Function at 0x14003f4e0
Capabilities:
Query or enumerate registry value

Disassembly:
push r13
push r14
push r15
mov eax, 0x1060
call fcn.14022bce0
sub rsp, rax
mov qword [rsp + 0x3a8], 0xfffffffffffffffe
mov qword [rsp + 0x1080], rbx
mov qword [rsp + 0x1088], rsi
mov qword [rsp + 0x1090], rdi
mov qword [rsp + 0x1098], r12
mov rax, qword [0x14035d8c0]
xor rax, rsp
mov qword [rsp + 0x1050], rax
xor esi, esi
mov dword [rsp + 0x40], esi
lea rcx, [rsp + 0x658]
call fcn.14000a1bc
nop
mov byte [rsp + 0x650], sil
lea r8d, [rsi + 0x15]
lea rdx, str.srl::Software::Detect
lea rcx, [rsp + 0x658]
call fcn.140009e14
nop
call fcn.140022850
cmp dword [rax + 8], 4
jl 0x14003f587
mov byte [rsp + 0x650], 1
lea rcx, [rsp + 0x650]
call fcn.140018900
nop
lea r15, vtable.srl::Value.0
mov qword [rsp + 0xc0], r15
lea rbx, vtable.srl::Version.0
mov qword [rsp + 0xc0], rbx
lea rcx, [rsp + 0xc8]
call fcn.140015830
mov r8d, 5
lea rdx, str.6.3.4
lea rcx, [rsp + 0xc8]
call fcn.140002a7c
nop
mov edx, 0x116b7
lea rcx, [rsp + 0x698]
call fcn.140023d80
nop
xor r9d, r9d
lea r8, [rsp + 0xc0]
mov rdx, rax
call fcn.1400595d0
nop
lea rdi, vtable.srl::GroupID.0
mov qword [rsp + 0x698], rdi
lea rcx, [rsp + 0x6a0]
call fcn.140009bb8
nop
mov qword [rsp + 0xc0], rbx
mov rcx, qword [rsp + 0xc8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x2b0], rcx
mov r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
lea r13, vtable.ATL::CAtlStringMgr.0
jg 0x14003f69d
mov rdx, qword [rsp + 0x2b0]
mov rcx, qword [rdx]
mov qword [rsp + 0x3b0], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x140040c9b
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x3b8], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea rbx, vtable.ATL::CWin32Heap.0
cmp rax, rbx
jne 0x140040c9b
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0xc0], r15
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x58], rsi
mov r9d, 0x20019
lea r8, str.SoftwareIntelNetwork_ServicesDMIX
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003e3a0
test eax, eax
jne 0x14003f8b9
mov dword [rsp + 0x64], 0x7d0
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd0]
xor r8d, r8d
lea rdx, str.OEMVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x304], eax
test eax, eax
jne 0x14003f750
mov eax, dword [rsp + 0xd0]
dec eax
cmp eax, 1
ja 0x14003f750
mov eax, dword [rsp + 0x64]
test eax, eax
je 0x14003f805
test al, 1
jne 0x14003f750
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003f80d
lea r12, vtable.srl::Name.0
mov r9d, 0x20019
lea r8, str.SoftwareIntelWirelessCommonAppFrameworkSettings
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003e3a0
test eax, eax
jne 0x14003fab4
mov dword [rsp + 0x6c], 0x7d0
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x98]
xor r8d, r8d
lea rdx, str.PROSetVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x2f0], eax
test eax, eax
jne 0x14003fea4
mov eax, dword [rsp + 0x98]
dec eax
cmp eax, 1
ja 0x14003fea4
mov eax, dword [rsp + 0x6c]
test eax, eax
je 0x14003fa0f
test al, 1
jne 0x14003fea4
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003fa17
jmp 0x14003fea4
mov word [rsp + 0x880], si
mov qword [rsp + 0xf0], r15
lea r12, vtable.srl::Name.0
mov qword [rsp + 0xf0], r12
lea rcx, [rsp + 0xf8]
call fcn.140015830
lea rcx, [rsp + 0x880]
mov rax, r14
