Function at 0x1403b5b58
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4e0
mov rax, qword [0x1404f5550]
xor rax, rsp
mov qword [rsp + AfxStoreField], rax
xor r14d, r14d
bt ecx, 0x10
mov rsi, r8
mov r15, rdx
mov ebx, ecx
mov dword [rsp + 0x5c], gethostbyname
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x3c], r14d
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x54], r14d
mov dword [rsp + 0x58], reloc.mfc90u.dll_SerializeElements_class_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_______
jae 0x1403b5bd6
lea rdx, [rsp + 0x30]
xor r8d, r8d
call fcn.1403b7458
mov eax, dword [rsp + 0x30]
lea ebp, [r14 + 1]
cmp eax, r14d
cmove eax, ebp
jmp 0x1403b6246
mov r13d, 2
test r13b, cl
je 0x1403b5c02
mov rcx, r8
call fcn.1403ba0b4
mov ecx, eax
mov eax, 0x91a2b3c5
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
add dword [rsp + 0x30], edx
test bl, 0x10
mov ebp, 1
je 0x1403b5d05
lea r12, [rsp + reloc.mfc90u.dll_CMiniFrameWnd::CMiniFrameWnd]
mov rcx, rsi
sub r12, rsi
mov al, byte [rcx]
mov byte [r12 + rcx], al
add rcx, rbp
cmp al, r14b
jne 0x1403b5c1e
mov rcx, rsi
call fcn.1403b9fd0
cmp eax, r14d
mov dword [rsp + 0x3c], eax
jne 0x1403b5cf4
mov rax, qword [str.Network_]
lea rcx, [rsp + reloc.mfc90u.dll_CMiniFrameWnd::CMiniFrameWnd]
lea rdi, [rsp + reloc.mfc90u.dll_CMiniFrameWnd::CMiniFrameWnd]
mov qword [rcx], rax
mov al, byte [0x14048b880]
mov byte [rsp + 0x49], r14b
mov byte [rcx + 8], al
mov al, byte [rsi]
or rcx, 0xffffffffffffffff
mov byte [rsp + 0x48], al
xor eax, eax
lea rdx, [rsp + 0x48]
repne scasb al, byte [rdi]
sub rdi, rbp
xor ecx, ecx
mov al, byte [rdx + rcx]
mov byte [rdi + rcx], al
add rcx, rbp
test al, al
jne 0x1403b5c81
lea r8, [rsp + 0x60]
lea rdx, [rsp + reloc.mfc90u.dll_CMiniFrameWnd::CMiniFrameWnd]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp eax, r14d
jne 0x1403b5cf4
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + reloc.mfc90u.dll_CMiniFrameWnd::CMiniFrameWnd]
lea rdx, str.RemotePath
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, r14d
je 0x1403b5cf4
mov rcx, rsi
mov al, byte [rcx]
mov byte [r12 + rcx], al
add rcx, rbp
cmp al, r14b
jne 0x1403b5ce6
lea rcx, [rsp + reloc.mfc90u.dll_CMiniFrameWnd::CMiniFrameWnd]
call fcn.1403b9fd0
add dword [rsp + 0x30], eax
bt ebx, 0xc
jae 0x1403b5d1e
call fcn.1403b9844
cmp eax, r14d
je 0x1403b5d1b
add dword [rsp + 0x30], eax
jmp 0x1403b5d1e
or ebx, 0x20
bt ebx, 0xe
jae 0x1403b5d2d
call fcn.1403b9a7c
add dword [rsp + 0x30], eax
test bl, 0x20
je 0x1403b5d40
call fcn.1403b9c7c
add dword [rsp + 0x30], eax
call fcn.1403b9c7c
test bl, 0x40
je 0x1403b5d5a
lea rdx, [rsp + 0x54]
mov rcx, r15
call fcn.1403b93b8
mov edx, dword [rsp + 0x54]
add dword [rsp + 0x30], edx
test bl, bl
jns 0x1403b6005
lea rcx, [rsp + 0x48]
mov dword [rsp + 0x48], 0x1e
mov byte [rsp + 0x210], r14b
call fcn.1403b92ec
lea rdx, [rsp + 0x40]
mov r12, 0xffffffff80000002
mov qword [rsp + 0x20], rdx
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion
mov r9d, ebp
xor r8d, r8d
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, r14d
jne 0x1403b5f04
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x210]
lea rdx, str.ProductId
mov edi, 0x64
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, r14d
jne 0x1403b5e01
lea rcx, [rsp + 0x210]
call fcn.1403b9280
btr eax, 0x1f
jmp 0x1403b5f79
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x40]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov r9d, ebp
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, r14d
jne 0x1403b5f8c
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x210]
lea rdx, str.ProductId
xor r8d, r8d
mov dword [rsp + 0x34], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, r14d
je 0x1403b5f6c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [rsp + 0x48], 0xb
jl 0x1403b5f92
call fcn.1403b80f8
cmp eax, r14d
je 0x1403b5f92
lea rax, [rsp + 0x40]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersion
mov r9d, SerializeElements<class ATL::CStringT<wchar_t,class StrTraitMFC_DLL<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, r14d
jne 0x1403b5f92
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x210]
lea rdx, str.ProductId
xor r8d, r8d
mov dword [rsp + 0x34], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, r14d
jne 0x1403b5f92
jmp 0x1403b5f6c
lea rax, [rsp + 0x40]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov r9d, ebp
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, r14d
jne 0x1403b5ff4
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x210]
lea rdx, str.ProductId
mov edi, 0x64
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, r14d
jne 0x1403b5f8c
lea rcx, [rsp + 0x210]
call fcn.1403b9280
add dword [rsp + 0x30], eax
lea rcx, [rsp + 0x210]
call fcn.1403b9280
jmp 0x1403b5f92
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x210]
lea rdx, str.ProductKey
xor r8d, r8d
mov byte [rsp + 0x210], r14b
mov dword [rsp + 0x34], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, r14d
jne 0x1403b5ff4
lea rcx, [rsp + 0x210]
call fcn.1403b9280
lea rcx, [rsp + 0x210]
add dword [rsp + 0x30], eax
call fcn.1403b9280
jmp 0x1403b5ffa
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
bt ebx, 8
jae 0x1403b61d2
mov al, byte [rsi + 1]
cmp al, r14b
je 0x1403b6061
cmp al, 0x3a
je 0x1403b6061
cmp al, 0x5c
je 0x1403b6037
lea rcx, [rsp + 0x280]
xor r8d, r8d
mov rdx, rsi
call fcn.1403b6858
jmp 0x1403b60ec
mov al, byte [rsi + 2]
mov rcx, r13
jmp 0x1403b6057
cmp al, 0x5c
je 0x1403b60e1
mov byte [rsp + rcx + 0x27e], al
add r13d, ebp
add rcx, rbp
mov al, byte [rcx + rsi]
cmp al, r14b
jne 0x1403b603f
jmp 0x1403b60e1
mov al, byte [rsi]
lea rcx, str.mpr.dll
mov byte [rsp + 0x4d], 0x3a
mov byte [rsp + 0x4c], al
mov byte [rsp + 0x4e], r14b
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp rax, r14
mov rdi, rax
jne 0x1403b608d
xor eax, eax
jmp 0x1403b6246
lea rdx, str.WNetGetConnectionA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r8, [rsp + 0x5c]
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x4c]
call rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp byte [rsp + reloc.mfc90u.dll_CDocItem::CDocItem], r14b
je 0x1403b60e1
lea rax, [rsp + reloc.mfc90u.dll_CDocItem::CDocItem]
mov cl, byte [rax]
cmp cl, 0x5c
je 0x1403b60e1
mov byte [rax - 2], cl
add rax, rbp
add r13d, ebp
cmp byte [rax], r14b
jne 0x1403b60cc
movsxd rax, r13d
mov byte [rsp + rax + 0x27e], r14b
cmp byte [rsp + 0x280], r14b
je 0x1403b61d2
lea rcx, str.Ws2_32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp rax, r14
mov r12, rax
je 0x1403b61ff
lea rdx, str.WSAStartup
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.gethostbyname
mov rcx, r12
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.WSACleanup
mov rcx, r12
mov r13, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x70]
mov ecx, SerializeElements<class ATL::CStringT<wchar_t,class StrTraitMFC_DLL<wchar_t,class ATL::ChTraitsCRT<wchar_t> > > >
mov r14, rax
call rdi
cmp rax, 0xffffffffffffffff
je 0x1403b61c6
lea rcx, [rsp + 0x280]
call r13
test rax, rax
mov rdi, rax
je 0x1403b61c3
mov rcx, qword [rax + 0x18]
mov rdx, qword [rcx]
mov cl, byte [rdx]
mov edx, dword [rsp + 0x30]
and ecx, 0x7f
shl ecx, 0x18
add edx, ecx
mov dword [rsp + 0x30], edx
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx]
movsx ecx, byte [rax + 1]
shl ecx, 0x10
add edx, ecx
mov dword [rsp + 0x30], edx
mov rax, qword [rdi + 0x18]
mov rcx, qword [rax]
movsx eax, byte [rcx + 2]
shl eax, 8
add edx, eax
mov dword [rsp + 0x30], edx
mov rax, qword [rdi + 0x18]
mov rcx, qword [rax]
movsx eax, byte [rcx + 3]
add edx, eax
mov dword [rsp + 0x30], edx
call r14
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor r14d, r14d
bt ebx, 0x11
jae 0x1403b623a
cmp r15, r14
mov dword [rsp + 0x3c], r14d
mov dword [rsp + 0x50], r14d
je 0x1403b6206
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r15
repne scasb al, byte [rdi]
not rcx
cmp rcx, rbp
je 0x1403b6206
mov rdx, r15
jmp 0x1403b6221
mov eax, 0x3a
jmp 0x1403b6246
cmp rsi, r14
je 0x1403b6232
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
repne scasb al, byte [rdi]
not rcx
cmp rcx, rbp
je 0x1403b6232
mov rdx, rsi
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x3c]
xor ecx, ecx
call fcn.1403b90f4
mov eax, dword [rsp + 0x3c]
add dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
btr eax, 0x1f
mov dword [rsp + 0x30], eax
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.1403c2380
mov rbx, qword [rsp + 0x538]
add rsp, 0x4e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret