Function at 0x1400178a0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x248
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1b0], xmm7
movaps xmmword [rbp + 0x1a0], xmm6
mov qword [rbp + 0x198], 0xfffffffffffffffe
mov rdi, rcx
mov dword [rbp + 0x164], 0
mov qword [rbp + 0x108], 0
lea rax, [rbp + 0x108]
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS_1_5_18Products
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14001798e
mov esi, eax
lea rdi, [rbp - 0x20]
mov rcx, rdi
mov edx, eax
call fcn.140009a80
cmp qword [rbp - 8], 0x10
jb 0x140017934
mov rdi, qword [rbp - 0x20]
lea rcx, str.RegOpenKeyEx_failed__li__s_n
mov edx, esi
mov r8, rdi
call fcn.140003560
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x140017984
mov rcx, qword [rbp - 0x20]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14001797f
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140018070
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400651e0
mov eax, 0xffffffff
jmp 0x140017a9c
mov rcx, qword [rbp + 0x108]
xorps xmm6, xmm6
movups xmmword [rsp + 0x48], xmm6
movups xmmword [rsp + 0x38], xmm6
movups xmmword [rsp + 0x28], xmm6
lea rax, [rbp + 0x164]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x58], 0
xor r13d, r13d
mov qword [rbp + 0x130], rcx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x140017a4f
mov esi, eax
lea rdi, [rbp - 0x20]
mov rcx, rdi
mov edx, eax
call fcn.140009a80
cmp qword [rbp - 8], 0x10
jb 0x1400179f3
mov rdi, qword [rbp - 0x20]
lea rcx, str.RegQueryInfoKeyW_failed__li__s_n
mov edx, esi
mov r8, rdi
call fcn.140003560
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x140017a43
mov rcx, qword [rbp - 0x20]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140017a3e
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140018070
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400651e0
mov dword [rbp + 0x194], 0xffffffff
jmp 0x140017a89
mov qword [rbp + 0x100], rdi
lea r15, [rbp - 0x20]
lea rsi, [rbp + 0x18c]
mov rdi, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
movaps xmm7, xmmword [0x14013f230]
lea r12, [rbp + 0x168]
cmp r13d, dword [rbp + 0x164]
jb 0x140017ad5
mov dword [rbp + 0x194], 0
mov rcx, qword [rbp + 0x130]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rbp + 0x194]
movaps xmm6, xmmword [rbp + 0x1a0]
movaps xmm7, xmmword [rbp + 0x1b0]
add rsp, 0x248
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.1400651e0
test bl, 3
jne 0x140017a89
add r13d, 1
cmp r13d, dword [rbp + 0x164]
jae 0x140017a7f
mov dword [rbp + 0x18c], 0x100
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov rcx, qword [rbp + 0x130]
mov edx, r13d
mov r8, r15
mov r9, rsi
call rdi
test eax, eax
je 0x140017b90
mov ebx, eax
mov rcx, r12
mov edx, eax
call fcn.140009a80
cmp qword [rbp + 0x180], 0x10
mov r8, r12
jb 0x140017b23
mov r8, qword [rbp + 0x168]
lea rcx, str.RegEnumKeyExA_failed__li__s_n
mov edx, ebx
call fcn.140003560
mov rax, qword [rbp + 0x180]
cmp rax, 0x10
jb 0x140017ac8
mov rcx, qword [rbp + 0x168]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140017b71
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140018070
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400651e0
add r13d, 1
cmp r13d, dword [rbp + 0x164]
jb 0x140017ad5
jmp 0x140017a7f
mov qword [rbp + 0x168], 0
movups xmmword [rbp + 0x178], xmm7
mov byte [rbp + 0x168], 0
mov edx, 0x4e
mov rcx, r12
lea r9, str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerUserDataS_1_5_18Products
call fcn.140003190
mov rax, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x180]
cmp rcx, rax
jne 0x140017bef
mov qword [rsp + 0x20], 1
mov edx, 1
mov rcx, r12
lea r9, [0x140141b60]
call fcn.140006270
jmp 0x140017c10
lea rdx, [rax + 1]
mov qword [rbp + 0x178], rdx
mov rdx, r12
cmp rcx, 0x10
jb 0x140017c0a
mov rdx, qword [rbp + 0x168]
mov word [rdx + rax], 0x5c
mov r14, rdi
mov rcx, r15
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, qword [rbp + 0x178]
mov rdi, qword [rbp + 0x180]
mov rdx, rdi
sub rdx, rcx
cmp rdx, rax
jae 0x140017c4c
mov qword [rsp + 0x20], rax
mov rcx, r12
mov rdx, rax
mov r9, r15
call fcn.140006270
mov rdi, r14
jmp 0x140017c85
mov rbx, rax
add rbx, rcx
mov qword [rbp + 0x178], rbx
mov rsi, r12
cmp rdi, 0x10
jb 0x140017c69