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003f840
mov dword [rsp + 0x300], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0xf8]
call fcn.140002a7c
nop
mov edx, 0x116d1
lea rcx, [rsp + 0x6c8]
call fcn.140023d80
nop
xor r9d, r9d
lea r8, [rsp + 0xf0]
mov rdx, rax
call fcn.1400595d0
nop
mov qword [rsp + 0x6c8], rdi
lea rcx, [rsp + 0x6d0]
call fcn.140009bb8
nop
lea rcx, [rsp + 0xf0]
call fcn.140054c00
jmp 0x14003f757
mov r9d, 0x20119
lea r8, str.SoftwareIntelNetwork_ServicesDMIX
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003e3a0
test eax, eax
jne 0x14003f750
mov dword [rsp + 0x68], 0x7d0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd4]
xor r8d, r8d
lea rdx, str.OEMVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x2fc], eax
test eax, eax
jne 0x14003f750
mov eax, dword [rsp + 0xd4]
dec eax
cmp eax, 1
ja 0x14003f750
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x14003f95f
test al, 1
jne 0x14003f750
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003f967
jmp 0x14003f750
mov word [rsp + 0x880], si
mov qword [rsp + 0xe0], r15
lea r12, vtable.srl::Name.0
mov qword [rsp + 0xe0], r12
lea rcx, [rsp + 0xe8]
call fcn.140015830
lea rcx, [rsp + 0x880]
mov rax, r14
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003f996
mov dword [rsp + 0x2f8], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0xe8]
call fcn.140002a7c
nop
mov edx, 0x116d1
lea rcx, [rsp + 0x6f8]
call fcn.140023d80
nop
xor r9d, r9d
lea r8, [rsp + 0xe0]
mov rdx, rax
call fcn.1400595d0
nop
mov qword [rsp + 0x6f8], rdi
lea rcx, [rsp + 0x700]
call fcn.140009bb8
nop
lea rcx, [rsp + 0xe0]
call fcn.140054c00
jmp 0x14003f757
mov word [rsp + 0x880], si
mov qword [rsp + 0x110], r15
mov qword [rsp + 0x110], r12
lea rcx, [rsp + 0x118]
call fcn.140015830
lea rcx, [rsp + 0x880]
mov rax, r14
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003fa40
mov dword [rsp + 0x2ec], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x118]
call fcn.140002a7c
nop
mov edx, 0x116c9
lea rcx, [rsp + 0x728]
call fcn.140023d80
nop
xor r9d, r9d
lea r8, [rsp + 0x110]
mov rdx, rax
call fcn.1400595d0
nop
mov qword [rsp + 0x728], rdi
lea rcx, [rsp + 0x730]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x110]
jmp 0x14003fe9f
mov r9d, 0x20019
lea r8, str.SoftwareIntelWirelessAppFrameworkSettings
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003e3a0
test eax, eax
jne 0x14003fc04
mov dword [rsp + 0x70], 0x7d0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x9c]
xor r8d, r8d
lea rdx, str.PROSetVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x2e8], eax
test eax, eax
jne 0x14003fea4
mov eax, dword [rsp + 0x9c]
dec eax
cmp eax, 1
ja 0x14003fea4
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x14003fb5a
test al, 1
jne 0x14003fea4
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003fb62
jmp 0x14003fea4
mov word [rsp + 0x880], si
mov qword [rsp + 0x168], r15
mov qword [rsp + 0x168], r12
lea rcx, [rsp + 0x170]
call fcn.140015830
lea rcx, [rsp + 0x880]
mov rax, r14
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003fb90
mov dword [rsp + 0x2c0], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x170]
call fcn.140002a7c
nop
mov edx, 0x116c9
lea rcx, [rsp + 0x758]
call fcn.140023d80
nop
xor r9d, r9d
lea r8, [rsp + 0x168]
mov rdx, rax
call fcn.1400595d0
nop
