Function at 0x1401ad330
Capabilities:
Get disk information
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2720]
mov eax, 0x2820
call fcn.140247340
sub rsp, rax
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x2860], rbx
mov rbx, rdx
mov r12, rcx
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x40]
call fcn.140249b10
xor r14d, r14d
mov qword [rsp + 0x50], r14
lea r8, [rsp + 0x50]
lea rdx, str.SOFTWAREClassesCLSIDFFFFFF0C_082A_4800_8502_1DD45C20036A
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea rsi, [r14 - 1]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1401ad3dc
mov dword [rsp + 0x58], 0x104
lea r9, [rsp + 0x58]
lea r8, [rbp + 0x40]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov eax, dword [rsp + 0x58]
mov byte [rbp + rax + 0x40], r14b
jmp 0x1401ad465
lea r8, [rsp + 0x50]
lea rdx, str.SOFTWAREClassesCLSIDFFFFFF0C_082A_4800_8502_1DD45C20036A
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.RPCRT4.dll_UuidCreate]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x70]
call qword [sym.imp.RPCRT4.dll_UuidToStringA]
mov r8, qword [rsp + 0x60]
mov edx, 0x104
lea rcx, [rbp + 0x40]
call fcn.140253604
lea rcx, [rsp + 0x60]
call qword [sym.imp.RPCRT4.dll_RpcStringFreeA]
lea rcx, [rbp + 0x40]
mov rax, rsi
inc rax
cmp byte [rcx + rax], r14b
jne 0x1401ad441
inc eax
mov dword [rsp + 0x20], eax
lea r9, [rbp + 0x40]
xor edx, edx
lea r8d, [rdx + 1]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov dword [rsp + 0x58], r14d
mov dword [rsp + 0x60], r14d
mov dword [rsp + 0x50], r14d
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0x370]
call fcn.140249b10
mov r8d, 0x410
lea rdx, [rbp + 0x370]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rbp + 0x370]
call qword [sym.imp.SHLWAPI.dll_PathStripToRootA]
mov dword [rsp + 0x38], r14d
mov qword [rsp + 0x30], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x370]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x1401ad559
mov edi, dword [rsp + 0x58]
mov ebx, edi
shr ebx, 0x10
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x150]
call fcn.140249b10
add di, bx
movzx r9d, di
lea r8, str._08X
mov edx, 0x100
lea rcx, [rbp + 0x150]
call fcn.14000b150
lea rdx, [rbp + 0x154]
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov rbx, qword [rbp + 0x2768]
jmp 0x1401ad56b
lea rdx, str.6963
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, 0x20
lea rcx, [rsp + 0x70]
call fcn.140250f88
mov edi, r14d
lea rax, [rsp + 0x70]
mov rdx, rsi
inc rdx
cmp byte [rax + rdx], dil
jne 0x1401ad585
mov r9d, r14d
mov dword [rbp - 0x68], 1
mov dword [rbp - 0x64], reloc.OLEAUT32.dll_SafeArrayGetDim
mov dword [rbp - 0x60], 0x100
mov dword [rbp - 0x5c], 0x1000
mov dword [rbp - 0x58], 0x10000
mov dword [rbp - 0x54], 0x100000
mov dword [rbp - 0x50], 0x1000000
mov dword [rbp - 0x4c], 0x10000000
nop dword [rax]
mov eax, r9d
movzx ecx, byte [rsp + rax + 0x70]
lea eax, [rcx - 0x30]
cmp al, 9
jbe 0x1401ad5fb
lea eax, [rcx - 0x41]
cmp al, 5
ja 0x1401ad5eb
lea eax, [rcx - 0x37]
jmp 0x1401ad5fb
lea eax, [rcx - 0x61]
cmp al, 5
ja 0x1401ad5f7
lea eax, [rcx - 0x57]
jmp 0x1401ad5fb
movzx eax, sil
lea r8d, [rdx - 1]
mov ecx, r8d
movsx edx, al
mov eax, dword [rbp + r8*4 - 0x68]
imul eax, edx
add edi, eax
inc r9d
mov edx, r8d
test r8d, r8d
jne 0x1401ad5d0
mov r15, r14
mov r8, rsi
inc r8
cmp byte [rbx + r8], r14b
jne 0x1401ad620
lea r9, [rsp + 0x50]
mov rdx, rbx
mov rcx, r12
call fcn.1401ac8c0
mov r13, rax
test rax, rax
je 0x1401ad719
movsxd r12, dword [rsp + 0x50]
mov rcx, r12
shl rcx, 2
cmp rcx, 0x7fffffff
jg 0x1401adb05
movabs rax, 0x5555555555555556
imul rcx
mov r8, rdx
shr r8, 0x3f
add r8, rdx
mov eax, 0x55555556
imul r12d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
mov ecx, r12d
sub ecx, eax
add r8d, ecx
mov eax, 0x6bca1af3
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x4c
mov ecx, r8d
sub ecx, eax
je 0x1401ad6c8
and ecx, 0x80000003
jge 0x1401ad6ba
dec ecx
or ecx, 0xfffffffc
inc ecx
test ecx, ecx
je 0x1401ad6c8
mov eax, 4
sub eax, ecx
add r8d, eax
mov dword [rsp + 0x50], r8d
lea eax, [r8 + 1]
mov ebx, eax
mov ecx, eax
call fcn.140247068
mov r15, rax
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.140249b10
mov dword [rsp + 0x20], 2
lea r9, [rsp + 0x50]
mov r8, r15
mov edx, r12d
mov rcx, r13
call fcn.14000a430
mov edx, 1
mov rcx, r13
call fcn.140247060
mov rbx, qword [rbp + 0x2768]
mov rax, qword [rbp + 0x2778]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], edi
mov rax, qword [rbp + 0x2770]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9, rbx
lea r8, str._EntitlementKeyType_:_CustomerEmail___EntitlementKeyValue_:__s___EntitlementKeyHash_:__s___ProductId_:__s___MachineId_:__u___DeviceId_:__s___TenantAlias_:__s_
mov edx, 0x1fa0
lea rcx, [rbp + 0x780]
call fcn.14000b150
lea rax, [rbp + 0x780]
mov r9, rsi
nop dword [rax + rax]
inc r9
cmp byte [rax + r9], r14b
jne 0x1401ad770
lea r8, str.Content_Type:_application_json__charsetutf_8_r_nContent_Length:__u
mov edx, 0x104
lea rcx, [rbp + 0x260]
call fcn.14000b150
test r15, r15
je 0x1401ad7a3
mov edx, 1
mov rcx, r15
call fcn.140247060
lea rax, vtable.CSABInternet.0
mov qword [rbp - 0x40], rax
lea rax, vtable.CSABByteString.0
mov qword [rbp - 0x20], rax
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp - 0x18], r14
mov ecx, 1
call fcn.140247068
mov rbx, rax
mov rdx, qword [rbp - 0x18]
test rdx, rdx
je 0x1401ad7f8
mov r8, qword [rbp - 8]
inc r8
mov rcx, rax
call fcn.1402496a0
mov edx, 1
mov rcx, qword [rbp - 0x18]
call fcn.140247060
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], 1
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.14000af20
nop
mov dword [rbp], r14d
mov qword [rbp - 0x28], r14
mov ecx, VariantTimeToDosDateTime
call fcn.140247068
mov qword [rbp - 0x38], rax
lea r8, str.SUPERSetup
mov edx, VariantTimeToDosDateTime
mov rcx, rax
call fcn.140253604
mov dword [rbp - 0x30], 1
lea rax, vtable.CSABInternet_TryAll.0
mov qword [rbp - 0x40], rax
mov qword [rbp + 8], r14