mov rsi, qword [rbp + 0x168]
add rcx, rsi
mov rdx, r15
mov r8, rax
call sub.VCRUNTIME140.dll_memmove
mov byte [rsi + rbx], 0
lea rsi, [rbp + 0x18c]
mov rdi, r14
mov rax, qword [rbp + 0x178]
mov rcx, qword [rbp + 0x180]
mov rdx, rcx
sub rdx, rax
cmp rdx, 0x12
jae 0x140017cbe
mov qword [rsp + 0x20], 0x12
mov edx, 0x12
mov rcx, r12
lea r9, str.InstallProperties
call fcn.140006270
jmp 0x140017cf0
lea rdx, [rax + 0x12]
mov qword [rbp + 0x178], rdx
mov rdx, r12
cmp rcx, 0x10
jb 0x140017cd9
mov rdx, qword [rbp + 0x168]
movups xmm0, xmmword [str.InstallProperties]
movups xmmword [rdx + rax], xmm0
mov word [rdx + rax + 0x10], 0x7365
mov byte [rdx + rax + 0x12], 0
mov qword [rbp + 0x110], 0
cmp qword [rbp + 0x180], 0x10
mov rdx, r12
jb 0x140017d0f
mov rdx, qword [rbp + 0x168]
lea rax, [rbp + 0x110]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, 4
test eax, eax
jne 0x140018020
mov rcx, qword [rbp + 0x110]
mov dword [rbp + 0x190], 0
mov rax, qword [0x140141ab0]
mov qword [rbp + 0xf0], rax
movaps xmm0, xmmword [str.DisplayName]
movaps xmmword [rbp + 0xe0], xmm0
lea rax, [rbp + 0x190]
mov qword [rsp + 0x30], rax
movups xmmword [rsp + 0x20], xmm6
mov qword [rbp + 0x158], rcx
xor edx, edx
lea r8, [rbp + 0xe0]
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140017daa
mov r14d, eax
cmp eax, 0xea
jne 0x140017e9a
lea rcx, [rbp + 0x118]
call fcn.140018200
mov edx, dword [rbp + 0x190]
shr rdx, 1
lea rcx, [rbp + 0x118]
call fcn.1400182d0
lea rcx, [rbp + 0x118]
call fcn.140018660
lea rcx, [rbp + 0x190]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov rcx, qword [rbp + 0x158]
xor edx, edx
lea r8, [rbp + 0xe0]
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140017f1f
mov ebx, eax
lea rcx, [rbp + 0x138]
mov edx, eax
call fcn.140009a80
cmp qword [rbp + 0x150], 0x10
lea r8, [rbp + 0x138]
jb 0x140017e3d
mov r8, qword [rbp + 0x138]
lea rcx, str.RegGetValueW_failed__li__s_n
mov edx, ebx
call fcn.140003560
mov rax, qword [rbp + 0x150]
cmp rax, 0x10
jb 0x140017e90
mov rcx, qword [rbp + 0x138]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140017e8b
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140018070
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400651e0
mov ebx, 4
jmp 0x140018007
lea rcx, [rbp + 0x138]
mov edx, r14d
call fcn.140009a80
cmp qword [rbp + 0x150], 0x10
lea r8, [rbp + 0x138]
jb 0x140017ec1
mov r8, qword [rbp + 0x138]
lea rcx, str.RegGetValueW_failed__li__s_n
mov edx, r14d
call fcn.140003560
mov rax, qword [rbp + 0x150]
cmp rax, 0x10
jb 0x140017f15
mov rcx, qword [rbp + 0x138]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140017f10
mov rbx, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rbx
cmp rcx, 0x20
jae 0x140018070
add rax, 0x28
mov rdx, rax
mov rcx, rbx
call fcn.1400651e0
mov ebx, 4
jmp 0x140018013
lea rcx, [rbp + 0x118]
lea rdx, [rbp + 0x138]
call fcn.140018680
mov r14, qword [rbp + 0x150]
lea rcx, [rbp + 0x138]
cmp r14, 0x10
jb 0x140017f4d
mov rcx, qword [rbp + 0x138]
mov rdx, qword [rbp + 0x100]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
xor ebx, ebx
test eax, eax
je 0x140017f6a
cmp r14, 0x10
jae 0x140017fd3
jmp 0x140018007
mov dword [rbp + 0x12c], 4
lea rax, [rbp + 0x12c]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x128]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov rcx, qword [rbp + 0x158]
xor edx, edx
lea r8, str.Version
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
neg eax
sbb eax, eax
or eax, dword [rbp + 0x128]
mov dword [rbp + 0x194], eax
mov ebx, 1
mov r14, qword [rbp + 0x150]
cmp r14, 0x10
jb 0x140018007
mov rcx, qword [rbp + 0x138]
lea rdx, [r14 + 1]
cmp rdx, 0x1000
jb 0x140018002
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x140018070
add r14, 0x28
mov rdx, r14
mov rcx, rax
call fcn.1400651e0
lea rcx, [rbp + 0x118]
call fcn.140018490
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rbp + 0x180]
cmp rax, 0x10
jb 0x140017ac3
mov rcx, qword [rbp + 0x168]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140017abe
mov rsi, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rsi
cmp rcx, 0x20
jae 0x140018070
add rax, 0x28
mov rdx, rax
mov rcx, rsi
lea rsi, [rbp + 0x18c]
jmp 0x140017abe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3