Function at 0x14003f370
Capabilities:
Query or enumerate registry value

Disassembly:
push r13
push r14
push r15
mov eax, 0x1060
call fcn.14022b5e0
sub rsp, rax
mov qword [rsp + 0x3a8], 0xfffffffffffffffe
mov qword [rsp + 0x1080], rbx
mov qword [rsp + 0x1088], rsi
mov qword [rsp + 0x1090], rdi
mov qword [rsp + 0x1098], r12
mov rax, qword [0x14035d8c0]
xor rax, rsp
mov qword [rsp + 0x1050], rax
xor esi, esi
mov dword [rsp + 0x40], esi
lea rcx, [rsp + 0x658]
call fcn.14000a1bc
nop
mov byte [rsp + 0x650], sil
lea r8d, [rsi + 0x15]
lea rdx, str.srl::Software::Detect
lea rcx, [rsp + 0x658]
call fcn.140009e14
nop
call fcn.1400227c0
cmp dword [rax + 8], 4
jl 0x14003f417
mov byte [rsp + 0x650], 1
lea rcx, [rsp + 0x650]
call fcn.140018900
nop
lea r15, vtable.srl::Value.0
mov qword [rsp + 0xc0], r15
lea rbx, vtable.srl::Version.0
mov qword [rsp + 0xc0], rbx
lea rcx, [rsp + 0xc8]
call fcn.140015830
mov r8d, 5
lea rdx, str.6.3.4
lea rcx, [rsp + 0xc8]
call fcn.140002a7c
nop
mov edx, 0x116b7
lea rcx, [rsp + 0x698]
call fcn.140023cf0
nop
xor r9d, r9d
lea r8, [rsp + 0xc0]
mov rdx, rax
call fcn.1400591f0
nop
lea rdi, vtable.srl::GroupID.0
mov qword [rsp + 0x698], rdi
lea rcx, [rsp + 0x6a0]
call fcn.140009bb8
nop
mov qword [rsp + 0xc0], rbx
mov rcx, qword [rsp + 0xc8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x2b0], rcx
mov r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
lea r13, vtable.ATL::CAtlStringMgr.0
jg 0x14003f52d
mov rdx, qword [rsp + 0x2b0]
mov rcx, qword [rdx]
mov qword [rsp + 0x3b0], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x140040b2b
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x3b8], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea rbx, vtable.ATL::CWin32Heap.0
cmp rax, rbx
jne 0x140040b2b
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0xc0], r15
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x58], rsi
mov r9d, 0x20019
lea r8, str.SoftwareIntelNetwork_ServicesDMIX
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003e230
test eax, eax
jne 0x14003f749
mov dword [rsp + 0x64], 0x7d0
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd0]
xor r8d, r8d
lea rdx, str.OEMVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x304], eax
test eax, eax
jne 0x14003f5e0
mov eax, dword [rsp + 0xd0]
dec eax
cmp eax, 1
ja 0x14003f5e0
mov eax, dword [rsp + 0x64]
test eax, eax
je 0x14003f695
test al, 1
jne 0x14003f5e0
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003f69d
lea r12, vtable.srl::Name.0
mov r9d, 0x20019
lea r8, str.SoftwareIntelWirelessCommonAppFrameworkSettings
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003e230
test eax, eax
jne 0x14003f944
mov dword [rsp + 0x6c], 0x7d0
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x98]
xor r8d, r8d
lea rdx, str.PROSetVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x2f0], eax
test eax, eax
jne 0x14003fd34
mov eax, dword [rsp + 0x98]
dec eax
cmp eax, 1
ja 0x14003fd34
mov eax, dword [rsp + 0x6c]
test eax, eax
je 0x14003f89f
test al, 1
jne 0x14003fd34
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003f8a7
jmp 0x14003fd34
mov word [rsp + 0x880], si
mov qword [rsp + 0xf0], r15
lea r12, vtable.srl::Name.0
mov qword [rsp + 0xf0], r12
lea rcx, [rsp + 0xf8]
call fcn.140015830
lea rcx, [rsp + 0x880]
mov rax, r14
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003f6d0
mov dword [rsp + 0x300], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0xf8]
call fcn.140002a7c
nop
mov edx, 0x116d1
lea rcx, [rsp + 0x6c8]
call fcn.140023cf0
nop
xor r9d, r9d
lea r8, [rsp + 0xf0]
mov rdx, rax
call fcn.1400591f0
nop
mov qword [rsp + 0x6c8], rdi
lea rcx, [rsp + 0x6d0]
call fcn.140009bb8
nop
lea rcx, [rsp + 0xf0]
call fcn.140054820
jmp 0x14003f5e7
mov r9d, 0x20119
lea r8, str.SoftwareIntelNetwork_ServicesDMIX
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003e230
test eax, eax
jne 0x14003f5e0
mov dword [rsp + 0x68], 0x7d0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd4]
xor r8d, r8d
lea rdx, str.OEMVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x2fc], eax
test eax, eax
jne 0x14003f5e0
mov eax, dword [rsp + 0xd4]
dec eax
cmp eax, 1
ja 0x14003f5e0
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x14003f7ef
test al, 1
jne 0x14003f5e0
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003f7f7
jmp 0x14003f5e0
mov word [rsp + 0x880], si
mov qword [rsp + 0xe0], r15
lea r12, vtable.srl::Name.0
mov qword [rsp + 0xe0], r12
lea rcx, [rsp + 0xe8]
call fcn.140015830
lea rcx, [rsp + 0x880]
mov rax, r14
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003f826
mov dword [rsp + 0x2f8], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0xe8]
call fcn.140002a7c
nop
mov edx, 0x116d1
lea rcx, [rsp + 0x6f8]
call fcn.140023cf0
nop
xor r9d, r9d
lea r8, [rsp + 0xe0]
mov rdx, rax
call fcn.1400591f0
nop
mov qword [rsp + 0x6f8], rdi
lea rcx, [rsp + 0x700]
call fcn.140009bb8
nop
lea rcx, [rsp + 0xe0]
call fcn.140054820
jmp 0x14003f5e7
mov word [rsp + 0x880], si
mov qword [rsp + 0x110], r15
mov qword [rsp + 0x110], r12
lea rcx, [rsp + 0x118]
call fcn.140015830
lea rcx, [rsp + 0x880]
mov rax, r14
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003f8d0
mov dword [rsp + 0x2ec], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x118]
call fcn.140002a7c
nop
mov edx, 0x116c9
lea rcx, [rsp + 0x728]
call fcn.140023cf0
nop
xor r9d, r9d
lea r8, [rsp + 0x110]
mov rdx, rax
call fcn.1400591f0
nop
mov qword [rsp + 0x728], rdi
lea rcx, [rsp + 0x730]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x110]
jmp 0x14003fd2f
mov r9d, 0x20019
lea r8, str.SoftwareIntelWirelessAppFrameworkSettings
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003e230
test eax, eax
jne 0x14003fa94
mov dword [rsp + 0x70], 0x7d0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x9c]
xor r8d, r8d
lea rdx, str.PROSetVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x2e8], eax
test eax, eax
jne 0x14003fd34
mov eax, dword [rsp + 0x9c]
dec eax
cmp eax, 1
ja 0x14003fd34
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x14003f9ea
test al, 1
jne 0x14003fd34
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003f9f2
jmp 0x14003fd34
mov word [rsp + 0x880], si
mov qword [rsp + 0x168], r15
mov qword [rsp + 0x168], r12
lea rcx, [rsp + 0x170]
call fcn.140015830
lea rcx, [rsp + 0x880]
mov rax, r14
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003fa20
mov dword [rsp + 0x2c0], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x170]
call fcn.140002a7c
nop
mov edx, 0x116c9
lea rcx, [rsp + 0x758]
call fcn.140023cf0
nop
xor r9d, r9d
lea r8, [rsp + 0x168]
mov rdx, rax
call fcn.1400591f0
nop
mov qword [rsp + 0x758], rdi
lea rcx, [rsp + 0x760]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x168]
jmp 0x14003fd2f
mov r9d, 0x20119
lea r8, str.SoftwareIntelWirelessCommonAppFrameworkSettings
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003e230
test eax, eax
jne 0x14003fbe4
mov dword [rsp + 0x74], 0x7d0
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa0]
xor r8d, r8d
lea rdx, str.PROSetVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x2ac], eax
test eax, eax
jne 0x14003fd34
mov eax, dword [rsp + 0xa0]
dec eax
cmp eax, 1
ja 0x14003fd34
mov eax, dword [rsp + 0x74]
test eax, eax
je 0x14003fb3a
test al, 1
jne 0x14003fd34
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003fb42
jmp 0x14003fd34
mov word [rsp + 0x880], si
mov qword [rsp + 0x138], r15
mov qword [rsp + 0x138], r12
lea rcx, [rsp + 0x140]
call fcn.140015830
lea rcx, [rsp + 0x880]
mov rax, r14
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003fb70
mov dword [rsp + 0x2a8], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x140]
call fcn.140002a7c
nop
mov edx, 0x116c9
lea rcx, [rsp + 0x788]
call fcn.140023cf0
nop
xor r9d, r9d
lea r8, [rsp + 0x138]
mov rdx, rax
call fcn.1400591f0
nop
mov qword [rsp + 0x788], rdi
lea rcx, [rsp + 0x790]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x138]
jmp 0x14003fd2f
mov r9d, 0x20119
lea r8, str.SoftwareIntelWirelessAppFrameworkSettings
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003e230
test eax, eax
jne 0x14003fd34
mov dword [rsp + 0x78], 0x7d0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa4]
xor r8d, r8d
lea rdx, str.PROSetVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x2a4], eax
test eax, eax
jne 0x14003fd34
mov eax, dword [rsp + 0xa4]
dec eax
cmp eax, 1
ja 0x14003fd34
mov eax, dword [rsp + 0x78]
test eax, eax
je 0x14003fc8a
test al, 1
jne 0x14003fd34
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003fc92
jmp 0x14003fd34
mov word [rsp + 0x880], si
mov qword [rsp + 0x128], r15
mov qword [rsp + 0x128], r12
lea rcx, [rsp + 0x130]
call fcn.140015830
lea rcx, [rsp + 0x880]
mov rax, r14
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003fcc0
mov dword [rsp + 0x2f4], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x130]
call fcn.140002a7c
nop
mov edx, 0x116c9
lea rcx, [rsp + 0x7b8]
call fcn.140023cf0
nop
xor r9d, r9d
lea r8, [rsp + 0x128]
mov rdx, rax
call fcn.1400591f0
nop
mov qword [rsp + 0x7b8], rdi
lea rcx, [rsp + 0x7c0]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x128]
call fcn.140054820
mov dword [rsp + 0x60], esi
mov edi, dword [rsp + 0x40]
lea r8, vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
lea rcx, vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
lea rdx, vtable.std::ios_base.0
lea r10, [0x1402f21a0]
lea r9, [0x1402f21a8]
mov ebx, dword [rsp + 0x60]
cmp ebx, 0x64
jae 0x14004096b
mov qword [rsp + 0x180], r9
mov qword [rsp + 0x190], r10
mov qword [rsp + 0x218], rdx
mov qword [rsp + 0x218], rcx
or edi, 1
mov dword [rsp + 0x40], edi
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x180], r8
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rsp + rcx + 0x17c], edx
mov qword [rsp + 0x188], rsi
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x180]
add rcx, rax
lea rdx, [rsp + 0x198]
call fcn.14001c830
nop
lea rax, [rsp + 0x190]
mov qword [rsp + 0x3c0], rax
mov rax, qword [rsp + 0x190]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x190], rax
mov rax, qword [rsp + 0x190]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x18c], edx
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x20]
mov dword [rsp + rcx + 0x17c], edx
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rsp + rcx + 0x17c], edx
lea rax, [rsp + 0x198]
mov qword [rsp + 0x3c8], rax
lea rcx, [rsp + 0x198]
call fcn.14001c720
nop
lea rax, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rsp + 0x198], rax
mov qword [rsp + 0x200], rsi
mov dword [rsp + 0x308], esi
mov dword [rsp + 0x208], esi
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x1a8], 4
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
mov eax, 0x30
mov word [rsp + rcx + 0x1d8], ax
mov edx, ebx
lea rcx, [rsp + 0x190]
call fcn.14001bc90
lea rcx, [rsp + 0x570]
call fcn.14000a1bc
nop
mov r8d, 0x4e
lea rdx, str.systemCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318_
lea rcx, [rsp + 0x570]
call fcn.140009e14
nop
lea rcx, [rsp + 0x5b0]
call fcn.140009da0
mov qword [rsp + 0x5c0], rsi
mov qword [rsp + 0x5c8], 7
mov word [rsp + 0x5b0], si
or edi, 0x20
mov dword [rsp + 0x40], edi
mov edx, dword [rsp + 0x208]
test dl, 2
jne 0x14003ffef
mov rax, qword [rsp + 0x1d8]
mov rcx, qword [rax]
mov qword [rsp + 0x3d0], rcx
test rcx, rcx
je 0x14003ffef
mov rax, qword [rsp + 0x1b8]
mov rdx, qword [rax]
mov qword [rsp + 0x3d8], rdx
mov qword [rsp + 0x3e0], rcx
mov qword [rsp + 0x2b8], rcx
lea r8, [rsp + 0x200]
lea rax, [rsp + 0x2b8]
cmp rcx, qword [rsp + 0x200]
cmovae r8, rax
mov qword [rsp + 0x3e8], r8
mov r8, qword [r8]
sub r8, rdx
sar r8, 1
lea rcx, [rsp + 0x5b0]
call fcn.140009e14
jmp 0x140040043
test dl, 4
jne 0x140040043
mov rax, qword [rsp + 0x1d0]
mov rcx, qword [rax]
mov qword [rsp + 0x3f0], rcx
test rcx, rcx
je 0x140040043
mov rax, qword [rsp + 0x1b0]
mov rdx, qword [rax]
mov qword [rsp + 0x3f8], rdx
mov rax, qword [rsp + 0x1e8]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, rcx
sar r8, 1
lea rcx, [rsp + 0x5b0]
call fcn.140009e14
and edi, 0xffffffdf
mov dword [rsp + 0x40], edi
or edi, 0x10
mov dword [rsp + 0x40], edi
lea r9, [rsp + 0x5b0]
cmp qword [rsp + 0x5c8], 8
cmovae r9, qword [rsp + 0x5b0]
mov qword [rsp + 0x400], r9
mov rsi, qword [rsp + 0x5c0]
mov qword [rsp + 0x320], rsi
mov r15, qword [rsp + 0x580]
mov qword [rsp + 0x328], r15
mov rcx, qword [rsp + 0x588]
mov rax, rcx
sub rax, r15
cmp rsi, rax
ja 0x1400400eb
lea rax, [r15 + rsi]
mov qword [rsp + 0x580], rax
lea rbx, [rsp + 0x570]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x570]
mov qword [rsp + 0x330], rbx
lea r8, [rsi + rsi]
lea rcx, [rbx + r15*2]
mov rdx, r9
call fcn.14022f3d0
lea rax, [r15 + rsi]
xor esi, esi
mov word [rbx + rax*2], si
jmp 0x140040102
mov qword [rsp + 0x20], rsi
mov rdx, rsi
lea rcx, [rsp + 0x570]
call fcn.140023610
xor esi, esi
and edi, 0xffffffef
mov dword [rsp + 0x40], edi
lea rcx, [rsp + 0x5b0]
call fcn.140009bb8
lea rcx, [rsp + 0x678]
call fcn.14000a1bc
nop
lea rbx, [rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rbx, qword [rsp + 0x570]
mov qword [rsp + 0x338], rbx
mov qword [rsp + 0x88], rsi
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x1400401eb
cmp qword [rax], 0
je 0x1400401d9
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x340], rax
test rax, rax
jne 0x140040186
mov eax, 1
jmp 0x140040211
lea rdx, str.RegOpenKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x348], rax
test rax, rax
je 0x1400401e4
mov qword [rsp + 0x30], rsi
mov rcx, qword [rsp + 0x58]
mov r8, qword [rcx]
mov qword [rsp + 0x28], r8
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call rax
jmp 0x140040211
mov rax, qword [rsp + 0x58]
cmp dword [rax + 8], 0
jne 0x1400401eb
mov eax, 1
jmp 0x140040211
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x30c], eax
test eax, eax
jne 0x14004093b
mov eax, esi
mov dword [rsp + 0xa8], eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140040245
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0xa8], eax
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x50], esi
test eax, eax
jne 0x14004093b
mov dword [rsp + 0x7c], 0x7d0
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd8]
xor r8d, r8d
lea rdx, str.DriverDesc
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x310], eax
test eax, eax
jne 0x140040638
mov eax, dword [rsp + 0xd8]
dec eax
cmp eax, 1
ja 0x140040638
mov eax, dword [rsp + 0x7c]
test eax, eax
je 0x1400402dd
test al, 1
jne 0x140040638
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x1400402e5
jmp 0x140040638
mov word [rsp + 0x880], si
call fcn.140011f18
mov rcx, rax
mov qword [rsp + 0x318], rax
test rax, rax
je 0x140040b34
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, r13
jne 0x140040b3e
lock inc dword [rcx + 0x20]
mov rbx, qword [rsp + 0x318]
add rbx, 0x10
mov qword [rsp + 0x350], rbx
add rbx, 0x18
mov qword [rsp + 0x90], rbx
lea rax, [rsp + 0x880]
mov qword [rsp + 0x358], rax
lea rcx, [rsp + 0x880]
mov byte [rsp + 0x44], 0
lea rax, [rsp + 0x880]
cmp rax, 0x10000
jae 0x140040388
movzx edx, cx
mov dword [rsp + 0x280], edx
lea rcx, [rsp + 0x90]
call fcn.140012700
mov byte [rsp + 0x44], 1
mov rbx, qword [rsp + 0x90]
jmp 0x14004058d
lea rax, [rsp + 0x880]
mov rdi, r14
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140040393
mov dword [rsp + 0x284], edi
test edi, edi
jne 0x140040488
lea rcx, [rbx - 0x18]
mov qword [rsp + 0x2c8], rcx
mov rax, qword [rcx]
mov qword [rsp + 0x120], rax
cmp dword [rcx + 8], edi
je 0x14004058d
cmp dword [rcx + 0x10], edi
jge 0x1400403e5
cmp dword [rbx - 0xc], edi
jl 0x140040b48
mov dword [rbx - 0x10], esi
mov word [rbx], si
jmp 0x14004058d
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x140040447
mov rdx, qword [rsp + 0x2c8]
mov rcx, qword [rdx]
mov qword [rsp + 0x360], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x140040b52
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x368], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, vtable.ATL::CWin32Heap.0
cmp rax, r9
jne 0x140040b52
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x120]
mov rax, qword [rcx]
mov rdx, qword [rax + 0x18]
cmp rax, r13
jne 0x140040b5b
lock inc dword [rcx + 0x20]
mov rbx, qword [rsp + 0x120]
add rbx, 0x10
mov qword [rsp + 0x370], rbx
add rbx, 0x18
mov qword [rsp + 0x90], rbx
jmp 0x14004058d
mov r15d, dword [rbx - 0x10]
mov dword [rsp + 0x288], r15d
lea rsi, [rsp + 0x880]
sub rsi, rbx
sar rsi, 1
mov qword [rsp + 0x378], rsi
test edi, edi
js 0x140040b79
lea rax, [rbx - 0x18]
mov qword [rsp + 0x380], rax
mov ecx, 1
sub ecx, dword [rax + 0x10]
