Function at 0x467290
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x520
mov rax, qword [0x004fb010]
xor rax, rsp
mov qword [rsp + 0x510], rax
mov rsi, r9
mov qword [rsp + 0xc8], r9
mov qword [rsp + 0x188], r9
mov qword [rsp + 0x190], r9
mov r14, qword [rsp + 0x570]
mov qword [rsp + 0xb8], r14
mov qword [rsp + 0x198], r14
xor r15d, r15d
mov eax, r15d
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x2e8], eax
mov edi, r15d
mov qword [rsp + 0xc0], r15
mov edx, 0x86
call fcn.0046c260
lea r13, [0x004ce880]
lea rdx, [rax*2]
add rdx, r13
lea rax, str.MainRpcCommandRouter::GetDeviceInfoListCommand
mov qword [rsp + 0x20], rax
lea r9, str._s_In
lea ecx, [r15 + 1]
mov r8d, 0x233
call fcn.0044b390
lea r9d, [r15 + 6]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SETUPAPI.dll_SetupDiGetClassDevsA]
mov r12, rax
mov qword [rsp + 0xd0], rax
cmp rax, 0xffffffffffffffff
jne 0x467378
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
jmp 0x468c5a
mov dword [rsp + 0x4f0], 0x20
xorps xmm0, xmm0
movups xmmword [rsp + 0x450], xmm0
movups xmmword [rsp + 0x460], xmm0
movups xmmword [rsp + 0x470], xmm0
movups xmmword [rsp + 0x480], xmm0
mov dword [rsp + 0x478], 1
lea rcx, [rsp + 0x450]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
mov qword [rsp + 0x480], r15
mov byte [rsp + 0x488], dil
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.0047970c
mov rbx, rax
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax], r15
mov qword [rax + 8], r15
lfence
mov ecx, 0x60
call fcn.0047970c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov qword [rsp + 0x330], rbx
mov qword [rsp + 0x270], r15
mov qword [rsp + 0x280], r15
mov qword [rsp + 0x288], SafeArrayGetDim
mov r8d, SafeArrayGetDim
lea rdx, str.get_list_status
lea rcx, [rsp + 0x270]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x330]
call fcn.00414f50
mov r8d, 1
lea rdx, [0x004cf298]
mov rcx, rax
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
mov qword [rsp + 0x1a0], r15
mov qword [rsp + 0x1b0], r15
mov qword [rsp + 0x1b8], SafeArrayGetDim
mov r8d, SafeArrayGetDim
lea rdx, str.device_list
lea rcx, [rsp + 0x1a0]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
lea rdx, [rsp + 0x1a0]
lea rcx, [rsp + 0x330]
call fcn.00414f50
xor r8d, r8d
lea rdx, [0x004baa2b]
mov rcx, rax
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
mov qword [rsp + 0x1c0], r15
mov qword [rsp + 0x1d0], r15
mov qword [rsp + 0x1d8], SafeArrayGetDim
mov r8d, 2
lea rdx, [0x004cf13c]
lea rcx, [rsp + 0x1c0]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x450]
call fcn.00411970
test al, al
je 0x4679a3
mov rax, qword [rsp + 0x480]
cmp rax, 1
jb 0x4679a3
xorps xmm0, xmm0
movups xmmword [rsp + 0x358], xmm0
mov ecx, 4
mov word [rsp + 0x366], cx
mov rsi, qword [rax + 0x10]
mov qword [rsp + 0x58], rsi
movups xmmword [rsp + 0x3f0], xmm0
movdqu xmmword [rsp + 0x3d0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x3e0], xmm1
mov qword [rsp + 0x3f0], r15
mov qword [rsp + 0x3f8], 0x100
movups xmmword [rsp + 0x490], xmm0
movups xmmword [rsp + 0x4c0], xmm0
lea rax, [rsp + 0x3d0]
mov qword [rsp + 0x490], rax
mov qword [rsp + 0x498], r15
movdqa xmmword [rsp + 0x4a0], xmm0
movdqa xmmword [rsp + 0x4b0], xmm1
mov qword [rsp + 0x4c0], 0x200
mov dword [rsp + 0x4c8], 0x144
mov byte [rsp + 0x4cc], 0
mov qword [rsp + 0x388], r15
mov qword [rsp + 0x398], r15
