Function at 0x14003f560
Capabilities:
Query or enumerate registry value

Disassembly:
push r13
push r14
push r15
mov eax, 0x1060
call fcn.14022bd60
sub rsp, rax
mov qword [rsp + 0x3a8], 0xfffffffffffffffe
mov qword [rsp + 0x1080], rbx
mov qword [rsp + 0x1088], rsi
mov qword [rsp + 0x1090], rdi
mov qword [rsp + 0x1098], r12
mov rax, qword [0x14035d8c0]
xor rax, rsp
mov qword [rsp + 0x1050], rax
xor esi, esi
mov dword [rsp + 0x40], esi
lea rcx, [rsp + 0x658]
call fcn.14000a1bc
nop
mov byte [rsp + 0x650], sil
lea r8d, [rsi + 0x15]
lea rdx, str.srl::Software::Detect
lea rcx, [rsp + 0x658]
call fcn.140009e14
nop
call fcn.140022850
cmp dword [rax + 8], 4
jl 0x14003f607
mov byte [rsp + 0x650], 1
lea rcx, [rsp + 0x650]
call fcn.140018900
nop
lea r15, vtable.srl::Value.0
mov qword [rsp + 0xc0], r15
lea rbx, vtable.srl::Version.0
mov qword [rsp + 0xc0], rbx
lea rcx, [rsp + 0xc8]
call fcn.140015830
mov r8d, 5
lea rdx, str.6.3.6
lea rcx, [rsp + 0xc8]
call fcn.140002a7c
nop
mov edx, 0x116b7
lea rcx, [rsp + 0x698]
call fcn.140023d80
nop
xor r9d, r9d
lea r8, [rsp + 0xc0]
mov rdx, rax
call fcn.140059650
nop
lea rdi, vtable.srl::GroupID.0
mov qword [rsp + 0x698], rdi
lea rcx, [rsp + 0x6a0]
call fcn.140009bb8
nop
mov qword [rsp + 0xc0], rbx
mov rcx, qword [rsp + 0xc8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x2b0], rcx
mov r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
lea r13, vtable.ATL::CAtlStringMgr.0
jg 0x14003f71d
mov rdx, qword [rsp + 0x2b0]
mov rcx, qword [rdx]
mov qword [rsp + 0x3b0], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x140040d1b
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x3b8], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea rbx, vtable.ATL::CWin32Heap.0
cmp rax, rbx
jne 0x140040d1b
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0xc0], r15
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x58], rsi
mov r9d, 0x20019
lea r8, str.SoftwareIntelNetwork_ServicesDMIX
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003e420
test eax, eax
jne 0x14003f939
mov dword [rsp + 0x64], 0x7d0
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd0]
xor r8d, r8d
lea rdx, str.OEMVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x304], eax
test eax, eax
jne 0x14003f7d0
mov eax, dword [rsp + 0xd0]
dec eax
cmp eax, 1
ja 0x14003f7d0
mov eax, dword [rsp + 0x64]
test eax, eax
je 0x14003f885
test al, 1
jne 0x14003f7d0
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003f88d
lea r12, vtable.srl::Name.0
mov r9d, 0x20019
lea r8, str.SoftwareIntelWirelessCommonAppFrameworkSettings
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003e420
test eax, eax
jne 0x14003fb34
mov dword [rsp + 0x6c], 0x7d0
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x98]
xor r8d, r8d
lea rdx, str.PROSetVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x2f0], eax
test eax, eax
jne 0x14003ff24
mov eax, dword [rsp + 0x98]
dec eax
cmp eax, 1
ja 0x14003ff24
mov eax, dword [rsp + 0x6c]
test eax, eax
je 0x14003fa8f
test al, 1
jne 0x14003ff24
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003fa97
jmp 0x14003ff24
mov word [rsp + 0x880], si
mov qword [rsp + 0xf0], r15
lea r12, vtable.srl::Name.0
mov qword [rsp + 0xf0], r12
lea rcx, [rsp + 0xf8]
call fcn.140015830
lea rcx, [rsp + 0x880]
mov rax, r14