mov dword [rsp + 0x28c], ecx
mov eax, dword [rax + 0xc]
sub eax, edi
mov dword [rsp + 0x290], eax
or eax, ecx
jge 0x1400404f4
mov edx, edi
lea rcx, [rsp + 0x90]
call fcn.140002a1c
mov rbx, qword [rsp + 0x90]
movsxd rax, dword [rbx - 0xc]
cmp rsi, r15
ja 0x14004055b
mov dword [rsp + 0x294], eax
lea rdx, [rbx + rsi*2]
mov qword [rsp + 0x388], rdx
movsxd r8, edi
add r8, r8
mov qword [rsp + 0x390], r8
je 0x140040578
test rdx, rdx
jne 0x140040537
call fcn.140231f64
mov dword [rax], 0x16
call fcn.140231e14
jmp 0x140040578
add rax, rax
cmp rax, r8
jae 0x140040551
call fcn.140231f64
mov dword [rax], 0x22
call fcn.140231e14
jmp 0x140040578
mov rcx, rbx
call fcn.14022f3d0
jmp 0x140040578
mov dword [rsp + 0x298], eax
mov rdx, rax
mov r9d, edi
lea r8, [rsp + 0x880]
mov rcx, rbx
call fcn.140002c18
cmp edi, dword [rbx - 0xc]
jg 0x140040b95
mov dword [rbx - 0x10], edi
movsxd rax, edi
xor esi, esi
mov word [rbx + rax*2], si
mov rax, r14
lea r15, str.Intel_R__Advanced_Network_Services_Virtual_Adapter
nop word [rax + rax]
movzx ecx, word [rbx + rax*2 + 2]
cmp cx, word [r15 + rax*2 + 2]
jne 0x1400405c6
add rax, 2
cmp rax, 0x33
je 0x140040765
movzx ecx, word [rbx + rax*2]
cmp cx, word [r15 + rax*2]
je 0x1400405a0
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x2d8], rbx
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x140040634
mov rdx, qword [rsp + 0x2d8]
mov rcx, qword [rdx]
mov qword [rsp + 0x398], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x140040b8d
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x3a0], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, vtable.ATL::CWin32Heap.0
cmp rax, r9
jne 0x140040b8d
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [rsp + 0x40]
lea rcx, [rsp + 0x678]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x570]
call fcn.140009bb8
nop
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rsp + rcx + 0x17c], edx
lea rcx, [rsp + 0x198]
call fcn.14001d3e0
nop
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea eax, [rcx - 0x20]
mov dword [rsp + rcx + 0x17c], eax
mov rax, qword [rsp + 0x190]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x190], rax
mov rax, qword [rsp + 0x190]
movsxd rcx, dword [rax + 4]
lea eax, [rcx - 0x10]
mov dword [rsp + rcx + 0x18c], eax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea eax, [rcx - 0x18]
mov dword [rsp + rcx + 0x17c], eax
lea rax, vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + 0x218], rax
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x218], rax
lea rcx, [rsp + 0x218]
call fcn.14022d3c4
nop
inc dword [rsp + 0x60]
lea r15, vtable.srl::Value.0
jmp 0x14003fd3c
mov dword [rsp + 0x80], 0x7d0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xac]
xor r8d, r8d
lea rdx, str.DriverVersion
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x29c], eax
test eax, eax
jne 0x1400407e4
mov eax, dword [rsp + 0xac]
dec eax
cmp eax, 1
ja 0x1400407e4
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x140040858
test al, 1
jne 0x1400407e4
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x140040860
lea r12, vtable.srl::GroupID.0
lea r15, vtable.srl::Value.0
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x2d0], rbx
lock xadd dword [rbx + 0x10], r14d
sub r14d, 1
jg 0x140040910
mov rdx, qword [rsp + 0x2d0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x140040b84
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, vtable.ATL::CWin32Heap.0
cmp rax, r9
jne 0x140040b84
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140040910
mov word [rsp + 0x880], si
lea r15, vtable.srl::Value.0
mov qword [rsp + 0x100], r15
mov qword [rsp + 0x100], r12
lea rcx, [rsp + 0x108]
call fcn.140015830
lea rcx, [rsp + 0x880]
mov rax, r14
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140040890
mov dword [rsp + 0x2a0], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x108]
call fcn.140002a7c
nop
mov edx, 0x116ca
lea rcx, [rsp + 0x7e8]
call fcn.140023cf0
nop
xor r9d, r9d
lea r8, [rsp + 0x100]
mov rdx, rax
call fcn.1400591f0
nop
lea r12, vtable.srl::GroupID.0
mov qword [rsp + 0x7e8], r12
lea rcx, [rsp + 0x7f0]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x100]
call fcn.140054820
jmp 0x1400407f2
lea rcx, [rsp + 0x678]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x570]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x180]
call fcn.14001b7c0
jmp 0x140040972
lea rcx, [rsp + 0x678]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x570]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x180]
call fcn.14001b7c0
lea r15, vtable.srl::Value.0
lea r12, vtable.srl::GroupID.0
mov r9d, 0x20019
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_SettingsZoneMapDomains_newcorp.com
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0x48]
call fcn.14003e230
test eax, eax
jne 0x140040ace
mov dword [rsp + 0xb4], esi
mov dword [rsp + 0xb0], 4
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb4]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb8]
xor r8d, r8d
lea rdx, str.http
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140040a60
cmp dword [rsp + 0xb8], 4
jne 0x140040a60
mov qword [rsp + 0x148], r15
lea rbx, vtable.srl::Exists.0
mov qword [rsp + 0x148], rbx
mov byte [rsp + 0x150], 1
mov edx, 0x11734
lea rcx, [rsp + 0x818]
call fcn.140023cf0
nop
xor r9d, r9d
lea r8, [rsp + 0x148]
mov rdx, rax
call fcn.1400591f0
nop
mov qword [rsp + 0x818], r12
lea rcx, [rsp + 0x820]
call fcn.140009bb8
nop
mov qword [rsp + 0x148], rbx
mov qword [rsp + 0x148], r15
jmp 0x140040ad3
mov qword [rsp + 0x158], r15
lea rbx, vtable.srl::Exists.0
mov qword [rsp + 0x158], rbx
mov byte [rsp + 0x160], 0
mov edx, 0x11734
lea rcx, [rsp + 0x848]
call fcn.140023cf0
nop
xor r9d, r9d
lea r8, [rsp + 0x158]
mov rdx, rax
call fcn.1400591f0
nop
mov qword [rsp + 0x848], r12
lea rcx, [rsp + 0x850]
call fcn.140009bb8
nop
mov qword [rsp + 0x158], rbx
mov qword [rsp + 0x158], r15
jmp 0x140040ad3
mov rdi, qword [rsp + 0x48]
test rdi, rdi
je 0x140040ae6
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
lea rcx, [rsp + 0x650]
call fcn.14001a370
mov al, 1
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.14022aa20
lea r11, [rsp + 0x1060]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call r8
nop
jmp 0x14003f52d
mov ecx, 0x80004005
call fcn.140002d3c
call rdx
mov rbx, rax
jmp 0x14004031e
mov ecx, 0x80070057
call fcn.140002d3c
call r8
nop
jmp 0x140040447
call rdx
mov rbx, rax
mov qword [rsp + 0x370], rax
add rbx, 0x18
mov qword [rsp + 0x90], rbx
jmp 0x14004058d
mov ecx, 0x80070057
call fcn.140002d3c
nop
call r8
nop
jmp 0x140040910
call r8
jmp 0x140040634
mov ecx, 0x80070057
call fcn.140002d3c
int3