mov qword [rsp + 0x3a0], SafeArrayGetDim
mov byte [rsp + 0x388], 0
xor r8d, r8d
mov edx, 0x104
lea rcx, [rsp + 0x388]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_unsigned_long_long_unsigned___int64___char____ptr64
nop
mov qword [rsp + 0x310], r15
mov qword [rsp + 0x320], r15
mov qword [rsp + 0x328], SafeArrayGetDim
mov byte [rsp + 0x310], 0
xor r8d, r8d
mov edx, 0x104
lea rcx, [rsp + 0x310]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_unsigned_long_long_unsigned___int64___char____ptr64
nop
mov dword [rsp + 0x368], r15d
mov dword [rsp + 0x2c8], r15d
mov qword [rsp + 0x2f0], r15
mov qword [rsp + 0x300], r15
mov qword [rsp + 0x308], SafeArrayGetDim
mov byte [rsp + 0x2f0], 0
xor r8d, r8d
mov edx, 0x104
lea rcx, [rsp + 0x2f0]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_unsigned_long_long_unsigned___int64___char____ptr64
nop
mov eax, r15d
mov rdi, 0xffffffffffffffff
movabs r14, 0xffff000000000000
movabs r13, 0xffffffffffff
mov dword [rsp + 0x54], eax
lea r8, [rsp + 0x4f0]
mov edx, eax
mov rcx, r12
call qword [sym.imp.SETUPAPI.dll_SetupDiEnumDeviceInfo]
test eax, eax
jne 0x467a20
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0x358]
call fcn.00412740
test al, al
je 0x46781c
mov qword [rsp + 0x1e0], r15
mov qword [rsp + 0x1f0], r15
mov qword [rsp + 0x1f8], SafeArrayGetDim
mov r8d, SafeArrayGetDim
lea rdx, str.get_list_status
lea rcx, [rsp + 0x1e0]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x330]
call fcn.00414f50
mov r8d, 1
lea rdx, [0x004c737c]
mov rcx, rax
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
lea rax, [rsp + 0x230]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x230], r15
mov qword [rsp + 0x240], r15
mov qword [rsp + 0x248], SafeArrayGetDim
mov r8d, SafeArrayGetDim
lea rdx, str.device_list
lea rcx, [rsp + 0x230]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
mov rcx, qword [rsp + 0x3e8]
lea rax, [rcx + 1]
cmp rax, qword [rsp + 0x3f0]
jbe 0x4677d0
mov edx, 1
lea rcx, [rsp + 0x3d0]
call fcn.00413680
mov rcx, qword [rsp + 0x3e8]
lea rax, [rcx + 1]
mov qword [rsp + 0x3e8], rax
mov byte [rcx], 0
dec qword [rsp + 0x3e8]
mov rbx, qword [rsp + 0x3e0]
lea rdx, [rsp + 0x230]
lea rcx, [rsp + 0x330]
call fcn.00414f50
inc rdi
cmp byte [rbx + rdi], 0
jne 0x467804
mov r8, rdi
mov rdx, rbx
mov rcx, rax
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
mov rdx, qword [rsp + 0x308]
cmp rdx, 0x10
jb 0x467862
inc rdx
mov rcx, qword [rsp + 0x2f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x46785d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x46785d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
mov qword [rsp + 0x300], r15
mov qword [rsp + 0x308], SafeArrayGetDim
mov byte [rsp + 0x2f0], 0
mov rdx, qword [rsp + 0x328]
cmp rdx, 0x10
jb 0x4678c4
inc rdx
mov rcx, qword [rsp + 0x310]
mov rax, rcx
cmp rdx, 0x1000
jb 0x4678bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x4678bf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
mov qword [rsp + 0x320], r15
mov qword [rsp + 0x328], SafeArrayGetDim
mov byte [rsp + 0x310], 0
mov rdx, qword [rsp + 0x3a0]
cmp rdx, 0x10
jb 0x467926
inc rdx
mov rcx, qword [rsp + 0x388]
mov rax, rcx
cmp rdx, 0x1000
jb 0x467921
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x467921
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
mov qword [rsp + 0x398], r15
mov qword [rsp + 0x3a0], SafeArrayGetDim
mov byte [rsp + 0x388], 0
mov rcx, qword [rsp + 0x4a8]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, 1
mov rcx, qword [rsp + 0x4a0]
call fcn.00479330
nop
mov rcx, qword [rsp + 0x3e0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov edx, 1
mov rcx, qword [rsp + 0x3d8]
call fcn.00479330
nop
mov rdi, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xc8]
mov r14, qword [rsp + 0xb8]
lea r13, [0x004ce880]
lea rdx, [rsp + 0x420]
lea rcx, [rsp + 0x330]
call fcn.004151d0
cmp qword [rsp + 0x190], 0
je 0x468b65
cmp qword [rsp + 0x198], 0
je 0x468b5a
mov r8d, dword [rsi]
mov rbx, qword [rsp + 0x430]
cmp r8, rbx
jbe 0x468b5a
xor edx, edx
mov rcx, r14
call fcn.004a2370
lea r8, [rsp + 0x420]
cmp qword [rsp + 0x438], 0x10
cmovae r8, qword [rsp + 0x420]
mov edx, dword [rsi]
mov r9, rbx
mov rcx, r14
call fcn.004268d0
jmp 0x468b6a
lea rcx, [rsp + 0x388]
cmp qword [rsp + 0x3a0], 0x10
cmovae rcx, qword [rsp + 0x388]
mov r8, qword [rsp + 0x398]
xor edx, edx
call fcn.004a2370
lea r8, [rsp + 0x388]
cmp qword [rsp + 0x3a0], 0x10
cmovae r8, qword [rsp + 0x388]
mov qword [rsp + 0x20], r15
mov r9d, 0x104
lea rdx, [rsp + 0x4f0]
mov rcx, r12
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceInstanceIdA]
test eax, eax
je 0x468b4f
mov dword [rsp + 0x368], r15d
mov eax, dword [rsp + 0x320]
mov dword [rsp + 0x2c8], eax
lea rcx, [rsp + 0x310]
cmp qword [rsp + 0x328], 0x10
cmovae rcx, qword [rsp + 0x310]
mov r8, qword [rsp + 0x320]
xor edx, edx
call fcn.004a2370
lea rcx, [rsp + 0x310]
cmp qword [rsp + 0x328], 0x10
cmovae rcx, qword [rsp + 0x310]
mov ebx, r15d
lea rax, [rsp + 0x2c8]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x2c8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x368]
mov r8d, 9
lea rdx, [rsp + 0x4f0]
mov rcx, r12
call qword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyA]
test eax, eax
jne 0x467c1a
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov ebx, eax
cmp eax, 0x7a
jne 0x467c1a
mov qword [rsp + 0x168], r15
mov qword [rsp + 0x178], r15
mov qword [rsp + 0x180], SafeArrayGetDim
mov edx, dword [rsp + 0x2c8]
xor r8d, r8d
lea rcx, [rsp + 0x168]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_unsigned_long_long_unsigned___int64___char____ptr64
mov rdx, qword [rsp + 0x328]
cmp rdx, 0x10
jb 0x467bae
inc rdx
mov rcx, qword [rsp + 0x310]
mov rax, rcx
cmp rdx, 0x1000
jb 0x467ba9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x468b2a
call fcn.00479330
movups xmm0, xmmword [rsp + 0x168]
movups xmmword [rsp + 0x310], xmm0
movups xmm1, xmmword [rsp + 0x178]
movups xmmword [rsp + 0x320], xmm1
mov qword [rsp + 0x178], r15
mov qword [rsp + 0x180], SafeArrayGetDim
mov byte [rsp + 0x168], 0
lea r9, [rsp + 0x310]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0x10
cmovae r9, rcx
movq r8, xmm1
mov rcx, r9
jmp 0x467abf
xor r9d, r9d
mov r8d, dword [rsp + 0x504]
lea rdx, [rsp + 0x3c8]
lea rcx, [rsp + 0x440]
call qword [sym.imp.api_ms_win_devices_config_l1_1_1.dll_CM_Get_DevNode_Status]
test ebx, ebx
je 0x467c4d
cmp dword [rsp + 0x3c8], 0x1c
jne 0x468b4f
movabs rax, 0x7fffffffffffffff
sub rax, qword [rsp + 0x320]
cmp rax, 0x27
jb 0x468cc7
lfence
lea rcx, [rsp + 0x310]
cmp qword [rsp + 0x328], 0x10
cmovae rcx, qword [rsp + 0x310]
mov rax, qword [rsp + 0x320]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 0x27
