Function at 0x140003ec0
Capabilities:
Read .ini file

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x480
mov r12, rdx
mov qword [rcx + 0x268], rdx
lea rax, [rax + 8]
mov r13d, r9d
mov rbp, r8
mov rsi, rcx
lea rdx, str.MicrosoftWindows_NTCurrentVersion
mov rcx, r12
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, 0x80
xor r14d, r14d
cmp eax, r14d
mov edi, 0x7d0
lea r15d, [rbx - 0x7f]
jne 0x140004363
lea rcx, [rsp + 0x41]
mov r8, rbx
xor edx, edx
mov byte [rsp + 0x40], r14b
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0xd1]
mov r8, rbx
xor edx, edx
mov byte [rsp + 0xd0], r14b
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x371]
xor edx, edx
mov r8d, 0x104
mov byte [rsp + 0x370], r14b
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x4c0]
lea r8, [rsp + 0x40]
lea rdx, [0x140014ae8]
mov r9d, ebx
call fcn.140012028
mov rcx, qword [rsp + 0x4c0]
lea r8, [rsp + 0xd0]
lea rdx, str.CSDVersion
mov r9d, ebx
call fcn.140012028
mov rcx, qword [rsp + 0x4c0]
lea r8, [rsp + 0x370]
lea rdx, str.PathName
mov r9d, 0x104
call fcn.140012028
cmp byte [rsp + 0x40], r14b
jne 0x140004174
cmp dword [0x140018ec8], r14d
jne 0x140004001
lea rcx, [0x140018ea0]
mov edx, 0x8000
mov r9d, 0x1000
mov r8d, 0x100
call fcn.1400094bc
mov edx, dword [0x140018ec0]
mov eax, r14d
cmp edx, r14d
jle 0x140004025
mov rcx, qword [0x140018eb0]
cmp dword [rcx], edi
je 0x14000407b
add eax, r15d
add rcx, 4
cmp eax, edx
jl 0x140004016
mov rbx, r14
cmp rbx, r14
jne 0x14000415d
cmp byte [0x140018b00], r14b
je 0x140004091
lea rdx, str.strings
lea rcx, [0x140018c10]
call fcn.140012ab4
mov rdx, qword [0x140018ea8]
mov ecx, edi
call fcn.140009b54
cmp eax, r14d
je 0x14000409d
mov rcx, qword [0x140018ea8]
call sub.msvcrt.dll_strlen
cmp eax, r14d
mov rdi, rax
jne 0x1400040c4
mov edi, 0x7d0
jmp 0x14000409d
movsxd rcx, eax
mov rax, qword [0x140018eb8]
mov ebx, dword [rax + rcx*4]
add rbx, qword [0x140018ea0]
jmp 0x140004028
mov rax, qword [0x140018af0]
cmp rax, r14
jne 0x1400040a5
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r9d, dword [0x140018ed0]
mov r8, qword [0x140018ea8]
mov edx, edi
add r9d, 0xffffffff
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadStringA]
mov edi, eax
cmp edi, r14d
jle 0x140004156
movsxd rcx, dword [0x140018ec4]
lea eax, [rcx + rdi + 2]
cmp eax, dword [0x140018ec8]
jge 0x140004156
mov eax, dword [0x140018ecc]
cmp dword [0x140018ec0], eax
jge 0x140004156
mov rdx, qword [0x140018ea8]
mov rbx, rcx
lea eax, [rdi + 1]
add rbx, qword [0x140018ea0]
movsxd r8, eax
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov eax, dword [0x140018ec4]
movsxd r11, dword [0x140018ec0]
mov rcx, qword [0x140018eb8]
mov dword [rcx + r11*4], eax
movsxd rcx, dword [0x140018ec0]
mov rax, qword [0x140018eb0]
mov dword [rax + rcx*4], 0x7d0
mov eax, dword [0x140018ec4]
add dword [0x140018ec0], r15d
cmp rbx, r14
lea ecx, [rax + rdi + 1]
mov dword [0x140018ec4], ecx
jne 0x14000415d
lea rbx, [0x140014821]
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.140012ab4
mov edi, 0x7d0
mov ebx, 0x80
cmp rbp, r14
je 0x140004263
mov rax, qword [0x140018a40]
cmp dword [rax + 0x57c], r14d
je 0x140004263
lea rcx, [rsp + 0x261]
xor edx, edx
mov r8d, 0x104
mov byte [rsp + 0x260], r14b
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x1d1]
mov r8, rbx
xor edx, edx
mov byte [rsp + 0x1d0], r14b
call sub.msvcrt.dll_memset
mov rcx, rbp
call sub.msvcrt.dll_strlen
lea rcx, str.prodspec.ini
mov rbx, rax
call sub.msvcrt.dll_strlen
lea rcx, [rbx + rax + 1]
cmp rcx, 0x104
jae 0x140004206
lea r8, [rsp + 0x260]
lea rdx, str.prodspec.ini
mov rcx, rbp
call fcn.14000874c
jmp 0x14000420e
mov byte [rsp + 0x260], r14b
lea rax, [rsp + 0x260]
lea r9, [rsp + 0x1d0]
lea r8, [0x140014821]
mov qword [rsp + 0x28], rax
lea rdx, str.Product
lea rcx, str.Product_Specification
mov ebx, 0x80
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [rsp + 0x1d0], r14b
je 0x140004263
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0x40]
call fcn.140012ab4
mov r8, qword [rsp + 0x4c0]
lea rax, [rsp + 0xd0]
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x370]
lea rdx, [rsp + 0x40]
mov r9d, r15d
mov rcx, rsi
mov qword [rsi + 0x290], r14
mov qword [rsp + 0x20], rax
mov qword [rsi + 0x298], r14
call fcn.140002c30
mov rcx, qword [rsp + 0x4c0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rsi + 0x290], r14
jne 0x1400042cc
cmp qword [rsi + 0x298], r14
jne 0x140004363
mov rax, qword [0x140018a40]
cmp dword [rax + 0x58c], r14d
je 0x140004363
lea rax, [rsp + 0x4c0]
lea rdx, str.MicrosoftWindows_NTCurrentVersionDefaultProductKey
mov r9d, 0x20019
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, r14d
jne 0x140004363
mov rax, qword [rsi + 0x290]
cmp rax, r14
je 0x14000431e
mov dword [rax + 0x3a8], r15d
mov r8, qword [rsp + 0x4c0]
lea rax, [rsp + 0xd0]
mov dword [rsp + 0x30], r15d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x370]
lea rdx, [rsp + 0x40]
mov r9d, r15d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140002c30
mov rcx, qword [rsp + 0x4c0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.14000871c
cmp dword [rax + 0x10], r15d
jne 0x1400045a9
lea rax, [rsp + 0x4c0]
lea rdx, str.MicrosoftWindowsCurrentVersion
mov r9d, 0x20019
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, r14d
jne 0x1400045a9
lea rcx, [rsp + 0x41]
mov r8, rbx
xor edx, edx
mov byte [rsp + 0x40], r14b
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x4c0]
lea r8, [rsp + 0x40]
lea rdx, [0x140014ae8]
mov r9d, ebx
call fcn.140012028
cmp byte [rsp + 0x40], r14b
jne 0x14000456b
cmp dword [0x140018ec8], r14d
jne 0x140004402
lea rcx, [0x140018ea0]
mov edx, 0x8000
mov r9d, 0x1000
mov r8d, 0x100
call fcn.1400094bc
mov edx, dword [0x140018ec0]
mov eax, r14d
cmp edx, r14d
jle 0x140004426
mov rcx, qword [0x140018eb0]
cmp dword [rcx], edi
je 0x14000447c
add eax, r15d
add rcx, 4
cmp eax, edx
jl 0x140004417
mov rbx, r14
cmp rbx, r14
jne 0x14000455e
cmp byte [0x140018b00], r14b
je 0x140004492
lea rdx, str.strings
lea rcx, [0x140018c10]
call fcn.140012ab4
mov rdx, qword [0x140018ea8]
mov ecx, edi
call fcn.140009b54
cmp eax, r14d
je 0x14000449e
mov rcx, qword [0x140018ea8]
call sub.msvcrt.dll_strlen
cmp eax, r14d
mov rdi, rax
jne 0x1400044c5
mov edi, 0x7d0
jmp 0x14000449e
movsxd rcx, eax
mov rax, qword [0x140018eb8]
mov ebx, dword [rax + rcx*4]
add rbx, qword [0x140018ea0]
jmp 0x140004429
mov rax, qword [0x140018af0]
cmp rax, r14
jne 0x1400044a6
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r9d, dword [0x140018ed0]
mov r8, qword [0x140018ea8]
mov edx, edi
add r9d, 0xffffffff
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadStringA]
mov edi, eax
cmp edi, r14d
jle 0x140004557
movsxd rcx, dword [0x140018ec4]
lea eax, [rdi + rcx + 2]
cmp eax, dword [0x140018ec8]
jge 0x140004557
mov eax, dword [0x140018ecc]
cmp dword [0x140018ec0], eax
jge 0x140004557
mov rdx, qword [0x140018ea8]
mov rbx, rcx
lea eax, [rdi + 1]
add rbx, qword [0x140018ea0]
movsxd r8, eax
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov eax, dword [0x140018ec4]
movsxd r11, dword [0x140018ec0]
mov rcx, qword [0x140018eb8]
mov dword [rcx + r11*4], eax
movsxd rcx, dword [0x140018ec0]
mov rax, qword [0x140018eb0]
mov dword [rax + rcx*4], 0x7d0
mov eax, dword [0x140018ec4]
add dword [0x140018ec0], r15d
cmp rbx, r14
lea ecx, [rax + rdi + 1]
mov dword [0x140018ec4], ecx
jne 0x14000455e
lea rbx, [0x140014821]
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.140012ab4
mov r8, qword [rsp + 0x4c0]
lea rdi, [0x140014821]
mov dword [rsp + 0x30], r15d
lea rdx, [rsp + 0x40]
mov r9d, r15d
mov rcx, rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call fcn.140002c30
mov rcx, qword [rsp + 0x4c0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400045b0
lea rdi, [0x140014821]
lea rax, [rsp + 0x4c0]
lea rdx, str.MicrosoftInternet_ExplorerRegistration
mov r9d, 0x20019
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, r14d
jne 0x14000479f
cmp dword [0x140018ec8], r14d
jne 0x140004605
lea rcx, [0x140018ea0]
mov edx, 0x8000
mov r9d, 0x1000
mov r8d, 0x100
call fcn.1400094bc
mov edx, dword [0x140018ec0]
mov eax, r14d
mov ebp, 0x7e4
cmp edx, r14d
jle 0x14000462e
mov rcx, qword [0x140018eb0]
cmp dword [rcx], ebp
je 0x14000467f
add eax, r15d
add rcx, 4
cmp eax, edx
jl 0x14000461f
mov rbx, r14
cmp rbx, r14
jne 0x140004762
cmp byte [0x140018b00], r14b
je 0x140004695
lea rdx, str.strings
lea rcx, [0x140018c10]
call fcn.140012ab4
mov rdx, qword [0x140018ea8]
mov ecx, ebp
call fcn.140009b54
cmp eax, r14d
je 0x1400046a1
mov rcx, qword [0x140018ea8]
call sub.msvcrt.dll_strlen
cmp eax, r14d
mov rdi, rax
jne 0x1400046c8
jmp 0x1400046a1
movsxd rcx, eax
mov rax, qword [0x140018eb8]
mov ebx, dword [rax + rcx*4]
add rbx, qword [0x140018ea0]
jmp 0x140004631
mov rax, qword [0x140018af0]
cmp rax, r14
jne 0x1400046a9
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r9d, dword [0x140018ed0]
mov r8, qword [0x140018ea8]
mov edx, ebp
add r9d, 0xffffffff
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadStringA]
mov edi, eax
cmp edi, r14d
jle 0x140004756
movsxd rcx, dword [0x140018ec4]
lea eax, [rdi + rcx + 2]
cmp eax, dword [0x140018ec8]
jge 0x140004756
mov eax, dword [0x140018ecc]
cmp dword [0x140018ec0], eax
jge 0x140004756
mov rdx, qword [0x140018ea8]
mov rbx, rcx
lea eax, [rdi + 1]
add rbx, qword [0x140018ea0]
movsxd r8, eax
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov eax, dword [0x140018ec4]
movsxd r11, dword [0x140018ec0]
mov rcx, qword [0x140018eb8]
mov dword [rcx + r11*4], eax
movsxd rcx, dword [0x140018ec0]
mov rax, qword [0x140018eb0]
mov dword [rax + rcx*4], ebp
mov eax, dword [0x140018ec4]
add dword [0x140018ec0], r15d
cmp rbx, r14
lea ecx, [rax + rdi + 1]
mov dword [0x140018ec4], ecx
jne 0x140004762
lea rdi, [0x140014821]
mov rbx, rdi
jmp 0x140004769
lea rdi, [0x140014821]
mov r8, qword [rsp + 0x4c0]
mov dword [rsp + 0x30], r15d
mov r9d, 3
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call fcn.140002c30
mov rcx, qword [rsp + 0x4c0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x4c0]
lea rdx, str.MicrosoftExchangeSetup
mov r9d, 0x20019
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, r14d
jne 0x14000498e
cmp dword [0x140018ec8], r14d
jne 0x1400047f4
lea rcx, [0x140018ea0]
mov edx, 0x8000
mov r9d, 0x1000
mov r8d, 0x100
call fcn.1400094bc
mov edx, dword [0x140018ec0]
mov eax, r14d
mov ebp, 0x899
cmp edx, r14d
jle 0x14000481d
mov rcx, qword [0x140018eb0]
cmp dword [rcx], ebp
je 0x14000486e
add eax, r15d
add rcx, 4
cmp eax, edx
jl 0x14000480e
mov rbx, r14
cmp rbx, r14
jne 0x140004958
cmp byte [0x140018b00], r14b
je 0x140004884
lea rdx, str.strings
lea rcx, [0x140018c10]
call fcn.140012ab4
mov rdx, qword [0x140018ea8]
mov ecx, ebp
call fcn.140009b54
cmp eax, r14d
je 0x140004890
mov rcx, qword [0x140018ea8]
call sub.msvcrt.dll_strlen
cmp eax, r14d
mov rdi, rax
jne 0x1400048b7
jmp 0x140004890
movsxd rcx, eax
mov rax, qword [0x140018eb8]
mov ebx, dword [rax + rcx*4]
add rbx, qword [0x140018ea0]
jmp 0x140004820
mov rax, qword [0x140018af0]
cmp rax, r14
jne 0x140004898
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r9d, dword [0x140018ed0]
mov r8, qword [0x140018ea8]
mov edx, ebp
add r9d, 0xffffffff
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadStringA]
mov edi, eax
cmp edi, r14d
jle 0x140004945
movsxd rcx, dword [0x140018ec4]
lea eax, [rdi + rcx + 2]
cmp eax, dword [0x140018ec8]
jge 0x140004945
mov eax, dword [0x140018ecc]
cmp dword [0x140018ec0], eax
jge 0x140004945
mov rdx, qword [0x140018ea8]
mov rbx, rcx
lea eax, [rdi + 1]
add rbx, qword [0x140018ea0]
movsxd r8, eax
mov rcx, rbx
call sub.msvcrt.dll_memcpy
mov eax, dword [0x140018ec4]
movsxd r11, dword [0x140018ec0]
mov rcx, qword [0x140018eb8]
mov dword [rcx + r11*4], eax
movsxd rcx, dword [0x140018ec0]
mov rax, qword [0x140018eb0]
mov dword [rax + rcx*4], ebp
mov eax, dword [0x140018ec4]
add dword [0x140018ec0], r15d
cmp rbx, r14
lea ecx, [rax + rdi + 1]
mov dword [0x140018ec4], ecx
jne 0x140004951
lea rdi, [0x140014821]
mov rbx, rdi
jmp 0x140004958
lea rdi, [0x140014821]
mov r8, qword [rsp + 0x4c0]
mov dword [rsp + 0x30], r15d
mov r9d, 5
mov rdx, rbx
mov rcx, rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
call fcn.140002c30
mov rcx, qword [rsp + 0x4c0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp r13d, r14d
jne 0x14000499e
mov rdx, r12
mov rcx, rsi
call fcn.1400037cc
lea rax, [rsp + 0x4c8]
lea rdx, str.MicrosoftMicrosoft_SQL_Server
mov r9d, 0x20019
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, r14d
jne 0x140004a37
mov edi, 0xff
lea rcx, [rsp + 0xd1]
xor edx, edx
mov r8, rdi
mov ebx, r14d
mov byte [rsp + 0xd0], r14b
call sub.msvcrt.dll_memset
xor edx, edx
jmp 0x140004a0c
mov rdx, qword [rsp + 0x4c8]
lea r8, [rsp + 0xd0]
mov rcx, rsi
call fcn.140002c8c
add ebx, r15d
mov edx, ebx
mov rcx, qword [rsp + 0x4c8]
lea r8, [rsp + 0xd0]
mov r9d, edi
call fcn.1400120d4
cmp eax, r14d
je 0x1400049ef
mov rcx, qword [rsp + 0x4c8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, r12
mov rcx, rsi
call fcn.140003c9c
mov rbx, qword [rsp + 0x4d0]
add rsp, 0x480
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret