Function at 0x140031b20
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1110]
mov eax, 0x1210
call fcn.14009c790
sub rsp, rax
mov rax, qword [0x1401198e8]
xor rax, rsp
mov qword [rbp + 0x1100], rax
movzx edi, r9b
mov byte [rsp + 0x34], r9b
mov r14, r8
mov qword [rsp + 0x70], r8
xor r13d, r13d
mov r12d, r13d
mov dword [rsp + 0x30], r13d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], rax
test r9b, r9b
je 0x140031b9b
lea r8, str.SYSTEMCurrentControlSetControlNetworkProviderOrder
jmp 0x140031c14
call fcn.140008180
mov rcx, rax
test rax, rax
je 0x140032bc1
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rdx, str.SYSTEMCurrentControlSetControlNetworkProviderOrder
lea rcx, [rsp + 0x38]
call fcn.1400062d0
test al, al
jne 0x140031be8
mov r8d, 0x36
lea rdx, str.SYSTEMCurrentControlSetControlNetworkProviderOrder
lea rcx, [rsp + 0x38]
call fcn.1400068f0
nop
mov dword [rsp + 0x30], 1
lea r8, str.AutorunsDisabled
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x58]
call fcn.140006020
nop
mov r12d, 3
mov dword [rsp + 0x30], r12d
mov r8, qword [rax]
mov rdx, 0xffffffff80000002
mov r9d, 0x20019
lea rcx, [rbp + 0xe0]
call fcn.140027410
nop
test r12b, 2
je 0x140031c62
and r12d, 0xfffffffd
mov dword [rsp + 0x30], r12d
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140031c5d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov r12d, dword [rsp + 0x30]
test r12b, 1
je 0x140031c97
and r12d, 0xfffffffe
mov dword [rsp + 0x30], r12d
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140031c92
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov r12d, dword [rsp + 0x30]
lea r15, vtable.std::_Ref_count_obj2_struct_AutorunsEntry_.0
mov rbx, qword [rbp + 0xe0]
test dil, dil
je 0x140031efa
mov ecx, 0x148
call fcn.14009bfa8
mov rsi, rax
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
mov qword [rax], r15
lea rdi, [rax + 0x10]
xor edx, edx
mov r8d, 0x138
mov rcx, rdi
call fcn.14009e880
mov rcx, rdi
call fcn.140007090
xorps xmm0, xmm0
movups xmmword [rbp + 0x78], xmm0
bts r12d, 0xa
mov qword [rbp + 0x78], rdi
mov qword [rbp + 0x80], rsi
mov dword [rdi + 0x118], 0x1080
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], 1
mov qword [rbp - 0x30], 7
mov eax, dword [0x1400eff20]
mov word [rbp - 0x48], ax
mov word [rbp - 0x46], r13w
mov r9d, 4
lea r8, str.HKLM
lea rcx, [rbp - 0x48]
call fcn.140006ee0
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x78], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 7
mov word [rax], r13w
bts r12d, 0xb
lea r8, str.SYSTEMCurrentControlSetControlNetworkProviderOrder
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x28]
call fcn.140006cf0
mov rdx, rax
mov rcx, rdi
call fcn.140005f80
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x140031de2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031ddd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032bcc
call fcn.14009bfe4
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r13w
mov rdx, qword [rbp - 0x70]
cmp rdx, 8
jb 0x140031e34
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031e2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032bd2
call fcn.14009bfe4
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x70], 7
mov word [rsp + 0x78], r13w
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x140031e86
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031e81
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032bd8
call fcn.14009bfe4
test rbx, rbx
je 0x140031e9a
mov rcx, rbx
call fcn.14002d4a0
mov qword [rdi + 0xa0], rax
mov rdx, qword [r14 + 8]
cmp rdx, qword [r14 + 0x10]
je 0x140031ebc
mov qword [rdx], rdi
mov qword [rdx + 8], rsi
mov rcx, r13
mov qword [rbp + 0x80], rcx
add qword [r14 + 8], 0x10
jmp 0x140031ecf
lea r8, [rbp + 0x78]
mov rcx, r14
call fcn.1400071a0