mov qword [rsp + 0x758], rdi
lea rcx, [rsp + 0x760]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x168]
jmp 0x14003fe9f
mov r9d, 0x20119
lea r8, str.SoftwareIntelWirelessCommonAppFrameworkSettings
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003e3a0
test eax, eax
jne 0x14003fd54
mov dword [rsp + 0x74], 0x7d0
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa0]
xor r8d, r8d
lea rdx, str.PROSetVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x2ac], eax
test eax, eax
jne 0x14003fea4
mov eax, dword [rsp + 0xa0]
dec eax
cmp eax, 1
ja 0x14003fea4
mov eax, dword [rsp + 0x74]
test eax, eax
je 0x14003fcaa
test al, 1
jne 0x14003fea4
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003fcb2
jmp 0x14003fea4
mov word [rsp + 0x880], si
mov qword [rsp + 0x138], r15
mov qword [rsp + 0x138], r12
lea rcx, [rsp + 0x140]
call fcn.140015830
lea rcx, [rsp + 0x880]
mov rax, r14
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003fce0
mov dword [rsp + 0x2a8], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x140]
call fcn.140002a7c
nop
mov edx, 0x116c9
lea rcx, [rsp + 0x788]
call fcn.140023d80
nop
xor r9d, r9d
lea r8, [rsp + 0x138]
mov rdx, rax
call fcn.1400595d0
nop
mov qword [rsp + 0x788], rdi
lea rcx, [rsp + 0x790]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x138]
jmp 0x14003fe9f
mov r9d, 0x20119
lea r8, str.SoftwareIntelWirelessAppFrameworkSettings
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003e3a0
test eax, eax
jne 0x14003fea4
mov dword [rsp + 0x78], 0x7d0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa4]
xor r8d, r8d
lea rdx, str.PROSetVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x2a4], eax
test eax, eax
jne 0x14003fea4
mov eax, dword [rsp + 0xa4]
dec eax
cmp eax, 1
ja 0x14003fea4
mov eax, dword [rsp + 0x78]
test eax, eax
je 0x14003fdfa
test al, 1
jne 0x14003fea4
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003fe02
jmp 0x14003fea4
mov word [rsp + 0x880], si
mov qword [rsp + 0x128], r15
mov qword [rsp + 0x128], r12
lea rcx, [rsp + 0x130]
call fcn.140015830
lea rcx, [rsp + 0x880]
mov rax, r14
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003fe30
mov dword [rsp + 0x2f4], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x130]
call fcn.140002a7c
nop
mov edx, 0x116c9
lea rcx, [rsp + 0x7b8]
call fcn.140023d80
nop
xor r9d, r9d
lea r8, [rsp + 0x128]
mov rdx, rax
call fcn.1400595d0
nop
mov qword [rsp + 0x7b8], rdi
lea rcx, [rsp + 0x7c0]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x128]
call fcn.140054c00
mov dword [rsp + 0x60], esi
mov edi, dword [rsp + 0x40]
lea r8, vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
lea rcx, vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
lea rdx, vtable.std::ios_base.0
lea r10, [0x1402f2160]
lea r9, [0x1402f2168]
mov ebx, dword [rsp + 0x60]
cmp ebx, 0x64
jae 0x140040adb
mov qword [rsp + 0x180], r9
mov qword [rsp + 0x190], r10
mov qword [rsp + 0x218], rdx
mov qword [rsp + 0x218], rcx
or edi, 1
mov dword [rsp + 0x40], edi
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x180], r8
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rsp + rcx + 0x17c], edx
mov qword [rsp + 0x188], rsi
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x180]
add rcx, rax
lea rdx, [rsp + 0x198]
call fcn.14001c830
nop
lea rax, [rsp + 0x190]
