Function at 0x430ee0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d943d
mov eax, dword fs:[0]
push eax
sub esp, 0xaf0
mov eax, dword [0x65bfd4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor edi, edi
mov dword [ebp - 0xa08], edi
push 0x62b5d4
lea ecx, [ebp - 0x868]
call fcn.00412820
mov dword [ebp - 4], edi
call fcn.00419a30
cmp dword [eax + 4], 4
jl 0x430f43
push ecx
lea ecx, [ebp - 0x868]
call fcn.00411390
mov byte [ebp - 4], 1
push str.6.4.6
lea ecx, [ebp - 0x9e0]
call fcn.0045a550
mov esi, eax
mov byte [ebp - 4], 2
push 0
push 0x116b7
lea ecx, [ebp - 0x84c]
call fcn.0041b290
mov byte [ebp - 4], 3
push 0
push esi
push eax
call fcn.00447420
mov byte [ebp - 4], 4
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x844]
call fcn.00407500
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x9e0]
call fcn.0045a830
mov dword [ebp - 0x9d4], 0x3e8
mov dword [ebp - 0x9ec], 0
mov dword [ebp - 0x9e8], 0
mov dword [ebp - 0x9e4], 0
mov byte [ebp - 4], 5
push 0x20019
push str.SoftwareIntelNetwork_ServicesDMIX
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x9ec]
call fcn.0042fb10
test eax, eax
jne 0x4310e4
mov dword [ebp - 0xa24], 0x7d0
mov dword [ebp - 0x9d4], eax
lea eax, [ebp - 0xa24]
push eax
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0x9d8]
push eax
push 0
push str.OEMVersion
push dword [ebp - 0x9ec]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call ebx
test eax, eax
jne 0x4311e3
mov eax, dword [ebp - 0x9d8]
cmp eax, 1
je 0x431048
cmp eax, 2
jne 0x4311e3
mov ecx, dword [ebp - 0xa24]
test ecx, ecx
je 0x43106f
test cl, 1
jne 0x4311e3
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x7e6], 0
je 0x431078
jmp 0x4311e3
xor eax, eax
mov word [ebp - 0x7e4], ax
shr ecx, 1
mov dword [ebp - 0x9d4], ecx
lea eax, [ebp - 0x7e4]
push eax
lea ecx, [ebp - 0x9e0]
call fcn.00442f70
mov esi, eax
mov byte [ebp - 4], 6
push 0
push 0x116d1
lea ecx, [ebp - 0x908]
call fcn.0041b290
mov byte [ebp - 4], 7
push 0
push esi
push eax
call fcn.00447420
mov byte [ebp - 4], 8
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x900]
call fcn.00407500
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x9e0]
call fcn.00443020
jmp 0x4311e3
push 0x20119
push str.SoftwareIntelNetwork_ServicesDMIX
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x9ec]
call fcn.0042fb10
test eax, eax
jne 0x4311dd
mov dword [ebp - 0xa28], 0x7d0
mov dword [ebp - 0x9d4], eax
lea eax, [ebp - 0xa28]
push eax
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0x9d8]
push eax
push 0
push str.OEMVersion
push dword [ebp - 0x9ec]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call ebx
test eax, eax
jne 0x4311e3
mov eax, dword [ebp - 0x9d8]
cmp eax, 1
je 0x43115c
cmp eax, 2
jne 0x4311e3
mov ecx, dword [ebp - 0xa28]
test ecx, ecx
je 0x43117c
test cl, 1
jne 0x4311e3
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x7e6], 0
je 0x431185
jmp 0x4311e3
xor eax, eax
mov word [ebp - 0x7e4], ax
shr ecx, 1
mov dword [ebp - 0x9d4], ecx
lea eax, [ebp - 0x7e4]
push eax
lea ecx, [ebp - 0x9e0]
call fcn.00442f70
mov esi, eax
mov byte [ebp - 4], 9
push 0
push 0x116d1
lea ecx, [ebp - 0x9d0]
call fcn.0041b290
mov byte [ebp - 4], 0xa
push 0
push esi
push eax
call fcn.00447420
mov byte [ebp - 4], 0xb
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x9c8]
jmp 0x4310cb
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x9d4], 0x3e8
push 0x20019
push str.SoftwareIntelWirelessCommonAppFrameworkSettings
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x9ec]
call fcn.0042fb10
test eax, eax
jne 0x4312e7
mov dword [ebp - 0xa04], 0x7d0
mov dword [ebp - 0x9d4], eax
lea eax, [ebp - 0xa04]
push eax
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0x9d8]
push eax
push 0
push str.PROSetVersion
push dword [ebp - 0x9ec]
call ebx
test eax, eax
jne 0x431512
mov eax, dword [ebp - 0x9d8]
cmp eax, 1
je 0x43125f
cmp eax, 2
jne 0x431512
mov ecx, dword [ebp - 0xa04]
test ecx, ecx
je 0x431286
test cl, 1
jne 0x431512
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x7e6], 0
je 0x43128f
jmp 0x431512
xor eax, eax
mov word [ebp - 0x7e4], ax
shr ecx, 1
mov dword [ebp - 0x9d4], ecx
lea eax, [ebp - 0x7e4]
push eax
lea ecx, [ebp - 0x9e0]
call fcn.00442f70
mov esi, eax
mov byte [ebp - 4], 0xc
push 0
push 0x116c9
lea ecx, [ebp - 0x9a8]
call fcn.0041b290
mov byte [ebp - 4], 0xd
push 0
push esi
push eax
call fcn.00447420
mov byte [ebp - 4], 0xe
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x9a0]
jmp 0x4314fe
push 0x20019
push str.SoftwareIntelWirelessAppFrameworkSettings
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x9ec]
call fcn.0042fb10
test eax, eax
jne 0x4313e1
mov dword [ebp - 0xa00], 0x7d0
mov dword [ebp - 0x9d4], eax
lea eax, [ebp - 0xa00]
push eax
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0x9d8]
push eax
push 0
push str.PROSetVersion
push dword [ebp - 0x9ec]
call ebx
test eax, eax
jne 0x431512
mov eax, dword [ebp - 0x9d8]
cmp eax, 1
je 0x431359
cmp eax, 2
jne 0x431512
mov ecx, dword [ebp - 0xa00]
test ecx, ecx
je 0x431380
test cl, 1
jne 0x431512
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x7e6], 0
je 0x431389
jmp 0x431512
xor eax, eax
mov word [ebp - 0x7e4], ax
shr ecx, 1
mov dword [ebp - 0x9d4], ecx
lea eax, [ebp - 0x7e4]
push eax
lea ecx, [ebp - 0x9e0]
call fcn.00442f70
mov esi, eax
mov byte [ebp - 4], 0xf
push 0
push 0x116c9
lea ecx, [ebp - 0x980]
call fcn.0041b290
mov byte [ebp - 4], 0x10
push 0
push esi
push eax
call fcn.00447420
mov byte [ebp - 4], 0x11
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x978]
jmp 0x4314fe
push 0x20119
push str.SoftwareIntelWirelessCommonAppFrameworkSettings
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x9ec]
call fcn.0042fb10
lea ecx, [ebp - 0x9ec]
test eax, eax
jne 0x431475
lea eax, [ebp - 0x9d4]
push eax
lea eax, [ebp - 0x7e4]
push eax
push str.PROSetVersion
call fcn.0042fc10
test eax, eax
jne 0x431512
lea eax, [ebp - 0x7e4]
push eax
lea ecx, [ebp - 0x9e0]
call fcn.00442f70
mov esi, eax
mov byte [ebp - 4], 0x12
push 0
push 0x116c9
lea ecx, [ebp - 0x958]
call fcn.0041b290
mov byte [ebp - 4], 0x13
push 0
push esi
push eax
call fcn.00447420
mov byte [ebp - 4], 0x14
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x950]
jmp 0x4314fe
push 0x20119
push str.SoftwareIntelWirelessAppFrameworkSettings
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042fb10
test eax, eax
jne 0x431512
lea eax, [ebp - 0x9d4]
push eax
lea eax, [ebp - 0x7e4]
push eax
push str.PROSetVersion
lea ecx, [ebp - 0x9ec]
call fcn.0042fc10
test eax, eax
jne 0x431512
lea eax, [ebp - 0x7e4]
push eax
lea ecx, [ebp - 0x9e0]
call fcn.00442f70
mov esi, eax
mov byte [ebp - 4], 0x15
push 0
push 0x116c9
lea ecx, [ebp - 0x890]
call fcn.0041b290
mov byte [ebp - 4], 0x16
push 0
push esi
push eax
call fcn.00447420
mov byte [ebp - 4], 0x17
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x888]
call fcn.00407500
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x9e0]
call fcn.00443020
xor ebx, ebx
mov dword [ebp - 0xa20], ebx
or esi, 0xffffffff
cmp ebx, 0x64
jae 0x43200d
mov dword [ebp - 0xadc], 0x629548
mov dword [ebp - 0xacc], 0x629540
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
mov dword [ebp - method.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov byte [ebp - 4], 0x18
or edi, 1
mov dword [ebp - 0xa08], edi
sub esp, 8
lea eax, [ebp - 0xac4]
push eax
lea ecx, [ebp - 0xadc]
call fcn.004146f0
mov dword [ebp - 4], 0x1a
lea eax, [ebp - 0xacc]
mov dword [ebp - 0xa0c], eax
mov eax, dword [ebp - 0xacc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0xacc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0xad0], eax
mov dword [ebp - 4], 0x1c
mov eax, dword [ebp - 0xadc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0xadc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ebp + ecx - 0xae0], eax
mov dword [ebp - 4], 0x1d
mov eax, dword [ebp - 0xadc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebp - 0xadc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0xae0], eax
lea eax, [ebp - 0xac4]
mov dword [ebp - 0xa0c], eax
mov ecx, eax
call fcn.004147a0
mov byte [ebp - 4], 0x1e
mov dword [ebp - method.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov dword [ebp - 0xa8c], 0
mov dword [ebp - 0xaf8], 0
mov dword [ebp - 0xa88], 0
mov byte [ebp - 4], 0x1f
mov byte [ebp - 4], 0x20
mov eax, dword [ebp - 0xadc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xabc], 4
mov dword [ebp + eax - 0xab8], 0
mov eax, dword [ebp - 0xadc]
mov eax, dword [eax + 4]
mov ecx, 0x30
mov word [ebp + eax - 0xa9c], cx
push ebx
lea ecx, [ebp - 0xacc]
call fcn.00413d60
lea ecx, [ebp - 0x7fc]
call fcn.004079ab
mov byte [ebp - 4], 0x21
mov edi, dword [ebp - 0x7e8]
cmp edi, 0x4e
jb 0x4316e3
lea esi, [ebp - 0x7fc]
cmp edi, 8
cmovae esi, dword [ebp - 0x7fc]
mov dword [ebp - 0x7ec], 0x4e
push 0x9c
push str.systemCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318_
push esi
call fcn.005ad520
add esp, 0xc
xor eax, eax
mov word [esi + 0x9c], ax
jmp 0x43182f
mov dword [ebp - 0x81c], VariantInit
mov dword [ebp - 0xafc], 8
mov dword [ebp - 0xaf4], VariantInit
mov dword [ebp - 0xaf0], VariantInit
mov dword [ebp - 0x820], VariantInit
mov dword [ebp - 0xae4], 8
mov dword [ebp - 0xaec], VariantInit
mov dword [ebp - 0xae0], VariantInit
mov dword [ebp - 0x824], 0x4f
mov ecx, edi
shr ecx, 1
mov eax, SysReAllocString
sub eax, ecx
cmp edi, eax
jbe 0x431753
mov ebx, SysReAllocString
jmp 0x431766
lea eax, [edi + ecx]
mov dword [ebp - 0xae8], eax
mov ebx, 0x4f
cmp eax, ebx
cmova ebx, eax
lea eax, [ebx + 1]
lea ecx, [eax + eax]
cmp eax, 0x7fffffff
jbe 0x431778
or ecx, 0xffffffff
jmp 0x431780
cmp ecx, 0x1000
jb 0x4317a4
lea eax, [ecx + 0x23]
cmp eax, ecx
cmovbe eax, esi
push eax
call fcn.004627a8
add esp, 4
test eax, eax
je 0x432217
lea esi, [eax + 0x23]
and esi, 0xffffffe0
mov dword [esi - 4], eax
jmp 0x4317b7
test ecx, ecx
je 0x4317b5
push ecx
call fcn.004627a8
add esp, 4
mov esi, eax
jmp 0x4317b7
xor esi, esi
mov dword [ebp - 0x7ec], 0x4e
mov dword [ebp - 0x7e8], ebx
push 0x9c
push str.systemCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318_
push esi
call fcn.005acfa0
add esp, 0xc
xor eax, eax
mov word [esi + 0x9c], ax
cmp edi, 8
jb 0x431829
lea ecx, [edi*2 + 2]
mov dword [ebp - 0x800], ecx
mov edx, dword [ebp - 0x7fc]
mov eax, edx
cmp ecx, 0x1000
jb 0x43181f
add ecx, 0x23
mov dword [ebp - 0x800], ecx
mov edx, dword [edx - 4]
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x432217
push ecx
push edx
call fcn.005a9369
add esp, 8
mov dword [ebp - 0x7fc], esi
lea eax, [ebp - 0x818]
push eax
lea ecx, [ebp - 0xac4]
call fcn.00414480
or dword [ebp - 0xa08], 8
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x818]
cmp dword [ebp - 0x804], 8
cmovae ecx, dword [ebp - 0x818]
mov edi, dword [ebp - 0x808]
mov ebx, dword [ebp - 0x7ec]
mov edx, dword [ebp - 0x7e8]
mov eax, edx
sub eax, ebx
cmp edi, eax
ja 0x4318af
lea eax, [edi + ebx]
mov dword [ebp - 0x7ec], eax
lea esi, [ebp - 0x7fc]
cmp edx, 8
cmovae esi, dword [ebp - 0x7fc]
lea eax, [edi + edi]
push eax
push ecx
lea eax, [esi + ebx*2]
push eax
call fcn.005ad520
add esp, 0xc
lea eax, [ebx + edi]
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x4318ca
mov byte [ebp - 0x9d8], 0
push edi
push ecx
push dword [ebp - 0x9d8]
push edi
lea ecx, [ebp - 0x7fc]
call fcn.0041acb0
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x818]
call fcn.00407500
lea ecx, [ebp - 0x83c]
call fcn.004079ab
mov byte [ebp - 4], 0x23
lea esi, [ebp - 0x7fc]
cmp dword [ebp - 0x7e8], 8
cmovae esi, dword [ebp - 0x7fc]
mov dword [ebp - 0x9f4], 0
mov ebx, dword [ebp - 0x9e4]
test ebx, ebx
je 0x431964
cmp dword [ebx], 0
je 0x431957
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x43192b
mov eax, 1
jmp 0x43197e
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x43195d
push 0
push dword [ebx]
lea ecx, [ebp - 0x9f4]
push ecx
push 0x20019
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call eax
jmp 0x43197e
cmp dword [ebx + 4], 0
jne 0x431964
mov eax, 1
jmp 0x43197e
lea eax, [ebp - 0x9f4]
push eax
push 0x20019
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x431fe0
mov ecx, dword [ebp - 0x9ec]
test ecx, ecx
je 0x4319a1
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x9ec], 0
mov dword [ebp - 0x9e8], 0
mov ecx, dword [ebp - 0x9f4]
mov dword [ebp - 0x9ec], ecx
mov dword [ebp - 0x9e8], 0
test eax, eax
jne 0x431fe0
mov dword [ebp - 0x9d4], 0x3e8
mov dword [ebp - 0x9fc], 0x7d0
mov dword [ebp - 0x9d4], eax
lea eax, [ebp - 0x9fc]
push eax
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0xa00]
push eax
push 0
push str.DriverDesc
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call edi
test eax, eax
jne 0x431e83
mov eax, dword [ebp - 0xa00]
cmp eax, 1
je 0x431a24
cmp eax, 2
jne 0x431e83
mov ecx, dword [ebp - 0x9fc]
test ecx, ecx
je 0x431a4b
test cl, 1
jne 0x431e83
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x7e6], 0
je 0x431a54
jmp 0x431e83
xor eax, eax
mov word [ebp - 0x7e4], ax
shr ecx, 1
mov dword [ebp - 0x9d4], ecx
call fcn.0040cb60
mov ecx, eax
test ecx, ecx
je 0x43221c
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x432226
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
lea esi, [eax + 0x10]
mov dword [ebp - 0x9f8], esi
mov byte [ebp - 4], 0x24
mov byte [ebp - 0x9ed], 0
lea eax, [ebp - 0x7e4]
test eax, 0xffff0000
jne 0x431ac4
movzx eax, ax
push eax
lea ecx, [ebp - 0x9f8]
call fcn.0040d3d0
mov byte [ebp - 0x9ed], 1
mov esi, dword [ebp - 0x9f8]
jmp 0x431c4f
lea edi, [ebp - 0x7e4]
lea ecx, [edi + 2]
nop dword [eax]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x431ad0
sub edi, ecx
sar edi, 1
jne 0x431b95
lea ecx, [esi - 0x10]
mov edi, dword [ecx]
cmp dword [ecx + 4], 0
je 0x431c49
lea edx, [ecx + 0xc]
cmp dword [edx], 0
jge 0x431b17
cmp dword [esi - 8], 0
jl 0x43222d
mov dword [esi - 0xc], 0
xor eax, eax
mov word [esi], ax
jmp 0x431c49
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x431b56
mov edx, dword [ecx]
mov eax, dword [edx]
mov esi, dword [eax + 4]
push ecx
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x432237
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x432237
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x432240
lock inc dword [edi + 0x14]
lea eax, [edi + 8]
lea esi, [eax + 0x10]
mov dword [ebp - 0x9f8], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x431c52
lea esi, [eax + 0x10]
mov dword [ebp - 0x9f8], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x431c52
mov eax, dword [esi - 0xc]
mov dword [ebp - 0xa04], eax
lea ebx, [ebp - 0x7e4]
sub ebx, esi
sar ebx, 1
test edi, edi
js 0x432249
mov ecx, 1
sub ecx, dword [esi - 4]
mov eax, dword [esi - 8]
sub eax, edi
or eax, ecx
jge 0x431bd3
push edi
lea ecx, [ebp - 0x9f8]
call fcn.00401fd8
mov esi, dword [ebp - 0x9f8]
cmp ebx, dword [ebp - 0xa04]
ja 0x431c23
mov eax, dword [esi - 8]
lea edx, [esi + ebx*2]
lea ecx, [edi + edi]
test ecx, ecx
je 0x431c37
test edx, edx
jne 0x431bfe
call fcn.005b0782
mov dword [eax], 0x16
call fcn.005b06a9
jmp 0x431c37
add eax, eax
cmp eax, ecx
jae 0x431c16
call fcn.005b0782
mov dword [eax], 0x22
call fcn.005b06a9
jmp 0x431c37
push ecx
push edx
push esi
call fcn.005ad520
add esp, 0xc
jmp 0x431c37
push edi
lea eax, [ebp - 0x7e4]
push eax
push dword [esi - 8]
push esi
call fcn.004021b4
add esp, 0x10
cmp edi, dword [esi - 8]
jg 0x43222d
mov dword [esi - 0xc], edi
xor eax, eax
mov word [esi + edi*2], ax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
or ebx, 0xffffffff
mov byte [ebp - 4], 0x25
mov ecx, str.Intel_R__Advanced_Network_Services_Virtual_Adapter
mov eax, esi
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x431c86
test dx, dx
je 0x431c82
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x431c86
add eax, 4
add ecx, 4
test dx, dx
jne 0x431c60
xor eax, eax
jmp 0x431c8b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x431e3f
mov dword [ebp - 0x9d4], 0x3e8
mov dword [ebp - 0x9d8], 0x7d0
mov dword [ebp - 0x9d4], eax
lea eax, [ebp - 0x9d8]
push eax
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0x9fc]
push eax
push 0
push str.DriverVersion
push dword [ebp - 0x9f4]
call edi
test eax, eax
jne 0x431dcb
mov eax, dword [ebp - 0x9fc]
cmp eax, 1
je 0x431ced
cmp eax, 2
jne 0x431dcb
mov ecx, dword [ebp - 0x9d8]
test ecx, ecx
je 0x431d14
test cl, 1
jne 0x431dcb
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x7e6], 0
je 0x431d1d
jmp 0x431dcb
xor eax, eax
mov word [ebp - 0x7e4], ax
shr ecx, 1
mov dword [ebp - 0x9d4], ecx
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov dword [ebp - method.srl::Name.virtual_0], vtable.srl::Name.0
call fcn.0040cb60
mov ecx, eax
test ecx, ecx
je 0x432253
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x43225d
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
add eax, 0x10
mov dword [ebp - 0xa10], eax
lea eax, [ebp - 0x7e4]
push eax
lea ecx, [ebp - 0xa14]
call fcn.00443120
mov byte [ebp - 4], 0x26
push 0
push 0x116ca
lea ecx, [ebp - 0x930]
call fcn.0041b290
mov byte [ebp - 4], 0x27
push 0
lea ecx, [ebp - 0xa14]
push ecx
push eax
call fcn.00447420
mov byte [ebp - 4], 0x28
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x928]
call fcn.00407500
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xa14]
call fcn.00443020
mov byte [ebp - 4], 0x23
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x431e0d
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x432264
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x432264
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x83c]
call fcn.00407500
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x7fc]
call fcn.00407500
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xadc]
call fcn.00413820
jmp 0x432013
mov byte [ebp - 4], 0x23
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x431e83
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x43226b
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x43226b
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x83c]
call fcn.00407500
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x7fc]
call fcn.00407500
mov byte [ebp - 4], 5
mov byte [ebp - 4], 0x29
mov eax, dword [ebp - 0xadc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebp - 0xadc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0xae0], eax
mov byte [ebp - 4], 0x2a
mov dword [ebp - method.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
