb 0x19598fc
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4320]
mov dx, 0x2b
call fcn.018ec0a0
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
lea rdx, [0x018e7940]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1959974
mov r9d, dword [rsp + 0x38]
add ebx, 1
mov dword [rbp + 0xa8], r9d
mov rcx, qword [0x01965a38]
lea rax, [0x01965a38]
cmp rcx, rax
je 0x1959974
bt dword [rcx + 0x1c], 0x1b
jae 0x1959974
cmp byte [rcx + 0x19], r12b
jb 0x1959974
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4320]
mov dx, 0x2c
call fcn.018ec0a0
cmp ebx, r14d
jne 0x19599f7
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
lea rdx, [0x018e7968]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x19599f7
mov r9d, dword [rsp + 0x38]
mov dword [rbp + 0xa4], r9d
mov dword [rbp + 0xa8], r9d
mov rcx, qword [0x01965a38]
lea rbx, [0x01965a38]
cmp rcx, rbx
je 0x19599fe
bt dword [rcx + 0x1c], 0x1b
jae 0x19599fe
cmp byte [rcx + 0x19], r12b
jb 0x19599fe
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4320]
mov dx, 0x2d
call fcn.018ec0a0
jmp 0x19599fe
lea rbx, [0x01965a38]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x30]
lea rdx, [0x018e7988]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1959ff8
mov eax, dword [rsp + 0x38]
mov dword [rbp], eax
mov rcx, qword [0x01965a38]
cmp rcx, rbx
je 0x1959a79
bt dword [rcx + 0x1c], 0x1b
jae 0x1959a79
cmp byte [rcx + 0x19], r12b
jb 0x1959a79
mov eax, dword [r13 + 0x1d90]
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4320]
mov r9d, r15d
mov dx, 0x2e
mov dword [rsp + 0x20], eax
call fcn.018fc70c
cmp dword [rbp], 0
mov ebx, r14d
jbe 0x1959f84
lea eax, [rbx + 1]
lea r9, [0x018e7488]
lea rcx, [rsp + 0xa0]
mov edx, 0x402
mov r8d, 0x201
mov dword [rsp + 0x64], eax
mov dword [rsp + 0x20], eax
call sub.msvcrt.dll__snwprintf_s
mov rcx, qword [rsp + 0x50]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1959f3c
lea rax, [r14 + rsi]
xor edi, edi
lea r15, [0x01965a38]
add rax, rax
mov esi, 0x201
lea r12, [r13 + rax*8 + 0x37e]
lea r13d, [rdi + 1]
lea r9, [0x018e79a0]
lea rcx, [rsp + 0xa0]
mov r8, rsi
mov edx, 0x402
mov dword [rsp + 0x20], r13d
call sub.msvcrt.dll__snwprintf_s
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0xa0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, dword [rsp + 0x38]
mov esi, r11d
mov edx, r11d
and r11d, 0xff0f
and esi, 0x80
and edx, 0xffff0000
mov dword [rsp + 0x38], r11d
xor ecx, ecx
mov eax, 0x10000
shl eax, cl
test edx, eax
je 0x1959b81
mov eax, ecx
shl eax, 4
or r11d, eax
xor edx, edx
add ecx, 1
cmp ecx, 0xa
jb 0x1959b6c
lea r9, [0x018e79b8]
lea rcx, [rsp + 0xa0]
mov edx, 0x402
mov r8d, 0x201
mov dword [rsp + 0x38], r11d
mov word [r12 - 2], r11w
mov dword [rsp + 0x20], r13d
call sub.msvcrt.dll__snwprintf_s
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x30]
lea rdx, [rsp + 0xa0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, dword [rsp + 0x38]
mov word [r12], r11w
mov rcx, qword [0x01965a38]
cmp rcx, r15
je 0x1959c30
bt dword [rcx + 0x1c], 0x1b
jae 0x1959c30
cmp byte [rcx + 0x19], 6
jb 0x1959c30
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4320]
movzx r9d, r11w
mov dx, 0x2f
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
call fcn.018fc604
test esi, esi
mov esi, 0x201
jne 0x1959d12
lea r9, [0x018e79c8]
lea rcx, [rsp + 0xa0]
mov r8, rsi
mov edx, 0x402
mov dword [rsp + 0x20], r13d
call sub.msvcrt.dll__snwprintf_s
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0xa0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1959ca0
mov eax, dword [rsp + 0x38]
shr eax, 8
jmp 0x1959d14
lea r9, [0x018e79e0]
lea rcx, [rsp + 0xa0]
mov r8, rsi
mov edx, 0x402
