Function at 0x140009ce4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x388]
sub rsp, 0x480
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x370], rax
lea rax, [rsp + 0x50]
xor r14d, r14d
mov r9d, 0x20019
mov qword [rsp + 0x50], r14
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionSetupWindowsFeaturesWindowsMediaVersion
mov rcx, 0xffffffff80000002
mov edi, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140009f92
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r14
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x14003fa00]
mov dword [rsp + 0x48], 3
mov dword [rsp + 0x4c], 8
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140009f87
cmp dword [rsp + 0x48], 3
jne 0x140009f87
mov r8d, 0x105
lea rdx, [rbp + 0x160]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140009f87
lea rcx, [rbp + 0x160]
call fcn.1400182b8
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.140016f30
test eax, eax
js 0x140009f87
movzx eax, word [rsp + 0x40]
lea rcx, [rsp + 0x60]
mov esi, dword [rsp + 0x40]
mov ebx, r14d
and rsi, 0xffffffffffff0000
mov dword [rsp + 0x30], r14d
or rsi, rax
mov dword [rsp + 0x34], r14d
mov eax, dword [rsp + 0x44]
shr rax, 0x10
shl rsi, 0x10
or rsi, rax
mov dword [rsp + 0x38], r14d
movzx eax, word [rsp + 0x44]
shl rsi, 0x10
or rsi, rax
mov dword [rsp + 0x3c], r14d
jmp 0x140009e3f
add ebx, edi
lea rcx, [rax + 2]
mov edx, 0x2e
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
jne 0x140009e39
mov ecx, ebx
sub ecx, edi
je 0x140009f23
sub ecx, edi
je 0x140009efb
cmp ecx, edi
lea rcx, [rsp + 0x60]
je 0x140009ece
test ebx, ebx
je 0x140009e83
call qword [sym.imp.msvcrt.dll__wtoi]
mov dword [rsp + 0x38], eax
jmp 0x140009f3f
add ebx, edi
lea rcx, [rax + 2]
mov edx, 0x2c
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
jne 0x140009e7d
lea rcx, [rsp + 0x60]
sub ebx, edi
je 0x140009ec5
sub ebx, edi
je 0x140009ebc
cmp ebx, edi
je 0x140009eb3
call qword [sym.imp.msvcrt.dll__wtoi]
mov dword [rsp + 0x30], eax
jmp 0x140009f3f
lea rdx, str._lu__lu__lu__lu
jmp 0x140009ed5
lea rdx, str._lu__lu__lu
jmp 0x140009f07
lea rdx, str._lu__lu
jmp 0x140009f2f
lea rdx, str._lu._lu._lu._lu
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x30]
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll_swscanf]
jmp 0x140009f3f
lea rdx, str._lu._lu._lu
lea rcx, [rsp + 0x60]
lea rax, [rsp + 0x38]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
call qword [sym.imp.msvcrt.dll_swscanf]
jmp 0x140009f3f
lea rdx, str._lu._lu
lea rcx, [rsp + 0x60]
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x30]
call qword [sym.imp.msvcrt.dll_swscanf]
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
mov edx, dword [rsp + 0x3c]
shl eax, 0x10
add ecx, eax
mov eax, dword [rsp + 0x38]
shl eax, 0x10
add edx, eax
mov r8d, ecx
and r8, 0xffffffffffff0000
movzx eax, cx
or r8, rax
movzx ecx, dx
shl r8, 0x10
mov eax, edx
shr rax, 0x10
or r8, rax
shl r8, 0x10
or r8, rcx
cmp r8, rsi
cmovb edi, r14d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.14003c810
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret