Function at 0x140057da0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov rax, qword [0x140300040]
xor rax, rsp
mov qword [rbp + 0x108], rax
mov qword [rsp + 0x60], r9
mov ebx, edx
mov qword [rbp + 0xd8], rcx
mov qword [rbp + 0x48], r9
mov r13, qword [rbp + 0x170]
mov qword [rbp + 0xe0], r13
mov qword [rbp + 0x50], r13
mov rax, qword [rbp + 0x178]
mov qword [rsp + 0x58], rax
mov qword [rbp + 0x58], rax
mov rax, qword [rbp + 0x180]
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0x60], rax
mov rax, qword [rbp + 0x188]
mov qword [rsp + 0x68], rax
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0x190]
mov qword [rsp + 0x70], rax
mov qword [rbp + 0x80], rax
mov rax, qword [rbp + 0x198]
mov qword [rsp + 0x78], rax
mov qword [rbp + 0x70], rax
mov rax, qword [rbp + 0x1a0]
mov qword [rbp - 0x58], rax
mov qword [rbp + 0x78], rax
xor r12d, r12d
mov r15d, r12d
mov dword [rsp + 0x50], r12d
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0x98], r12
mov qword [rbp + 0x98], r12
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xa8], r12
mov qword [rbp + 0xa8], r12
mov qword [rbp + 0xc8], r12
mov r8, r13
mov rdx, r9
lea rcx, [rbp + 0xc8]
call fcn.140029150
nop
mov qword [rbp + 0xe8], r12
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x140058ddc
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0xf0], r12
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x140058de7
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rbp + 0xf0], rax
lea r14, str.SoftwareClasses_
lea rdi, [r12 - 1]
test ebx, ebx
je 0x14005843b
mov qword [rbp - 0x68], r12
mov rax, qword [r13]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x140057f4f
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x140038ca6.0]
mov rcx, rax
test rax, rax
jne 0x140057f73
call fcn.140019590
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x140038ca6.0]
mov rcx, rax
test rax, rax
je 0x140058df2
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x68], rbx
mov dword [rsp + 0x50], 1
mov r15, qword [r13]
movsxd r12, dword [r15 - 0x10]
mov rsi, rdi
nop dword [rax + rax]
inc rsi
cmp word [r14 + rsi*2], 0
jne 0x140057fa0
lea r14d, [rsi + r12]
test r14d, r14d
js 0x140058e08
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x140057fda
mov edx, r14d
lea rcx, [rbp - 0x68]
call fcn.140018ea0
mov rbx, qword [rbp - 0x68]
movsxd rax, esi
lea rsi, [rax + rax]
test rsi, rsi
je 0x14005800f
test rbx, rbx
jne 0x140057ffd
call fcn.1401fed34
mov dword [rax], 0x16
call fcn.1401feb94
jmp 0x14005800f
mov r8, rsi
lea rdx, str.SoftwareClasses_
mov rcx, rbx
call fcn.14022e460
mov r8, r12
add r8, r8
lea rcx, [rsi + rbx]
je 0x140058046
test rcx, rcx
je 0x140058036
test r15, r15
je 0x14005802f
mov rdx, r15
call fcn.14022e460
jmp 0x140058046
xor edx, edx
call fcn.14022eb00
call fcn.1401fed34
mov dword [rax], 0x16
call fcn.1401feb94
cmp r14d, dword [rbx - 0xc]
jg 0x140058e08
mov dword [rbx - 0x10], r14d
movsxd rax, r14d
xor r12d, r12d
mov word [rbx + rax*2], r12w
mov r14, qword [rbp + 0xd8]
mov rsi, qword [r14 + 0x40]
mov rcx, qword [rbp + 0xa0]
test rcx, rcx
je 0x14005807c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0xa0], r12
lea rax, [rbp + 0x104]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
mov ecx, 1
and ecx, 0xfffffffe
mov dword [rsp + 0x50], ecx
lea rdx, [rbx - 0x18]
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400580ed
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
test esi, esi
jne 0x1400581d2
mov rcx, qword [rbp + 0xa0]
test rcx, rcx
je 0x1400581d2
mov dword [rbp + 0x88], r12d
mov dword [rbp + 0xd0], 1
lea rax, [rbp + 0x88]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0xd0]
xor r8d, r8d
lea rdx, [0x140267540]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rbp + 0x88]
test edx, edx
je 0x1400581d2
mov ecx, dword [rbp + 0xd0]
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x14005815f
cmp ecx, 7
jne 0x1400581d2
add rdx, 2
cmovb rdx, rdi
mov ecx, 1
call fcn.14020cf94
mov rbx, rax
test rax, rax
je 0x1400581d2
lea rax, [rbp + 0x88]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0xd0]
xor r8d, r8d
lea rdx, [0x140267540]
mov rcx, qword [rbp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400581ca
mov r8, rdi
nop
inc r8
cmp word [rbx + r8*2], 0
jne 0x1400581b0
mov rdx, rbx
lea rcx, [rbp + 0xe8]
call fcn.140018f50
mov rcx, rbx
call fcn.140207144
mov rbx, qword [r13]
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x1400581e8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x98], r12
lea rax, [rbp + 0xf8]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x98]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140058313
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x140058313
mov dword [rbp + 0x8c], r12d
mov dword [rbp + 0xd4], 1
lea rax, [rbp + 0x8c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0xd4]
xor r8d, r8d
lea rdx, [0x140267540]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rbp + 0x8c]
test edx, edx
je 0x140058313
mov ecx, dword [rbp + 0xd4]
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x1400582a1
cmp ecx, 7
jne 0x140058313
add rdx, 2
cmovb rdx, rdi
mov ecx, 1
call fcn.14020cf94
mov rbx, rax
test rax, rax
je 0x140058313
lea rax, [rbp + 0x8c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0xd4]
xor r8d, r8d
lea rdx, [0x140267540]
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14005830b
mov r8, rdi
inc r8
cmp word [rbx + r8*2], 0
jne 0x1400582f1
mov rdx, rbx
lea rcx, [rbp + 0xf0]
call fcn.140018f50
mov rcx, rbx
call fcn.140207144
cmp qword [rbp + 0xa0], 0
je 0x1400583a4
lea rax, [rbp + 0x30]
mov qword [rbp - 0x70], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 0x78], rax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x80], rax
mov rcx, qword [rbp + 0xe8]
add rcx, 0xffffffffffffffe8
call fcn.140019180
add rax, 0x18
mov qword [rbp + 0x30], rax
mov rsi, qword [rsp + 0x60]
mov rcx, qword [rsi]
sub rcx, 0x18
call fcn.140019180
add rax, 0x18
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0xc8]
add rcx, 0xffffffffffffffe8
call fcn.140019180
add rax, 0x18
mov qword [rbp - 0x48], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x28]
lea r8, [rbp - 0x48]
lea rdx, [rbp + 0xa0]
mov rcx, r14
call fcn.140057210
jmp 0x1400583a9
mov rsi, qword [rsp + 0x60]
cmp qword [rbp + 0x98], 0
je 0x14005842f
lea rax, [rbp - 0x40]
mov qword [rbp - 0x80], rax
lea rax, [rbp - 0x38]
mov qword [rbp - 0x78], rax
lea rax, [rbp - 0x30]
mov qword [rbp - 0x70], rax
mov rcx, qword [rbp + 0xf0]
add rcx, 0xffffffffffffffe8
call fcn.140019180
add rax, 0x18
mov qword [rbp - 0x40], rax
mov rcx, qword [rsi]
sub rcx, 0x18
call fcn.140019180
add rax, 0x18
mov qword [rbp - 0x38], rax
mov rcx, qword [rbp + 0xc8]
add rcx, 0xffffffffffffffe8
call fcn.140019180
add rax, 0x18
mov qword [rbp - 0x30], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0x98]
mov rcx, r14
call fcn.140057210
mov r15d, dword [rsp + 0x50]
lea r14, str.SoftwareClasses_
mov qword [rbp - 0x60], r12
mov rax, qword [rbp + 0xc8]
mov rcx, qword [rax - 0x18]
test rcx, rcx
je 0x140058464
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
call qword [case.0x140038ca6.0]
mov rcx, rax
test rax, rax
jne 0x140058488
call fcn.140019590
mov rdx, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 0x20]
mov rcx, rdx
call qword [case.0x140038ca6.0]
mov rcx, rax
test rax, rax
je 0x140058dfd
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x60], rbx
or r15d, 2
mov dword [rsp + 0x50], r15d
mov r13, qword [rbp + 0xc8]
movsxd r12, dword [r13 - 0x10]
mov rsi, rdi
inc rsi
cmp word [r14 + rsi*2], 0
jne 0x1400584b4
lea r14d, [rsi + r12]
test r14d, r14d
js 0x140058dd1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x1400584ee
mov edx, r14d
lea rcx, [rbp - 0x60]
call fcn.140018ea0
mov rbx, qword [rbp - 0x60]
movsxd rax, esi
lea rsi, [rax + rax]
test rsi, rsi
je 0x140058523
test rbx, rbx
jne 0x140058511
call fcn.1401fed34
mov dword [rax], 0x16
call fcn.1401feb94
jmp 0x140058523
mov r8, rsi
lea rdx, str.SoftwareClasses_
mov rcx, rbx
call fcn.14022e460
mov r8, r12
add r8, r8
lea rcx, [rsi + rbx]
je 0x14005855a
test rcx, rcx
je 0x14005854a
test r13, r13
je 0x140058543
mov rdx, r13
call fcn.14022e460
jmp 0x14005855a
xor edx, edx
call fcn.14022eb00
call fcn.1401fed34
mov dword [rax], 0x16
call fcn.1401feb94
cmp r14d, dword [rbx - 0xc]
jg 0x140058dd1
mov dword [rbx - 0x10], r14d
movsxd rax, r14d
xor r14d, r14d
mov word [rbx + rax*2], r14w
mov r13, qword [rbp + 0xd8]
mov rsi, qword [r13 + 0x40]
mov rcx, qword [rbp + 0xb0]
test rcx, rcx
je 0x140058590
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0xb0], r14
lea rax, [rbp + 0xfc]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
and r15d, 0xfffffffd
mov dword [rsp + 0x50], r15d
lea rdx, [rbx - 0x18]
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1400585fe
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov r15, qword [rsp + 0x58]
test esi, esi
jne 0x140058727
mov rbx, qword [r15]
cmp qword [rbp + 0xb0], 0
je 0x14005864c
test rbx, rbx
je 0x14005864c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
lea r9d, [rsi + 1]
xor r8d, r8d
lea rdx, [0x140267540]
mov rcx, qword [rbp + 0xb0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rax, [rbp - 0x28]
mov qword [rbp - 0x80], rax
lea rax, [rbp - 0x18]
mov qword [rbp - 0x78], rax
lea rax, [rbp - 0x20]
mov qword [rbp - 0x70], rax
lea rax, [rbp - 0x10]
mov qword [rbp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rbp - 0x50], rax
mov rcx, qword [rbp - 0x58]
mov rcx, qword [rcx]
sub rcx, 0x18
call fcn.140019180
add rax, 0x18
mov qword [rbp - 0x28], rax
mov rcx, qword [rsp + 0x78]
mov rcx, qword [rcx]
sub rcx, 0x18
call fcn.140019180
add rax, 0x18
mov qword [rbp - 0x18], rax
mov r14, qword [rsp + 0x70]
mov rcx, qword [r14]
sub rcx, 0x18
call fcn.140019180
add rax, 0x18
mov qword [rbp - 0x20], rax
mov rsi, qword [rsp + 0x68]
mov rcx, qword [rsi]
sub rcx, 0x18
call fcn.140019180
add rax, 0x18
mov qword [rbp - 0x10], rax
mov r12, qword [rbp + 0xc0]
mov rcx, qword [r12]
sub rcx, 0x18
call fcn.140019180
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x10]
lea r8, [rsp + 0x58]
lea rdx, [rbp + 0xb0]
call fcn.1400575d0
jmp 0x140058738
mov r12, qword [rbp + 0xc0]
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x70]
mov rbx, qword [rbp + 0xc8]
mov rcx, qword [rbp + 0xa8]
test rcx, rcx
je 0x140058751
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor edx, edx
mov qword [rbp + 0xa8], rdx
lea rax, [rbp + 0x100]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0xa8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], edx
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400588a9
mov rbx, qword [r15]
cmp qword [rbp + 0xa8], 0
je 0x1400587e4
test rbx, rbx
je 0x1400587e4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, [0x140267540]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rax, [rbp - 8]
mov qword [rbp - 0x50], rax
lea rax, [rbp]
mov qword [rbp + 0x40], rax
lea rax, [rbp + 8]
mov qword [rbp - 0x80], rax
lea rax, [rbp + 0x10]
mov qword [rbp - 0x78], rax
lea rax, [rbp + 0x18]
mov qword [rbp - 0x70], rax
mov rax, qword [rbp - 0x58]
mov rcx, qword [rax]
sub rcx, 0x18
call fcn.140019180
add rax, 0x18
mov qword [rbp - 8], rax
mov rax, qword [rsp + 0x78]
mov rcx, qword [rax]
sub rcx, 0x18
call fcn.140019180
add rax, 0x18
mov qword [rbp], rax
mov rcx, qword [r14]
sub rcx, 0x18
call fcn.140019180
add rax, 0x18
mov qword [rbp + 8], rax
mov rcx, qword [rsi]
sub rcx, 0x18
call fcn.140019180
add rax, 0x18
mov qword [rbp + 0x10], rax
mov rcx, qword [r12]
sub rcx, 0x18
call fcn.140019180
add rax, 0x18
mov qword [rbp + 0x18], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x30], rax
lea rax, [rbp]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x10]
lea r8, [rbp + 0x18]
lea rdx, [rbp + 0xa8]
call fcn.1400575d0
xor esi, esi
mov qword [rbp + 0xb8], rsi
mov qword [rbp + 0xb8], rsi
mov qword [rbp + 0xc0], rsi
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x140058e13
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
lea rbx, [rax + 0x18]
mov qword [rbp + 0xc0], rbx
mov qword [rbp + 0xd8], rsi
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x140058e1e
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rbp + 0xd8], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x50], rax
mov r14, qword [rbp + 0xe0]
mov rcx, qword [r14]
sub rcx, 0x18
call fcn.140019180
add rax, 0x18
mov qword [rbp + 0x20], rax
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x38]
call fcn.14005aa70
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400589ae
cmp dword [rbx + 0x10], esi
jl 0x14005899d
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14005899d
call fcn.140019180
mov rsi, rax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14005898e
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
mov rax, qword [r8 + 8]
call qword [case.0x140038ca6.0]
lea rax, [rsi + 0x18]
mov qword [rbp + 0xc0], rax
xor esi, esi
jmp 0x1400589ae
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp + 0xc0]
call fcn.140018f50
nop
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400589d2
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov rbx, qword [r13 + 0x40]
mov rcx, qword [rbp + 0xb8]
test rcx, rcx
je 0x1400589e8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0xb8], rsi
lea rax, [rbp + 0xb8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp + 0xc0]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140058b1c
mov rcx, qword [rbp + 0xb8]
test rcx, rcx
je 0x140058b1c
mov dword [rbp + 0x90], esi
mov dword [rbp + 0xe0], 1
lea rax, [rbp + 0x90]
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0xe0]
xor r8d, r8d
lea rdx, str.ProgId
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rbp + 0x90]
test edx, edx
je 0x140058b07
mov ecx, dword [rbp + 0xe0]
lea eax, [rcx - 1]
cmp eax, 1
jbe 0x140058a8b
cmp ecx, 7
jne 0x140058b07
add rdx, 2
cmovb rdx, rdi
mov ecx, 1
call fcn.14020cf94
mov rbx, rax
test rax, rax
je 0x140058b07
lea rax, [rbp + 0x90]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0xe0]
xor r8d, r8d
lea rdx, str.ProgId
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140058aff
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x140058ae0
mov rdx, rbx
lea rcx, [rbp + 0xd8]
call fcn.140018f50
mov esi, 1
mov rcx, rbx
call fcn.140207144
cmp esi, 1
jne 0x140058b1a
cmp qword [rbp + 0xc8], 0
je 0x140058dc6
xor esi, esi
mov rdx, qword [rbp + 0xd8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140058b44
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rbp + 0xc0]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140058b6c
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rcx, qword [rbp + 0xb8]
test rcx, rcx
je 0x140058b7e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0xb8], rsi
mov rdx, qword [rbp + 0xf0]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140058bad
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rbp + 0xe8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140058bd5
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rbp + 0xc8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140058bfd
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rcx, qword [rbp + 0xa8]
test rcx, rcx
je 0x140058c0f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0xa8], rsi
mov rcx, qword [rbp + 0xb0]
test rcx, rcx
je 0x140058c28
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0xb0], rsi
mov rcx, qword [rbp + 0x98]
test rcx, rcx
je 0x140058c41
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x98], rsi
mov rcx, qword [rbp + 0xa0]
test rcx, rcx
je 0x140058c5a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0xa0], rsi
mov rdx, qword [rsp + 0x60]
mov rdx, qword [rdx]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140058c8a
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [r14]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140058cae
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [r15]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140058cd2
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140058cf7
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rsp + 0x68]
mov rdx, qword [rdx]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140058d20
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rdx, qword [rsp + 0x70]
mov rdx, qword [rdx]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140058d49
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rax, qword [rsp + 0x78]
mov rdx, qword [rax]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140058d72
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rax, qword [rbp - 0x58]
mov rdx, qword [rax]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140058d97
mov rcx, qword [rdx]
mov r8, qword [rcx]
mov rax, qword [r8 + 8]
call qword [case.0x140038ca6.0]
mov eax, 1
mov rcx, qword [rbp + 0x108]
xor rcx, rsp
call fcn.1401f74b0
mov rbx, qword [rsp + 0x258]
add rsp, 0x210
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140019300
nop
mov ecx, 0x80070057
call fcn.140019300
nop
mov ecx, 0x80004005
call fcn.140019300
nop
mov ecx, 0x80004005
call fcn.140019300
nop
mov ecx, 0x80004005
call fcn.140019300
nop
mov ecx, 0x80004005
call fcn.140019300
nop
mov ecx, 0x80070057
call fcn.140019300
nop
mov ecx, 0x80004005
call fcn.140019300
nop
mov ecx, 0x80004005
call fcn.140019300
int3