lea r9, str.SYSTEMCurrentControlSetControlClass_
lea r8, [rsp + 0x310]
movzx edx, byte [rsp + 0x50]
lea rcx, [rsp + 0x4d0]
call sym.AsusSoftwareManager.exe_public:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_struct_std::_String_constructor_concat_tag__class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64__char_const__const___ptr64__unsigned_long_long_unsigned___int64___char_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
mov ebx, dword [rsp + 0x40]
or ebx, 1
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x2d0], r15
mov qword [rsp + 0x3a8], r15
mov qword [rsp + 0x3b8], r15
mov qword [rsp + 0x3c0], SafeArrayGetDim
mov byte [rsp + 0x3a8], 0
mov r8d, 7
lea rdx, [0x004be820]
lea rcx, [rsp + 0x3a8]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
mov qword [rsp + 0x338], r15
mov qword [rsp + 0x348], r15
mov qword [rsp + 0x350], SafeArrayGetDim
mov byte [rsp + 0x338], 0
mov r8d, 8
lea rdx, str.1_1_1900
lea rcx, [rsp + 0x338]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
lea rdx, [rsp + 0x4d0]
cmp qword [rsp + 0x4e8], 0x10
cmovae rdx, qword [rsp + 0x4d0]
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExA]
test eax, eax
jne 0x468196
mov dword [rsp + 0x2e8], r15d
mov eax, dword [rsp + 0x300]
mov dword [rsp + 0x2ec], eax
lea rcx, [rsp + 0x2f0]
cmp qword [rsp + 0x308], 0x10
cmovae rcx, qword [rsp + 0x2f0]
mov r8d, eax
xor edx, edx
call fcn.004a2370
lea rax, [rsp + 0x2f0]
cmp qword [rsp + 0x308], 0x10
cmovae rax, qword [rsp + 0x2f0]
lea rcx, [rsp + 0x2ec]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2e8]
xor r8d, r8d
lea rdx, str.DriverVersion
mov rcx, qword [rsp + 0x2d0]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
test eax, eax
jne 0x467ef6
lea rdx, [rsp + 0x2f0]
cmp qword [rsp + 0x308], 0x10
cmovae rdx, qword [rsp + 0x2f0]
mov qword [rsp + 0x148], r15
mov qword [rsp + 0x158], r15
mov qword [rsp + 0x160], SafeArrayGetDim
mov r8, rdi
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x467e60
lea rcx, [rsp + 0x148]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
mov rdx, qword [rsp + 0x3c0]
cmp rdx, 0x10
jb 0x467eba
inc rdx
mov rcx, qword [rsp + 0x3a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x467eb5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x468006
call fcn.00479330
movups xmm0, xmmword [rsp + 0x148]
movups xmmword [rsp + 0x3a8], xmm0
movups xmm1, xmmword [rsp + 0x158]
movups xmmword [rsp + 0x3b8], xmm1
mov qword [rsp + 0x158], r15
mov qword [rsp + 0x160], SafeArrayGetDim
mov byte [rsp + 0x148], 0
mov eax, dword [rsp + 0x300]
mov dword [rsp + 0x2ec], eax
lea rcx, [rsp + 0x2f0]
cmp qword [rsp + 0x308], 0x10
cmovae rcx, qword [rsp + 0x2f0]
mov r8d, eax
xor edx, edx
call fcn.004a2370
lea rax, [rsp + 0x2f0]
cmp qword [rsp + 0x308], 0x10
cmovae rax, qword [rsp + 0x2f0]
lea rcx, [rsp + 0x2ec]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x2e8]
xor r8d, r8d
lea rdx, str.DriverDate
mov rcx, qword [rsp + 0x2d0]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExA]
test eax, eax
jne 0x46804e
lea rdx, [rsp + 0x2f0]
cmp qword [rsp + 0x308], 0x10
cmovae rdx, qword [rsp + 0x2f0]
mov qword [rsp + 0x128], r15
mov qword [rsp + 0x138], r15
mov qword [rsp + 0x140], SafeArrayGetDim
mov r8, rdi
inc r8
cmp byte [rdx + r8], 0
jne 0x467fb5
lea rcx, [rsp + 0x128]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
mov rdx, qword [rsp + 0x350]
cmp rdx, 0x10
jb 0x468012
inc rdx
mov rcx, qword [rsp + 0x338]
mov rax, rcx
cmp rdx, 0x1000
jb 0x46800d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x46800d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
movups xmm0, xmmword [rsp + 0x128]
movups xmmword [rsp + 0x338], xmm0
movups xmm1, xmmword [rsp + 0x138]
movups xmmword [rsp + 0x348], xmm1
mov qword [rsp + 0x138], r15
mov qword [rsp + 0x140], SafeArrayGetDim
mov byte [rsp + 0x128], 0
mov qword [rsp + 0x200], r15
mov qword [rsp + 0x210], r15
mov qword [rsp + 0x218], r15
lea rdx, [rsp + 0x338]
lea rcx, [rsp + 0x200]
call sym.AsusSoftwareManager.exe_private:_void___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Construct_lv_contents_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char___const____ptr64____ptr64
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x290]
call fcn.0045ec90
mov rbx, rax
lea rax, [rsp + 0x338]
cmp rax, rbx
je 0x468129
mov rdx, qword [rsp + 0x350]
cmp rdx, 0x10
jb 0x4680e7
inc rdx
mov rcx, qword [rsp + 0x338]
mov rax, rcx
cmp rdx, 0x1000
jb 0x4680e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x468163
call fcn.00479330
mov qword [rsp + 0x348], r15
mov qword [rsp + 0x350], SafeArrayGetDim
mov byte [rsp + 0x338], 0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x338], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x348], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], SafeArrayGetDim
mov byte [rbx], 0
mov rdx, qword [rsp + 0x2a8]
cmp rdx, 0x10
jb 0x46816f
inc rdx
mov rcx, qword [rsp + 0x290]
mov rax, rcx
cmp rdx, 0x1000
jb 0x46816a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x46816a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
mov byte [rsp + 0x290], 0
cmp qword [rsp + 0x2d0], 0
jne 0x468192
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov qword [rsp + 0x2d0], r15
mov ebx, dword [rsp + 0x40]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x370], xmm1
mov qword [rsp + 0x380], r15
lea rdx, [rsp + 0x388]
cmp qword [rsp + 0x3a0], 0x10
cmovae rdx, qword [rsp + 0x388]
mov qword [rsp + 0xe8], r15
mov qword [rsp + 0xf8], r15
mov qword [rsp + 0x100], SafeArrayGetDim
mov byte [rsp + 0xe8], 0
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x4681f0
lea rcx, [rsp + 0xe8]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
mov r9d, 0x1e
lea r8, str.SYSTEMCurrentControlSetEnum_
xor edx, edx
lea rcx, [rsp + 0xe8]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::insert_unsigned_long_long_unsigned___int64___char_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
mov qword [rsp + 0x400], r15
mov qword [rsp + 0x410], r15
mov qword [rsp + 0x418], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x400], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x410], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], SafeArrayGetDim
mov byte [rax], 0
or ebx, 2
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x2e8], ebx
mov rdx, qword [rsp + 0x100]
cmp rdx, 0x10
jb 0x4682b6
inc rdx
mov rcx, qword [rsp + 0xe8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x4682b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x4682b1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
mov qword [rsp + 0xf8], r15
mov qword [rsp + 0x100], SafeArrayGetDim
mov byte [rsp + 0xe8], 0
mov qword [rsp + 0x108], r15
mov qword [rsp + 0x118], r15
mov qword [rsp + 0x120], SafeArrayGetDim
mov byte [rsp + 0x108], 0
mov r8d, 0xa
lea rdx, str.HardwareID
lea rcx, [rsp + 0x108]
call sym.AsusSoftwareManager.exe_public:_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char______ptr64___cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::assign_char_const__const___ptr64__unsigned_long_long_unsigned___int64_____ptr64
nop
lea r9, [rsp + 0x108]
lea r8, [rsp + 0x400]
lea rcx, [rsp + 0x2b0]
call fcn.00457ab0
mov rbx, rax
lea rax, [rsp + 0x370]
cmp rax, rbx
je 0x468379
lea rcx, [rsp + 0x370]
call fcn.004350b0
mov rax, qword [rbx]
mov qword [rsp + 0x370], rax
mov rax, qword [rbx + 8]
mov qword [rsp + 0x378], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x380], rax
mov qword [rbx], r15
mov qword [rbx + 8], r15
mov qword [rbx + 0x10], r15
lea rcx, [rsp + 0x2b0]
call fcn.004350b0
nop
mov rdx, qword [rsp + 0x120]
cmp rdx, 0x10
jb 0x4683cd
inc rdx
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x4683c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x4683c8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
mov byte [rsp + 0x108], 0
jmp 0x46840e
mov ecx, 3
mov r12, qword [rsp + 0x370]
mov rax, qword [rsp + 0x378]
mov qword [rsp + 0x48], rax
cmp r12, rax
je 0x468989
xorps xmm0, xmm0
movups xmmword [rsp + 0x2d8], xmm0
mov word [rsp + 0x2e6], cx
movups xmmword [rsp + 0x98], xmm0
mov word [rsp + 0xa6], r15w
mov rax, r12
cmp qword [r12 + 0x18], 0x10
jb 0x468464
mov rax, qword [r12]
mov edi, dword [r12 + 0x10]
lea rbx, [0x004bafc0]
test rax, rax
cmovne rbx, rax
lea rcx, [rsp + 0x98]
call fcn.00412480
mov qword [rsp + 0x220], rbx
mov dword [rsp + 0x228], edi
mov r8, rsi
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0x98]
call fcn.00414cd0
xorps xmm0, xmm0
movups xmmword [rsp + 0x88], xmm0
mov eax, 0x405
mov word [rsp + 0x96], ax
mov rax, qword [rsp + 0x90]
and rax, r14
lea rcx, str.device_id
or rax, rcx
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x88], 9
mov ecx, dword [rsp + 0x2d8]
mov r14d, dword [rsp + 0x2dc]
cmp ecx, r14d
jb 0x46856f
test r14d, r14d
jne 0x46850a
lea edi, [r14 + 0x10]
jmp 0x468518
lea edi, [r14 + 1]
shr edi, 1
add edi, r14d
cmp edi, r14d
jbe 0x46856f
lfence
mov rbx, qword [rsp + 0x2e0]
mov rdx, rbx
and rdx, r13
mov r9d, edi
shl r9, 5
mov r8d, dword [rsp + 0x2dc]
shl r8, 5
mov rcx, rsi
call fcn.0046c190
movabs rcx, 0xffff000000000000
and rbx, rcx
or rbx, rax
mov qword [rsp + 0x2e0], rbx
mov r14d, edi
mov dword [rsp + 0x2dc], edi
mov ecx, dword [rsp + 0x2d8]
jmp 0x468577
mov rbx, qword [rsp + 0x2e0]
mov rdx, rbx
and rdx, r13
mov qword [rsp + 0x60], rdx
mov eax, ecx
shl rax, 5
movups xmm0, xmmword [rsp + 0x88]
movups xmmword [rax + rdx], xmm0
mov word [rsp + 0x96], r15w
movups xmm0, xmmword [rsp + 0x98]
movups xmmword [rax + rdx + 0x10], xmm0
mov word [rsp + 0xa6], r15w
lea r13d, [rcx + 1]
mov dword [rsp + 0x2d8], r13d
xorps xmm0, xmm0
movups xmmword [rsp + 0xa8], xmm0
mov word [rsp + 0xb6], r15w
lea rax, [rsp + 0x3a8]
cmp qword [rsp + 0x3c0], 0x10
cmovae rax, qword [rsp + 0x3a8]
lea rsi, [0x004bafc0]
test rax, rax
cmovne rsi, rax
mov edi, dword [rsp + 0x3b8]
lea rcx, [rsp + 0xa8]
call fcn.00412480
mov qword [rsp + 0x250], rsi
mov dword [rsp + 0x258], edi
mov rsi, qword [rsp + 0x58]
mov r8, rsi
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0xa8]
call fcn.00414cd0
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov eax, 0x405
mov word [rsp + 0x76], ax
mov rax, qword [rsp + 0x70]
movabs rcx, 0xffff000000000000
and rax, rcx
lea rcx, str.driver_version
or rax, rcx
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x68], SafeArrayGetDim
cmp r13d, r14d
jb 0x4686e9
test r14d, r14d
jne 0x468686
lea edi, [r14 + 0x10]
jmp 0x468694
lea edi, [r14 + 1]
shr edi, 1
add edi, r14d
cmp edi, r14d
jbe 0x4686e9
lfence
mov r9d, edi
shl r9, 5
mov r8d, dword [rsp + 0x2dc]
shl r8, 5
mov rdx, qword [rsp + 0x60]
mov rcx, rsi
call fcn.0046c190
mov rbx, qword [rsp + 0x2e0]
movabs rcx, 0xffff000000000000
and rbx, rcx
or rbx, rax
mov qword [rsp + 0x2e0], rbx
mov r14d, edi
mov dword [rsp + 0x2dc], edi
mov r13d, dword [rsp + 0x2d8]
mov rcx, rbx
movabs rax, 0xffffffffffff
and rcx, rax
mov qword [rsp + 0x60], rcx
mov eax, r13d
shl rax, 5
movups xmm0, xmmword [rsp + 0x68]
movups xmmword [rax + rcx], xmm0
mov word [rsp + 0x76], r15w
movups xmm0, xmmword [rsp + 0xa8]
movups xmmword [rax + rcx + 0x10], xmm0
mov word [rsp + 0xb6], r15w
inc r13d
mov dword [rsp + 0x2d8], r13d
xorps xmm0, xmm0
movups xmmword [rsp + 0xd8], xmm0
mov word [rsp + 0xe6], r15w
lea rax, [rsp + 0x338]
cmp qword [rsp + 0x350], 0x10
cmovae rax, qword [rsp + 0x338]
lea rsi, [0x004bafc0]
test rax, rax
cmovne rsi, rax
mov edi, dword [rsp + 0x348]
lea rcx, [rsp + 0xd8]
call fcn.00412480
mov qword [rsp + 0x260], rsi
mov dword [rsp + 0x268], edi
mov rsi, qword [rsp + 0x58]
mov r8, rsi
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0xd8]
call fcn.00414cd0
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov eax, 0x405
mov word [rsp + 0x86], ax
mov rax, qword [rsp + 0x80]
movabs rcx, 0xffff000000000000
and rax, rcx
lea rcx, str.driver_date
or rax, rcx
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x78], SafeArrayGetDim
cmp r13d, r14d
jb 0x468867
test r14d, r14d
jne 0x468805
lea edi, [r14 + 0x10]
jmp 0x468813
lea edi, [r14 + 1]
shr edi, 1
add edi, r14d
cmp edi, r14d
jbe 0x468867
lfence
mov r9d, edi
shl r9, 5
mov r8d, dword [rsp + 0x2dc]
shl r8, 5
mov rdx, qword [rsp + 0x60]
mov rcx, rsi
call fcn.0046c190
mov rbx, qword [rsp + 0x2e0]
movabs r14, 0xffff000000000000
and rbx, r14
or rbx, rax
mov qword [rsp + 0x2e0], rbx
mov dword [rsp + 0x2dc], edi
mov r13d, dword [rsp + 0x2d8]
jmp 0x468871
movabs r14, 0xffff000000000000
movabs rdi, 0xffffffffffff
and rbx, rdi
mov eax, r13d
shl rax, 5
movups xmm0, xmmword [rsp + 0x78]
movups xmmword [rax + rbx], xmm0
mov word [rsp + 0x86], r15w
movups xmm0, xmmword [rsp + 0xd8]
movups xmmword [rax + rbx + 0x10], xmm0
mov word [rsp + 0xe6], r15w
inc r13d
mov dword [rsp + 0x2d8], r13d
mov edx, dword [rsp + 0x358]
mov eax, dword [rsp + 0x35c]
cmp edx, eax
jb 0x46892d
test eax, eax
jne 0x4688d3
lea ebx, [rax + 0x10]
jmp 0x4688de
lea ebx, [rax + 1]
shr ebx, 1
add ebx, eax
cmp ebx, eax
jbe 0x46892d
lfence
mov rdx, qword [rsp + 0x360]
and rdx, rdi
mov r9d, ebx
shl r9, 4
mov r8d, dword [rsp + 0x35c]
shl r8, 4
mov rcx, rsi
call fcn.0046c190
mov rcx, qword [rsp + 0x360]
and rcx, r14
or rcx, rax
mov qword [rsp + 0x360], rcx
mov dword [rsp + 0x35c], ebx
mov edx, dword [rsp + 0x358]
jmp 0x468935
mov rcx, qword [rsp + 0x360]
mov eax, edx
add rax, rax
and rcx, rdi
inc edx
mov dword [rsp + 0x358], edx
movups xmm0, xmmword [rsp + 0x2d8]
movups xmmword [rcx + rax*8], xmm0
