Function at 0x1403a16e8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4e0
mov rax, qword [0x1404e41f8]
xor rax, rsp
mov qword [rsp + AfxStoreField], rax
xor r14d, r14d
bt ecx, 0x10
mov rsi, r8
mov r15, rdx
mov ebx, ecx
mov dword [rsp + 0x5c], gethostbyname
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x3c], r14d
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x54], r14d
mov dword [rsp + 0x58], reloc.mfc90u.dll_SerializeElements_class_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_______
jae 0x1403a1766
lea rdx, [rsp + 0x30]
xor r8d, r8d
call fcn.1403a2fe8
mov eax, dword [rsp + 0x30]
lea ebp, [r14 + 1]
cmp eax, r14d
cmove eax, ebp
jmp 0x1403a1dd6
mov r13d, 2
test r13b, cl
je 0x1403a1792
mov rcx, r8
call fcn.1403a5c44
mov ecx, eax
mov eax, 0x91a2b3c5
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
add dword [rsp + 0x30], edx
test bl, 0x10
mov ebp, 1
je 0x1403a1895
lea r12, [rsp + reloc.mfc90u.dll_CMiniFrameWnd::CMiniFrameWnd]
mov rcx, rsi
sub r12, rsi
mov al, byte [rcx]
mov byte [r12 + rcx], al
add rcx, rbp
cmp al, r14b
jne 0x1403a17ae
mov rcx, rsi
call fcn.1403a5b60
cmp eax, r14d
mov dword [rsp + 0x3c], eax
jne 0x1403a1884
mov rax, qword [str.Network_]
lea rcx, [rsp + reloc.mfc90u.dll_CMiniFrameWnd::CMiniFrameWnd]
lea rdi, [rsp + reloc.mfc90u.dll_CMiniFrameWnd::CMiniFrameWnd]
mov qword [rcx], rax
mov al, byte [0x140479038]
mov byte [rsp + 0x49], r14b
mov byte [rcx + 8], al
mov al, byte [rsi]
or rcx, 0xffffffffffffffff
mov byte [rsp + 0x48], al
xor eax, eax
lea rdx, [rsp + 0x48]
repne scasb al, byte [rdi]
sub rdi, rbp
xor ecx, ecx
mov al, byte [rdx + rcx]
mov byte [rdi + rcx], al
add rcx, rbp
test al, al
jne 0x1403a1811
lea r8, [rsp + 0x60]
lea rdx, [rsp + reloc.mfc90u.dll_CMiniFrameWnd::CMiniFrameWnd]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp eax, r14d
jne 0x1403a1884
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + reloc.mfc90u.dll_CMiniFrameWnd::CMiniFrameWnd]
lea rdx, str.RemotePath
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, r14d
je 0x1403a1884
mov rcx, rsi
mov al, byte [rcx]
mov byte [r12 + rcx], al
add rcx, rbp
cmp al, r14b
jne 0x1403a1876
lea rcx, [rsp + reloc.mfc90u.dll_CMiniFrameWnd::CMiniFrameWnd]
call fcn.1403a5b60
add dword [rsp + 0x30], eax
bt ebx, 0xc
jae 0x1403a18ae
call fcn.1403a53d4
cmp eax, r14d
je 0x1403a18ab
add dword [rsp + 0x30], eax
jmp 0x1403a18ae
or ebx, 0x20
bt ebx, 0xe
jae 0x1403a18bd
call fcn.1403a560c
add dword [rsp + 0x30], eax
test bl, 0x20
je 0x1403a18d0
call fcn.1403a580c
add dword [rsp + 0x30], eax
call fcn.1403a580c
test bl, 0x40
je 0x1403a18ea
lea rdx, [rsp + 0x54]
mov rcx, r15
call fcn.1403a4f48
mov edx, dword [rsp + 0x54]
add dword [rsp + 0x30], edx
test bl, bl
jns 0x1403a1b95
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x48], 0x1e
mov byte [rsp + 0x210], r14b
call fcn.1403a4e7c
lea rdx, [rsp + 0x40]
mov r12, 0xffffffff80000002
mov qword [rsp + 0x20], rdx
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion
mov r9d, ebp
xor r8d, r8d
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, r14d
jne 0x1403a1a94
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x210]
lea rdx, str.ProductId
mov edi, 0x64
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, r14d
jne 0x1403a1991
lea rcx, [rsp + 0x210]
call fcn.1403a4e10
btr eax, 0x1f
jmp 0x1403a1b09
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x40]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov r9d, ebp
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, r14d
jne 0x1403a1b1c
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x210]
lea rdx, str.ProductId
xor r8d, r8d
mov dword [rsp + 0x34], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, r14d
je 0x1403a1afc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [rsp + 0x48], 0xb
jl 0x1403a1b22
call fcn.1403a3c88
cmp eax, r14d
je 0x1403a1b22
lea rax, [rsp + 0x40]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion
mov r9d, SerializeElements<class ATL::CStringT<wchar_t,class StrTraitMFC_DLL<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, r14d
jne 0x1403a1b22
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x210]
lea rdx, str.ProductId
xor r8d, r8d