mov qword [rsp + 0x3c0], rax
mov rax, qword [rsp + 0x190]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x190], rax
mov rax, qword [rsp + 0x190]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x18c], edx
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x20]
mov dword [rsp + rcx + 0x17c], edx
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rsp + rcx + 0x17c], edx
lea rax, [rsp + 0x198]
mov qword [rsp + 0x3c8], rax
lea rcx, [rsp + 0x198]
call fcn.14001c720
nop
lea rax, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rsp + 0x198], rax
mov qword [rsp + 0x200], rsi
mov dword [rsp + 0x308], esi
mov dword [rsp + 0x208], esi
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x1a8], 4
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
mov eax, 0x30
mov word [rsp + rcx + 0x1d8], ax
mov edx, ebx
lea rcx, [rsp + 0x190]
call fcn.14001bc90
lea rcx, [rsp + 0x570]
call fcn.14000a1bc
nop
mov r8d, 0x4e
lea rdx, str.systemCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318_
lea rcx, [rsp + 0x570]
call fcn.140009e14
nop
lea rcx, [rsp + 0x5b0]
call fcn.140009da0
mov qword [rsp + 0x5c0], rsi
mov qword [rsp + 0x5c8], 7
mov word [rsp + 0x5b0], si
or edi, 0x20
mov dword [rsp + 0x40], edi
mov edx, dword [rsp + 0x208]
test dl, 2
jne 0x14004015f
mov rax, qword [rsp + 0x1d8]
mov rcx, qword [rax]
mov qword [rsp + 0x3d0], rcx
test rcx, rcx
je 0x14004015f
mov rax, qword [rsp + 0x1b8]
mov rdx, qword [rax]
mov qword [rsp + 0x3d8], rdx
mov qword [rsp + 0x3e0], rcx
mov qword [rsp + 0x2b8], rcx
lea r8, [rsp + 0x200]
lea rax, [rsp + 0x2b8]
cmp rcx, qword [rsp + 0x200]
cmovae r8, rax
mov qword [rsp + 0x3e8], r8
mov r8, qword [r8]
sub r8, rdx
sar r8, 1
lea rcx, [rsp + 0x5b0]
call fcn.140009e14
jmp 0x1400401b3
test dl, 4
jne 0x1400401b3
mov rax, qword [rsp + 0x1d0]
mov rcx, qword [rax]
mov qword [rsp + 0x3f0], rcx
test rcx, rcx
je 0x1400401b3
mov rax, qword [rsp + 0x1b0]
mov rdx, qword [rax]
mov qword [rsp + 0x3f8], rdx
mov rax, qword [rsp + 0x1e8]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, rcx
sar r8, 1
lea rcx, [rsp + 0x5b0]
call fcn.140009e14
and edi, 0xffffffdf
mov dword [rsp + 0x40], edi
or edi, 0x10
mov dword [rsp + 0x40], edi
lea r9, [rsp + 0x5b0]
cmp qword [rsp + 0x5c8], 8
cmovae r9, qword [rsp + 0x5b0]
mov qword [rsp + 0x400], r9
mov rsi, qword [rsp + 0x5c0]
mov qword [rsp + 0x320], rsi
mov r15, qword [rsp + 0x580]
mov qword [rsp + 0x328], r15
mov rcx, qword [rsp + 0x588]
mov rax, rcx
sub rax, r15
cmp rsi, rax
ja 0x14004025b
lea rax, [r15 + rsi]
mov qword [rsp + 0x580], rax
lea rbx, [rsp + 0x570]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x570]
mov qword [rsp + 0x330], rbx
lea r8, [rsi + rsi]
lea rcx, [rbx + r15*2]
mov rdx, r9
call fcn.14022fad0
lea rax, [r15 + rsi]
xor esi, esi
mov word [rbx + rax*2], si
jmp 0x140040272
mov qword [rsp + 0x20], rsi
mov rdx, rsi
lea rcx, [rsp + 0x570]
call fcn.1400236a0
xor esi, esi
and edi, 0xffffffef
mov dword [rsp + 0x40], edi
lea rcx, [rsp + 0x5b0]
call fcn.140009bb8
lea rcx, [rsp + 0x678]
call fcn.14000a1bc
nop
lea rbx, [rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rbx, qword [rsp + 0x570]
mov qword [rsp + 0x338], rbx
mov qword [rsp + 0x88], rsi
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x14004035b
cmp qword [rax], 0
je 0x140040349