mov rcx, qword [rbp + 0x80]
mov r9, qword [r14 + 8]
sub r9, qword [r14]
sar r9, 4
mov r8d, 0x98
mov rax, qword gs:[0x58]
mov rdx, qword [rax]
mov qword [r8 + rdx], r9
test rcx, rcx
je 0x140031efa
call fcn.140003a40
test rbx, rbx
jne 0x140031f07
xor dil, dil
jmp 0x140032b73
lea r8, str.ProviderOrder
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0xa8]
call fcn.1400262f0
nop
mov rdi, r13
movabs rsi, 0x7ffffffffffffffe
mov r15d, 0xa
nop word [rax + rax]
lea rdx, [rbp + 0xa8]
cmp qword [rbp + 0xc0], 8
setae r11b
mov r10, qword [rbp + 0xa8]
cmovae rdx, r10
mov r8, qword [rbp + 0xb8]
lea r9, [rdi + rdi]
cmp rdi, r8
jae 0x140031faf
mov rax, r8
sub rax, rdi
lea rcx, [r9 + rdx]
mov rbx, r13
je 0x140031f99
cmp word [rcx], 0x2c
je 0x140031f96
cmp rax, 1
je 0x140031f99
dec rax
add rcx, 2
cmp word [rcx], 0x2c
jne 0x140031f83
mov rbx, rcx
test rbx, rbx
je 0x140031faf
sub rbx, rdx
sar rbx, 1
mov qword [rsp + 0x68], rbx
cmp rbx, 0xffffffffffffffff
jne 0x140032006
lea rdx, [rbp + 0xa8]
test r11b, r11b
cmovne rdx, r10
cmp rdi, r8
jae 0x140031ffa
mov rax, r8
sub rax, rdi
lea rcx, [rdx + r9]
mov rbx, r13
je 0x140031fed
cmp word [rcx], 0x20
je 0x140031fea
cmp rax, 1
je 0x140031fed
dec rax
add rcx, 2
cmp word [rcx], 0x20
jne 0x140031fd7
mov rbx, rcx
test rbx, rbx
je 0x140031ffa
sub rbx, rdx
sar rbx, 1
jmp 0x140032001
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x68], rbx
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], r13
cmp r8, rdi
jb 0x140032bbb
sub rbx, rdi
sub r8, rdi
cmp r8, rbx
cmovb rbx, r8
lea r14, [rbp + 0xa8]
test r11b, r11b
cmovne r14, r10
add r14, r9
cmp rbx, rsi
ja 0x140032bb5
cmp rbx, 8
jae 0x140032079
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x38], 7
add rbx, rbx
mov r8, rbx
mov rdx, r14
lea rcx, [rbp + 0x20]
call fcn.14009d3c0
mov word [rbp + rbx + 0x20], r13w
mov rdi, qword [rbp + 0x38]
mov rsi, qword [rbp + 0x20]
jmp 0x1400320c4
mov rdi, rbx
or rdi, 7
cmp rdi, rsi
jbe 0x14003208a
mov rdi, rsi
jmp 0x140032092
cmp rdi, 0xa
cmovb rdi, r15
lea rdx, [rdi + 1]
lea rcx, [rbp + 0x20]
call fcn.1400037f0
mov rsi, rax
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x30], rbx
mov qword [rbp + 0x38], rdi
add rbx, rbx
mov r8, rbx
mov rdx, r14
mov rcx, rax
call fcn.14009d3c0
mov word [rsi + rbx], r13w
or r12d, 4
mov dword [rsp + 0x30], r12d
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xc8], xmm0
mov qword [rbp + 0xd8], rax
lea r13, [rbp + 0x20]
cmp rdi, 8
setae byte [rsp + 0x35]
cmovae r13, rsi
call fcn.140008180
mov rcx, rax
test rax, rax
je 0x140032c3e
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rdx, [0x1400eff20]
lea rcx, [rsp + 0x48]
call fcn.1400062d0
test al, al
jne 0x14003213e
mov r8d, 1
lea rdx, [0x1400eff20]
lea rcx, [rsp + 0x48]
call fcn.1400068f0
nop
xor ecx, ecx
mov qword [rsp + 0x50], rcx
mov rdi, qword [rsp + 0x48]
lea rax, [rdi - 0x18]
mov qword [rsp + 0x40], rax
mov rcx, qword [rdi - 0x18]
test rcx, rcx
je 0x140032167
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x140032176
call fcn.140008180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
nop
test rax, rax
je 0x140032c33
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
or r12d, 8
mov dword [rsp + 0x30], r12d
movsxd r15, dword [rdi - 0x10]
mov rsi, 0xffffffffffffffff
lea rdx, str.SystemCurrentControlSetServices
nop dword [rax]
inc rsi
cmp word [rdx + rsi*2], 0
jne 0x1400321b0
lea r14d, [r15 + rsi]
test r14d, r14d
js 0x140032c28
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x1400321f2
mov edx, r14d
lea rcx, [rsp + 0x50]
call fcn.140006870
mov rbx, qword [rsp + 0x50]
lea rdx, str.SystemCurrentControlSetServices
movsxd rsi, esi
add rsi, rsi
je 0x14003221c
test rbx, rbx
jne 0x140032211
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
jmp 0x14003221c
mov r8, rsi
mov rcx, rbx
call fcn.14009d3c0
mov r8, r15
add r8, r8
lea rcx, [rsi + rbx]
je 0x140032258
test rcx, rcx
je 0x140032248
test rdi, rdi
je 0x14003223c
mov rdx, rdi
call fcn.14009d3c0
jmp 0x140032258
xor edx, edx
call fcn.14009e880
test rdi, rdi
jne 0x140032258
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
lea r15, [rbx - 0x18]
mov qword [rbp - 0x50], r15
cmp r14d, dword [r15 + 0xc]
jg 0x140032c28
mov dword [r15 + 8], r14d
movsxd rax, r14d
xor esi, esi
mov word [rbx + rax*2], si
mov qword [rsp + 0x58], rsi
mov rcx, qword [r15]
test rcx, rcx
je 0x14003228f
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x14003229e
call fcn.140008180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
nop
test rax, rax
je 0x140032c1d
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x58], rdi
or r12d, 0x10
mov dword [rsp + 0x30], r12d
test r13, r13
je 0x1400322dc
mov rsi, 0xffffffffffffffff
nop
inc rsi
cmp word [r13 + rsi*2], 0
jne 0x1400322d0
movsxd r14, dword [r15 + 8]
lea r15d, [rsi + r14]
test r15d, r15d
js 0x140032c12
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, r15d
or eax, ecx
jge 0x140032311
mov edx, r15d
lea rcx, [rsp + 0x58]
call fcn.140006870
mov rdi, qword [rsp + 0x58]
add r14, r14
je 0x14003234c
test rdi, rdi
je 0x14003233c
mov r8, r14
mov rcx, rdi
test rbx, rbx
je 0x140032330
mov rdx, rbx
call fcn.14009d3c0
jmp 0x14003234c
xor edx, edx
call fcn.14009e880
test rbx, rbx
jne 0x14003234c
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
movsxd r8, esi
add r8, r8
lea rcx, [r14 + rdi]
je 0x140032383
test rcx, rcx
je 0x140032373
test r13, r13
je 0x14003236c
mov rdx, r13
call fcn.14009d3c0
jmp 0x140032383
xor edx, edx
call fcn.14009e880
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
cmp r15d, dword [rdi - 0xc]
jg 0x140032c12
mov dword [rdi - 0x10], r15d
movsxd rax, r15d
xor ecx, ecx
mov word [rdi + rax*2], cx
mov qword [rsp + 0x60], rcx
mov rcx, qword [rdi - 0x18]
test rcx, rcx
je 0x1400323b3
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x1400323c2
call fcn.140008180
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
nop
test rax, rax
je 0x140032c07
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x60], rbx
or r12d, 0x20
mov dword [rsp + 0x30], r12d
movsxd r13, dword [rdi - 0x10]
lea r15d, [r13 + 0x10]
test r15d, r15d
js 0x140032bfc
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r15d
or eax, ecx
jge 0x14003241b
mov edx, r15d
lea rcx, [rsp + 0x60]
call fcn.140006870
mov rbx, qword [rsp + 0x60]
mov rsi, r13
add rsi, rsi
je 0x140032459
test rbx, rbx
je 0x140032449
mov r8, rsi
mov rcx, rbx
test rdi, rdi
je 0x14003243d
mov rdx, rdi
call fcn.14009d3c0
jmp 0x140032459
xor edx, edx
call fcn.14009e880
test rdi, rdi
jne 0x140032459
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
lea rax, [rsi + rbx]
test rax, rax
jne 0x140032474
call fcn.1400a31cc
mov dword [rax], 0x16
call fcn.1400a3060
jmp 0x140032489
movups xmm0, xmmword [str.NetworkProvider]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1400f5f08]
movups xmmword [rax + 0x10], xmm1
cmp r15d, dword [rbx - 0xc]
jg 0x140032bfc
mov dword [rbx - 0x10], r15d
mov rax, r13
xor r13d, r13d
mov word [rbx + rax*2 + 0x20], r13w
lea r9d, [r13 + 1]
mov r8, rbx
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0xc8]
call fcn.140027410
nop
and r12d, 0xffffffdf
mov dword [rsp + 0x30], r12d
mov eax, 0xffffffff
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x1400324e4
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + VariantCopy]
and dword [rsp + 0x30], 0xffffffef
mov eax, 0xffffffff
lock xadd dword [rdi - 8], eax
sub eax, 1
jg 0x140032506
mov rcx, qword [rdi - 0x18]
mov rax, qword [rcx]
lea rdx, [rdi - 0x18]
call qword [rax + VariantCopy]
and dword [rsp + 0x30], 0xfffffff7
mov eax, 0xffffffff
mov rdx, qword [rbp - 0x50]