mov dword [rsp + 0x34], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, r14d
jne 0x1403a1b22
jmp 0x1403a1afc
lea rax, [rsp + 0x40]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov r9d, ebp
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, r14d
jne 0x1403a1b84
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x210]
lea rdx, str.ProductId
mov edi, 0x64
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, r14d
jne 0x1403a1b1c
lea rcx, [rsp + 0x210]
call fcn.1403a4e10
add dword [rsp + 0x30], eax
lea rcx, [rsp + 0x210]
call fcn.1403a4e10
jmp 0x1403a1b22
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x210]
lea rdx, str.ProductKey
xor r8d, r8d
mov byte [rsp + 0x210], r14b
mov dword [rsp + 0x34], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, r14d
jne 0x1403a1b84
lea rcx, [rsp + 0x210]
call fcn.1403a4e10
lea rcx, [rsp + 0x210]
add dword [rsp + 0x30], eax
call fcn.1403a4e10
jmp 0x1403a1b8a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
bt ebx, 8
jae 0x1403a1d62
mov al, byte [rsi + 1]
cmp al, r14b
je 0x1403a1bf1
cmp al, 0x3a
je 0x1403a1bf1
cmp al, 0x5c
je 0x1403a1bc7
lea rcx, [rsp + 0x280]
xor r8d, r8d
mov rdx, rsi
call fcn.1403a23e8
jmp 0x1403a1c7c
mov al, byte [rsi + 2]
mov rcx, r13
jmp 0x1403a1be7
cmp al, 0x5c
je 0x1403a1c71
mov byte [rsp + rcx + 0x27e], al
add r13d, ebp
add rcx, rbp
mov al, byte [rcx + rsi]
cmp al, r14b
jne 0x1403a1bcf
jmp 0x1403a1c71
mov al, byte [rsi]
lea rcx, str.mpr.dll
mov byte [rsp + 0x4d], 0x3a
mov byte [rsp + 0x4c], al
mov byte [rsp + 0x4e], r14b
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp rax, r14
mov rdi, rax
jne 0x1403a1c1d
xor eax, eax
jmp 0x1403a1dd6
lea rdx, str.WNetGetConnectionA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r8, [rsp + 0x5c]
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x4c]
call rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp byte [rsp + reloc.mfc90u.dll_CDocItem::CDocItem], r14b
je 0x1403a1c71
lea rax, [rsp + reloc.mfc90u.dll_CDocItem::CDocItem]
mov cl, byte [rax]
cmp cl, 0x5c
je 0x1403a1c71
mov byte [rax - 2], cl
add rax, rbp
add r13d, ebp
cmp byte [rax], r14b
jne 0x1403a1c5c
movsxd rax, r13d
mov byte [rsp + rax + 0x27e], r14b
cmp byte [rsp + 0x280], r14b
je 0x1403a1d62
lea rcx, str.Ws2_32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp rax, r14
mov r12, rax
je 0x1403a1d8f
lea rdx, str.WSAStartup
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.gethostbyname
mov rcx, r12
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WSACleanup
mov rcx, r12
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x70]
mov ecx, SerializeElements<class ATL::CStringT<wchar_t,class StrTraitMFC_DLL<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >
mov r14, rax
call rdi
cmp rax, 0xffffffffffffffff
je 0x1403a1d56
lea rcx, [rsp + 0x280]
call r13
test rax, rax
mov rdi, rax
je 0x1403a1d53
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx]
mov cl, byte [rdx]
mov edx, dword [rsp + 0x30]
and ecx, 0x7f
shl ecx, 0x18
add edx, ecx
mov dword [rsp + 0x30], edx
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx]
movsx ecx, byte [rax + 1]
shl ecx, 0x10
add edx, ecx
mov dword [rsp + 0x30], edx
mov rax, qword [rdi + 0x18]
mov rcx, qword [rax]
movsx eax, byte [rcx + 2]
shl eax, 8
add edx, eax
mov dword [rsp + 0x30], edx
mov rax, qword [rdi + 0x18]
mov rcx, qword [rax]
movsx eax, byte [rcx + 3]
add edx, eax
mov dword [rsp + 0x30], edx
call r14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor r14d, r14d
bt ebx, 0x11
jae 0x1403a1dca
cmp r15, r14
mov dword [rsp + 0x3c], r14d
mov dword [rsp + 0x50], r14d
je 0x1403a1d96
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r15
repne scasb al, byte [rdi]
not rcx
cmp rcx, rbp
je 0x1403a1d96
mov rdx, r15
jmp 0x1403a1db1
mov eax, 0x3a
jmp 0x1403a1dd6
cmp rsi, r14
je 0x1403a1dc2
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
cmp rcx, rbp
je 0x1403a1dc2
mov rdx, rsi
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x3c]
xor ecx, ecx
call fcn.1403a4c84
mov eax, dword [rsp + 0x3c]
add dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
btr eax, 0x1f
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.1403addc0
mov rbx, qword [rsp + 0x538]
add rsp, 0x4e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret