Function at 0x1400366c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0xc90
mov rax, qword [0x14031a940]
xor rax, rsp
mov qword [rsp + 0xc80], rax
xor r14d, r14d
mov dword [rsp + 0x30], r14d
xorps xmm0, xmm0
movups xmmword [rsp + 0x2b8], xmm0
movdqa xmm1, xmmword [0x1402d3620]
movdqu xmmword [rsp + 0x2c8], xmm1
mov word [rsp + 0x2b8], r14w
mov byte [rsp + 0x2b0], r14b
lea rdx, str.srl::Software::Detect
lea rcx, [rsp + 0x2b8]
call fcn.1400184d0
nop
call fcn.140021130
cmp dword [rax + 8], 4
jl 0x140036756
lea rcx, [rsp + 0x2b0]
call fcn.140016330
nop
lea rbx, vtable.srl::Version.0
mov qword [rsp + 0xd8], rbx
call fcn.1400102e4
mov rcx, rax
test rax, rax
je 0x140037e26
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xe0], rax
mov r8d, 6
lea rdx, str.6.5.18
lea rcx, [rsp + 0xe0]
call fcn.140002b2c
nop
mov edx, 0x116b7
lea rcx, [rsp + 0x328]
call fcn.140022830
nop
xor r9d, r9d
lea r8, [rsp + 0xd8]
mov rdx, rax
call fcn.140050f90
nop
lea r15, vtable.srl::GroupID.0
mov qword [rsp + 0x328], r15
mov rdx, qword [rsp + 0x348]
cmp rdx, 8
jb 0x140036821
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x330]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003681c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037e31
call fcn.1400041d4
movdqa xmm0, xmmword [0x1402d3620]
movdqu xmmword [rsp + 0x340], xmm0
mov word [rsp + 0x330], r14w
mov qword [rsp + 0xd8], rbx
mov rdx, qword [rsp + 0xe0]
add rdx, 0xffffffffffffffe8
mov rsi, 0xffffffffffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003686b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, r14
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x48], r14d
mov qword [rsp + 0x50], r14
mov qword [rsp + 0xd0], r14
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareIntelNetwork_ServicesDMIX
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140036b49
mov rdi, qword [rsp + 0xd0]
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x58], 0x7d0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x88]
xor r8d, r8d
lea rdx, str.OEMVersion
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140036937
mov eax, dword [rsp + 0x88]
dec eax
cmp eax, 1
ja 0x140036937
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x140036a19
test al, 1
jne 0x140036937
shr rax, 1
cmp word [rsp + rax*2 + 0x4ae], 0
je 0x140036a22
lea r12, vtable.srl::Name.0
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareIntelWirelessCommonAppFrameworkSettings
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140036e69
mov eax, r14d
test rdi, rdi
je 0x140036983
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x38]
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x48], r14d
test eax, eax
jne 0x140036e69
mov dword [rsp + 0x60], 0x7d0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x90]
xor r8d, r8d
lea rdx, str.PROSetVersion
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400373a3
mov eax, dword [rsp + 0x90]
dec eax
cmp eax, 1
ja 0x1400373a3
mov eax, dword [rsp + 0x60]
test eax, eax
je 0x140036d3a
test al, 1
jne 0x1400373a3
shr rax, 1
cmp word [rsp + rax*2 + 0x4ae], 0
je 0x140036d43
jmp 0x1400373a3
mov word [rsp + 0x4b0], r14w
lea r12, vtable.srl::Name.0
mov qword [rsp + 0xe8], r12
call fcn.1400102e4
mov rcx, rax
test rax, rax
je 0x140037e37
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xf0], rax
lea rax, [rsp + 0x4b0]
mov r8, rsi
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x140036a60
lea rdx, [rsp + 0x4b0]
lea rcx, [rsp + 0xf0]
call fcn.140002b2c
nop
mov edx, 0x116d1
lea rcx, [rsp + 0x358]
call fcn.140022830
nop
xor r9d, r9d
lea r8, [rsp + 0xe8]
mov rdx, rax
call fcn.140050f90
nop
mov qword [rsp + 0x358], r15
mov rdx, qword [rsp + 0x378]
cmp rdx, 8
jb 0x140036af8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x360]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140036af3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037e42
call fcn.1400041d4
movdqa xmm0, xmmword [0x1402d3620]
movdqu xmmword [rsp + 0x370], xmm0
mov word [rsp + 0x360], r14w
mov qword [rsp + 0xe8], r12
mov rdx, qword [rsp + 0xf0]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140036d30
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x40]
jmp 0x14003693e
mov qword [rsp + 0x158], r14
lea rax, [rsp + 0x158]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SoftwareIntelNetwork_ServicesDMIX
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140036937
mov rdi, qword [rsp + 0x158]
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x48], 0x100
mov dword [rsp + 0x5c], 0x7d0
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x8c]
xor r8d, r8d
lea rdx, str.OEMVersion
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140036937
mov eax, dword [rsp + 0x8c]
dec eax
cmp eax, 1
ja 0x140036937
mov eax, dword [rsp + 0x5c]
test eax, eax
je 0x140036c0f
test al, 1
jne 0x140036937
shr rax, 1
cmp word [rsp + rax*2 + 0x4ae], 0
je 0x140036c18
jmp 0x140036937
mov word [rsp + 0x4b0], r14w
lea r12, vtable.srl::Name.0
mov qword [rsp + 0xf8], r12
call fcn.1400102e4
mov rcx, rax
test rax, rax
je 0x140037e48
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x100], rax
lea rax, [rsp + 0x4b0]
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x140036c55
lea rdx, [rsp + 0x4b0]
lea rcx, [rsp + 0x100]
call fcn.140002b2c
nop
mov edx, 0x116d1
lea rcx, [rsp + 0x388]
call fcn.140022830
nop
xor r9d, r9d
lea r8, [rsp + 0xf8]
mov rdx, rax
call fcn.140050f90
nop
mov qword [rsp + 0x388], r15
mov rdx, qword [rsp + 0x3a8]
cmp rdx, 8
jb 0x140036ced
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x390]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140036ce8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037e53
call fcn.1400041d4
movdqa xmm0, xmmword [0x1402d3620]
movdqu xmmword [rsp + 0x3a0], xmm0
mov word [rsp + 0x390], r14w
mov qword [rsp + 0xf8], r12
mov rdx, qword [rsp + 0x100]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140036d30
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x40]
jmp 0x14003693e
mov word [rsp + 0x4b0], r14w
mov qword [rsp + 0x108], r12
call fcn.1400102e4
mov rcx, rax
test rax, rax
je 0x140037e59
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x110], rax
lea rax, [rsp + 0x4b0]
mov r8, rsi
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140036d80
lea rdx, [rsp + 0x4b0]
lea rcx, [rsp + 0x110]
call fcn.140002b2c
nop
mov edx, 0x116c9
lea rcx, [rsp + 0x3b8]
call fcn.140022830
nop
xor r9d, r9d
lea r8, [rsp + 0x108]
mov rdx, rax
call fcn.140050f90
nop
mov qword [rsp + 0x3b8], r15
mov rdx, qword [rsp + 0x3d8]
cmp rdx, 8
jb 0x140036e18
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x3c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140036e13
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037e64
call fcn.1400041d4
movdqa xmm0, xmmword [0x1402d3620]
movdqu xmmword [rsp + 0x3d0], xmm0
mov word [rsp + 0x3c0], r14w
mov qword [rsp + 0x108], r12
mov rdx, qword [rsp + 0x110]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003720f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x40]
jmp 0x1400373a3
mov qword [rsp + 0xb8], r14
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareIntelWirelessAppFrameworkSettings
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003706d
mov eax, r14d
test rdi, rdi
je 0x140036eb4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0xb8]