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140032528
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov eax, 0xffffffff
mov rdx, qword [rsp + 0x40]
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140032545
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rsi, qword [rbp + 0xc8]
test rsi, rsi
je 0x1400329e3
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
mov qword [rbp + 0x68], r13
mov qword [rbp + 0x70], 7
mov word [rbp + 0x58], r13w
mov r12d, dword [rsp + 0x30]
or r12d, 0x40
mov dword [rsp + 0x30], r12d
mov dword [rbp + 0x18], 0x800
lea rax, [rbp + 0x18]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x50]
xor r8d, r8d
lea rdx, str.ProviderPath
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400325b9
cmp eax, 0xd
jne 0x1400325fb
jmp 0x1400325d1
mov eax, dword [rbp + 0x50]
dec eax
cmp eax, 1
ja 0x1400325d1
cmp dword [rbp + 0x18], 0
jne 0x1400325d1
mov word [rbp + 0x100], r13w
lea rax, [rbp + 0x100]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x1400325e0
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0x58]
call fcn.140003510
cmp qword [rbp + 0x68], 0
je 0x14003299d
mov ecx, 0x148
call fcn.14009bfa8
mov r15, rax
mov qword [rsp + 0x40], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rax, vtable.std::_Ref_count_obj2_struct_AutorunsEntry_.0
mov qword [r15], rax
lea rbx, [r15 + 0x10]
xor edx, edx
mov r8d, 0x138
mov rcx, rbx
call fcn.14009e880
mov rcx, rbx
call fcn.140007090
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
bts r12d, 7
mov dword [rsp + 0x30], r12d
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], r15
movzx eax, byte [rsp + 0x34]
xor eax, 1
add eax, eax
bts eax, 0xd
mov dword [rbx + 0x118], eax
lea rax, [rbp + 0x20]
cmp rbx, rax
je 0x1400326a2
lea rdx, [rbp + 0x20]
cmp byte [rsp + 0x35], 0
cmovne rdx, qword [rbp + 0x20]
mov r8, qword [rbp + 0x30]
mov rcx, rbx
call fcn.140003510
lea rcx, [rbx + 0x80]
lea rax, [rbp + 0x58]
cmp rcx, rax
je 0x1400326c9
lea rdx, [rbp + 0x58]
cmp qword [rbp + 0x70], 8
cmovae rdx, qword [rbp + 0x58]
mov r8, qword [rbp + 0x68]
call fcn.140003510
lea rcx, [rbp + 0x58]
call fcn.14002e1f0
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.14002c0f0
mov rdi, rax
add rbx, 0x60
cmp rbx, rax
je 0x140032757
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140032729
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140032724
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140032bde
mov rcx, r8
call fcn.14009bfe4
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], 7
mov word [rbx], r13w
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 7
mov word [rdi], r13w
mov rdx, qword [rbp + 0x10]
cmp rdx, 8
jb 0x140032797
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032792
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032bde
call fcn.14009bfe4
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
lock inc dword [r15 + 8]
mov r14, qword [rbp + 0x40]
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], r15
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x68]
call fcn.1400263f0
mov rsi, qword [rbp + 0xc8]
test al, al
je 0x14003291d
xorps xmm0, xmm0
movups xmmword [rbp + 0x88], xmm0
mov rdi, r13
mov qword [rbp + 0x98], r13
mov ebx, 7
mov qword [rbp + 0xa0], rbx
mov word [rbp + 0x88], r13w
mov r12d, dword [rsp + 0x30]
bts r12d, 8
mov dword [rsp + 0x30], r12d
mov dword [rbp + 0x1c], 0x800
lea rax, [rbp + 0x1c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x900]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x54]
xor r8d, r8d
lea rdx, str.Name
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140032842
cmp eax, 0xd
jne 0x14003289b
jmp 0x140032859
mov eax, dword [rbp + 0x54]
dec eax
cmp eax, 1
ja 0x140032859
cmp dword [rbp + 0x1c], edi
jne 0x140032859
mov word [rbp + 0x900], r13w
