Function at 0x14003e4b0
Capabilities:
Query or enumerate registry value

Disassembly:
push r13
push r14
push r15
mov eax, 0x1060
call fcn.14022a960
sub rsp, rax
mov qword [rsp + 0x3a8], 0xfffffffffffffffe
mov qword [rsp + 0x1080], rbx
mov qword [rsp + 0x1088], rsi
mov qword [rsp + 0x1090], rdi
mov qword [rsp + 0x1098], r12
mov rax, qword [0x14035c8c0]
xor rax, rsp
mov qword [rsp + 0x1050], rax
xor esi, esi
mov dword [rsp + 0x40], esi
lea rcx, [rsp + 0x658]
call fcn.140009e28
nop
mov byte [rsp + 0x650], sil
lea r8d, [rsi + 0x15]
lea rdx, str.srl::Software::Detect
lea rcx, [rsp + 0x658]
call fcn.140009a80
nop
call fcn.1400224d0
cmp dword [rax + 8], 4
jl 0x14003e557
mov byte [rsp + 0x650], 1
lea rcx, [rsp + 0x650]
call fcn.140018570
nop
lea r15, vtable.srl::Value.0
mov qword [rsp + 0xc0], r15
lea rbx, vtable.srl::Version.0
mov qword [rsp + 0xc0], rbx
lea rcx, [rsp + 0xc8]
call fcn.1400154a0
mov r8d, 5
lea rdx, str.6.4.6
lea rcx, [rsp + 0xc8]
call fcn.140002a7c
nop
mov edx, 0x116b7
lea rcx, [rsp + 0x698]
call fcn.140023a00
nop
xor r9d, r9d
lea r8, [rsp + 0xc0]
mov rdx, rax
call fcn.140058450
nop
lea rdi, vtable.srl::GroupID.0
mov qword [rsp + 0x698], rdi
lea rcx, [rsp + 0x6a0]
call fcn.140009824
nop
mov qword [rsp + 0xc0], rbx
mov rcx, qword [rsp + 0xc8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x2b0], rcx
mov r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
lea r13, vtable.ATL::CAtlStringMgr.0
jg 0x14003e66d
mov rdx, qword [rsp + 0x2b0]
mov rcx, qword [rdx]
mov qword [rsp + 0x3b0], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14003fc6b
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x3b8], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea rbx, vtable.ATL::CWin32Heap.0
cmp rax, rbx
jne 0x14003fc6b
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0xc0], r15
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x58], rsi
mov r9d, 0x20019
lea r8, str.SoftwareIntelNetwork_ServicesDMIX
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003d370
test eax, eax
jne 0x14003e889
mov dword [rsp + 0x64], 0x7d0
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd0]
xor r8d, r8d
lea rdx, str.OEMVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x304], eax
test eax, eax
jne 0x14003e720
mov eax, dword [rsp + 0xd0]
dec eax
cmp eax, 1
ja 0x14003e720
mov eax, dword [rsp + 0x64]
test eax, eax
je 0x14003e7d5
test al, 1
jne 0x14003e720
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003e7dd
lea r12, vtable.srl::Name.0
mov r9d, 0x20019
lea r8, str.SoftwareIntelWirelessCommonAppFrameworkSettings
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003d370
test eax, eax
jne 0x14003ea84
mov dword [rsp + 0x6c], 0x7d0
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x98]
xor r8d, r8d
lea rdx, str.PROSetVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x2f0], eax
test eax, eax
jne 0x14003ee74
mov eax, dword [rsp + 0x98]
dec eax
cmp eax, 1
ja 0x14003ee74
mov eax, dword [rsp + 0x6c]
test eax, eax
je 0x14003e9df
test al, 1
jne 0x14003ee74
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003e9e7
jmp 0x14003ee74
mov word [rsp + 0x880], si
mov qword [rsp + 0xf0], r15
lea r12, vtable.srl::Name.0
mov qword [rsp + 0xf0], r12
lea rcx, [rsp + 0xf8]
call fcn.1400154a0
lea rcx, [rsp + 0x880]
mov rax, r14