lea ecx, [ebp - 0xac4]
call fcn.00415310
mov dword [ebp - method.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
mov esi, dword [ebp - 0xa90]
test esi, esi
je 0x431f20
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x431f15
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x431f15
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx]
push 8
push esi
call fcn.005a9369
add esp, 8
mov byte [ebp - 4], 0x2b
mov eax, dword [ebp - 0xadc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0xadc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ebp + ecx - 0xae0], eax
mov eax, dword [ebp - 0xacc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0xacc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0xad0], eax
mov eax, dword [ebp - 0xadc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0xadc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0xae0], eax
mov byte [ebp - 4], 0x2c
mov dword [ebp - method.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov byte [ebp - 4], 0x2d
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
lea eax, [ebp - 0xa74]
push eax
call fcn.005ab546
add esp, 4
mov byte [ebp - 4], 5
mov ebx, dword [ebp - 0xa20]
inc ebx
mov dword [ebp - 0xa20], ebx
mov edi, dword [ebp - 0xa08]
jmp 0x43151a
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x83c]
call fcn.00407500
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x7fc]
call fcn.00407500
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xadc]
call fcn.00413820
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x20019
push str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_SettingsZoneMapDomains_newcorp.com
push SysReAllocStringLen
lea ecx, [ebp - 0x9ec]
call fcn.0042fb10
test eax, eax
jne 0x432173
mov dword [ebp - 0xa0c], eax
mov dword [ebp - 0xa2c], 4
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0xa0c]
push eax
lea eax, [ebp - 0x9d8]
push eax
push 0
push str.http
mov esi, dword [ebp - 0x9ec]
push esi
call edi
test eax, eax
jne 0x4320f8
cmp dword [ebp - 0x9d8], 4
jne 0x4320f8
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov byte [ebp - 0xa18], 1
mov byte [ebp - 4], 0x2e
push eax
push 0x11734
lea ecx, [ebp - 0x8e0]
call fcn.0041b290
mov byte [ebp - 4], 0x2f
push 0
lea ecx, [ebp - 0xa1c]
push ecx
push eax
call fcn.00447420
mov byte [ebp - 4], 0x30
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x8d8]
call fcn.00407500
mov byte [ebp - 4], 0x31
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov byte [ebp - 4], 5
jmp 0x432179
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov byte [ebp - 0x9dc], 0
mov byte [ebp - 4], 0x32
push 0
push 0x11734
lea ecx, [ebp - 0x8b8]
call fcn.0041b290
mov byte [ebp - 4], 0x33
push 0
lea ecx, [ebp - 0x9e0]
push ecx
push eax
call fcn.00447420
mov byte [ebp - 4], 0x34
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x8b0]
call fcn.00407500
mov byte [ebp - 4], 0x35
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov byte [ebp - 4], 5
jmp 0x432179
mov esi, dword [ebp - 0x9ec]
mov byte [ebp - 4], 1
test esi, esi
je 0x432192
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x9ec], 0
mov dword [ebp - 0x9e8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x868]
call fcn.00412760
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005a909b
mov esp, ebp
pop ebp
ret
call fcn.005b06b9
push 0x80004005
call fcn.004022df
call edx
jmp 0x431a82
push 0x80070057
call fcn.004022df
mov ecx, edx
call esi
jmp 0x431b56
mov ecx, edi
call edx
jmp 0x431b81
push 0x80070057
call fcn.004022df
push 0x80004005
call fcn.004022df
call edx
jmp 0x431d5f
call edx
jmp 0x431e0d
call edx
jmp 0x431e83