Function at 0x14003e460
Capabilities:
Query or enumerate registry value

Disassembly:
push r13
push r14
push r15
mov eax, 0x1060
call fcn.14022a310
sub rsp, rax
mov qword [rsp + 0x3a8], 0xfffffffffffffffe
mov qword [rsp + 0x1080], rbx
mov qword [rsp + 0x1088], rsi
mov qword [rsp + 0x1090], rdi
mov qword [rsp + 0x1098], r12
mov rax, qword [0x14035b8c0]
xor rax, rsp
mov qword [rsp + 0x1050], rax
xor esi, esi
mov dword [rsp + 0x40], esi
lea rcx, [rsp + 0x658]
call fcn.140009d24
nop
mov byte [rsp + 0x650], sil
lea r8d, [rsi + 0x15]
lea rdx, str.srl::Software::Detect
lea rcx, [rsp + 0x658]
call fcn.14000997c
nop
call fcn.140022280
cmp dword [rax + 8], 4
jl 0x14003e507
mov byte [rsp + 0x650], 1
lea rcx, [rsp + 0x650]
call fcn.1400183a0
nop
lea r15, vtable.srl::Value.0
mov qword [rsp + 0xc0], r15
lea rbx, vtable.srl::Version.0
mov qword [rsp + 0xc0], rbx
lea rcx, [rsp + 0xc8]
call fcn.1400152d0
mov r8d, 5
lea rdx, str.6.5.1
lea rcx, [rsp + 0xc8]
call fcn.1400029fc
nop
mov edx, 0x116b7
lea rcx, [rsp + 0x698]
call fcn.1400237b0
nop
xor r9d, r9d
lea r8, [rsp + 0xc0]
mov rdx, rax
call fcn.140058400
nop
lea rdi, vtable.srl::GroupID.0
mov qword [rsp + 0x698], rdi
lea rcx, [rsp + 0x6a0]
call fcn.140009568
nop
mov qword [rsp + 0xc0], rbx
mov rcx, qword [rsp + 0xc8]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x2b0], rcx
mov r14, 0xffffffffffffffff
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
lea r13, vtable.ATL::CAtlStringMgr.0
jg 0x14003e61d
mov rdx, qword [rsp + 0x2b0]
mov rcx, qword [rdx]
mov qword [rsp + 0x3b0], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14003fc1b
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x3b8], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea rbx, vtable.ATL::CWin32Heap.0
cmp rax, rbx
jne 0x14003fc1b
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0xc0], r15
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x58], rsi
mov r9d, 0x20019
lea r8, str.SoftwareIntelNetwork_ServicesDMIX
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003cf00
test eax, eax
jne 0x14003e839
mov dword [rsp + 0x64], 0x7d0
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd0]
xor r8d, r8d
lea rdx, str.OEMVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x304], eax
test eax, eax
jne 0x14003e6d0
mov eax, dword [rsp + 0xd0]
dec eax
cmp eax, 1
ja 0x14003e6d0
mov eax, dword [rsp + 0x64]
test eax, eax
je 0x14003e785
test al, 1
jne 0x14003e6d0
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003e78d
lea r12, vtable.srl::Name.0
mov r9d, 0x20019
lea r8, str.SoftwareIntelWirelessCommonAppFrameworkSettings
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003cf00
test eax, eax
jne 0x14003ea34
mov dword [rsp + 0x6c], 0x7d0
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x98]
xor r8d, r8d
lea rdx, str.PROSetVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x2f0], eax
test eax, eax
jne 0x14003ee24
mov eax, dword [rsp + 0x98]
dec eax
cmp eax, 1
ja 0x14003ee24
mov eax, dword [rsp + 0x6c]
test eax, eax
je 0x14003e98f
test al, 1
jne 0x14003ee24
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003e997
jmp 0x14003ee24
mov word [rsp + 0x880], si
mov qword [rsp + 0xf0], r15
lea r12, vtable.srl::Name.0
mov qword [rsp + 0xf0], r12
lea rcx, [rsp + 0xf8]
call fcn.1400152d0
lea rcx, [rsp + 0x880]
mov rax, r14
