Function at 0x1400b4da0
Capabilities:
Check if file exists
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
lea rbp, [rsp - 0x200]
sub rsp, 0x300
mov rax, qword [0x1403a8088]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
cmp dword [0x14045ebc8], 0
je 0x1400b4df3
movzx ecx, word [0x14045e53c]
call fcn.140084710
test eax, eax
je 0x1400b5d12
mov qword [rsp + 0x58], 4
mov qword [rsp + 0x60], 1
jmp 0x1400b4e05
mov qword [rsp + 0x58], 2
mov qword [rsp + 0x60], 2
mov qword [rsp + 0x310], rbx
lea r10, [0x14033bcf8]
mov qword [rsp + 0x318], rsi
lea rcx, [0x14033c140]
mov qword [rsp + 0x320], rdi
lea r8, [0x14033bd30]
mov qword [rsp + 0x2f8], r12
mov qword [rsp + 0x2f0], r13
mov qword [rsp + 0x2e8], r14
xor r14d, r14d
mov esi, r14d
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x2e0], r15
nop dword [rax]
mov rbx, r14
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x48], rbx
mov edi, r14d
cmp dword [0x14045e968], 0
jne 0x1400b5caf
movsxd rax, edi
mov r9d, 0x20019
imul rdx, rax, 0x208
cmp dword [0x14045ebc8], 0
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
je 0x1400b4ea4
add rdx, rcx
jmp 0x1400b4ea7
add rdx, r8
mov rcx, qword [r10 + rsi*8]
mov r8d, 4
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b5c81
mov rcx, qword [rbp - 0x60]
lea r9, [rbp - 0x4c]
mov qword [rsp + 0x38], r14
lea r8, [rbp - 0x40]
mov qword [rsp + 0x30], r14
xor edx, edx
mov qword [rsp + 0x28], r14
mov r13d, r14d
mov qword [rsp + 0x20], r14
mov dword [rbp - 0x4c], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x1400b5c77
xor edi, edi
nop
inc r13d
cmp dword [0x14045e968], 0
jne 0x1400b5c66
mov rcx, qword [rbp - 0x60]
lea rax, [rbp - 0x68]
mov r9d, 1
mov qword [rbp - 0x68], rdi
lea rdx, [rbp - 0x40]
mov dword [rbp - 0x50], edi
mov r12, rdi
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 3]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b4fe0
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400b4fef
lea rax, [rbp - 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
lea rdx, [0x14033b6b8]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b4fe0
mov eax, dword [rbp - 0x50]
test eax, eax
je 0x1400b4fe0
add eax, 4
mov ecx, eax
mov dword [rbp - 0x50], eax
call fcn.14012a2dc
mov r12, rax
test rax, rax
je 0x1400b4fe0
mov r8d, dword [rbp - 0x50]
xor edx, edx
mov rcx, rax
call fcn.14027b2c0
mov rcx, qword [rbp - 0x68]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
xor r8d, r8d
mov qword [rsp + 0x20], r12
lea rdx, [0x14033b6b8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b4fd5
cmp dword [rbp - 0x50], eax
ja 0x1400b4fe0
mov rcx, r12
call fcn.14012a2d4
mov r12, rdi
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400b4fef
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x60]
lea rax, [rbp - 0x68]
mov r9d, 1
mov qword [rbp - 0x68], rdi
lea rdx, [rbp - 0x40]
mov dword [rbp - 0x50], edi
mov r15, rdi
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 3]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b50bf
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400b50ce
lea rax, [rbp - 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
lea rdx, str.QuietDisplayName
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b50bf
mov eax, dword [rbp - 0x50]
test eax, eax
je 0x1400b50bf
add eax, 4
mov ecx, eax
mov dword [rbp - 0x50], eax
call fcn.14012a2dc
mov r15, rax
test rax, rax
je 0x1400b50bf
mov r8d, dword [rbp - 0x50]
xor edx, edx
mov rcx, rax
call fcn.14027b2c0
mov rcx, qword [rbp - 0x68]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
xor r8d, r8d
mov qword [rsp + 0x20], r15
lea rdx, str.QuietDisplayName
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b50b4
cmp dword [rbp - 0x50], eax
ja 0x1400b50bf
mov rcx, r15
call fcn.14012a2d4
mov r15, rdi
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400b50ce
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r12, r12
jne 0x1400b50dc
test r15, r15
je 0x1400b5c1a
mov rcx, qword [rbp - 0x60]
lea rax, [rbp - 0x68]
mov r9d, 1
mov qword [rbp - 0x68], rdi
lea rdx, [rbp - 0x40]
mov dword [rbp - 0x50], edi
mov r14, rdi
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 3]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b51ac
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400b51bb
lea rax, [rbp - 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
lea rdx, [0x14033b6f8]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b51ac
mov eax, dword [rbp - 0x50]
test eax, eax
je 0x1400b51ac
add eax, 4
mov ecx, eax
mov dword [rbp - 0x50], eax
call fcn.14012a2dc
mov r14, rax
test rax, rax
je 0x1400b51ac
mov r8d, dword [rbp - 0x50]
xor edx, edx
mov rcx, rax
call fcn.14027b2c0
mov rcx, qword [rbp - 0x68]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
xor r8d, r8d
mov qword [rsp + 0x20], r14
lea rdx, [0x14033b6f8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b51a1
cmp dword [rbp - 0x50], eax
ja 0x1400b51ac
mov rcx, r14
call fcn.14012a2d4
mov r14, rdi
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400b51bb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x60]
lea rax, [rbp - 0x68]
xor esi, esi
mov qword [rbp - 0x68], rdi
lea rdx, [rbp - 0x40]
mov dword [rbp - 0x50], esi
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 1]
lea r8d, [rsi + 4]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b5288
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400b5297
lea rax, [rbp - 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
lea rdx, [0x14033a8c8]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b5288
mov eax, dword [rbp - 0x50]
test eax, eax
je 0x1400b5288
add eax, 4
mov ecx, eax
mov dword [rbp - 0x50], eax
call fcn.14012a2dc
mov rdi, rax
test rax, rax
je 0x1400b5288
mov r8d, dword [rbp - 0x50]
xor edx, edx
mov rcx, rax
call fcn.14027b2c0
mov rcx, qword [rbp - 0x68]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, [0x14033a8c8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b527d
cmp dword [rbp - 0x50], esi
ja 0x1400b5288
mov rcx, rdi
call fcn.14012a2d4
mov rdi, rsi
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400b5297
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x60]
lea rax, [rbp - 0x68]
mov r9d, 1
mov qword [rbp - 0x68], rsi
lea rdx, [rbp - 0x40]
mov dword [rbp - 0x50], esi
mov rbx, rsi
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 3]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b5367
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400b5376
lea rax, [rbp - 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
lea rdx, [0x14033b638]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b5367
mov eax, dword [rbp - 0x50]
test eax, eax
je 0x1400b5367
add eax, 4
mov ecx, eax
mov dword [rbp - 0x50], eax
call fcn.14012a2dc
mov rbx, rax
test rax, rax
je 0x1400b5367
mov r8d, dword [rbp - 0x50]
xor edx, edx
mov rcx, rax
call fcn.14027b2c0
mov rcx, qword [rbp - 0x68]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [0x14033b638]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b535c
cmp dword [rbp - 0x50], esi
ja 0x1400b5367
mov rcx, rbx
call fcn.14012a2d4
mov rbx, rsi
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400b5376
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14, r14
jne 0x1400b5389
test rdi, rdi
jne 0x1400b5389
test rbx, rbx
je 0x1400b5c18
mov ecx, 0x4b0
call fcn.14012a618
xor edx, edx
mov r8d, 0x4b0
mov rcx, rax
mov rsi, rax
call fcn.14027b2c0
cmp dword [0x14045ebc8], 0
lea rdx, [0x14033bcf8]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rdx + rax*8]
lea rdx, [rsi + 8]
mov qword [rsi], rcx
je 0x1400b5442
imul r8, qword [rsp + 0x48], 0x208
lea rax, [0x14033c140]
mov ecx, 2
add r8, rax
nop
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [r8]
lea r8, [r8 + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm1, xmmword [r8 - 0x70]
movups xmmword [rdx - 0x70], xmm1
movups xmm0, xmmword [r8 - 0x60]
movups xmmword [rdx - 0x60], xmm0
movups xmm1, xmmword [r8 - 0x50]
movups xmmword [rdx - 0x50], xmm1
movups xmm0, xmmword [r8 - 0x40]
movups xmmword [rdx - 0x40], xmm0
movups xmm1, xmmword [r8 - 0x30]
movups xmmword [rdx - 0x30], xmm1
movups xmm0, xmmword [r8 - 0x20]
movups xmmword [rdx - 0x20], xmm0
movups xmm1, xmmword [r8 - 0x10]
movups xmmword [rdx - 0x10], xmm1
sub rcx, 1
jne 0x1400b53e0
mov eax, dword [r8]
mov dword [rdx], eax
jmp 0x1400b54b7
imul rax, qword [rsp + 0x48], 0x208
lea rcx, [0x14033bd30]
add rax, rcx
mov ecx, 2
nop word [rax + rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [rdx - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x10], xmm1
sub rcx, 1
jne 0x1400b5460
mov ecx, dword [rax]
mov dword [rdx], ecx
lea rcx, [rsi + 0x210]
mov edx, 2
lea rax, [rbp - 0x40]
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x1400b54d0
mov eax, dword [rax]
lea r9d, [rdx + 1]
mov dword [rcx], eax
lea r8d, [rdx + 4]
mov qword [rsi + 0x458], rdi
lea rdx, [rbp - 0x40]
mov qword [rsi + 0x430], rbx
test r12, r12
mov qword [rsi + 0x420], r15
mov rax, r15
cmovne rax, r12
mov qword [rsi + 0x428], r14
mov qword [rsi + 0x418], rax
xor edi, edi
mov rcx, qword [rbp - 0x60]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov ebx, edi
mov qword [rbp - 0x68], rdi
mov dword [rbp - 0x50], edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b5623
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400b5632
lea rax, [rbp - 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
lea rdx, str.InstallDate
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b5623
mov eax, dword [rbp - 0x50]
test eax, eax
je 0x1400b5623
add eax, 4
mov ecx, eax
mov dword [rbp - 0x50], eax
call fcn.14012a2dc
mov rbx, rax
test rax, rax
je 0x1400b5623
mov r8d, dword [rbp - 0x50]
xor edx, edx
mov rcx, rax
call fcn.14027b2c0
mov rcx, qword [rbp - 0x68]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.InstallDate
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b5618
cmp dword [rbp - 0x50], edi
ja 0x1400b5623
mov rcx, rbx
call fcn.14012a2d4
mov rbx, rdi
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400b5632
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsi + 0x438], rbx
lea rax, [rbp - 0x68]
mov rcx, qword [rbp - 0x60]
lea rdx, [rbp - 0x40]
mov r9d, 1
mov qword [rbp - 0x68], rdi
mov rbx, rdi
mov dword [rbp - 0x50], edi
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 3]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b5709
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400b5718
lea rax, [rbp - 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
lea rdx, [0x14033b680]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b5709
mov eax, dword [rbp - 0x50]
test eax, eax
je 0x1400b5709
add eax, 4
mov ecx, eax
mov dword [rbp - 0x50], eax
call fcn.14012a2dc
mov rbx, rax
test rax, rax
je 0x1400b5709
mov r8d, dword [rbp - 0x50]
xor edx, edx
mov rcx, rax
call fcn.14027b2c0
mov rcx, qword [rbp - 0x68]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [0x14033b680]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b56fe
cmp dword [rbp - 0x50], edi
ja 0x1400b5709
mov rcx, rbx
call fcn.14012a2d4
mov rbx, rdi
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400b5718
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsi + 0x440], rbx
lea rax, [rbp - 0x68]
mov rcx, qword [rbp - 0x60]
lea rdx, [rbp - 0x40]
mov r9d, 1
mov qword [rbp - 0x68], rdi
mov rbx, rdi
mov dword [rbp - 0x50], edi
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 3]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b57ef
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400b57fe
lea rax, [rbp - 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
lea rdx, [0x14033b798]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b57ef
mov eax, dword [rbp - 0x50]
test eax, eax
je 0x1400b57ef
add eax, 4
mov ecx, eax
mov dword [rbp - 0x50], eax
call fcn.14012a2dc
mov rbx, rax
test rax, rax
je 0x1400b57ef
mov r8d, dword [rbp - 0x50]
xor edx, edx
mov rcx, rax
call fcn.14027b2c0
mov rcx, qword [rbp - 0x68]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [0x14033b798]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b57e4
cmp dword [rbp - 0x50], edi
ja 0x1400b57ef
mov rcx, rbx
call fcn.14012a2d4
mov rbx, rdi
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400b57fe
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsi + 0x448], rbx
lea rax, [rbp - 0x68]
mov rcx, qword [rbp - 0x60]
lea rdx, [rbp - 0x40]
mov r9d, 1
mov qword [rbp - 0x68], rdi
mov rbx, rdi
mov dword [rbp - 0x50], edi
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 3]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b58d5
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400b58e4
lea rax, [rbp - 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
lea rdx, [0x14033b7b8]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b58d5
mov eax, dword [rbp - 0x50]
test eax, eax
je 0x1400b58d5
add eax, 4
mov ecx, eax
mov dword [rbp - 0x50], eax
call fcn.14012a2dc
mov rbx, rax
test rax, rax
je 0x1400b58d5
mov r8d, dword [rbp - 0x50]
xor edx, edx
mov rcx, rax
call fcn.14027b2c0
mov rcx, qword [rbp - 0x68]
lea rax, [rbp - 0x50]
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [0x14033b7b8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b58ca
cmp dword [rbp - 0x50], edi
ja 0x1400b58d5
mov rcx, rbx
call fcn.14012a2d4
mov rbx, rdi
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1400b58e4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9d, 1
mov qword [rsi + 0x450], rbx
mov rcx, qword [rbp - 0x60]
lea rax, [rbp - 0x58]
lea rdx, [rbp - 0x40]
mov qword [rbp - 0x58], rdi
mov dword [rbp - 0x50], edi
lea r8d, [r9 + 3]
mov dword [rbp - 0x68], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b5950
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1400b595f
lea rax, [rbp - 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044b738]
lea rax, [rbp - 0x50]
lea rdx, [0x14033b7d8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1400b595f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rbp - 0x50]
lea rdx, [rbp - 0x40]
mov dword [rsi + 0x460], eax
mov r9d, 1
mov rcx, qword [rbp - 0x60]
lea rax, [rbp - 0x58]
mov qword [rbp - 0x58], rdi
mov dword [rbp - 0x50], edi
lea r8d, [r9 + 3]
mov dword [rbp - 0x68], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b59cd
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1400b59dc
lea rax, [rbp - 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044b738]
lea rax, [rbp - 0x50]
lea rdx, [0x14033b7f8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1400b59dc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rbp - 0x50]
lea rdx, [rbp - 0x40]
mov dword [rsi + 0x464], eax
mov r9d, 1
mov rcx, qword [rbp - 0x60]
lea rax, [rbp - 0x58]
mov qword [rbp - 0x58], rdi
mov dword [rbp - 0x50], edi
lea r8d, [r9 + 3]
mov dword [rbp - 0x68], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b5a4a
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1400b5a59
lea rax, [rbp - 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044b738]
lea rax, [rbp - 0x50]
lea rdx, [0x14033b718]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1400b5a59
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rbp - 0x50]
lea rdx, [rbp - 0x40]
mov dword [rsi + 0x468], eax
mov r9d, 1
mov rcx, qword [rbp - 0x60]