mov dword [rsp + 0x20], r13d
call sub.msvcrt.dll__snwprintf_s
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0xa0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, dword [rsp + 0x38]
cvtsi2ss xmm0, r11
divss xmm0, dword [0x018e7b28]
call fcn.01917980
movzx eax, ax
jmp 0x1959d14
xor eax, eax
mov dword [rsp + 0x38], eax
mov word [r12 + 2], ax
mov rcx, qword [0x01965a38]
cmp rcx, r15
je 0x1959d57
bt dword [rcx + 0x1c], 0x1b
jae 0x1959d57
cmp byte [rcx + 0x19], 6
jb 0x1959d57
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4320]
movzx r9d, ax
mov dx, 0x30
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
call fcn.018fc604
lea r9, [0x018e79f8]
lea rcx, [rsp + 0xa0]
mov r8, rsi
mov edx, 0x402
mov dword [rsp + 0x20], r13d
call sub.msvcrt.dll__snwprintf_s
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
lea rdx, [rsp + 0xa0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1959df8
mov rcx, qword [0x01965a38]
cmp rcx, r15
je 0x1959dec
bt dword [rcx + 0x1c], 0x1b
jae 0x1959dec
cmp byte [rcx + 0x19], 6
jb 0x1959dec
movsx r9d, word [rsp + 0x34]
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4320]
mov dx, 0x31
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
call fcn.018fc604
mov edx, dword [rsp + 0x34]
sar edx, 8
jmp 0x1959ec6
lea r9, [0x018e7a10]
lea rcx, [rsp + 0xa0]
mov r8, rsi
mov edx, 0x402
mov dword [rsp + 0x20], r13d
call sub.msvcrt.dll__snwprintf_s
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x34]
lea rdx, [rsp + 0xa0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1959e76
mov rcx, qword [0x01965a38]
cmp rcx, r15
je 0x1959eae
bt dword [rcx + 0x1c], 0x1b
jae 0x1959eae
cmp byte [rcx + 0x19], 6
jb 0x1959eae
mov r9d, dword [rsp + 0x34]
mov dx, 0x32
jmp 0x1959e96
mov rcx, qword [0x01965a38]
cmp rcx, r15
je 0x1959eae
bt dword [rcx + 0x1c], 0x1b
jae 0x1959eae
cmp byte [rcx + 0x19], 6
jb 0x1959eae
mov r9d, eax
mov dx, 0x33
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4320]
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
call fcn.018fc604
mov ecx, dword [rsp + 0x34]
mov eax, 0x51eb851f
shl ecx, 8
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [rsp + 0x34], edx
mov word [r12 + 4], dx
mov rcx, qword [0x01965a38]
cmp rcx, r15
je 0x1959f09
bt dword [rcx + 0x1c], 0x1b
jae 0x1959f09
cmp byte [rcx + 0x19], 6
jb 0x1959f09
mov rcx, qword [rcx + 0x10]
movsx r9d, dx
lea r8, [0x018e4320]
mov dx, 0x34
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], ebx
call fcn.018fc604
add r12, 8
cmp r13d, 2
mov edi, r13d
jl 0x1959aed
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15d, dword [rsp + 0x60]
mov r13, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x68]
mov r12b, 6
jmp 0x1959f73
mov rcx, qword [0x01965a38]
lea rax, [0x01965a38]
cmp rcx, rax
je 0x1959f73
bt dword [rcx + 0x1c], 0x1b
jae 0x1959f73
cmp byte [rcx + 0x19], r12b
jb 0x1959f73
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4320]
mov r9d, r15d
mov dx, 0x35
call fcn.018ec0a0
mov ebx, dword [rsp + 0x64]
add r14, 1
cmp ebx, dword [rbp]
jb 0x1959a86
xor r14d, r14d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add r15d, 1
add rsi, 0x1e
add rbp, 0x1e0
cmp r15d, 0xd
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x68], rsi
jbe 0x195982c
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.018fdad0
lea r11, [rsp + 0x4d0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rcx, qword [0x01965a38]
cmp rcx, rbx
je 0x1959f87
bt dword [rcx + 0x1c], 0x1b
jae 0x1959f87
cmp byte [rcx + 0x19], r12b
jb 0x1959f87
mov eax, dword [rbp]
mov rcx, qword [rcx + 0x10]
lea r8, [0x018e4320]
mov r9d, r15d
mov dx, 0x36
mov dword [rsp + 0x20], eax
call fcn.018fc70c
jmp 0x1959f87