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x340], rax
test rax, rax
jne 0x1400402f6
mov eax, 1
jmp 0x140040381
lea rdx, str.RegOpenKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x348], rax
test rax, rax
je 0x140040354
mov qword [rsp + 0x30], rsi
mov rcx, qword [rsp + 0x58]
mov r8, qword [rcx]
mov qword [rsp + 0x28], r8
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call rax
jmp 0x140040381
mov rax, qword [rsp + 0x58]
cmp dword [rax + 8], 0
jne 0x14004035b
mov eax, 1
jmp 0x140040381
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x30c], eax
test eax, eax
jne 0x140040aab
mov eax, esi
mov dword [rsp + 0xa8], eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400403b5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0xa8], eax
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x50], esi
test eax, eax
jne 0x140040aab
mov dword [rsp + 0x7c], 0x7d0
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd8]
xor r8d, r8d
lea rdx, str.DriverDesc
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x310], eax
test eax, eax
jne 0x1400407a8
mov eax, dword [rsp + 0xd8]
dec eax
cmp eax, 1
ja 0x1400407a8
mov eax, dword [rsp + 0x7c]
test eax, eax
je 0x14004044d
test al, 1
jne 0x1400407a8
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x140040455
jmp 0x1400407a8
mov word [rsp + 0x880], si
call fcn.140011f18
mov rcx, rax
mov qword [rsp + 0x318], rax
test rax, rax
je 0x140040ca4
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, r13
jne 0x140040cae
lock inc dword [rcx + 0x20]
mov rbx, qword [rsp + 0x318]
add rbx, 0x10
mov qword [rsp + 0x350], rbx
add rbx, 0x18
mov qword [rsp + 0x90], rbx
lea rax, [rsp + 0x880]
mov qword [rsp + 0x358], rax
lea rcx, [rsp + 0x880]
mov byte [rsp + 0x44], 0
lea rax, [rsp + 0x880]
cmp rax, 0x10000
jae 0x1400404f8
movzx edx, cx
mov dword [rsp + 0x280], edx
lea rcx, [rsp + 0x90]
call fcn.140012700
mov byte [rsp + 0x44], 1
mov rbx, qword [rsp + 0x90]
jmp 0x1400406fd
lea rax, [rsp + 0x880]
mov rdi, r14
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140040503
mov dword [rsp + 0x284], edi
test edi, edi
jne 0x1400405f8
lea rcx, [rbx - 0x18]
mov qword [rsp + 0x2c8], rcx
mov rax, qword [rcx]
mov qword [rsp + 0x120], rax
cmp dword [rcx + 8], edi
je 0x1400406fd
cmp dword [rcx + 0x10], edi
jge 0x140040555
cmp dword [rbx - 0xc], edi
jl 0x140040cb8
mov dword [rbx - 0x10], esi
mov word [rbx], si
jmp 0x1400406fd
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x1400405b7
mov rdx, qword [rsp + 0x2c8]
mov rcx, qword [rdx]
mov qword [rsp + 0x360], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x140040cc2
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x368], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, vtable.ATL::CWin32Heap.0
cmp rax, r9
jne 0x140040cc2
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x120]
mov rax, qword [rcx]
mov rdx, qword [rax + 0x18]
cmp rax, r13
jne 0x140040ccb
lock inc dword [rcx + 0x20]
mov rbx, qword [rsp + 0x120]
add rbx, 0x10
mov qword [rsp + 0x370], rbx
add rbx, 0x18
mov qword [rsp + 0x90], rbx
jmp 0x1400406fd
mov r15d, dword [rbx - 0x10]
mov dword [rsp + 0x288], r15d
lea rsi, [rsp + 0x880]
sub rsi, rbx
sar rsi, 1
mov qword [rsp + 0x378], rsi
test edi, edi
js 0x140040ce9
lea rax, [rbx - 0x18]
mov qword [rsp + 0x380], rax
mov ecx, 1
sub ecx, dword [rax + 0x10]
mov dword [rsp + 0x28c], ecx
mov eax, dword [rax + 0xc]
sub eax, edi
mov dword [rsp + 0x290], eax
or eax, ecx
jge 0x140040664
mov edx, edi
lea rcx, [rsp + 0x90]
call fcn.140002a1c
mov rbx, qword [rsp + 0x90]
movsxd rax, dword [rbx - 0xc]
cmp rsi, r15
ja 0x1400406cb
mov dword [rsp + 0x294], eax
lea rdx, [rbx + rsi*2]
mov qword [rsp + 0x388], rdx
movsxd r8, edi
add r8, r8
mov qword [rsp + 0x390], r8
je 0x1400406e8
test rdx, rdx
jne 0x1400406a7
call fcn.140232664
mov dword [rax], 0x16
call fcn.140232514
jmp 0x1400406e8
add rax, rax
cmp rax, r8
jae 0x1400406c1
call fcn.140232664
mov dword [rax], 0x22
call fcn.140232514
jmp 0x1400406e8
mov rcx, rbx
call fcn.14022fad0
jmp 0x1400406e8
mov dword [rsp + 0x298], eax
mov rdx, rax
mov r9d, edi
lea r8, [rsp + 0x880]
mov rcx, rbx
call fcn.140002c18
cmp edi, dword [rbx - 0xc]
jg 0x140040d05
mov dword [rbx - 0x10], edi
movsxd rax, edi
xor esi, esi
mov word [rbx + rax*2], si
mov rax, r14
lea r15, str.Intel_R__Advanced_Network_Services_Virtual_Adapter
nop word [rax + rax]
movzx ecx, word [rbx + rax*2 + 2]
cmp cx, word [r15 + rax*2 + 2]
jne 0x140040736
add rax, 2
cmp rax, 0x33
je 0x1400408d5
movzx ecx, word [rbx + rax*2]
cmp cx, word [r15 + rax*2]
je 0x140040710
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x2d8], rbx
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x1400407a4
mov rdx, qword [rsp + 0x2d8]
mov rcx, qword [rdx]
mov qword [rsp + 0x398], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x140040cfd
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x3a0], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, vtable.ATL::CWin32Heap.0
cmp rax, r9
jne 0x140040cfd
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [rsp + 0x40]
lea rcx, [rsp + 0x678]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x570]
call fcn.140009bb8
nop
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rsp + rcx + 0x17c], edx
lea rcx, [rsp + 0x198]
call fcn.14001d3e0
nop
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea eax, [rcx - 0x20]
mov dword [rsp + rcx + 0x17c], eax
mov rax, qword [rsp + 0x190]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x190], rax
mov rax, qword [rsp + 0x190]
movsxd rcx, dword [rax + 4]
lea eax, [rcx - 0x10]
mov dword [rsp + rcx + 0x18c], eax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea eax, [rcx - 0x18]
mov dword [rsp + rcx + 0x17c], eax
lea rax, vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + 0x218], rax
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x218], rax
lea rcx, [rsp + 0x218]
call fcn.14022dac4
nop
inc dword [rsp + 0x60]
lea r15, vtable.srl::Value.0
jmp 0x14003feac
mov dword [rsp + 0x80], 0x7d0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xac]
xor r8d, r8d
lea rdx, str.DriverVersion
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x29c], eax
test eax, eax
jne 0x140040954
mov eax, dword [rsp + 0xac]
dec eax
cmp eax, 1
ja 0x140040954
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x1400409c8
test al, 1
jne 0x140040954
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x1400409d0
lea r12, vtable.srl::GroupID.0
lea r15, vtable.srl::Value.0
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x2d0], rbx
lock xadd dword [rbx + 0x10], r14d
sub r14d, 1
jg 0x140040a80
mov rdx, qword [rsp + 0x2d0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x140040cf4
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, vtable.ATL::CWin32Heap.0
cmp rax, r9
jne 0x140040cf4
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140040a80
mov word [rsp + 0x880], si
lea r15, vtable.srl::Value.0
mov qword [rsp + 0x100], r15
mov qword [rsp + 0x100], r12
lea rcx, [rsp + 0x108]
call fcn.140015830
lea rcx, [rsp + 0x880]
mov rax, r14
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x140040a00
mov dword [rsp + 0x2a0], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x108]
call fcn.140002a7c
nop
mov edx, 0x116ca
lea rcx, [rsp + 0x7e8]
call fcn.140023d80
nop
xor r9d, r9d
lea r8, [rsp + 0x100]
mov rdx, rax
call fcn.1400595d0
nop
lea r12, vtable.srl::GroupID.0
mov qword [rsp + 0x7e8], r12
lea rcx, [rsp + 0x7f0]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x100]
call fcn.140054c00
jmp 0x140040962
lea rcx, [rsp + 0x678]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x570]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x180]
call fcn.14001b7c0
jmp 0x140040ae2
lea rcx, [rsp + 0x678]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x570]
call fcn.140009bb8
nop
lea rcx, [rsp + 0x180]
call fcn.14001b7c0
lea r15, vtable.srl::Value.0
lea r12, vtable.srl::GroupID.0
mov r9d, 0x20019
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_SettingsZoneMapDomains_newcorp.com
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0x48]
call fcn.14003e3a0
test eax, eax
jne 0x140040c3e
mov dword [rsp + 0xb4], esi
mov dword [rsp + 0xb0], 4
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb4]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb8]
xor r8d, r8d
lea rdx, str.http
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140040bd0
cmp dword [rsp + 0xb8], 4
jne 0x140040bd0
mov qword [rsp + 0x148], r15
lea rbx, vtable.srl::Exists.0
mov qword [rsp + 0x148], rbx
mov byte [rsp + 0x150], 1
mov edx, 0x11734
lea rcx, [rsp + 0x818]
call fcn.140023d80
nop
xor r9d, r9d
lea r8, [rsp + 0x148]
mov rdx, rax
call fcn.1400595d0
nop
mov qword [rsp + 0x818], r12
lea rcx, [rsp + 0x820]
call fcn.140009bb8
nop
mov qword [rsp + 0x148], rbx
mov qword [rsp + 0x148], r15
jmp 0x140040c43
mov qword [rsp + 0x158], r15
lea rbx, vtable.srl::Exists.0
mov qword [rsp + 0x158], rbx
mov byte [rsp + 0x160], 0
mov edx, 0x11734
lea rcx, [rsp + 0x848]
call fcn.140023d80
nop
xor r9d, r9d
lea r8, [rsp + 0x158]
mov rdx, rax
call fcn.1400595d0
nop
mov qword [rsp + 0x848], r12
lea rcx, [rsp + 0x850]
call fcn.140009bb8
nop
mov qword [rsp + 0x158], rbx
mov qword [rsp + 0x158], r15
jmp 0x140040c43
mov rdi, qword [rsp + 0x48]
test rdi, rdi
je 0x140040c56
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
lea rcx, [rsp + 0x650]
call fcn.14001a370
mov al, 1
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.14022b120
lea r11, [rsp + 0x1060]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call r8
nop
jmp 0x14003f69d
mov ecx, 0x80004005
call fcn.140002d3c
call rdx
mov rbx, rax
jmp 0x14004048e
mov ecx, 0x80070057
call fcn.140002d3c
call r8
nop
jmp 0x1400405b7
call rdx
mov rbx, rax
mov qword [rsp + 0x370], rax
add rbx, 0x18
mov qword [rsp + 0x90], rbx
jmp 0x1400406fd
mov ecx, 0x80070057
call fcn.140002d3c
nop
call r8
nop
jmp 0x140040a80
call r8
jmp 0x1400407a4
mov ecx, 0x80070057
call fcn.140002d3c
int3