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003e810
mov dword [rsp + 0x300], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0xf8]
call fcn.140002a7c
nop
mov edx, 0x116d1
lea rcx, [rsp + 0x6c8]
call fcn.140023a00
nop
xor r9d, r9d
lea r8, [rsp + 0xf0]
mov rdx, rax
call fcn.140058450
nop
mov qword [rsp + 0x6c8], rdi
lea rcx, [rsp + 0x6d0]
call fcn.140009824
nop
lea rcx, [rsp + 0xf0]
call fcn.140053a80
jmp 0x14003e727
mov r9d, 0x20119
lea r8, str.SoftwareIntelNetwork_ServicesDMIX
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003d370
test eax, eax
jne 0x14003e720
mov dword [rsp + 0x68], 0x7d0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd4]
xor r8d, r8d
lea rdx, str.OEMVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x2fc], eax
test eax, eax
jne 0x14003e720
mov eax, dword [rsp + 0xd4]
dec eax
cmp eax, 1
ja 0x14003e720
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x14003e92f
test al, 1
jne 0x14003e720
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003e937
jmp 0x14003e720
mov word [rsp + 0x880], si
mov qword [rsp + 0xe0], r15
lea r12, vtable.srl::Name.0
mov qword [rsp + 0xe0], r12
lea rcx, [rsp + 0xe8]
call fcn.1400154a0
lea rcx, [rsp + 0x880]
mov rax, r14
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003e966
mov dword [rsp + 0x2f8], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0xe8]
call fcn.140002a7c
nop
mov edx, 0x116d1
lea rcx, [rsp + 0x6f8]
call fcn.140023a00
nop
xor r9d, r9d
lea r8, [rsp + 0xe0]
mov rdx, rax
call fcn.140058450
nop
mov qword [rsp + 0x6f8], rdi
lea rcx, [rsp + 0x700]
call fcn.140009824
nop
lea rcx, [rsp + 0xe0]
call fcn.140053a80
jmp 0x14003e727
mov word [rsp + 0x880], si
mov qword [rsp + 0x110], r15
mov qword [rsp + 0x110], r12
lea rcx, [rsp + 0x118]
call fcn.1400154a0
lea rcx, [rsp + 0x880]
mov rax, r14
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003ea10
mov dword [rsp + 0x2ec], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x118]
call fcn.140002a7c
nop
mov edx, 0x116c9
lea rcx, [rsp + 0x728]
call fcn.140023a00
nop
xor r9d, r9d
lea r8, [rsp + 0x110]
mov rdx, rax
call fcn.140058450
nop
mov qword [rsp + 0x728], rdi
lea rcx, [rsp + 0x730]
call fcn.140009824
nop
lea rcx, [rsp + 0x110]
jmp 0x14003ee6f
mov r9d, 0x20019
lea r8, str.SoftwareIntelWirelessAppFrameworkSettings
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003d370
test eax, eax
jne 0x14003ebd4
mov dword [rsp + 0x70], 0x7d0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x9c]
xor r8d, r8d
lea rdx, str.PROSetVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x2e8], eax
test eax, eax
jne 0x14003ee74
mov eax, dword [rsp + 0x9c]
dec eax
cmp eax, 1
ja 0x14003ee74
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x14003eb2a
test al, 1
jne 0x14003ee74
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003eb32
jmp 0x14003ee74
mov word [rsp + 0x880], si
mov qword [rsp + 0x168], r15
mov qword [rsp + 0x168], r12
lea rcx, [rsp + 0x170]
call fcn.1400154a0
lea rcx, [rsp + 0x880]
mov rax, r14
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003eb60
mov dword [rsp + 0x2c0], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x170]
call fcn.140002a7c
nop
mov edx, 0x116c9
lea rcx, [rsp + 0x758]
call fcn.140023a00
nop
xor r9d, r9d
lea r8, [rsp + 0x168]
mov rdx, rax
call fcn.140058450
nop
mov qword [rsp + 0x758], rdi
lea rcx, [rsp + 0x760]
call fcn.140009824
nop
lea rcx, [rsp + 0x168]
jmp 0x14003ee6f
mov r9d, 0x20119
lea r8, str.SoftwareIntelWirelessCommonAppFrameworkSettings
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003d370
test eax, eax
jne 0x14003ed24
mov dword [rsp + 0x74], 0x7d0
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa0]
xor r8d, r8d
lea rdx, str.PROSetVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x2ac], eax
test eax, eax
jne 0x14003ee74
mov eax, dword [rsp + 0xa0]
dec eax
cmp eax, 1
ja 0x14003ee74
mov eax, dword [rsp + 0x74]
test eax, eax
je 0x14003ec7a
test al, 1
jne 0x14003ee74
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003ec82
jmp 0x14003ee74
mov word [rsp + 0x880], si
mov qword [rsp + 0x138], r15
mov qword [rsp + 0x138], r12
lea rcx, [rsp + 0x140]
call fcn.1400154a0
lea rcx, [rsp + 0x880]
mov rax, r14
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003ecb0
mov dword [rsp + 0x2a8], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x140]
call fcn.140002a7c
nop
mov edx, 0x116c9
lea rcx, [rsp + 0x788]
call fcn.140023a00
nop
xor r9d, r9d
lea r8, [rsp + 0x138]
mov rdx, rax
call fcn.140058450
nop
mov qword [rsp + 0x788], rdi
lea rcx, [rsp + 0x790]
call fcn.140009824
nop
lea rcx, [rsp + 0x138]
jmp 0x14003ee6f
mov r9d, 0x20119
lea r8, str.SoftwareIntelWirelessAppFrameworkSettings
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003d370
test eax, eax
jne 0x14003ee74
mov dword [rsp + 0x78], 0x7d0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa4]
xor r8d, r8d
lea rdx, str.PROSetVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x2a4], eax
test eax, eax
jne 0x14003ee74
mov eax, dword [rsp + 0xa4]
dec eax
cmp eax, 1
ja 0x14003ee74
mov eax, dword [rsp + 0x78]
test eax, eax
je 0x14003edca
test al, 1
jne 0x14003ee74
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003edd2
jmp 0x14003ee74
mov word [rsp + 0x880], si
mov qword [rsp + 0x128], r15
mov qword [rsp + 0x128], r12
lea rcx, [rsp + 0x130]
call fcn.1400154a0
lea rcx, [rsp + 0x880]
mov rax, r14
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003ee00
mov dword [rsp + 0x2f4], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x130]
call fcn.140002a7c
nop
mov edx, 0x116c9
lea rcx, [rsp + 0x7b8]
call fcn.140023a00
nop
xor r9d, r9d
lea r8, [rsp + 0x128]
mov rdx, rax
call fcn.140058450
nop
mov qword [rsp + 0x7b8], rdi
lea rcx, [rsp + 0x7c0]
call fcn.140009824
nop
lea rcx, [rsp + 0x128]
call fcn.140053a80
mov dword [rsp + 0x60], esi
mov edi, dword [rsp + 0x40]
lea r8, vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
lea rcx, vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
lea rdx, vtable.std::ios_base.0
lea r10, [0x1402f0f80]
lea r9, [0x1402f0f88]
mov ebx, dword [rsp + 0x60]
cmp ebx, 0x64
jae 0x14003faab
mov qword [rsp + 0x180], r9
mov qword [rsp + 0x190], r10
mov qword [rsp + 0x218], rdx
mov qword [rsp + 0x218], rcx
or edi, 1
mov dword [rsp + 0x40], edi
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x180], r8
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rsp + rcx + 0x17c], edx
mov qword [rsp + 0x188], rsi
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x180]
add rcx, rax
lea rdx, [rsp + 0x198]
call fcn.14001c4a0
nop
lea rax, [rsp + 0x190]
mov qword [rsp + 0x3c0], rax
mov rax, qword [rsp + 0x190]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x190], rax
mov rax, qword [rsp + 0x190]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x18c], edx
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x20]
mov dword [rsp + rcx + 0x17c], edx
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rsp + rcx + 0x17c], edx
lea rax, [rsp + 0x198]
mov qword [rsp + 0x3c8], rax
lea rcx, [rsp + 0x198]
call fcn.14001c390
nop
lea rax, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rsp + 0x198], rax
mov qword [rsp + 0x200], rsi
mov dword [rsp + 0x308], esi
mov dword [rsp + 0x208], esi
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x1a8], 4
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
mov eax, 0x30
mov word [rsp + rcx + 0x1d8], ax
mov edx, ebx
lea rcx, [rsp + 0x190]
call fcn.14001b900
lea rcx, [rsp + 0x570]
call fcn.140009e28
nop
mov r8d, 0x4e
lea rdx, str.systemCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318_
lea rcx, [rsp + 0x570]
call fcn.140009a80
nop
lea rcx, [rsp + 0x5b0]
call fcn.140009a0c
mov qword [rsp + 0x5c0], rsi
mov qword [rsp + 0x5c8], 7
mov word [rsp + 0x5b0], si
or edi, 0x20
mov dword [rsp + 0x40], edi
mov edx, dword [rsp + 0x208]
test dl, 2
jne 0x14003f12f
mov rax, qword [rsp + 0x1d8]
mov rcx, qword [rax]
mov qword [rsp + 0x3d0], rcx
test rcx, rcx
je 0x14003f12f
mov rax, qword [rsp + 0x1b8]
mov rdx, qword [rax]
mov qword [rsp + 0x3d8], rdx
mov qword [rsp + 0x3e0], rcx
mov qword [rsp + 0x2b8], rcx
lea r8, [rsp + 0x200]
lea rax, [rsp + 0x2b8]
cmp rcx, qword [rsp + 0x200]
cmovae r8, rax
mov qword [rsp + 0x3e8], r8
mov r8, qword [r8]
sub r8, rdx
sar r8, 1
lea rcx, [rsp + 0x5b0]
call fcn.140009a80
jmp 0x14003f183
test dl, 4
jne 0x14003f183
mov rax, qword [rsp + 0x1d0]
mov rcx, qword [rax]
mov qword [rsp + 0x3f0], rcx
test rcx, rcx
je 0x14003f183
mov rax, qword [rsp + 0x1b0]
mov rdx, qword [rax]
mov qword [rsp + 0x3f8], rdx
mov rax, qword [rsp + 0x1e8]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, rcx
sar r8, 1
lea rcx, [rsp + 0x5b0]
call fcn.140009a80
and edi, 0xffffffdf
mov dword [rsp + 0x40], edi
or edi, 0x10
mov dword [rsp + 0x40], edi
lea r9, [rsp + 0x5b0]
cmp qword [rsp + 0x5c8], 8
cmovae r9, qword [rsp + 0x5b0]
mov qword [rsp + 0x400], r9
mov rsi, qword [rsp + 0x5c0]
mov qword [rsp + 0x320], rsi
mov r15, qword [rsp + 0x580]
mov qword [rsp + 0x328], r15
mov rcx, qword [rsp + 0x588]
mov rax, rcx
sub rax, r15
cmp rsi, rax
ja 0x14003f22b
lea rax, [r15 + rsi]
mov qword [rsp + 0x580], rax
lea rbx, [rsp + 0x570]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x570]
mov qword [rsp + 0x330], rbx
lea r8, [rsi + rsi]
lea rcx, [rbx + r15*2]
mov rdx, r9
call fcn.14022e750
lea rax, [r15 + rsi]
xor esi, esi
mov word [rbx + rax*2], si
jmp 0x14003f242
mov qword [rsp + 0x20], rsi
mov rdx, rsi
lea rcx, [rsp + 0x570]
call fcn.140023320
xor esi, esi
and edi, 0xffffffef
mov dword [rsp + 0x40], edi
lea rcx, [rsp + 0x5b0]
call fcn.140009824
lea rcx, [rsp + 0x678]
call fcn.140009e28
nop
lea rbx, [rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rbx, qword [rsp + 0x570]
mov qword [rsp + 0x338], rbx
mov qword [rsp + 0x88], rsi
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x14003f32b
cmp qword [rax], 0
je 0x14003f319
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x340], rax
test rax, rax
jne 0x14003f2c6
mov eax, 1
jmp 0x14003f351
lea rdx, str.RegOpenKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x348], rax
test rax, rax
je 0x14003f324
mov qword [rsp + 0x30], rsi
mov rcx, qword [rsp + 0x58]
mov r8, qword [rcx]
mov qword [rsp + 0x28], r8
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call rax
jmp 0x14003f351
mov rax, qword [rsp + 0x58]
cmp dword [rax + 8], 0
jne 0x14003f32b
mov eax, 1
jmp 0x14003f351
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x30c], eax
test eax, eax
jne 0x14003fa7b
mov eax, esi
mov dword [rsp + 0xa8], eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14003f385
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0xa8], eax
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x50], esi
test eax, eax
jne 0x14003fa7b
mov dword [rsp + 0x7c], 0x7d0
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd8]
xor r8d, r8d
lea rdx, str.DriverDesc
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x310], eax
test eax, eax
jne 0x14003f778
mov eax, dword [rsp + 0xd8]
dec eax
cmp eax, 1
ja 0x14003f778
mov eax, dword [rsp + 0x7c]
test eax, eax
je 0x14003f41d
test al, 1
jne 0x14003f778
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003f425
jmp 0x14003f778
mov word [rsp + 0x880], si
call fcn.140011b88
mov rcx, rax
mov qword [rsp + 0x318], rax
test rax, rax
je 0x14003fc74
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, r13
jne 0x14003fc7e
lock inc dword [rcx + 0x20]
mov rbx, qword [rsp + 0x318]
add rbx, 0x10
mov qword [rsp + 0x350], rbx
add rbx, 0x18
mov qword [rsp + 0x90], rbx
lea rax, [rsp + 0x880]
mov qword [rsp + 0x358], rax
lea rcx, [rsp + 0x880]
mov byte [rsp + 0x44], 0
lea rax, [rsp + 0x880]
cmp rax, 0x10000
jae 0x14003f4c8
movzx edx, cx
mov dword [rsp + 0x280], edx
lea rcx, [rsp + 0x90]
call fcn.140012370
mov byte [rsp + 0x44], 1
mov rbx, qword [rsp + 0x90]
jmp 0x14003f6cd
lea rax, [rsp + 0x880]
mov rdi, r14
inc rdi
cmp word [rax + rdi*2], 0
jne 0x14003f4d3
mov dword [rsp + 0x284], edi
test edi, edi
jne 0x14003f5c8
lea rcx, [rbx - 0x18]
mov qword [rsp + 0x2c8], rcx
mov rax, qword [rcx]
mov qword [rsp + 0x120], rax
cmp dword [rcx + 8], edi
je 0x14003f6cd
cmp dword [rcx + 0x10], edi
jge 0x14003f525
cmp dword [rbx - 0xc], edi
jl 0x14003fc88
mov dword [rbx - 0x10], esi
mov word [rbx], si
jmp 0x14003f6cd
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x14003f587
mov rdx, qword [rsp + 0x2c8]
mov rcx, qword [rdx]
mov qword [rsp + 0x360], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14003fc92
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x368], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, vtable.ATL::CWin32Heap.0
cmp rax, r9
jne 0x14003fc92
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x120]
mov rax, qword [rcx]
mov rdx, qword [rax + 0x18]
cmp rax, r13
jne 0x14003fc9b
lock inc dword [rcx + 0x20]
mov rbx, qword [rsp + 0x120]
add rbx, 0x10
mov qword [rsp + 0x370], rbx
add rbx, 0x18
mov qword [rsp + 0x90], rbx
jmp 0x14003f6cd
mov r15d, dword [rbx - 0x10]
mov dword [rsp + 0x288], r15d
lea rsi, [rsp + 0x880]
sub rsi, rbx
sar rsi, 1
mov qword [rsp + 0x378], rsi
test edi, edi
js 0x14003fcb9
lea rax, [rbx - 0x18]
mov qword [rsp + 0x380], rax
mov ecx, 1
sub ecx, dword [rax + 0x10]
mov dword [rsp + 0x28c], ecx
mov eax, dword [rax + 0xc]
sub eax, edi
mov dword [rsp + 0x290], eax
or eax, ecx
jge 0x14003f634
mov edx, edi
lea rcx, [rsp + 0x90]
call fcn.140002a1c
mov rbx, qword [rsp + 0x90]
movsxd rax, dword [rbx - 0xc]
cmp rsi, r15
ja 0x14003f69b
mov dword [rsp + 0x294], eax
lea rdx, [rbx + rsi*2]
mov qword [rsp + 0x388], rdx
movsxd r8, edi
add r8, r8
mov qword [rsp + 0x390], r8
je 0x14003f6b8
test rdx, rdx
jne 0x14003f677
call fcn.1402312e4
mov dword [rax], 0x16
call fcn.140231194
jmp 0x14003f6b8
add rax, rax
cmp rax, r8
jae 0x14003f691
call fcn.1402312e4
mov dword [rax], 0x22
call fcn.140231194
jmp 0x14003f6b8
mov rcx, rbx
call fcn.14022e750
jmp 0x14003f6b8
mov dword [rsp + 0x298], eax
mov rdx, rax
mov r9d, edi
lea r8, [rsp + 0x880]
mov rcx, rbx
call fcn.140002c18
cmp edi, dword [rbx - 0xc]
jg 0x14003fcd5
mov dword [rbx - 0x10], edi
movsxd rax, edi
xor esi, esi
mov word [rbx + rax*2], si
mov rax, r14
lea r15, str.Intel_R__Advanced_Network_Services_Virtual_Adapter
nop word [rax + rax]
movzx ecx, word [rbx + rax*2 + 2]
cmp cx, word [r15 + rax*2 + 2]
jne 0x14003f706
add rax, 2
cmp rax, 0x33
je 0x14003f8a5
movzx ecx, word [rbx + rax*2]
cmp cx, word [r15 + rax*2]
je 0x14003f6e0
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x2d8], rbx
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x14003f774
mov rdx, qword [rsp + 0x2d8]
mov rcx, qword [rdx]
mov qword [rsp + 0x398], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14003fccd
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x3a0], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, vtable.ATL::CWin32Heap.0
cmp rax, r9
jne 0x14003fccd
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [rsp + 0x40]
lea rcx, [rsp + 0x678]
call fcn.140009824
nop
lea rcx, [rsp + 0x570]
call fcn.140009824
nop
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rsp + rcx + 0x17c], edx
lea rcx, [rsp + 0x198]
call fcn.14001d050
nop
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea eax, [rcx - 0x20]
mov dword [rsp + rcx + 0x17c], eax
mov rax, qword [rsp + 0x190]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x190], rax
mov rax, qword [rsp + 0x190]
movsxd rcx, dword [rax + 4]
lea eax, [rcx - 0x10]
mov dword [rsp + rcx + 0x18c], eax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea eax, [rcx - 0x18]
mov dword [rsp + rcx + 0x17c], eax
lea rax, vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + 0x218], rax
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x218], rax
lea rcx, [rsp + 0x218]
call fcn.14022c744
nop
inc dword [rsp + 0x60]
lea r15, vtable.srl::Value.0
jmp 0x14003ee7c
mov dword [rsp + 0x80], 0x7d0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xac]
xor r8d, r8d
lea rdx, str.DriverVersion
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x29c], eax
test eax, eax
jne 0x14003f924
mov eax, dword [rsp + 0xac]
dec eax
cmp eax, 1
ja 0x14003f924
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x14003f998
test al, 1
jne 0x14003f924
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003f9a0
lea r12, vtable.srl::GroupID.0
lea r15, vtable.srl::Value.0
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x2d0], rbx
lock xadd dword [rbx + 0x10], r14d
sub r14d, 1
jg 0x14003fa50
mov rdx, qword [rsp + 0x2d0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14003fcc4
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, vtable.ATL::CWin32Heap.0
cmp rax, r9
jne 0x14003fcc4
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14003fa50
mov word [rsp + 0x880], si
lea r15, vtable.srl::Value.0
mov qword [rsp + 0x100], r15
mov qword [rsp + 0x100], r12
lea rcx, [rsp + 0x108]
call fcn.1400154a0
lea rcx, [rsp + 0x880]
mov rax, r14
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003f9d0
mov dword [rsp + 0x2a0], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x108]
call fcn.140002a7c
nop
mov edx, 0x116ca
lea rcx, [rsp + 0x7e8]
call fcn.140023a00
nop
xor r9d, r9d
lea r8, [rsp + 0x100]
mov rdx, rax
call fcn.140058450
nop
lea r12, vtable.srl::GroupID.0
mov qword [rsp + 0x7e8], r12
lea rcx, [rsp + 0x7f0]
call fcn.140009824
nop
lea rcx, [rsp + 0x100]
call fcn.140053a80
jmp 0x14003f932
lea rcx, [rsp + 0x678]
call fcn.140009824
nop
lea rcx, [rsp + 0x570]
call fcn.140009824
nop
lea rcx, [rsp + 0x180]
call fcn.14001b430
jmp 0x14003fab2
lea rcx, [rsp + 0x678]
call fcn.140009824
nop
lea rcx, [rsp + 0x570]
call fcn.140009824
nop
lea rcx, [rsp + 0x180]
call fcn.14001b430
lea r15, vtable.srl::Value.0
lea r12, vtable.srl::GroupID.0
mov r9d, 0x20019
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_SettingsZoneMapDomains_newcorp.com
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0x48]
call fcn.14003d370
test eax, eax
jne 0x14003fc0e
mov dword [rsp + 0xb4], esi
mov dword [rsp + 0xb0], 4
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb4]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb8]
xor r8d, r8d
lea rdx, str.http
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003fba0
cmp dword [rsp + 0xb8], 4
jne 0x14003fba0
mov qword [rsp + 0x148], r15
lea rbx, vtable.srl::Exists.0
mov qword [rsp + 0x148], rbx
mov byte [rsp + 0x150], 1
mov edx, 0x11734
lea rcx, [rsp + 0x818]
call fcn.140023a00
nop
xor r9d, r9d
lea r8, [rsp + 0x148]
mov rdx, rax
call fcn.140058450
nop
mov qword [rsp + 0x818], r12
lea rcx, [rsp + 0x820]
call fcn.140009824
nop
mov qword [rsp + 0x148], rbx
mov qword [rsp + 0x148], r15
jmp 0x14003fc13
mov qword [rsp + 0x158], r15
lea rbx, vtable.srl::Exists.0
mov qword [rsp + 0x158], rbx
mov byte [rsp + 0x160], 0
mov edx, 0x11734
lea rcx, [rsp + 0x848]
call fcn.140023a00
nop
xor r9d, r9d
lea r8, [rsp + 0x158]
mov rdx, rax
call fcn.140058450
nop
mov qword [rsp + 0x848], r12
lea rcx, [rsp + 0x850]
call fcn.140009824
nop
mov qword [rsp + 0x158], rbx
mov qword [rsp + 0x158], r15
jmp 0x14003fc13
mov rdi, qword [rsp + 0x48]
test rdi, rdi
je 0x14003fc26
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
lea rcx, [rsp + 0x650]
call fcn.140019fe0
mov al, 1
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.140229da0
lea r11, [rsp + 0x1060]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call r8
nop
jmp 0x14003e66d
mov ecx, 0x80004005
call fcn.140002d3c
call rdx
mov rbx, rax
jmp 0x14003f45e
mov ecx, 0x80070057
call fcn.140002d3c
call r8
nop
jmp 0x14003f587
call rdx
mov rbx, rax
mov qword [rsp + 0x370], rax
add rbx, 0x18
mov qword [rsp + 0x90], rbx
jmp 0x14003f6cd
mov ecx, 0x80070057
call fcn.140002d3c
nop
call r8
nop
jmp 0x14003fa50
call r8
jmp 0x14003f774
mov ecx, 0x80070057
call fcn.140002d3c
int3