lea rax, [rbp - 0x58]
mov qword [rbp - 0x58], rdi
mov dword [rbp - 0x50], edi
lea r8d, [r9 + 3]
mov dword [rbp - 0x68], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b5ac7
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1400b5ad6
lea rax, [rbp - 0x68]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044b738]
lea rax, [rbp - 0x50]
lea rdx, str.EstimatedSize
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x1400b5ad6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rbp - 0x50]
mov rcx, rsi
mov dword [rsi + 0x46c], eax
call fcn.1400b4300
xor edx, edx
mov dword [rsi + 0x4a4], eax
mov rcx, rsi
call fcn.1400b3b50
mov qword [rsi + 0x480], rax
test rax, rax
je 0x1400b5b78
mov rcx, rax
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400b5b78
cmp dword [rsi + 0x4a4], edi
jne 0x1400b5b78
lea rdx, [0x140460248]
lea rcx, [rsp + 0x68]
call fcn.140070880
mov rdx, rax
mov rcx, rsi
call fcn.1400b4860
mov dword [rsi + 0x494], eax
test eax, eax
jne 0x1400b5b78
lea rdx, [0x1404602f8]
lea rcx, [rbp - 0x80]
call fcn.140070880
mov rcx, qword [rsi + 0x480]
mov rdx, rax
call fcn.1400b4b00
mov dword [rsi + 0x490], eax
test eax, eax
jne 0x1400b5b78
xor edx, edx
mov rcx, rsi
call fcn.1400b43b0
mov qword [rsi + 0x488], rax
cmp dword [rsi + 0x46c], edi
ja 0x1400b5bfe
cmp dword [rsi + 0x4a4], edi
jne 0x1400b5bfe
mov rbx, qword [rsi + 0x480]
test rbx, rbx
je 0x1400b5bfe
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x1400b5bfe
lea r8d, [rax + 1]
mov rcx, rbx
lea rdx, str.:_Extend_:_Recycle.Bin_:BOOT_:EFI_:Windows_:Windows_:Users_:Documents_and_Settings_:ProgramData_:ProgramDataPackages_:ProgramDataPackages_:ProgramDataPackage_Cache_:ProgramDataPackage_Cache_:Program_Files__x86__:Program_Files__x86_Microsoft_:Program_Files_:Program_FilesMicrosoft_:Program_FilesWindows_:Program_FilesWindowsApps_:UsersAppData_:UsersAppDataLocal_:UsersAppDataLocalOneDrive_:UsersAppDataLocalPackages_:UsersAppDataLocalTemp_:UsersAppDataLocalMicrosoft_:UsersAppDataLocalMicrosoftWindows_:UsersAppDataLocalLow_:UsersAppDataLocalLowMicrosoft_:UsersAppDataRoaming_:UsersAppDataRoamingMicrosoft_:UsersOneDrive_:UsersDocuments_:UsersDesktop_
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecExW]
test eax, eax
je 0x1400b5bfe
mov rdi, qword [rsi + 0x480]
mov edx, 1
mov rcx, rdi
lea r8d, [rdx + 2]
call fcn.1400526c0
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400b5bfc
lea r9, [rsi + 0x470]
mov r8, rdi
lea rdx, [0x140082180]
mov rcx, rax
call fcn.140052980
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov rcx, qword [0x14045df08]
xor r9d, r9d
mov r8, rsi
mov edx, 0x591
call qword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1400b5c1a
xor edi, edi
xor edx, edx
mov dword [rbp - 0x4c], 0x104
mov r8d, 0x208
lea rcx, [rbp - 0x40]
call fcn.14027b2c0
mov rcx, qword [rbp - 0x60]
lea r9, [rbp - 0x4c]
mov qword [rsp + 0x38], rdi
lea r8, [rbp - 0x40]
mov qword [rsp + 0x30], rdi
mov edx, r13d
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x1400b4f00
mov rbx, qword [rsp + 0x48]
xor r14d, r14d
mov edi, dword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
lea rcx, [0x14033c140]
inc rbx
mov dword [rsp + 0x40], edi
lea r8, [0x14033bd30]
mov qword [rsp + 0x48], rbx
lea r10, [0x14033bcf8]
cmp rbx, qword [rsp + 0x58]
jl 0x1400b4e70
inc rsi
mov qword [rsp + 0x50], rsi
cmp rsi, qword [rsp + 0x60]
jl 0x1400b4e60
mov rcx, qword [0x14045df08]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x592
call qword [sym.imp.USER32.dll_PostMessageW]
mov r15, qword [rsp + 0x2e0]
mov r14, qword [rsp + 0x2e8]
mov r13, qword [rsp + 0x2f0]
mov r12, qword [rsp + 0x2f8]
mov rdi, qword [rsp + 0x320]
mov rsi, qword [rsp + 0x318]
mov rbx, qword [rsp + 0x310]
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.14012a2b0
add rsp, 0x300
pop rbp
ret