Function at 0x430c60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5d7e3d
mov eax, dword fs:[0]
push eax
sub esp, 0xaf0
mov eax, dword [0x659fd4]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor edi, edi
mov dword [ebp - 0xa08], edi
push 0x62a4b4
lea ecx, [ebp - 0x868]
call fcn.004128a0
mov dword [ebp - 4], edi
call fcn.00419ac0
cmp dword [eax + 4], 4
jl 0x430cc3
push ecx
lea ecx, [ebp - 0x868]
call fcn.00411500
mov byte [ebp - 4], 1
push str.6.5.0
lea ecx, [ebp - 0x9e0]
call fcn.0045a280
mov esi, eax
mov byte [ebp - 4], 2
push 0
push 0x116b7
lea ecx, [ebp - 0x84c]
call fcn.0041b320
mov byte [ebp - 4], 3
push 0
push esi
push eax
call fcn.00447180
mov byte [ebp - 4], 4
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x844]
call fcn.004076c4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x9e0]
call fcn.0045a560
mov dword [ebp - 0x9d4], 0x3e8
mov dword [ebp - 0x9ec], 0
mov dword [ebp - 0x9e8], 0
mov dword [ebp - 0x9e4], 0
mov byte [ebp - 4], 5
push 0x20019
push str.SoftwareIntelNetwork_ServicesDMIX
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x9ec]
call fcn.0042f890
test eax, eax
jne 0x430e64
mov dword [ebp - 0xa24], 0x7d0
mov dword [ebp - 0x9d4], eax
lea eax, [ebp - 0xa24]
push eax
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0x9d8]
push eax
push 0
push str.OEMVersion
push dword [ebp - 0x9ec]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call ebx
test eax, eax
jne 0x430f63
mov eax, dword [ebp - 0x9d8]
cmp eax, 1
je 0x430dc8
cmp eax, 2
jne 0x430f63
mov ecx, dword [ebp - 0xa24]
test ecx, ecx
je 0x430def
test cl, 1
jne 0x430f63
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x7e6], 0
je 0x430df8
jmp 0x430f63
xor eax, eax
mov word [ebp - 0x7e4], ax
shr ecx, 1
mov dword [ebp - 0x9d4], ecx
lea eax, [ebp - 0x7e4]
push eax
lea ecx, [ebp - 0x9e0]
call fcn.00442cd0
mov esi, eax
mov byte [ebp - 4], 6
push 0
push 0x116d1
lea ecx, [ebp - 0x908]
call fcn.0041b320
mov byte [ebp - 4], 7
push 0
push esi
push eax
call fcn.00447180
mov byte [ebp - 4], 8
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x900]
call fcn.004076c4
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x9e0]
call fcn.00442d80
jmp 0x430f63
push 0x20119
push str.SoftwareIntelNetwork_ServicesDMIX
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x9ec]
call fcn.0042f890
test eax, eax
jne 0x430f5d
mov dword [ebp - 0xa28], 0x7d0
mov dword [ebp - 0x9d4], eax
lea eax, [ebp - 0xa28]
push eax
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0x9d8]
push eax
push 0
push str.OEMVersion
push dword [ebp - 0x9ec]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call ebx
test eax, eax
jne 0x430f63
mov eax, dword [ebp - 0x9d8]
cmp eax, 1
je 0x430edc
cmp eax, 2
jne 0x430f63
mov ecx, dword [ebp - 0xa28]
test ecx, ecx
je 0x430efc
test cl, 1
jne 0x430f63
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x7e6], 0
je 0x430f05
jmp 0x430f63
xor eax, eax
mov word [ebp - 0x7e4], ax
shr ecx, 1
mov dword [ebp - 0x9d4], ecx
lea eax, [ebp - 0x7e4]
push eax
lea ecx, [ebp - 0x9e0]
call fcn.00442cd0
mov esi, eax
mov byte [ebp - 4], 9
push 0
push 0x116d1
lea ecx, [ebp - 0x9d0]
call fcn.0041b320
mov byte [ebp - 4], 0xa
push 0
push esi
push eax
call fcn.00447180
mov byte [ebp - 4], 0xb
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x9c8]
jmp 0x430e4b
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x9d4], 0x3e8
push 0x20019
push str.SoftwareIntelWirelessCommonAppFrameworkSettings
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x9ec]
call fcn.0042f890
test eax, eax
jne 0x431067
mov dword [ebp - 0xa04], 0x7d0
mov dword [ebp - 0x9d4], eax
lea eax, [ebp - 0xa04]
push eax
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0x9d8]
push eax
push 0
push str.PROSetVersion
push dword [ebp - 0x9ec]
call ebx
test eax, eax
jne 0x431292
mov eax, dword [ebp - 0x9d8]
cmp eax, 1
je 0x430fdf
cmp eax, 2
jne 0x431292
mov ecx, dword [ebp - 0xa04]
test ecx, ecx
je 0x431006
test cl, 1
jne 0x431292
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x7e6], 0
je 0x43100f
jmp 0x431292
xor eax, eax
mov word [ebp - 0x7e4], ax
shr ecx, 1
mov dword [ebp - 0x9d4], ecx
lea eax, [ebp - 0x7e4]
push eax
lea ecx, [ebp - 0x9e0]
call fcn.00442cd0
mov esi, eax
mov byte [ebp - 4], 0xc
push 0
push 0x116c9
lea ecx, [ebp - 0x9a8]
call fcn.0041b320
mov byte [ebp - 4], 0xd
push 0
push esi
push eax
call fcn.00447180
mov byte [ebp - 4], 0xe
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x9a0]
jmp 0x43127e
push 0x20019
push str.SoftwareIntelWirelessAppFrameworkSettings
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x9ec]
call fcn.0042f890
test eax, eax
jne 0x431161
mov dword [ebp - 0xa00], 0x7d0
mov dword [ebp - 0x9d4], eax
lea eax, [ebp - 0xa00]
push eax
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0x9d8]
push eax
push 0
push str.PROSetVersion
push dword [ebp - 0x9ec]
call ebx
test eax, eax
jne 0x431292
mov eax, dword [ebp - 0x9d8]
cmp eax, 1
je 0x4310d9
cmp eax, 2
jne 0x431292
mov ecx, dword [ebp - 0xa00]
test ecx, ecx
je 0x431100
test cl, 1
jne 0x431292
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x7e6], 0
je 0x431109
jmp 0x431292
xor eax, eax
mov word [ebp - 0x7e4], ax
shr ecx, 1
mov dword [ebp - 0x9d4], ecx
lea eax, [ebp - 0x7e4]
push eax
lea ecx, [ebp - 0x9e0]
call fcn.00442cd0
mov esi, eax
mov byte [ebp - 4], 0xf
push 0
push 0x116c9
lea ecx, [ebp - 0x980]
call fcn.0041b320
mov byte [ebp - 4], 0x10
push 0
push esi
push eax
call fcn.00447180
mov byte [ebp - 4], 0x11
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x978]
jmp 0x43127e
push 0x20119
push str.SoftwareIntelWirelessCommonAppFrameworkSettings
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x9ec]
call fcn.0042f890
lea ecx, [ebp - 0x9ec]
test eax, eax
jne 0x4311f5
lea eax, [ebp - 0x9d4]
push eax
lea eax, [ebp - 0x7e4]
push eax
push str.PROSetVersion
call fcn.0042f990
test eax, eax
jne 0x431292
lea eax, [ebp - 0x7e4]
push eax
lea ecx, [ebp - 0x9e0]
call fcn.00442cd0
mov esi, eax
mov byte [ebp - 4], 0x12
push 0
push 0x116c9
lea ecx, [ebp - 0x958]
call fcn.0041b320
mov byte [ebp - 4], 0x13
push 0
push esi
push eax
call fcn.00447180
mov byte [ebp - 4], 0x14
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x950]
jmp 0x43127e
push 0x20119
push str.SoftwareIntelWirelessAppFrameworkSettings
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0042f890
test eax, eax
jne 0x431292
lea eax, [ebp - 0x9d4]
push eax
lea eax, [ebp - 0x7e4]
push eax
push str.PROSetVersion
lea ecx, [ebp - 0x9ec]
call fcn.0042f990
test eax, eax
jne 0x431292
lea eax, [ebp - 0x7e4]
push eax
lea ecx, [ebp - 0x9e0]
call fcn.00442cd0
mov esi, eax
mov byte [ebp - 4], 0x15
push 0
push 0x116c9
lea ecx, [ebp - 0x890]
call fcn.0041b320
mov byte [ebp - 4], 0x16
push 0
push esi
push eax
call fcn.00447180
mov byte [ebp - 4], 0x17
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x888]
call fcn.004076c4
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x9e0]
call fcn.00442d80
xor ebx, ebx
mov dword [ebp - 0xa20], ebx
or esi, 0xffffffff
cmp ebx, 0x64
jae 0x431d8d
mov dword [ebp - 0xadc], 0x628438
mov dword [ebp - 0xacc], 0x628430
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
mov dword [ebp - method.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov byte [ebp - 4], 0x18
or edi, 1
mov dword [ebp - 0xa08], edi
sub esp, 8
lea eax, [ebp - 0xac4]
push eax
lea ecx, [ebp - 0xadc]
call fcn.00414790
mov dword [ebp - 4], 0x1a
lea eax, [ebp - 0xacc]
mov dword [ebp - 0xa0c], eax
mov eax, dword [ebp - 0xacc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0xacc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0xad0], eax
mov dword [ebp - 4], 0x1c
mov eax, dword [ebp - 0xadc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0xadc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ebp + ecx - 0xae0], eax
mov dword [ebp - 4], 0x1d
mov eax, dword [ebp - 0xadc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebp - 0xadc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0xae0], eax
lea eax, [ebp - 0xac4]
mov dword [ebp - 0xa0c], eax
mov ecx, eax
call fcn.00414840
mov byte [ebp - 4], 0x1e
mov dword [ebp - method.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov dword [ebp - 0xa8c], 0
mov dword [ebp - 0xaf8], 0
mov dword [ebp - 0xa88], 0
mov byte [ebp - 4], 0x1f
mov byte [ebp - 4], 0x20
mov eax, dword [ebp - 0xadc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xabc], 4
mov dword [ebp + eax - 0xab8], 0
mov eax, dword [ebp - 0xadc]
mov eax, dword [eax + 4]
mov ecx, 0x30
mov word [ebp + eax - 0xa9c], cx
push ebx
lea ecx, [ebp - 0xacc]
call fcn.00413de0
lea ecx, [ebp - 0x7fc]
call fcn.00407bea
mov byte [ebp - 4], 0x21
mov edi, dword [ebp - 0x7e8]
cmp edi, 0x4e
jb 0x431463
lea esi, [ebp - 0x7fc]
cmp edi, 8
cmovae esi, dword [ebp - 0x7fc]
mov dword [ebp - 0x7ec], 0x4e
push 0x9c
push str.systemCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318_
push esi
call fcn.005abfe0
add esp, 0xc
xor eax, eax
mov word [esi + 0x9c], ax
jmp 0x4315af
mov dword [ebp - 0x81c], VariantClear
mov dword [ebp - 0xafc], 8
mov dword [ebp - 0xaf4], SysReAllocStringLen
mov dword [ebp - 0xaf0], VariantClear
mov dword [ebp - 0x820], VariantClear
mov dword [ebp - 0xae4], 8
mov dword [ebp - 0xaec], SysReAllocStringLen
mov dword [ebp - 0xae0], VariantClear
mov dword [ebp - 0x824], 0x4f
mov ecx, edi
shr ecx, 1
mov eax, SysReAllocString
sub eax, ecx
cmp edi, eax
jbe 0x4314d3
mov ebx, SysReAllocString
jmp 0x4314e6
lea eax, [edi + ecx]
mov dword [ebp - 0xae8], eax
mov ebx, 0x4f
cmp eax, ebx
cmova ebx, eax
lea eax, [ebx + 1]
lea ecx, [eax + eax]
cmp eax, 0x7fffffff
jbe 0x4314f8
or ecx, 0xffffffff
jmp 0x431500
cmp ecx, 0x1000
jb 0x431524
lea eax, [ecx + 0x23]
cmp eax, ecx
cmovbe eax, esi
push eax
call fcn.00461253
add esp, 4
test eax, eax
je 0x431f97
lea esi, [eax + 0x23]
and esi, 0xffffffe0
mov dword [esi - 4], eax
jmp 0x431537
test ecx, ecx
je 0x431535
push ecx
call fcn.00461253
add esp, 4
mov esi, eax
jmp 0x431537
xor esi, esi
mov dword [ebp - 0x7ec], 0x4e
mov dword [ebp - 0x7e8], ebx
push 0x9c
push str.systemCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318_
push esi
call fcn.005aba60
add esp, 0xc
xor eax, eax
mov word [esi + 0x9c], ax
cmp edi, 8
jb 0x4315a9
lea ecx, [edi*2 + 2]
mov dword [ebp - 0x800], ecx
mov edx, dword [ebp - 0x7fc]
mov eax, edx
cmp ecx, 0x1000
jb 0x43159f
add ecx, 0x23
mov dword [ebp - 0x800], ecx
mov edx, dword [edx - 4]
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x431f97
push ecx
push edx
call fcn.005a7e2d
add esp, 8
mov dword [ebp - 0x7fc], esi
lea eax, [ebp - 0x818]
push eax
lea ecx, [ebp - 0xac4]
call fcn.00414520
or dword [ebp - 0xa08], 8
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x818]
cmp dword [ebp - 0x804], 8
cmovae ecx, dword [ebp - 0x818]
mov edi, dword [ebp - 0x808]
mov ebx, dword [ebp - 0x7ec]
mov edx, dword [ebp - 0x7e8]
mov eax, edx
sub eax, ebx
cmp edi, eax
ja 0x43162f
lea eax, [edi + ebx]
mov dword [ebp - 0x7ec], eax
lea esi, [ebp - 0x7fc]
cmp edx, 8
cmovae esi, dword [ebp - 0x7fc]
lea eax, [edi + edi]
push eax
push ecx
lea eax, [esi + ebx*2]
push eax
call fcn.005abfe0
add esp, 0xc
lea eax, [ebx + edi]
xor ecx, ecx
mov word [esi + eax*2], cx
jmp 0x43164a
mov byte [ebp - 0x9d8], 0
push edi
push ecx
push dword [ebp - 0x9d8]
push edi
lea ecx, [ebp - 0x7fc]
call fcn.0041ad40
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x818]
call fcn.004076c4
lea ecx, [ebp - 0x83c]
call fcn.00407bea
mov byte [ebp - 4], 0x23
lea esi, [ebp - 0x7fc]
cmp dword [ebp - 0x7e8], 8
cmovae esi, dword [ebp - 0x7fc]
mov dword [ebp - 0x9f4], 0
mov ebx, dword [ebp - 0x9e4]
test ebx, ebx
je 0x4316e4
cmp dword [ebx], 0
je 0x4316d7
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x4316ab
mov eax, 1
jmp 0x4316fe
push str.RegOpenKeyTransactedW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4316dd
push 0
push dword [ebx]
lea ecx, [ebp - 0x9f4]
push ecx
push 0x20019
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call eax
jmp 0x4316fe
cmp dword [ebx + 4], 0
jne 0x4316e4
mov eax, 1
jmp 0x4316fe
lea eax, [ebp - 0x9f4]
push eax
push 0x20019
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x431d60
mov ecx, dword [ebp - 0x9ec]
test ecx, ecx
je 0x431721
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x9ec], 0
mov dword [ebp - 0x9e8], 0
mov ecx, dword [ebp - 0x9f4]
mov dword [ebp - 0x9ec], ecx
mov dword [ebp - 0x9e8], 0
test eax, eax
jne 0x431d60
mov dword [ebp - 0x9d4], 0x3e8
mov dword [ebp - 0x9fc], 0x7d0
mov dword [ebp - 0x9d4], eax
lea eax, [ebp - 0x9fc]
push eax
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0xa00]
push eax
push 0
push str.DriverDesc
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
call edi
test eax, eax
jne 0x431c03
mov eax, dword [ebp - 0xa00]
cmp eax, 1
je 0x4317a4
cmp eax, 2
jne 0x431c03
mov ecx, dword [ebp - 0x9fc]
test ecx, ecx
je 0x4317cb
test cl, 1
jne 0x431c03
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x7e6], 0
je 0x4317d4
jmp 0x431c03
xor eax, eax
mov word [ebp - 0x7e4], ax
shr ecx, 1
mov dword [ebp - 0x9d4], ecx
call fcn.0040cce6
mov ecx, eax
test ecx, ecx
je 0x431f9c
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x431fa6
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
lea esi, [eax + 0x10]
mov dword [ebp - 0x9f8], esi
mov byte [ebp - 4], 0x24
mov byte [ebp - 0x9ed], 0
lea eax, [ebp - 0x7e4]
test eax, 0xffff0000
jne 0x431844
movzx eax, ax
push eax
lea ecx, [ebp - 0x9f8]
call fcn.0040d540
mov byte [ebp - 0x9ed], 1
mov esi, dword [ebp - 0x9f8]
jmp 0x4319cf
lea edi, [ebp - 0x7e4]
lea ecx, [edi + 2]
nop dword [eax]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x431850
sub edi, ecx
sar edi, 1
jne 0x431915
lea ecx, [esi - 0x10]
mov edi, dword [ecx]
cmp dword [ecx + 4], 0
je 0x4319c9
lea edx, [ecx + 0xc]
cmp dword [edx], 0
jge 0x431897
cmp dword [esi - 8], 0
jl 0x431fad
mov dword [esi - 0xc], 0
xor eax, eax
mov word [esi], ax
jmp 0x4319c9
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x4318d6
mov edx, dword [ecx]
mov eax, dword [edx]
mov esi, dword [eax + 4]
push ecx
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x431fb7
mov edx, dword [edx + 4]
mov eax, dword [edx]
mov esi, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x431fb7
push 0
push dword [edx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x431fc0
lock inc dword [edi + 0x14]
lea eax, [edi + 8]
lea esi, [eax + 0x10]
mov dword [ebp - 0x9f8], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x4319d2
lea esi, [eax + 0x10]
mov dword [ebp - 0x9f8], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x4319d2
mov eax, dword [esi - 0xc]
mov dword [ebp - 0xa04], eax
lea ebx, [ebp - 0x7e4]
sub ebx, esi
sar ebx, 1
test edi, edi
js 0x431fc9
mov ecx, 1
sub ecx, dword [esi - 4]
mov eax, dword [esi - 8]
sub eax, edi
or eax, ecx
jge 0x431953
push edi
lea ecx, [ebp - 0x9f8]
call fcn.00401fd8
mov esi, dword [ebp - 0x9f8]
cmp ebx, dword [ebp - 0xa04]
ja 0x4319a3
mov eax, dword [esi - 8]
lea edx, [esi + ebx*2]
lea ecx, [edi + edi]
test ecx, ecx
je 0x4319b7
test edx, edx
jne 0x43197e
call fcn.005af242
mov dword [eax], 0x16
call fcn.005af169
jmp 0x4319b7
add eax, eax
cmp eax, ecx
jae 0x431996
call fcn.005af242
mov dword [eax], 0x22
call fcn.005af169
jmp 0x4319b7
push ecx
push edx
push esi
call fcn.005abfe0
add esp, 0xc
jmp 0x4319b7
push edi
lea eax, [ebp - 0x7e4]
push eax
push dword [esi - 8]
push esi
call fcn.004021b4
add esp, 0x10
cmp edi, dword [esi - 8]
jg 0x431fad
mov dword [esi - 0xc], edi
xor eax, eax
mov word [esi + edi*2], ax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
or ebx, 0xffffffff
mov byte [ebp - 4], 0x25
mov ecx, str.Intel_R__Advanced_Network_Services_Virtual_Adapter
mov eax, esi
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x431a06
test dx, dx
je 0x431a02
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x431a06
add eax, 4
add ecx, 4
test dx, dx
jne 0x4319e0
xor eax, eax
jmp 0x431a0b
sbb eax, eax
or eax, 1
test eax, eax
jne 0x431bbf
mov dword [ebp - 0x9d4], 0x3e8
mov dword [ebp - 0x9d8], 0x7d0
mov dword [ebp - 0x9d4], eax
lea eax, [ebp - 0x9d8]
push eax
lea eax, [ebp - 0x7e4]
push eax
lea eax, [ebp - 0x9fc]
push eax
push 0
push str.DriverVersion
push dword [ebp - 0x9f4]
call edi
test eax, eax
jne 0x431b4b
mov eax, dword [ebp - 0x9fc]
cmp eax, 1
je 0x431a6d
cmp eax, 2
jne 0x431b4b
mov ecx, dword [ebp - 0x9d8]
test ecx, ecx
je 0x431a94
test cl, 1
jne 0x431b4b
mov eax, ecx
shr eax, 1
cmp word [ebp + eax*2 - 0x7e6], 0
je 0x431a9d
jmp 0x431b4b
xor eax, eax
mov word [ebp - 0x7e4], ax
shr ecx, 1
mov dword [ebp - 0x9d4], ecx
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov dword [ebp - method.srl::Name.virtual_0], vtable.srl::Name.0
call fcn.0040cce6
mov ecx, eax
test ecx, ecx
je 0x431fd3
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x431fdd
lock inc dword [ecx + 0x14]
lea eax, [ecx + 8]
add eax, 0x10
mov dword [ebp - 0xa10], eax
lea eax, [ebp - 0x7e4]
push eax
lea ecx, [ebp - 0xa14]
call fcn.00442e80
mov byte [ebp - 4], 0x26
push 0
push 0x116ca
lea ecx, [ebp - 0x930]
call fcn.0041b320
mov byte [ebp - 4], 0x27
push 0
lea ecx, [ebp - 0xa14]
push ecx
push eax
call fcn.00447180
mov byte [ebp - 4], 0x28
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x928]
call fcn.004076c4
mov byte [ebp - 4], 0x25
lea ecx, [ebp - 0xa14]
call fcn.00442d80
mov byte [ebp - 4], 0x23
add esi, 0xfffffff0
lock xadd dword [esi + 0xc], ebx
dec ebx
test ebx, ebx
jg 0x431b8d
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x431fe4
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x431fe4
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x83c]
call fcn.004076c4
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x7fc]
call fcn.004076c4
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xadc]
call fcn.004138a0
jmp 0x431d93
mov byte [ebp - 4], 0x23
add esi, 0xfffffff0
mov eax, ebx
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x431c03
mov ecx, dword [esi]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push esi
cmp eax, vtable.ATL::CAtlStringMgr.0
jne 0x431feb
mov ecx, dword [ecx + 4]
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp eax, vtable.ATL::CWin32Heap.0
jne 0x431feb
push 0
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x83c]
call fcn.004076c4
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x7fc]
call fcn.004076c4
mov byte [ebp - 4], 5
mov byte [ebp - 4], 0x29
mov eax, dword [ebp - 0xadc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebp - 0xadc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x68]
mov dword [ebp + ecx - 0xae0], eax
mov byte [ebp - 4], 0x2a
mov dword [ebp - method.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
lea ecx, [ebp - 0xac4]
call fcn.004153b0
mov dword [ebp - method.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__.0
mov esi, dword [ebp - 0xa90]
test esi, esi
je 0x431ca0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x431c95
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x431c95
mov edx, dword [eax]
push 1
mov ecx, eax
call dword [edx]
push 8
push esi
call fcn.005a7e2d
add esp, 8
mov byte [ebp - 4], 0x2b
mov eax, dword [ebp - 0xadc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0xadc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x20]
mov dword [ebp + ecx - 0xae0], eax
mov eax, dword [ebp - 0xacc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0xacc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0xad0], eax
mov eax, dword [ebp - 0xadc]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0xadc]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x18]
mov dword [ebp + ecx - 0xae0], eax
mov byte [ebp - 4], 0x2c
mov dword [ebp - method.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov byte [ebp - 4], 0x2d
mov dword [ebp - method.std::ios_base.virtual_0], vtable.std::ios_base.0
lea eax, [ebp - 0xa74]
push eax
call fcn.005aa006
add esp, 4
mov byte [ebp - 4], 5
mov ebx, dword [ebp - 0xa20]
inc ebx
mov dword [ebp - 0xa20], ebx
mov edi, dword [ebp - 0xa08]
jmp 0x43129a
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x83c]
call fcn.004076c4
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x7fc]
call fcn.004076c4
mov byte [ebp - 4], 5
lea ecx, [ebp - 0xadc]
call fcn.004138a0
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x20019
push str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_SettingsZoneMapDomains_newcorp.com
push SysReAllocStringLen
lea ecx, [ebp - 0x9ec]
call fcn.0042f890
test eax, eax
jne 0x431ef3
mov dword [ebp - 0xa0c], eax
mov dword [ebp - 0xa2c], 4
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0xa0c]
push eax
lea eax, [ebp - 0x9d8]
push eax
push 0
push str.http
mov esi, dword [ebp - 0x9ec]
push esi
call edi
test eax, eax
jne 0x431e78
cmp dword [ebp - 0x9d8], 4
jne 0x431e78
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov byte [ebp - 0xa18], 1
mov byte [ebp - 4], 0x2e
push eax
push 0x11734
lea ecx, [ebp - 0x8e0]
call fcn.0041b320
mov byte [ebp - 4], 0x2f
push 0
lea ecx, [ebp - 0xa1c]
push ecx
push eax
call fcn.00447180
mov byte [ebp - 4], 0x30
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x8d8]
call fcn.004076c4
mov byte [ebp - 4], 0x31
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov byte [ebp - 4], 5
jmp 0x431ef9
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov byte [ebp - 0x9dc], 0
mov byte [ebp - 4], 0x32
push 0
push 0x11734
lea ecx, [ebp - 0x8b8]
call fcn.0041b320
mov byte [ebp - 4], 0x33
push 0
lea ecx, [ebp - 0x9e0]
push ecx
push eax
call fcn.00447180
mov byte [ebp - 4], 0x34
mov dword [ebp - method.srl::GroupID.virtual_0], vtable.srl::GroupID.0
lea ecx, [ebp - 0x8b0]
call fcn.004076c4
mov byte [ebp - 4], 0x35
mov dword [ebp - method.srl::Exists.virtual_0], vtable.srl::Exists.0
mov dword [ebp - method.srl::Value.virtual_0], vtable.srl::Value.0
mov byte [ebp - 4], 5
jmp 0x431ef9
mov esi, dword [ebp - 0x9ec]
mov byte [ebp - 4], 1
test esi, esi
je 0x431f12
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x9ec], 0
mov dword [ebp - 0x9e8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x868]
call fcn.004127e0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.005a7b5f
mov esp, ebp
pop ebp
ret
call fcn.005af179
push 0x80004005
call fcn.004022df
call edx
jmp 0x431802
push 0x80070057
call fcn.004022df
mov ecx, edx
call esi
jmp 0x4318d6
mov ecx, edi
call edx
jmp 0x431901
push 0x80070057
call fcn.004022df
push 0x80004005
call fcn.004022df
call edx
jmp 0x431adf
call edx
jmp 0x431b8d
call edx
jmp 0x431c03