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x48], r14d
test eax, eax
jne 0x14003706d
mov dword [rsp + 0x64], 0x7d0
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x94]
xor r8d, r8d
lea rdx, str.PROSetVersion
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400373a3
mov eax, dword [rsp + 0x94]
dec eax
cmp eax, 1
ja 0x1400373a3
mov eax, dword [rsp + 0x64]
test eax, eax
je 0x140036f45
test al, 1
jne 0x1400373a3
shr rax, 1
cmp word [rsp + rax*2 + 0x4ae], 0
je 0x140036f4e
jmp 0x1400373a3
mov word [rsp + 0x4b0], r14w
mov qword [rsp + 0x118], r12
call fcn.1400102e4
mov rcx, rax
test rax, rax
je 0x140037e6a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x120], rax
lea rax, [rsp + 0x4b0]
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x140036f84
lea rdx, [rsp + 0x4b0]
lea rcx, [rsp + 0x120]
call fcn.140002b2c
nop
mov edx, 0x116c9
lea rcx, [rsp + 0x3e8]
call fcn.140022830
nop
xor r9d, r9d
lea r8, [rsp + 0x118]
mov rdx, rax
call fcn.140050f90
nop
mov qword [rsp + 0x3e8], r15
mov rdx, qword [rsp + 0x408]
cmp rdx, 8
jb 0x14003701c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x3f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037017
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037e75
call fcn.1400041d4
movdqa xmm0, xmmword [0x1402d3620]
movdqu xmmword [rsp + 0x400], xmm0
mov word [rsp + 0x3f0], r14w
mov qword [rsp + 0x118], r12
mov rdx, qword [rsp + 0x120]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003720f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x40]
jmp 0x1400373a3
mov qword [rsp + 0xc0], r14
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SoftwareIntelWirelessCommonAppFrameworkSettings
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140037219
mov eax, r14d
test rdi, rdi
je 0x1400370b8
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x48], 0x100
test eax, eax
jne 0x140037219
mov dword [rsp + 0x68], 0x7d0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x98]
xor r8d, r8d
lea rdx, str.PROSetVersion
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400373a3
mov eax, dword [rsp + 0x98]
dec eax
cmp eax, 1
ja 0x1400373a3
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x14003714c
test al, 1
jne 0x1400373a3
shr rax, 1
cmp word [rsp + rax*2 + 0x4ae], 0
je 0x140037155
jmp 0x1400373a3
mov word [rsp + 0x4b0], r14w
mov qword [rsp + 0x128], r12
call fcn.1400102e4
mov rcx, rax
test rax, rax
je 0x140037e7b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x130], rax
lea rax, [rsp + 0x4b0]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140037190
lea rdx, [rsp + 0x4b0]
lea rcx, [rsp + 0x130]
call fcn.140002b2c
nop
mov edx, 0x116c9
lea rcx, [rsp + 0x448]
call fcn.140022830
nop
xor r9d, r9d
lea r8, [rsp + 0x128]
mov rdx, rax
call fcn.140050f90
nop
lea rcx, [rsp + 0x448]
call fcn.1400229c0
nop
mov qword [rsp + 0x128], r12
mov rdx, qword [rsp + 0x130]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003720f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x40]
jmp 0x1400373a3
mov qword [rsp + 0xc8], r14
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SoftwareIntelWirelessAppFrameworkSettings
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400373a3
mov eax, r14d
test rdi, rdi
je 0x140037264
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0xc8]
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x48], 0x100
test eax, eax
jne 0x1400373a3
mov dword [rsp + 0x6c], 0x7d0
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x9c]
xor r8d, r8d
lea rdx, str.PROSetVersion
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400373a3
mov eax, dword [rsp + 0x9c]
dec eax
cmp eax, 1
ja 0x1400373a3
mov eax, dword [rsp + 0x6c]
test eax, eax
je 0x1400372f8
test al, 1
jne 0x1400373a3
shr rax, 1
cmp word [rsp + rax*2 + 0x4ae], 0
je 0x140037301
jmp 0x1400373a3
mov word [rsp + 0x4b0], r14w
mov qword [rsp + 0x160], r12
call fcn.1400102e4
mov rcx, rax
test rax, rax
je 0x140037e86
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x168], rax
lea rax, [rsp + 0x4b0]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140037340
lea rdx, [rsp + 0x4b0]
lea rcx, [rsp + 0x168]
call fcn.140002b2c
nop
mov edx, 0x116c9
lea rcx, [rsp + 0x478]
call fcn.140022830
nop
xor r9d, r9d
lea r8, [rsp + 0x160]
mov rdx, rax
call fcn.140050f90
nop
lea rcx, [rsp + 0x478]
call fcn.1400229c0
nop
lea rcx, [rsp + 0x160]
call fcn.14004c4d0
mov r13d, r14d
mov r15d, 0x30
lea rbx, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
lea rcx, vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
lea r8, [0x1402cc628]
lea rdx, [0x1402cc630]
cmp r13d, 0x64
jae 0x140037c27
mov qword [rsp + 0x170], rdx
mov qword [rsp + 0x180], r8
mov qword [rsp + 0x210], r14
mov qword [rsp + 0x238], r14
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x240], xmm0
or dword [rsp + 0x30], 1
mov qword [rsp + 0x208], rcx
mov dword [rsp + 0x204], 0x80
mov qword [rsp + 0x178], r14
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x208]
call fcn.14001a400
nop
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x17c], edx
mov rax, qword [rsp + 0x170]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x170], rax
mov rax, qword [rsp + 0x170]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x20]
mov dword [rsp + rcx + 0x16c], edx
mov rax, qword [rsp + 0x170]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rsp + rcx + 0x170], rax
mov rax, qword [rsp + 0x170]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rsp + rcx + 0x16c], edx
lea rcx, [rsp + 0x188]
call fcn.14001a360
mov qword [rsp + 0x188], rbx
mov qword [rsp + 0x1f0], r14
mov dword [rsp + 0x1f8], r14d
mov rax, qword [rsp + 0x170]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x198], 4
mov rax, qword [rsp + 0x170]
movsxd rcx, dword [rax + 4]
mov word [rsp + rcx + 0x1c8], r15w
mov edx, r13d
lea rcx, [rsp + 0x180]
call fcn.140019750
xorps xmm0, xmm0
movups xmmword [rsp + 0x270], xmm0
mov qword [rsp + 0x280], r14
mov qword [rsp + 0x288], 7
mov word [rsp + 0x270], r14w
lea rdx, str.systemCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318_
lea rcx, [rsp + 0x270]
call fcn.1400184d0
lea rdx, [rsp + 0x290]
lea rcx, [rsp + 0x188]
call fcn.14001a150
or dword [rsp + 0x30], 0x10
lea r9, [rsp + 0x290]
cmp qword [rsp + 0x2a8], 8
cmovae r9, qword [rsp + 0x290]
mov r14, qword [rsp + 0x2a0]
mov r15, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x288]
mov rax, rcx
sub rax, r15
cmp r14, rax
ja 0x1400375fe
lea rax, [r14 + r15]
mov qword [rsp + 0x280], rax
lea rbx, [rsp + 0x270]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x270]
lea rcx, [rbx + r15*2]
lea r8, [r14 + r14]
mov rdx, r9
call fcn.140225630
lea rax, [r15 + r14]
xor r14d, r14d
mov word [rbx + rax*2], r14w
jmp 0x140037616
mov qword [rsp + 0x20], r14
mov rdx, r14
lea rcx, [rsp + 0x270]
call fcn.140022120
xor r14d, r14d
mov rdx, qword [rsp + 0x2a8]
cmp rdx, 8
jb 0x14003765e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x290]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037659
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037e91
call fcn.1400041d4
xorps xmm0, xmm0
movups xmmword [rsp + 0x308], xmm0
mov qword [rsp + 0x318], r14
mov qword [rsp + 0x320], 7
mov word [rsp + 0x308], r14w
lea rdx, [rsp + 0x270]
cmp qword [rsp + 0x288], 8
cmovae rdx, qword [rsp + 0x270]
mov qword [rsp + 0x80], r14
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140037bac
mov eax, r14d
test rdi, rdi
je 0x1400376e4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x80]
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x48], r14d
test eax, eax
jne 0x140037bac
mov dword [rsp + 0x70], 0x7d0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa0]
xor r8d, r8d
lea rdx, str.DriverDesc
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140037844
mov eax, dword [rsp + 0xa0]
dec eax
cmp eax, 1
ja 0x140037844
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x140037775
test al, 1
jne 0x140037844
shr rax, 1
cmp word [rsp + rax*2 + 0x4ae], 0
je 0x14003777e
jmp 0x140037844
mov word [rsp + 0x4b0], r14w
call fcn.1400102e4
mov rcx, rax
test rax, rax
je 0x140037e97
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x4b0]
cmp rax, 0x10000
lea rax, [rsp + 0x4b0]
jae 0x1400377c5
movzx edx, ax
lea rcx, [rsp + 0x78]
call fcn.140010b40
jmp 0x1400377ee
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400377d0
lea rdx, [rsp + 0x4b0]
lea rcx, [rsp + 0x78]
call fcn.140002b2c
nop
mov rbx, qword [rsp + 0x78]
mov rcx, rsi
lea r15, str.Intel_R__Advanced_Network_Services_Virtual_Adapter
nop dword [rax]
movzx eax, word [rbx + rcx*2 + 2]
cmp ax, word [r15 + rcx*2 + 2]
jne 0x140037826
add rcx, 2
cmp rcx, 0x33
je 0x1400379a2
movzx eax, word [rbx + rcx*2]
cmp ax, word [r15 + rcx*2]
je 0x140037800
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003783f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdi, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x288]
cmp rdx, 8
jb 0x14003788c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x270]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037887
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037eb3
call fcn.1400041d4
mov qword [rsp + 0x280], r14
mov qword [rsp + 0x288], 7
mov word [rsp + 0x270], r14w
mov rax, qword [rsp + 0x170]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rsp + rcx + 0x170], rax
mov rax, qword [rsp + 0x170]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rsp + rcx + 0x16c], edx
lea rcx, [rsp + 0x188]
call fcn.14001b0c0
mov rax, qword [rsp + 0x170]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x170], rax
mov rax, qword [rsp + 0x170]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x20]
mov dword [rsp + rcx + 0x16c], edx
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x17c], edx
mov rax, qword [rsp + 0x170]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x170], rax
mov rax, qword [rsp + 0x170]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rsp + rcx + 0x16c], edx
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x208], rax
lea rcx, [rsp + 0x208]
call fcn.1402236c0
nop
inc r13d
jmp 0x1400373a6
mov dword [rsp + 0x74], 0x7d0
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa4]
xor r8d, r8d
lea rdx, str.DriverVersion
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140037a0c
mov eax, dword [rsp + 0xa4]
dec eax
cmp eax, 1
ja 0x140037a0c
mov eax, dword [rsp + 0x74]
test eax, eax
je 0x140037a7c
test al, 1
jne 0x140037a0c
shr rax, 1
cmp word [rsp + rax*2 + 0x4ae], 0
je 0x140037a85
lea rdi, vtable.srl::GroupID.0
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140037a2b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x288]
cmp rdx, 8
jb 0x140037bfb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x270]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037a72
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037eb3
call fcn.1400041d4
jmp 0x140037bfb
mov word [rsp + 0x4b0], r14w
mov qword [rsp + 0x138], r12
call fcn.1400102e4
mov rcx, rax
test rax, rax
je 0x140037ea2
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x140], rax
lea rax, [rsp + 0x4b0]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140037ac0
lea rdx, [rsp + 0x4b0]
lea rcx, [rsp + 0x140]
call fcn.140002b2c
nop
mov edx, 0x116ca
lea rcx, [rsp + 0x418]
call fcn.140022830
nop
xor r9d, r9d
lea r8, [rsp + 0x138]
mov rdx, rax
call fcn.140050f90
nop
lea rdi, vtable.srl::GroupID.0
mov qword [rsp + 0x418], rdi
mov rdx, qword [rsp + 0x438]
cmp rdx, 8
jb 0x140037b5f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x420]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037b5a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037ead
call fcn.1400041d4
movdqa xmm0, xmmword [0x1402d3620]
movdqu xmmword [rsp + 0x430], xmm0
mov word [rsp + 0x420], r14w
mov qword [rsp + 0x138], r12
mov rdx, qword [rsp + 0x140]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140037ba2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x78]
jmp 0x140037a13
mov rdx, qword [rsp + 0x288]
cmp rdx, 8
jb 0x140037bf4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x270]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037bef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037eb3
call fcn.1400041d4
lea rdi, vtable.srl::GroupID.0
mov qword [rsp + 0x280], r14
mov qword [rsp + 0x288], 7
mov word [rsp + 0x270], r14w
lea rcx, [rsp + 0x170]
call fcn.140019440
jmp 0x140037c2e
lea rdi, vtable.srl::GroupID.0
mov r9d, 0x20019
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_SettingsZoneMapDomains_newcorp.com
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0x40]
call fcn.140034b30
mov rbx, qword [rsp + 0x40]
test eax, eax
jne 0x140037dd6
mov dword [rsp + 0xac], r14d
mov dword [rsp + 0xa8], 4
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xac]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb0]
xor r8d, r8d
lea rdx, str.http
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140037cb3
cmp dword [rsp + 0xb0], 4
je 0x140037d47
lea rax, vtable.srl::Exists.0
mov qword [rsp + 0x148], rax
mov byte [rsp + 0x150], 0
mov edx, 0x11734
lea rcx, [rsp + 0x2d8]
call fcn.140022830
nop
xor r9d, r9d
lea r8, [rsp + 0x148]
mov rdx, rax
call fcn.140050f90
nop
mov qword [rsp + 0x2d8], rdi
mov rdx, qword [rsp + 0x2f8]
cmp rdx, 8
jb 0x140037d42
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037d3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037eb9
call fcn.1400041d4
nop
jmp 0x140037dd6
lea rax, vtable.srl::Exists.0
mov qword [rsp + 0x148], rax
mov byte [rsp + 0x150], 1
mov edx, 0x11734
lea rcx, [rsp + 0x2d8]
call fcn.140022830
nop
xor r9d, r9d
lea r8, [rsp + 0x148]
mov rdx, rax
call fcn.140050f90
nop
mov qword [rsp + 0x2d8], rdi
mov rdx, qword [rsp + 0x2f8]
cmp rdx, 8
jb 0x140037dd6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037dd0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140037ebf
call fcn.1400041d4
nop
test rbx, rbx
je 0x140037de5
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x2b0]
call fcn.140017d20
mov al, 1
mov rcx, qword [rsp + 0xc80]
xor rcx, rsp
call fcn.140220e50
lea r11, [rsp + 0xc90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
mov ecx, 0x80004005
call fcn.140002dfc
nop
call fcn.14022a144
nop
mov ecx, 0x80004005
call fcn.140002dfc
nop
call fcn.14022a144
nop
mov ecx, 0x80004005
call fcn.140002dfc
nop
call fcn.14022a144
nop
mov ecx, 0x80004005
call fcn.140002dfc
nop
call fcn.14022a144
nop
mov ecx, 0x80004005
call fcn.140002dfc
nop
call fcn.14022a144
nop
mov ecx, 0x80004005
call fcn.140002dfc
int3
mov ecx, 0x80004005
call fcn.140002dfc
nop
call fcn.14022a144
nop
mov ecx, 0x80004005
call fcn.140002dfc
nop
mov ecx, 0x80004005
call fcn.140002dfc
nop
call fcn.14022a144
nop
call fcn.14022a144
nop
call fcn.14022a144
nop
call fcn.14022a144
int3