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003e7c0
mov dword [rsp + 0x300], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0xf8]
call fcn.1400029fc
nop
mov edx, 0x116d1
lea rcx, [rsp + 0x6c8]
call fcn.1400237b0
nop
xor r9d, r9d
lea r8, [rsp + 0xf0]
mov rdx, rax
call fcn.140058400
nop
mov qword [rsp + 0x6c8], rdi
lea rcx, [rsp + 0x6d0]
call fcn.140009568
nop
lea rcx, [rsp + 0xf0]
call fcn.140053a30
jmp 0x14003e6d7
mov r9d, 0x20119
lea r8, str.SoftwareIntelNetwork_ServicesDMIX
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003cf00
test eax, eax
jne 0x14003e6d0
mov dword [rsp + 0x68], 0x7d0
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd4]
xor r8d, r8d
lea rdx, str.OEMVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x2fc], eax
test eax, eax
jne 0x14003e6d0
mov eax, dword [rsp + 0xd4]
dec eax
cmp eax, 1
ja 0x14003e6d0
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x14003e8df
test al, 1
jne 0x14003e6d0
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003e8e7
jmp 0x14003e6d0
mov word [rsp + 0x880], si
mov qword [rsp + 0xe0], r15
lea r12, vtable.srl::Name.0
mov qword [rsp + 0xe0], r12
lea rcx, [rsp + 0xe8]
call fcn.1400152d0
lea rcx, [rsp + 0x880]
mov rax, r14
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003e916
mov dword [rsp + 0x2f8], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0xe8]
call fcn.1400029fc
nop
mov edx, 0x116d1
lea rcx, [rsp + 0x6f8]
call fcn.1400237b0
nop
xor r9d, r9d
lea r8, [rsp + 0xe0]
mov rdx, rax
call fcn.140058400
nop
mov qword [rsp + 0x6f8], rdi
lea rcx, [rsp + 0x700]
call fcn.140009568
nop
lea rcx, [rsp + 0xe0]
call fcn.140053a30
jmp 0x14003e6d7
mov word [rsp + 0x880], si
mov qword [rsp + 0x110], r15
mov qword [rsp + 0x110], r12
lea rcx, [rsp + 0x118]
call fcn.1400152d0
lea rcx, [rsp + 0x880]
mov rax, r14
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003e9c0
mov dword [rsp + 0x2ec], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x118]
call fcn.1400029fc
nop
mov edx, 0x116c9
lea rcx, [rsp + 0x728]
call fcn.1400237b0
nop
xor r9d, r9d
lea r8, [rsp + 0x110]
mov rdx, rax
call fcn.140058400
nop
mov qword [rsp + 0x728], rdi
lea rcx, [rsp + 0x730]
call fcn.140009568
nop
lea rcx, [rsp + 0x110]
jmp 0x14003ee1f
mov r9d, 0x20019
lea r8, str.SoftwareIntelWirelessAppFrameworkSettings
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003cf00
test eax, eax
jne 0x14003eb84
mov dword [rsp + 0x70], 0x7d0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x9c]
xor r8d, r8d
lea rdx, str.PROSetVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x2e8], eax
test eax, eax
jne 0x14003ee24
mov eax, dword [rsp + 0x9c]
dec eax
cmp eax, 1
ja 0x14003ee24
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x14003eada
test al, 1
jne 0x14003ee24
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003eae2
jmp 0x14003ee24
mov word [rsp + 0x880], si
mov qword [rsp + 0x168], r15
mov qword [rsp + 0x168], r12
lea rcx, [rsp + 0x170]
call fcn.1400152d0
lea rcx, [rsp + 0x880]
mov rax, r14
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003eb10
mov dword [rsp + 0x2c0], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x170]
call fcn.1400029fc
nop
mov edx, 0x116c9
lea rcx, [rsp + 0x758]
call fcn.1400237b0
nop
xor r9d, r9d
lea r8, [rsp + 0x168]
mov rdx, rax
call fcn.140058400
nop
mov qword [rsp + 0x758], rdi
lea rcx, [rsp + 0x760]
call fcn.140009568
nop
lea rcx, [rsp + 0x168]
jmp 0x14003ee1f
mov r9d, 0x20119
lea r8, str.SoftwareIntelWirelessCommonAppFrameworkSettings
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003cf00
test eax, eax
jne 0x14003ecd4
mov dword [rsp + 0x74], 0x7d0
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa0]
xor r8d, r8d
lea rdx, str.PROSetVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x2ac], eax
test eax, eax
jne 0x14003ee24
mov eax, dword [rsp + 0xa0]
dec eax
cmp eax, 1
ja 0x14003ee24
mov eax, dword [rsp + 0x74]
test eax, eax
je 0x14003ec2a
test al, 1
jne 0x14003ee24
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003ec32
jmp 0x14003ee24
mov word [rsp + 0x880], si
mov qword [rsp + 0x138], r15
mov qword [rsp + 0x138], r12
lea rcx, [rsp + 0x140]
call fcn.1400152d0
lea rcx, [rsp + 0x880]
mov rax, r14
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003ec60
mov dword [rsp + 0x2a8], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x140]
call fcn.1400029fc
nop
mov edx, 0x116c9
lea rcx, [rsp + 0x788]
call fcn.1400237b0
nop
xor r9d, r9d
lea r8, [rsp + 0x138]
mov rdx, rax
call fcn.140058400
nop
mov qword [rsp + 0x788], rdi
lea rcx, [rsp + 0x790]
call fcn.140009568
nop
lea rcx, [rsp + 0x138]
jmp 0x14003ee1f
mov r9d, 0x20119
lea r8, str.SoftwareIntelWirelessAppFrameworkSettings
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.14003cf00
test eax, eax
jne 0x14003ee24
mov dword [rsp + 0x78], 0x7d0
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa4]
xor r8d, r8d
lea rdx, str.PROSetVersion
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x2a4], eax
test eax, eax
jne 0x14003ee24
mov eax, dword [rsp + 0xa4]
dec eax
cmp eax, 1
ja 0x14003ee24
mov eax, dword [rsp + 0x78]
test eax, eax
je 0x14003ed7a
test al, 1
jne 0x14003ee24
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003ed82
jmp 0x14003ee24
mov word [rsp + 0x880], si
mov qword [rsp + 0x128], r15
mov qword [rsp + 0x128], r12
lea rcx, [rsp + 0x130]
call fcn.1400152d0
lea rcx, [rsp + 0x880]
mov rax, r14
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003edb0
mov dword [rsp + 0x2f4], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x130]
call fcn.1400029fc
nop
mov edx, 0x116c9
lea rcx, [rsp + 0x7b8]
call fcn.1400237b0
nop
xor r9d, r9d
lea r8, [rsp + 0x128]
mov rdx, rax
call fcn.140058400
nop
mov qword [rsp + 0x7b8], rdi
lea rcx, [rsp + 0x7c0]
call fcn.140009568
nop
lea rcx, [rsp + 0x128]
call fcn.140053a30
mov dword [rsp + 0x60], esi
mov edi, dword [rsp + 0x40]
lea r8, vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
lea rcx, vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
lea rdx, vtable.std::ios_base.0
lea r10, [0x1402efdd0]
lea r9, [0x1402efdd8]
mov ebx, dword [rsp + 0x60]
cmp ebx, 0x64
jae 0x14003fa5b
mov qword [rsp + 0x180], r9
mov qword [rsp + 0x190], r10
mov qword [rsp + 0x218], rdx
mov qword [rsp + 0x218], rcx
or edi, 1
mov dword [rsp + 0x40], edi
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x180], r8
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x18]
mov dword [rsp + rcx + 0x17c], edx
mov qword [rsp + 0x188], rsi
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x180]
add rcx, rax
lea rdx, [rsp + 0x198]
call fcn.14001c250
nop
lea rax, [rsp + 0x190]
mov qword [rsp + 0x3c0], rax
mov rax, qword [rsp + 0x190]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x190], rax
mov rax, qword [rsp + 0x190]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x18c], edx
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x20]
mov dword [rsp + rcx + 0x17c], edx
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rsp + rcx + 0x17c], edx
lea rax, [rsp + 0x198]
mov qword [rsp + 0x3c8], rax
lea rcx, [rsp + 0x198]
call fcn.14001c140
nop
lea rax, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rsp + 0x198], rax
mov qword [rsp + 0x200], rsi
mov dword [rsp + 0x308], esi
mov dword [rsp + 0x208], esi
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x1a8], 4
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
mov eax, 0x30
mov word [rsp + rcx + 0x1d8], ax
mov edx, ebx
lea rcx, [rsp + 0x190]
call fcn.14001b6b0
lea rcx, [rsp + 0x570]
call fcn.140009d24
nop
mov r8d, 0x4e
lea rdx, str.systemCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318_
lea rcx, [rsp + 0x570]
call fcn.14000997c
nop
lea rcx, [rsp + 0x5b0]
call fcn.140006790
mov qword [rsp + 0x5c0], rsi
mov qword [rsp + 0x5c8], 7
mov word [rsp + 0x5b0], si
or edi, 0x20
mov dword [rsp + 0x40], edi
mov edx, dword [rsp + 0x208]
test dl, 2
jne 0x14003f0df
mov rax, qword [rsp + 0x1d8]
mov rcx, qword [rax]
mov qword [rsp + 0x3d0], rcx
test rcx, rcx
je 0x14003f0df
mov rax, qword [rsp + 0x1b8]
mov rdx, qword [rax]
mov qword [rsp + 0x3d8], rdx
mov qword [rsp + 0x3e0], rcx
mov qword [rsp + 0x2b8], rcx
lea r8, [rsp + 0x200]
lea rax, [rsp + 0x2b8]
cmp rcx, qword [rsp + 0x200]
cmovae r8, rax
mov qword [rsp + 0x3e8], r8
mov r8, qword [r8]
sub r8, rdx
sar r8, 1
lea rcx, [rsp + 0x5b0]
call fcn.14000997c
jmp 0x14003f133
test dl, 4
jne 0x14003f133
mov rax, qword [rsp + 0x1d0]
mov rcx, qword [rax]
mov qword [rsp + 0x3f0], rcx
test rcx, rcx
je 0x14003f133
mov rax, qword [rsp + 0x1b0]
mov rdx, qword [rax]
mov qword [rsp + 0x3f8], rdx
mov rax, qword [rsp + 0x1e8]
movsxd r8, dword [rax]
add r8, r8
sub r8, rdx
add r8, rcx
sar r8, 1
lea rcx, [rsp + 0x5b0]
call fcn.14000997c
and edi, 0xffffffdf
mov dword [rsp + 0x40], edi
or edi, 0x10
mov dword [rsp + 0x40], edi
lea r9, [rsp + 0x5b0]
cmp qword [rsp + 0x5c8], 8
cmovae r9, qword [rsp + 0x5b0]
mov qword [rsp + 0x400], r9
mov rsi, qword [rsp + 0x5c0]
mov qword [rsp + 0x320], rsi
mov r15, qword [rsp + 0x580]
mov qword [rsp + 0x328], r15
mov rcx, qword [rsp + 0x588]
mov rax, rcx
sub rax, r15
cmp rsi, rax
ja 0x14003f1db
lea rax, [r15 + rsi]
mov qword [rsp + 0x580], rax
lea rbx, [rsp + 0x570]
cmp rcx, 8
cmovae rbx, qword [rsp + 0x570]
mov qword [rsp + 0x330], rbx
lea r8, [rsi + rsi]
lea rcx, [rbx + r15*2]
mov rdx, r9
call fcn.14022e100
lea rax, [r15 + rsi]
xor esi, esi
mov word [rbx + rax*2], si
jmp 0x14003f1f2
mov qword [rsp + 0x20], rsi
mov rdx, rsi
lea rcx, [rsp + 0x570]
call fcn.1400230d0
xor esi, esi
and edi, 0xffffffef
mov dword [rsp + 0x40], edi
lea rcx, [rsp + 0x5b0]
call fcn.140009568
lea rcx, [rsp + 0x678]
call fcn.140009d24
nop
lea rbx, [rsp + 0x570]
cmp qword [rsp + 0x588], 8
cmovae rbx, qword [rsp + 0x570]
mov qword [rsp + 0x338], rbx
mov qword [rsp + 0x88], rsi
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x14003f2db
cmp qword [rax], 0
je 0x14003f2c9
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x340], rax
test rax, rax
jne 0x14003f276
mov eax, 1
jmp 0x14003f301
lea rdx, str.RegOpenKeyTransactedW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x348], rax
test rax, rax
je 0x14003f2d4
mov qword [rsp + 0x30], rsi
mov rcx, qword [rsp + 0x58]
mov r8, qword [rcx]
mov qword [rsp + 0x28], r8
lea rcx, [rsp + 0x88]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call rax
jmp 0x14003f301
mov rax, qword [rsp + 0x58]
cmp dword [rax + 8], 0
jne 0x14003f2db
mov eax, 1
jmp 0x14003f301
lea rax, [rsp + 0x88]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x30c], eax
test eax, eax
jne 0x14003fa2b
mov eax, esi
mov dword [rsp + 0xa8], eax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14003f335
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0xa8], eax
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x50], esi
test eax, eax
jne 0x14003fa2b
mov dword [rsp + 0x7c], 0x7d0
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xd8]
xor r8d, r8d
lea rdx, str.DriverDesc
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x310], eax
test eax, eax
jne 0x14003f728
mov eax, dword [rsp + 0xd8]
dec eax
cmp eax, 1
ja 0x14003f728
mov eax, dword [rsp + 0x7c]
test eax, eax
je 0x14003f3cd
test al, 1
jne 0x14003f728
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003f3d5
jmp 0x14003f728
mov word [rsp + 0x880], si
call fcn.140011978
mov rcx, rax
mov qword [rsp + 0x318], rax
test rax, rax
je 0x14003fc24
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, r13
jne 0x14003fc2e
lock inc dword [rcx + 0x20]
mov rbx, qword [rsp + 0x318]
add rbx, 0x10
mov qword [rsp + 0x350], rbx
add rbx, 0x18
mov qword [rsp + 0x90], rbx
lea rax, [rsp + 0x880]
mov qword [rsp + 0x358], rax
lea rcx, [rsp + 0x880]
mov byte [rsp + 0x44], 0
lea rax, [rsp + 0x880]
cmp rax, 0x10000
jae 0x14003f478
movzx edx, cx
mov dword [rsp + 0x280], edx
lea rcx, [rsp + 0x90]
call fcn.140012160
mov byte [rsp + 0x44], 1
mov rbx, qword [rsp + 0x90]
jmp 0x14003f67d
lea rax, [rsp + 0x880]
mov rdi, r14
inc rdi
cmp word [rax + rdi*2], 0
jne 0x14003f483
mov dword [rsp + 0x284], edi
test edi, edi
jne 0x14003f578
lea rcx, [rbx - 0x18]
mov qword [rsp + 0x2c8], rcx
mov rax, qword [rcx]
mov qword [rsp + 0x120], rax
cmp dword [rcx + 8], edi
je 0x14003f67d
cmp dword [rcx + 0x10], edi
jge 0x14003f4d5
cmp dword [rbx - 0xc], edi
jl 0x14003fc38
mov dword [rbx - 0x10], esi
mov word [rbx], si
jmp 0x14003f67d
mov eax, r14d
lock xadd dword [rcx + 0x10], eax
sub eax, 1
jg 0x14003f537
mov rdx, qword [rsp + 0x2c8]
mov rcx, qword [rdx]
mov qword [rsp + 0x360], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14003fc42
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x368], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, vtable.ATL::CWin32Heap.0
cmp rax, r9
jne 0x14003fc42
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x120]
mov rax, qword [rcx]
mov rdx, qword [rax + 0x18]
cmp rax, r13
jne 0x14003fc4b
lock inc dword [rcx + 0x20]
mov rbx, qword [rsp + 0x120]
add rbx, 0x10
mov qword [rsp + 0x370], rbx
add rbx, 0x18
mov qword [rsp + 0x90], rbx
jmp 0x14003f67d
mov r15d, dword [rbx - 0x10]
mov dword [rsp + 0x288], r15d
lea rsi, [rsp + 0x880]
sub rsi, rbx
sar rsi, 1
mov qword [rsp + 0x378], rsi
test edi, edi
js 0x14003fc69
lea rax, [rbx - 0x18]
mov qword [rsp + 0x380], rax
mov ecx, 1
sub ecx, dword [rax + 0x10]
mov dword [rsp + 0x28c], ecx
mov eax, dword [rax + 0xc]
sub eax, edi
mov dword [rsp + 0x290], eax
or eax, ecx
jge 0x14003f5e4
mov edx, edi
lea rcx, [rsp + 0x90]
call fcn.14000299c
mov rbx, qword [rsp + 0x90]
movsxd rax, dword [rbx - 0xc]
cmp rsi, r15
ja 0x14003f64b
mov dword [rsp + 0x294], eax
lea rdx, [rbx + rsi*2]
mov qword [rsp + 0x388], rdx
movsxd r8, edi
add r8, r8
mov qword [rsp + 0x390], r8
je 0x14003f668
test rdx, rdx
jne 0x14003f627
call fcn.140230c94
mov dword [rax], 0x16
call fcn.140230b44
jmp 0x14003f668
add rax, rax
cmp rax, r8
jae 0x14003f641
call fcn.140230c94
mov dword [rax], 0x22
call fcn.140230b44
jmp 0x14003f668
mov rcx, rbx
call fcn.14022e100
jmp 0x14003f668
mov dword [rsp + 0x298], eax
mov rdx, rax
mov r9d, edi
lea r8, [rsp + 0x880]
mov rcx, rbx
call fcn.140002b98
cmp edi, dword [rbx - 0xc]
jg 0x14003fc85
mov dword [rbx - 0x10], edi
movsxd rax, edi
xor esi, esi
mov word [rbx + rax*2], si
mov rax, r14
lea r15, str.Intel_R__Advanced_Network_Services_Virtual_Adapter
nop word [rax + rax]
movzx ecx, word [rbx + rax*2 + 2]
cmp cx, word [r15 + rax*2 + 2]
jne 0x14003f6b6
add rax, 2
cmp rax, 0x33
je 0x14003f855
movzx ecx, word [rbx + rax*2]
cmp cx, word [r15 + rax*2]
je 0x14003f690
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x2d8], rbx
mov eax, r14d
lock xadd dword [rbx + 0x10], eax
sub eax, 1
jg 0x14003f724
mov rdx, qword [rsp + 0x2d8]
mov rcx, qword [rdx]
mov qword [rsp + 0x398], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14003fc7d
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x3a0], rcx
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, vtable.ATL::CWin32Heap.0
cmp rax, r9
jne 0x14003fc7d
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov edi, dword [rsp + 0x40]
lea rcx, [rsp + 0x678]
call fcn.140009568
nop
lea rcx, [rsp + 0x570]
call fcn.140009568
nop
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rsp + rcx + 0x17c], edx
lea rcx, [rsp + 0x198]
call fcn.14001ce00
nop
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea eax, [rcx - 0x20]
mov dword [rsp + rcx + 0x17c], eax
mov rax, qword [rsp + 0x190]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x190], rax
mov rax, qword [rsp + 0x190]
movsxd rcx, dword [rax + 4]
lea eax, [rcx - 0x10]
mov dword [rsp + rcx + 0x18c], eax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_istream_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + rcx + 0x180], rax
mov rax, qword [rsp + 0x180]
movsxd rcx, dword [rax + 4]
lea eax, [rcx - 0x18]
mov dword [rsp + rcx + 0x17c], eax
lea rax, vtable.std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__.0
mov qword [rsp + 0x218], rax
lea rax, vtable.std::ios_base.0
mov qword [rsp + 0x218], rax
lea rcx, [rsp + 0x218]
call fcn.14022c0f4
nop
inc dword [rsp + 0x60]
lea r15, vtable.srl::Value.0
jmp 0x14003ee2c
mov dword [rsp + 0x80], 0x7d0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x880]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xac]
xor r8d, r8d
lea rdx, str.DriverVersion
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x29c], eax
test eax, eax
jne 0x14003f8d4
mov eax, dword [rsp + 0xac]
dec eax
cmp eax, 1
ja 0x14003f8d4
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x14003f948
test al, 1
jne 0x14003f8d4
shr rax, 1
cmp word [rsp + rax*2 + 0x87e], 0
je 0x14003f950
lea r12, vtable.srl::GroupID.0
lea r15, vtable.srl::Value.0
add rbx, 0xffffffffffffffe8
mov qword [rsp + 0x2d0], rbx
lock xadd dword [rbx + 0x10], r14d
sub r14d, 1
jg 0x14003fa00
mov rdx, qword [rsp + 0x2d0]
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14003fc74
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, vtable.ATL::CWin32Heap.0
cmp rax, r9
jne 0x14003fc74
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14003fa00
mov word [rsp + 0x880], si
lea r15, vtable.srl::Value.0
mov qword [rsp + 0x100], r15
mov qword [rsp + 0x100], r12
lea rcx, [rsp + 0x108]
call fcn.1400152d0
lea rcx, [rsp + 0x880]
mov rax, r14
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x14003f980
mov dword [rsp + 0x2a0], eax
mov r8d, eax
lea rdx, [rsp + 0x880]
lea rcx, [rsp + 0x108]
call fcn.1400029fc
nop
mov edx, 0x116ca
lea rcx, [rsp + 0x7e8]
call fcn.1400237b0
nop
xor r9d, r9d
lea r8, [rsp + 0x100]
mov rdx, rax
call fcn.140058400
nop
lea r12, vtable.srl::GroupID.0
mov qword [rsp + 0x7e8], r12
lea rcx, [rsp + 0x7f0]
call fcn.140009568
nop
lea rcx, [rsp + 0x100]
call fcn.140053a30
jmp 0x14003f8e2
lea rcx, [rsp + 0x678]
call fcn.140009568
nop
lea rcx, [rsp + 0x570]
call fcn.140009568
nop
lea rcx, [rsp + 0x180]
call fcn.14001b1e0
jmp 0x14003fa62
lea rcx, [rsp + 0x678]
call fcn.140009568
nop
lea rcx, [rsp + 0x570]
call fcn.140009568
nop
lea rcx, [rsp + 0x180]
call fcn.14001b1e0
lea r15, vtable.srl::Value.0
lea r12, vtable.srl::GroupID.0
mov r9d, 0x20019
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionInternet_SettingsZoneMapDomains_newcorp.com
mov rdx, 0xffffffff80000001
lea rcx, [rsp + 0x48]
call fcn.14003cf00
test eax, eax
jne 0x14003fbbe
mov dword [rsp + 0xb4], esi
mov dword [rsp + 0xb0], 4
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb4]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb8]
xor r8d, r8d
lea rdx, str.http
mov rdi, qword [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003fb50
cmp dword [rsp + 0xb8], 4
jne 0x14003fb50
mov qword [rsp + 0x148], r15
lea rbx, vtable.srl::Exists.0
mov qword [rsp + 0x148], rbx
mov byte [rsp + 0x150], 1
mov edx, 0x11734
lea rcx, [rsp + 0x818]
call fcn.1400237b0
nop
xor r9d, r9d
lea r8, [rsp + 0x148]
mov rdx, rax
call fcn.140058400
nop
mov qword [rsp + 0x818], r12
lea rcx, [rsp + 0x820]
call fcn.140009568
nop
mov qword [rsp + 0x148], rbx
mov qword [rsp + 0x148], r15
jmp 0x14003fbc3
mov qword [rsp + 0x158], r15
lea rbx, vtable.srl::Exists.0
mov qword [rsp + 0x158], rbx
mov byte [rsp + 0x160], 0
mov edx, 0x11734
lea rcx, [rsp + 0x848]
call fcn.1400237b0
nop
xor r9d, r9d
lea r8, [rsp + 0x158]
mov rdx, rax
call fcn.140058400
nop
mov qword [rsp + 0x848], r12
lea rcx, [rsp + 0x850]
call fcn.140009568
nop
mov qword [rsp + 0x158], rbx
mov qword [rsp + 0x158], r15
jmp 0x14003fbc3
mov rdi, qword [rsp + 0x48]
test rdi, rdi
je 0x14003fbd6
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
lea rcx, [rsp + 0x650]
call fcn.140019d90
mov al, 1
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.140229750
lea r11, [rsp + 0x1060]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
call r8
nop
jmp 0x14003e61d
mov ecx, 0x80004005
call fcn.140002cbc
call rdx
mov rbx, rax
jmp 0x14003f40e
mov ecx, 0x80070057
call fcn.140002cbc
call r8
nop
jmp 0x14003f537
call rdx
mov rbx, rax
mov qword [rsp + 0x370], rax
add rbx, 0x18
mov qword [rsp + 0x90], rbx
jmp 0x14003f67d
mov ecx, 0x80070057
call fcn.140002cbc
nop
call r8
nop
jmp 0x14003fa00
call r8
jmp 0x14003f724
mov ecx, 0x80070057
call fcn.140002cbc
int3