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003f8c0
mov dword [rsp + 0x300], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0xf8]
call fcn.140002a7c
nop
mov edx, 0x116d1
lea rcx, [rsp + 0x6c8]
call fcn.140023d80
nop
xor r9d, r9d
lea r8, [rsp + 0xf0]
mov rdx, rax
call fcn.140059650
nop
mov qword [rsp + 0x6c8], rdi
lea rcx, [rsp + 0x6d0]
call fcn.140009bb8
nop
lea rcx, [rsp + 0xf0]
call fcn.140054c80
jmp 0x14003f7d7
mov r9d, 0x20119
lea r8, str.SoftwareIntelNetwork_ServicesDMIX
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003e420
test eax, eax
jne 0x14003f7d0
mov dword [rsp + 0x68], 0x7d0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd4]
xor r8d, r8d
lea rdx, str.OEMVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x2fc], eax
test eax, eax
jne 0x14003f7d0
mov eax, dword [rsp + 0xd4]
dec eax
cmp eax, 1
ja 0x14003f7d0
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x14003f9df
test al, 1
jne 0x14003f7d0
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003f9e7
jmp 0x14003f7d0
mov word [rsp + 0x880], si
mov qword [rsp + 0xe0], r15
lea r12, vtable.srl::Name.0
mov qword [rsp + 0xe0], r12
lea rcx, [rsp + 0xe8]
call fcn.140015830
lea rcx, [rsp + 0x880]
mov rax, r14
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003fa16
mov dword [rsp + 0x2f8], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0xe8]
call fcn.140002a7c
nop
mov edx, 0x116d1
lea rcx, [rsp + 0x6f8]
call fcn.140023d80
nop
xor r9d, r9d
lea r8, [rsp + 0xe0]
mov rdx, rax
call fcn.140059650
nop
mov qword [rsp + 0x6f8], rdi
lea rcx, [rsp + 0x700]
call fcn.140009bb8
nop
lea rcx, [rsp + 0xe0]
call fcn.140054c80
jmp 0x14003f7d7
mov word [rsp + 0x880], si
mov qword [rsp + 0x110], r15
mov qword [rsp + 0x110], r12
lea rcx, [rsp + 0x118]
call fcn.140015830
lea rcx, [rsp + 0x880]
mov rax, r14
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003fac0
mov dword [rsp + 0x2ec], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x118]
call fcn.140002a7c
nop
mov edx, 0x116c9
lea rcx, [rsp + 0x728]
call fcn.140023d80
nop
xor r9d, r9d
lea r8, [rsp + 0x110]
mov rdx, rax
call fcn.140059650
nop
mov qword [rsp + 0x728], rdi
lea rcx, [rsp + 0x730]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x110]
jmp 0x14003ff1f
mov r9d, 0x20019
lea r8, str.SoftwareIntelWirelessAppFrameworkSettings
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003e420
test eax, eax
jne 0x14003fc84
mov dword [rsp + 0x70], 0x7d0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x9c]
xor r8d, r8d
lea rdx, str.PROSetVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x2e8], eax
test eax, eax
jne 0x14003ff24
mov eax, dword [rsp + 0x9c]
dec eax
cmp eax, 1
ja 0x14003ff24
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x14003fbda
test al, 1
jne 0x14003ff24
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003fbe2
jmp 0x14003ff24
mov word [rsp + 0x880], si
mov qword [rsp + 0x168], r15
mov qword [rsp + 0x168], r12
lea rcx, [rsp + 0x170]
call fcn.140015830
lea rcx, [rsp + 0x880]
mov rax, r14
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003fc10
mov dword [rsp + 0x2c0], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x170]
call fcn.140002a7c
nop
mov edx, 0x116c9
lea rcx, [rsp + 0x758]
call fcn.140023d80
nop
xor r9d, r9d
lea r8, [rsp + 0x168]
mov rdx, rax
call fcn.140059650
nop
mov qword [rsp + 0x758], rdi
lea rcx, [rsp + 0x760]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x168]
jmp 0x14003ff1f
mov r9d, 0x20119
lea r8, str.SoftwareIntelWirelessCommonAppFrameworkSettings
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003e420
test eax, eax
jne 0x14003fdd4
mov dword [rsp + 0x74], 0x7d0
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa0]
xor r8d, r8d
lea rdx, str.PROSetVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x2ac], eax
test eax, eax
jne 0x14003ff24
mov eax, dword [rsp + 0xa0]
dec eax
cmp eax, 1
ja 0x14003ff24
mov eax, dword [rsp + 0x74]
test eax, eax
je 0x14003fd2a
test al, 1
jne 0x14003ff24
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003fd32
jmp 0x14003ff24
mov word [rsp + 0x880], si
mov qword [rsp + 0x138], r15
mov qword [rsp + 0x138], r12
lea rcx, [rsp + 0x140]
call fcn.140015830
lea rcx, [rsp + 0x880]
mov rax, r14
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003fd60
mov dword [rsp + 0x2a8], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x140]
call fcn.140002a7c
nop
mov edx, 0x116c9
lea rcx, [rsp + 0x788]
call fcn.140023d80
nop
xor r9d, r9d
lea r8, [rsp + 0x138]
mov rdx, rax
call fcn.140059650
nop
mov qword [rsp + 0x788], rdi
lea rcx, [rsp + 0x790]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x138]
jmp 0x14003ff1f
mov r9d, 0x20119
lea r8, str.SoftwareIntelWirelessAppFrameworkSettings
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003e420
test eax, eax
jne 0x14003ff24
mov dword [rsp + 0x78], 0x7d0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa4]
xor r8d, r8d
lea rdx, str.PROSetVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x2a4], eax
test eax, eax
jne 0x14003ff24
mov eax, dword [rsp + 0xa4]
dec eax
cmp eax, 1
ja 0x14003ff24
mov eax, dword [rsp + 0x78]
test eax, eax
je 0x14003fe7a
test al, 1
jne 0x14003ff24
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003fe82
jmp 0x14003ff24
mov word [rsp + 0x880], si
mov qword [rsp + 0x128], r15
mov qword [rsp + 0x128], r12
lea rcx, [rsp + 0x130]
call fcn.140015830
lea rcx, [rsp + 0x880]
mov rax, r14
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003feb0
mov dword [rsp + 0x2f4], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x130]
call fcn.140002a7c
nop
mov edx, 0x116c9
lea rcx, [rsp + 0x7b8]
call fcn.140023d80
nop
xor r9d, r9d
lea r8, [rsp + 0x128]
mov rdx, rax
call fcn.140059650
nop
mov qword [rsp + 0x7b8], rdi
lea rcx, [rsp + 0x7c0]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x128]
call fcn.140054c80
mov dword [rsp + 0x60], esi
mov edi, dword [rsp + 0x40]
lea r8, vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
lea rcx, vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
lea rdx, vtable.std::ios_base.0
lea r10, [0x1402f2150]
lea r9, [0x1402f2158]
mov ebx, dword [rsp + 0x60]
cmp ebx, 0x64
jae 0x140040b5b
mov qword [rsp + 0x180], r9
mov qword [rsp + 0x190], r10
mov qword [rsp + 0x218], rdx
mov qword [rsp + 0x218], rcx
or edi, 1
mov dword [rsp + 0x40], edi
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x180], r8
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rsp + rcx + 0x17c], edx
mov qword [rsp + 0x188], rsi
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x180]
add rcx, rax
lea rdx, [rsp + 0x198]
call fcn.14001c830
nop
lea rax, [rsp + 0x190]
mov qword [rsp + 0x3c0], rax
mov rax, qword [rsp + 0x190]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x190], rax
mov rax, qword [rsp + 0x190]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x18c], edx
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x20]
mov dword [rsp + rcx + 0x17c], edx
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rsp + rcx + 0x17c], edx
lea rax, [rsp + 0x198]
mov qword [rsp + 0x3c8], rax
lea rcx, [rsp + 0x198]
call fcn.14001c720
nop
lea rax, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rsp + 0x198], rax
mov qword [rsp + 0x200], rsi
mov dword [rsp + 0x308], esi
mov dword [rsp + 0x208], esi
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x1a8], 4
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
mov eax, 0x30
mov word [rsp + rcx + 0x1d8], ax
mov edx, ebx
lea rcx, [rsp + 0x190]
call fcn.14001bc90
lea rcx, [rsp + 0x570]
call fcn.14000a1bc
nop
mov r8d, 0x4e
lea rdx, str.systemCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318_
lea rcx, [rsp + 0x570]
call fcn.140009e14
nop
lea rcx, [rsp + 0x5b0]
call fcn.140009da0
mov qword [rsp + 0x5c0], rsi
mov qword [rsp + 0x5c8], 7
mov word [rsp + 0x5b0], si
or edi, 0x20
mov dword [rsp + 0x40], edi
mov edx, dword [rsp + 0x208]
test dl, 2
jne 0x1400401df
mov rax, qword [rsp + 0x1d8]
mov rcx, qword [rax]
mov qword [rsp + 0x3d0], rcx
test rcx, rcx
je 0x1400401df
mov rax, qword [rsp + 0x1b8]
mov rdx, qword [rax]
mov qword [rsp + 0x3d8], rdx
mov qword [rsp + 0x3e0], rcx
mov qword [rsp + 0x2b8], rcx
lea r8, [rsp + 0x200]
lea rax, [rsp + 0x2b8]
cmp rcx, qword [rsp + 0x200]
cmovae r8, rax
mov qword [rsp + 0x3e8], r8
mov r8, qword [r8]
sub r8, rdx
sar r8, 1
lea rcx, [rsp + 0x5b0]
call fcn.140009e14
jmp 0x140040233
test dl, 4
jne 0x140040233
mov rax, qword [rsp + 0x1d0]
mov rcx, qword [rax]
mov qword [rsp + 0x3f0], rcx
test rcx, rcx
je 0x140040233
mov rax, qword [rsp + 0x1b0]
mov rdx, qword [rax]
mov qword [rsp + 0x3f8], rdx
mov rax, qword [rsp + 0x1e8]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, rcx
sar r8, 1
lea rcx, [rsp + 0x5b0]
call fcn.140009e14
and edi, 0xffffffdf
mov dword [rsp + 0x40], edi
or edi, 0x10
mov dword [rsp + 0x40], edi
lea r9, [rsp + 0x5b0]
cmp qword [rsp + 0x5c8], 8
cmovae r9, qword [rsp + 0x5b0]
mov qword [rsp + 0x400], r9
mov rsi, qword [rsp + 0x5c0]
mov qword [rsp + 0x320], rsi
mov r15, qword [rsp + 0x580]
mov qword [rsp + 0x328], r15
mov rcx, qword [rsp + 0x588]
mov rax, rcx
sub rax, r15
cmp rsi, rax
ja 0x1400402db
lea rax, [r15 + rsi]
mov qword [rsp + 0x580], rax
lea rbx, [rsp + 0x570]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x570]
mov qword [rsp + 0x330], rbx
lea r8, [rsi + rsi]
lea rcx, [rbx + r15*2]
mov rdx, r9
call fcn.14022fb50
lea rax, [r15 + rsi]
xor esi, esi
mov word [rbx + rax*2], si
jmp 0x1400402f2
mov qword [rsp + 0x20], rsi
mov rdx, rsi
lea rcx, [rsp + 0x570]
call fcn.1400236a0
xor esi, esi
and edi, 0xffffffef
mov dword [rsp + 0x40], edi
lea rcx, [rsp + 0x5b0]
call fcn.140009bb8
lea rcx, [rsp + 0x678]
call fcn.14000a1bc
nop
lea rbx, [rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rbx, qword [rsp + 0x570]
mov qword [rsp + 0x338], rbx
mov qword [rsp + 0x88], rsi
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x1400403db
cmp qword [rax], 0
je 0x1400403c9
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x340], rax
test rax, rax
jne 0x140040376
mov eax, 1
jmp 0x140040401
lea rdx, str.RegOpenKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x348], rax
test rax, rax
je 0x1400403d4
mov qword [rsp + 0x30], rsi
mov rcx, qword [rsp + 0x58]
mov r8, qword [rcx]
mov qword [rsp + 0x28], r8
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call rax
jmp 0x140040401
mov rax, qword [rsp + 0x58]
cmp dword [rax + 8], 0
jne 0x1400403db
mov eax, 1
jmp 0x140040401
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x30c], eax
test eax, eax
jne 0x140040b2b
mov eax, esi
mov dword [rsp + 0xa8], eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140040435
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0xa8], eax
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x50], esi
test eax, eax
jne 0x140040b2b
mov dword [rsp + 0x7c], 0x7d0
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd8]
xor r8d, r8d
lea rdx, str.DriverDesc
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x310], eax
test eax, eax
jne 0x140040828
mov eax, dword [rsp + 0xd8]
dec eax
cmp eax, 1
ja 0x140040828
mov eax, dword [rsp + 0x7c]
test eax, eax
je 0x1400404cd
test al, 1
jne 0x140040828
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x1400404d5
jmp 0x140040828
mov word [rsp + 0x880], si
call fcn.140011f18
mov rcx, rax
mov qword [rsp + 0x318], rax
test rax, rax
je 0x140040d24
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, r13
jne 0x140040d2e
lock inc dword [rcx + 0x20]
mov rbx, qword [rsp + 0x318]
add rbx, 0x10
mov qword [rsp + 0x350], rbx
add rbx, 0x18
mov qword [rsp + 0x90], rbx
lea rax, [rsp + 0x880]
mov qword [rsp + 0x358], rax
lea rcx, [rsp + 0x880]
mov byte [rsp + 0x44], 0
lea rax, [rsp + 0x880]
cmp rax, 0x10000
jae 0x140040578
movzx edx, cx
mov dword [rsp + 0x280], edx
lea rcx, [rsp + 0x90]
call fcn.140012700
mov byte [rsp + 0x44], 1
mov rbx, qword [rsp + 0x90]
jmp 0x14004077d
lea rax, [rsp + 0x880]
mov rdi, r14
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140040583
mov dword [rsp + 0x284], edi
test edi, edi
jne 0x140040678
lea rcx, [rbx - 0x18]
mov qword [rsp + 0x2c8], rcx
mov rax, qword [rcx]
mov qword [rsp + 0x120], rax
cmp dword [rcx + 8], edi
je 0x14004077d
cmp dword [rcx + 0x10], edi
jge 0x1400405d5
cmp dword [rbx - 0xc], edi
jl 0x140040d38
mov dword [rbx - 0x10], esi
mov word [rbx], si
jmp 0x14004077d
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140040637
mov rdx, qword [rsp + 0x2c8]
mov rcx, qword [rdx]
mov qword [rsp + 0x360], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x140040d42
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x368], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, vtable.ATL::CWin32Heap.0
cmp rax, r9
jne 0x140040d42
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x120]
mov rax, qword [rcx]
mov rdx, qword [rax + 0x18]
cmp rax, r13
jne 0x140040d4b
lock inc dword [rcx + 0x20]
mov rbx, qword [rsp + 0x120]
add rbx, 0x10
mov qword [rsp + 0x370], rbx
add rbx, 0x18
mov qword [rsp + 0x90], rbx
jmp 0x14004077d
mov r15d, dword [rbx - 0x10]
mov dword [rsp + 0x288], r15d
lea rsi, [rsp + 0x880]
sub rsi, rbx
sar rsi, 1
mov qword [rsp + 0x378], rsi
test edi, edi
js 0x140040d69
lea rax, [rbx - 0x18]
mov qword [rsp + 0x380], rax
mov ecx, 1
sub ecx, dword [rax + 0x10]
mov dword [rsp + 0x28c], ecx
mov eax, dword [rax + 0xc]
sub eax, edi
mov dword [rsp + 0x290], eax
or eax, ecx
jge 0x1400406e4
mov edx, edi
lea rcx, [rsp + 0x90]
call fcn.140002a1c
mov rbx, qword [rsp + 0x90]
movsxd rax, dword [rbx - 0xc]
cmp rsi, r15
ja 0x14004074b
mov dword [rsp + 0x294], eax
lea rdx, [rbx + rsi*2]
mov qword [rsp + 0x388], rdx
movsxd r8, edi
add r8, r8
mov qword [rsp + 0x390], r8
je 0x140040768
test rdx, rdx
jne 0x140040727
call fcn.1402326e4
mov dword [rax], 0x16
call fcn.140232594
jmp 0x140040768
add rax, rax
cmp rax, r8
jae 0x140040741
call fcn.1402326e4
mov dword [rax], 0x22
call fcn.140232594
jmp 0x140040768
mov rcx, rbx
call fcn.14022fb50
jmp 0x140040768
mov dword [rsp + 0x298], eax
mov rdx, rax
mov r9d, edi
lea r8, [rsp + 0x880]
mov rcx, rbx
call fcn.140002c18
cmp edi, dword [rbx - 0xc]
jg 0x140040d85
mov dword [rbx - 0x10], edi
movsxd rax, edi
xor esi, esi
mov word [rbx + rax*2], si
mov rax, r14
lea r15, str.Intel_R__Advanced_Network_Services_Virtual_Adapter
nop word [rax + rax]
movzx ecx, word [rbx + rax*2 + 2]
cmp cx, word [r15 + rax*2 + 2]
jne 0x1400407b6
add rax, 2
cmp rax, 0x33
je 0x140040955
movzx ecx, word [rbx + rax*2]
cmp cx, word [r15 + rax*2]
je 0x140040790
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x2d8], rbx
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x140040824
mov rdx, qword [rsp + 0x2d8]
mov rcx, qword [rdx]
mov qword [rsp + 0x398], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x140040d7d
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x3a0], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, vtable.ATL::CWin32Heap.0
cmp rax, r9
jne 0x140040d7d
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [rsp + 0x40]
lea rcx, [rsp + 0x678]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x570]
call fcn.140009bb8
nop
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rsp + rcx + 0x17c], edx
lea rcx, [rsp + 0x198]
call fcn.14001d3e0
nop
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea eax, [rcx - 0x20]
mov dword [rsp + rcx + 0x17c], eax
mov rax, qword [rsp + 0x190]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x190], rax
mov rax, qword [rsp + 0x190]
movsxd rcx, dword [rax + 4]
lea eax, [rcx - 0x10]
mov dword [rsp + rcx + 0x18c], eax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea eax, [rcx - 0x18]
mov dword [rsp + rcx + 0x17c], eax
lea rax, vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + 0x218], rax
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x218], rax
lea rcx, [rsp + 0x218]
call fcn.14022db44
nop
inc dword [rsp + 0x60]
lea r15, vtable.srl::Value.0
jmp 0x14003ff2c
mov dword [rsp + 0x80], 0x7d0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xac]
xor r8d, r8d
lea rdx, str.DriverVersion
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x29c], eax
test eax, eax
jne 0x1400409d4
mov eax, dword [rsp + 0xac]
dec eax
cmp eax, 1
ja 0x1400409d4
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x140040a48
test al, 1
jne 0x1400409d4
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x140040a50
lea r12, vtable.srl::GroupID.0
lea r15, vtable.srl::Value.0
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x2d0], rbx
lock xadd dword [rbx + 0x10], r14d
sub r14d, 1
jg 0x140040b00
mov rdx, qword [rsp + 0x2d0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x140040d74
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, vtable.ATL::CWin32Heap.0
cmp rax, r9
jne 0x140040d74
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140040b00
mov word [rsp + 0x880], si
lea r15, vtable.srl::Value.0
mov qword [rsp + 0x100], r15
mov qword [rsp + 0x100], r12
lea rcx, [rsp + 0x108]
call fcn.140015830
lea rcx, [rsp + 0x880]
mov rax, r14
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140040a80
mov dword [rsp + 0x2a0], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x108]
call fcn.140002a7c
nop
mov edx, 0x116ca
lea rcx, [rsp + 0x7e8]
call fcn.140023d80
nop
xor r9d, r9d
lea r8, [rsp + 0x100]
mov rdx, rax
call fcn.140059650
nop
lea r12, vtable.srl::GroupID.0
mov qword [rsp + 0x7e8], r12
lea rcx, [rsp + 0x7f0]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x100]
call fcn.140054c80
jmp 0x1400409e2
lea rcx, [rsp + 0x678]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x570]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x180]
call fcn.14001b7c0
jmp 0x140040b62
lea rcx, [rsp + 0x678]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x570]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x180]
call fcn.14001b7c0
lea r15, vtable.srl::Value.0
lea r12, vtable.srl::GroupID.0
mov r9d, 0x20019
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_SettingsZoneMapDomains_newcorp.com
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0x48]
call fcn.14003e420
test eax, eax
jne 0x140040cbe
mov dword [rsp + 0xb4], esi
mov dword [rsp + 0xb0], 4
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb4]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb8]
xor r8d, r8d
lea rdx, str.http
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140040c50
cmp dword [rsp + 0xb8], 4
jne 0x140040c50
mov qword [rsp + 0x148], r15
lea rbx, vtable.srl::Exists.0
mov qword [rsp + 0x148], rbx
mov byte [rsp + 0x150], 1
mov edx, 0x11734
lea rcx, [rsp + 0x818]
call fcn.140023d80
nop
xor r9d, r9d
lea r8, [rsp + 0x148]
mov rdx, rax
call fcn.140059650
nop
mov qword [rsp + 0x818], r12
lea rcx, [rsp + 0x820]
call fcn.140009bb8
nop
mov qword [rsp + 0x148], rbx
mov qword [rsp + 0x148], r15
jmp 0x140040cc3
mov qword [rsp + 0x158], r15
lea rbx, vtable.srl::Exists.0
mov qword [rsp + 0x158], rbx
mov byte [rsp + 0x160], 0
mov edx, 0x11734
lea rcx, [rsp + 0x848]
call fcn.140023d80
nop
xor r9d, r9d
lea r8, [rsp + 0x158]
mov rdx, rax
call fcn.140059650
nop
mov qword [rsp + 0x848], r12
lea rcx, [rsp + 0x850]
call fcn.140009bb8
nop
mov qword [rsp + 0x158], rbx
mov qword [rsp + 0x158], r15
jmp 0x140040cc3
mov rdi, qword [rsp + 0x48]
test rdi, rdi
je 0x140040cd6
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
lea rcx, [rsp + 0x650]
call fcn.14001a370
mov al, 1
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.14022b1a0
lea r11, [rsp + 0x1060]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call r8
nop
jmp 0x14003f71d
mov ecx, 0x80004005
call fcn.140002d3c
call rdx
mov rbx, rax
jmp 0x14004050e
mov ecx, 0x80070057
call fcn.140002d3c
call r8
nop
jmp 0x140040637
call rdx
mov rbx, rax
mov qword [rsp + 0x370], rax
add rbx, 0x18
mov qword [rsp + 0x90], rbx
jmp 0x14004077d
mov ecx, 0x80070057
call fcn.140002d3c
nop
call r8
nop
jmp 0x140040b00
call r8
jmp 0x140040824
mov ecx, 0x80070057
call fcn.140002d3c
int3