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r14
mov dword [rbp + 0x28], r14d
lea rax, [rbp + 0x260]
nop word [rax + rax]
inc rsi
cmp byte [rax + rsi], 0
jne 0x1401ad870
lea rdi, [rsi + 1]
cmp rdi, qword [rbp - 0x10]
jbe 0x1401ad8be
mov rcx, rdi
call fcn.140247068
mov rbx, rax
mov rdx, qword [rbp - 0x18]
test rdx, rdx
je 0x1401ad8b4
mov r8, qword [rbp - 8]
inc r8
mov rcx, rax
call fcn.1402496a0
mov edx, 1
mov rcx, qword [rbp - 0x18]
call fcn.140247060
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rdi
jmp 0x1401ad8c2
mov rbx, qword [rbp - 0x18]
mov byte [rbx], 0
test rsi, rsi
je 0x1401ad8e1
mov r9, rsi
lea r8, [rbp + 0x260]
mov rdx, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
call fcn.140250550
mov qword [rbp - 8], rsi
mov dword [rsp + 0x40], 1
lea rax, [rbp + 0x780]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xffffffff
lea r9, str._client_registration_Json_ActivateSoftware
mov r8d, 1
lea rdx, str.b2c.support.com
lea rcx, [rbp - 0x40]
call fcn.1400e6ad0
test eax, eax
je 0x1401adade
mov byte [rbp + 0x780], 0
mov r9d, dword [rsp + 0x68]
mov r8, qword [rbp - 0x70]
mov edx, 0x1fa0
lea rcx, [rbp + 0x780]
call fcn.140250550
mov rcx, qword [rbp - 0x70]
call fcn.140247060
mov rsi, qword [rbp + 0x2780]
test rsi, rsi
je 0x1401ad9fc
lea rdx, str._Status_:
lea rcx, [rbp + 0x780]
call fcn.140248db4
mov rbx, rax
test rax, rax
je 0x1401ad9fc
add rbx, 9
lea rdx, [0x140299a54]
mov rcx, rbx
call fcn.140248db4
mov rdi, rax
test rax, rax
jne 0x1401ad9c0
lea rdx, [0x14028a83c]
mov rcx, rbx
call fcn.140248db4
mov rdi, rax
test rax, rax
je 0x1401ad9fc
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x150]
call fcn.140249b10
sub rdi, rbx
mov r9, rdi
mov r8, rbx
mov edx, 0x104
lea rcx, [rbp + 0x150]
call fcn.140250550
lea rcx, [rbp + 0x150]
call fcn.1402520ac
mov dword [rsi], eax
lea rdx, str._Keys_:__
lea rcx, [rbp + 0x780]
call fcn.140248db4
mov rbx, rax
test rax, rax
je 0x1401adade
add rbx, 9
lea rdx, [0x14028b4b4]
mov rcx, rbx
call fcn.140248db4
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1401adade
sub rax, rbx
cmp rax, 0xc
jl 0x1401adade
mov r8d, r14d
mov r9d, r14d
mov edx, r14d
lea r10, [0x140000000]
nop dword [rax]
cmp edx, 0xc
jae 0x1401adab4
cmp edx, 0xb
ja case.default.0x1401ada77
mov eax, edx
mov ecx, dword [r10 + rax*4 + 0x1adb10]
add rcx, r10
jmp rcx
mov eax, edx
cmp byte [rax + rbx], 0x2d
je case.default.0x1401ada77
mov r8d, 1
jmp case.default.0x1401ada77
mov eax, edx
movzx ecx, byte [rax + rbx]
lea eax, [rcx - 0x30]
cmp al, 9
jbe 0x1401ada9e
mov r8d, 1
jmp 0x1401adaa8
mov eax, r9d
mov byte [rbp + rax + 0x780], cl
inc r9d
inc edx
test r8d, r8d
je 0x1401ada60
jmp 0x1401adade
test r8d, r8d
jne 0x1401adade
mov eax, r9d
mov byte [rbp + rax + 0x780], r8b
mov r8d, 0xa
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x780]
call fcn.140251de0
mov r14d, eax
lea rcx, [rbp - 0x40]
call fcn.1400e3a90
mov eax, r14d
mov rbx, qword [rsp + 0x2860]
add rsp, 0x2820
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140004cd0
int3