lea rax, [rbp + 0x900]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], di
jne 0x140032870
lea rdx, [rbp + 0x900]
lea rcx, [rbp + 0x88]
call fcn.140003510
mov rbx, qword [rbp + 0xa0]
mov rdi, qword [rbp + 0x98]
test rdi, rdi
je 0x1400328d2
lea rcx, [r14 + 0x20]
lea rax, [rbp + 0x88]
cmp rcx, rax
je 0x1400328d2
lea rdx, [rbp + 0x88]
cmp rbx, 8
cmovae rdx, qword [rbp + 0x88]
mov r8, rdi
call fcn.140003510
mov rbx, qword [rbp + 0xa0]
btr r12d, 8
mov dword [rsp + 0x30], r12d
cmp rbx, 8
jb 0x140032922
lea rdx, [rbx*2 + 2]
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032916
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032be4
call fcn.14009bfe4
jmp 0x140032922
mov r12d, dword [rsp + 0x30]
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax + 8]
cmp rdx, qword [rax + 0x10]
je 0x140032947
mov qword [rdx], r14
mov qword [rdx + 8], r15
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x40], xmm0
add qword [rax + 8], 0x10
jmp 0x140032954
lea r8, [rbp + 0x40]
mov rcx, rax
call fcn.1400071a0
nop
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x14003299d
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140032991
mov rbx, qword [rbp + 0x48]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, 0xffffffff
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140032991
mov rcx, qword [rbp + 0x48]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov r12d, dword [rsp + 0x30]
mov rsi, qword [rbp + 0xc8]
and r12d, 0xffffffbf
mov rdx, qword [rbp + 0x70]
cmp rdx, 8
jb 0x1400329e8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400329dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032bea
call fcn.14009bfe4
jmp 0x1400329e8
mov r12d, dword [rsp + 0x30]
mov rdi, qword [rsp + 0x68]
cmp rdi, 0xffffffffffffffff
je 0x140032a5e
inc rdi
test rsi, rsi
je 0x140032a05
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
movabs rsi, 0x7ffffffffffffffe
mov r15d, 0xa
jb 0x140031f40
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032a54
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032bf0
call fcn.14009bfe4
jmp 0x140031f40
test rsi, rsi
je 0x140032a6d
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 8
jb 0x140032aad
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032aa8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032bf0
call fcn.14009bfe4
cmp byte [rsp + 0x34], 0
je 0x140032b09
xor r9d, r9d
mov r14, qword [rsp + 0x70]
mov r8, r14
lea rdx, str.SYSTEMCurrentControlSetControlNetworkProviderOrder
mov rcx, 0xffffffff80000002
call fcn.140031b20
mov rdx, qword [r14 + 8]
mov r8d, 0x98
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov rcx, qword [r8 + rcx]
shl rcx, 4
add rcx, qword [r14]
mov r8, rdx
sub r8, rcx
sar r8, 4
lea r9, [0x140023240]
call fcn.14000a910
mov dil, 1
mov rdx, qword [rbp + 0xc0]
cmp rdx, 8
jb 0x140032b52
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032b4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032bf6
call fcn.14009bfe4
mov qword [rbp + 0xb8], r13
mov qword [rbp + 0xc0], 7
mov word [rbp + 0xa8], r13w
mov rbx, qword [rbp + 0xe0]
test rbx, rbx
je 0x140032b81
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, dil
mov rcx, qword [rbp + 0x1100]
xor rcx, rsp
call fcn.14009c570
lea r11, [rsp + 0x1210]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140003690
nop
call fcn.140007070
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
call fcn.1400a3080
nop
call fcn.1400a3080
nop
call fcn.1400a3080
nop
call fcn.1400a3080
int3
call fcn.1400a3080
nop
call fcn.1400a3080
nop
call fcn.1400a3080
nop
call fcn.1400a3080
nop
mov ecx, 0x80070057
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80070057
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80070057
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
nop
mov ecx, 0x80004005
call fcn.140007f00
int3