Function at 0x14004cdf0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0xb8]
sub rsp, 0x190
mov qword [rbp + 8], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x14035c8c0]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov rsi, rcx
mov byte [rbp - 0x80], 0
lea rcx, [rbp - 0x78]
call fcn.1400154a0
nop
lea rax, [0x1402f7e88]
lea rdx, [0x1402ef4b8]
cmp byte [rbp - 0x80], 0
cmovne rdx, rax
mov rdi, 0xffffffffffffffff
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14004ce60
mov r8d, eax
lea rcx, [rbp - 0x78]
call fcn.140002a7c
mov rbx, qword [rbp - 0x78]
mov r9, rbx
xor r8d, r8d
mov edx, 0x116f0
mov rcx, qword [rsi]
call fcn.14001fa50
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
lea r14, vtable.ATL::CAtlStringMgr.0
lea r15, vtable.ATL::CWin32Heap.0
sub eax, 1
jg 0x14004cee3
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004d5c1
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r15
jne 0x14004d5c1
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
xor r12d, r12d
mov qword [rsp + 0x68], r12
mov dword [rsp + 0x70], r12d
mov qword [rsp + 0x78], r12
mov r9d, 0x20019
lea r8, str.SOFTWAREMicrosoftInternet_Explorer
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x68]
call fcn.14003d370
mov rbx, qword [rsp + 0x68]
test eax, eax
jne 0x14004d578
mov dword [rsp + 0x30], 0x64
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, str.svcVersion
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004cf79
mov eax, dword [rsp + 0x58]
dec eax
cmp eax, 1
ja 0x14004cf79
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x14004cfe3
test al, 1
jne 0x14004cf79
shr rax, 1
cmp word [rbp + rax*2 + 0xe], r12w
je 0x14004cfe8
mov dword [rsp + 0x34], 0x64
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5c]
xor r8d, r8d
lea rdx, [0x1402f32b8]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004d578
mov eax, dword [rsp + 0x5c]
dec eax
cmp eax, 1
ja 0x14004d578
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x14004cfe3
test al, 1
jne 0x14004d578
shr rax, 1
cmp word [rbp + rax*2 + 0xe], 0
je 0x14004cfe8
jmp 0x14004d578
mov word [rbp + 0x10], r12w
lea rax, [rsp + 0x38]
mov qword [rbp - 0x70], rax
call fcn.140011b88
mov rcx, rax
test rax, rax
je 0x14004d5c9
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, r14
jne 0x14004d5d4
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x10]
cmp rax, 0x10000
jae 0x14004d042
lea rax, [rbp + 0x10]
movzx edx, ax
lea rcx, [rsp + 0x38]
call fcn.140012370
jmp 0x14004d06c
lea rcx, [rbp + 0x10]
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14004d050
mov r8d, eax
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x38]
call fcn.140002a7c
nop
lea rcx, [rsp + 0x40]
call fcn.1400154a0
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x40]
call fcn.140002b88
mov edx, 0x2c
lea rcx, [rsp + 0x40]
call fcn.14007bed0
mov r9, qword [rsp + 0x40]
xor r8d, r8d
mov edx, 0x1160c
mov rcx, qword [rsi]
call fcn.14001fa50
nop
lea rcx, [rsp + 0x38]
call fcn.14004a160
mov byte [rbp - 0x68], 1
lea rcx, [rbp - 0x60]
call fcn.1400154a0
nop
lea r9, [rbp - 0x68]
xor r8d, r8d
mov edx, 0x116f0
mov rcx, rsi
call fcn.140085fe0
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004d123
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004d5db
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r15
jne 0x14004d5db
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
call fcn.140011b88
mov rcx, rax
test rax, rax
je 0x14004d5e3
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, r14
jne 0x14004d5ee
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rdx, str.Internet_Explorer
cmp rdx, 0x10000
jae 0x14004d174
movzx edx, dx
lea rcx, [rsp + 0x60]
call fcn.140012370
jmp 0x14004d198
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x14004d180
mov r8d, eax
lea rcx, [rsp + 0x60]
call fcn.140002a7c
nop
mov rbx, qword [rsp + 0x60]
mov r9, rbx
mov r8d, dword [0x14036bb90]
mov edx, 0x116b9
mov rcx, qword [rsi]
call fcn.14001fa50
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004d1fb
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004d5f5
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r15
jne 0x14004d5f5
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [rsp + 0x48]
mov qword [rbp - 0x70], rax
call fcn.140011b88
mov rcx, rax
test rax, rax
je 0x14004d5fd
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, r14
jne 0x14004d608
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x10]
cmp rax, 0x10000
jae 0x14004d255
lea rax, [rbp + 0x10]
movzx edx, ax
lea rcx, [rsp + 0x48]
call fcn.140012370
jmp 0x14004d27c
lea rcx, [rbp + 0x10]
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14004d260
mov r8d, eax
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x48]
call fcn.140002a7c
nop
lea rcx, [rsp + 0x50]
call fcn.1400154a0
nop
mov ebx, dword [0x14036bb90]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x50]
call fcn.140002b88
mov edx, 0x2c
lea rcx, [rsp + 0x50]
call fcn.14007bed0
mov r9, qword [rsp + 0x50]
mov r8d, ebx
mov edx, 0x116b8
mov rcx, qword [rsi]
call fcn.14001fa50
nop
lea rcx, [rsp + 0x48]
call fcn.14004a160
mov byte [rbp - 0x58], 1
lea rcx, [rbp - 0x50]
call fcn.1400154a0
nop
lea r9, [rbp - 0x58]
mov r8d, dword [0x14036bb90]
mov edx, 0x1177b
mov rcx, rsi
call fcn.140085fe0
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004d33d
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004d60f
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r15
jne 0x14004d60f
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp - 0x48], 0
lea rcx, [rbp - 0x40]
call fcn.1400154a0
nop
lea r9, [rbp - 0x48]
mov r8d, dword [0x14036bb90]
mov edx, 0x1177e
mov rcx, rsi
call fcn.140085fe0
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004d3af
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004d617
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r15
jne 0x14004d617
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp - 0x38], 0
lea rcx, [rbp - 0x30]
call fcn.1400154a0
nop
lea r9, [rbp - 0x38]
mov r8d, dword [0x14036bb90]
mov edx, 0x1177c
mov rcx, rsi
call fcn.140085fe0
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004d421
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004d61f
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r15
jne 0x14004d61f
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp - 0x28], 0
lea rcx, [rbp - 0x20]
call fcn.1400154a0
nop
lea r9, [rbp - 0x28]
mov r8d, dword [0x14036bb90]
mov edx, 0x11780
mov rcx, rsi
call fcn.140085fe0
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004d493
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004d627
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r15
jne 0x14004d627
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp - 0x18], 0
lea rcx, [rbp - 0x10]
call fcn.1400154a0
nop
lea r9, [rbp - 0x18]
mov r8d, dword [0x14036bb90]
mov edx, 0x1177f
mov rcx, rsi
call fcn.140085fe0
nop
mov rdx, qword [rbp - 0x10]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004d505
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004d62f
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r15
jne 0x14004d62f
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp - 8], 0
lea rcx, [rbp]
call fcn.1400154a0
nop
lea r9, [rbp - 8]
mov r8d, dword [0x14036bb90]
mov edx, 0x1177d
mov rcx, rsi
call fcn.140085fe0
nop
mov rdx, qword [rbp]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14004d56d
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004d5bb
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r15
jne 0x14004d5bb
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
inc dword [0x14036bb90]
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x14004d58b
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x68], r12
mov dword [rsp + 0x70], r12d
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140229da0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call r8
nop
jmp 0x14004d56d
call r8
jmp 0x14004cee3
mov ecx, 0x80004005
call fcn.140002d3c
int3
call rdx
jmp 0x14004d01a
call r8
jmp 0x14004d123
mov ecx, 0x80004005
call fcn.140002d3c
int3
call rdx
jmp 0x14004d14c
call r8
jmp 0x14004d1fb
mov ecx, 0x80004005
call fcn.140002d3c
int3
call rdx
jmp 0x14004d22d
call r8
jmp 0x14004d33d
call r8
jmp 0x14004d3af
call r8
jmp 0x14004d421
call r8
jmp 0x14004d493
call r8
jmp 0x14004d505