mov word [rsp + 0x2e6], r15w
add r12, 0x20
cmp r12, qword [rsp + 0x48]
mov ecx, 3
movabs r13, 0xffffffffffff
jne 0x468431
mov rax, qword [rsp + 0x378]
mov r12, qword [rsp + 0x370]
mov rdx, rax
mov rcx, r12
call fcn.00435850
mov rax, qword [rsp + 0x370]
mov qword [rsp + 0x378], rax
cmp rax, qword [rsp + 0x380]
je 0x4689bc
lea rcx, [rsp + 0x370]
call fcn.004350b0
nop
mov rdx, qword [rsp + 0x418]
cmp rdx, 0x10
jb 0x468a02
inc rdx
mov rcx, qword [rsp + 0x400]
mov rax, rcx
cmp rdx, 0x1000
jb 0x4689fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x4689fd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
mov qword [rsp + 0x410], r15
mov qword [rsp + 0x418], 0xf
mov byte [rsp + 0x400], 0
lea rcx, [rsp + 0x370]
call fcn.004350b0
nop
mov rdx, qword [rsp + 0x350]
cmp rdx, 0x10
jb 0x468a72
inc rdx
mov rcx, qword [rsp + 0x338]
mov rax, rcx
cmp rdx, 0x1000
jb 0x468a6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x468a6d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
mov qword [rsp + 0x348], r15
mov qword [rsp + 0x350], SafeArrayGetDim
mov byte [rsp + 0x338], 0
mov rdx, qword [rsp + 0x3c0]
cmp rdx, 0x10
jb 0x468ad4
inc rdx
mov rcx, qword [rsp + 0x3a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x468acf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x468acf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
mov qword [rsp + 0x3b8], r15
mov qword [rsp + 0x3c0], SafeArrayGetDim
mov byte [rsp + 0x3a8], 0
mov rdx, qword [rsp + 0x4e8]
cmp rdx, 0x10
jb 0x468b36
inc rdx
mov rcx, qword [rsp + 0x4d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x468b31
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x468b31
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
mov r12, qword [rsp + 0xd0]
movabs r13, 0xffffffffffff
mov rdi, 0xffffffffffffffff
mov eax, dword [rsp + 0x54]
inc eax
jmp 0x4676c0
mov eax, dword [rsp + 0x430]
inc eax
mov dword [rsi], eax
mov edi, 8
mov rdx, qword [rsp + 0x438]
cmp rdx, 0x10
jb 0x468bb0
inc rdx
mov rcx, qword [rsp + 0x420]
mov rax, rcx
cmp rdx, 0x1000
jb 0x468bab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x468bab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.00479330
mov qword [rsp + 0x430], r15
mov qword [rsp + 0x438], 0xf
mov byte [rsp + 0x420], 0
mov rbx, qword [rsp + 0x330]
test rbx, rbx
je 0x468bf7
mov rcx, rbx
call fcn.00415820
mov rcx, rbx
call fcn.004158b0
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, rbx
call fcn.00479330
nop
mov rdx, qword [rsp + 0x480]
test rdx, rdx
je 0x468c27
mov rax, rdx
mov rdx, r15
mov qword [rsp + 0x480], rdx
test rax, rax
je 0x468c27
mov rdx, rax
call fcn.00412580
mov rdx, qword [rsp + 0x480]
mov byte [rsp + 0x488], 0
test rdx, rdx
je 0x468c39
call fcn.00412580
cmp dword [rsp + 0x478], 0
je 0x468c51
lea rcx, [rsp + 0x450]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_DeleteCriticalSection]
mov rcx, r12
call qword [sym.imp.SETUPAPI.dll_SetupDiDestroyDeviceInfoList]
mov edx, 0x86
call fcn.0046c260
lea rdx, [rax*2]
add rdx, r13
mov qword [rsp + 0x28], rdi
lea rax, str.MainRpcCommandRouter::GetDeviceInfoListCommand
mov qword [rsp + 0x20], rax
lea r9, str._s_Out_0x_08x_
mov ecx, 1
mov r8d, 0x2e4
call fcn.0044b390
mov rax, rdi
mov rcx, qword [rsp + 0x510]
xor rcx, rsp
call fcn.00479310
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.004038b0
nop
int3