Function at 0x14008b220
Capabilities:
Get file version info
Query or enumerate registry value

Disassembly:
push rbx
push rdi
push r12
push r15
sub rsp, 0x348
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rsp + 0x310], rax
mov rax, qword [rsp + 0x390]
mov r15, 0xffffffffffffffff
mov r12, rdx
mov qword [rsp + 0x68], rax
mov rdx, r15
mov qword [rsp + 0x60], r9
mov qword [rsp + 0x48], r8
mov rdi, rcx
nop word [rax + rax]
inc rdx
cmp word [rcx + rdx*2], 0
jne 0x14008b270
mov qword [rsp + 0x340], rbp
inc rdx
mov qword [rsp + 0x338], rsi
mov qword [rsp + 0x330], r13
mov qword [rsp + 0x328], r14
call fcn.1400e926c
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400e1108
mov rbx, rax
test rax, rax
je 0x14008bafa
xor r13d, r13d
mov dword [rax + 0x10], 1
mov rcx, rdi
mov qword [rax + 8], r13
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x14008b2e0
test rdi, rdi
jne 0x14008bafa
lea rdx, str._PROCESSID:
mov rcx, rax
mov rdi, rbx
call fcn.1400e3cd4
test rax, rax
je 0x14008ba80
mov rcx, qword [rbx]
lea rdx, str._PROCESSID:
call fcn.1400e3cd4
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
lea rsi, [rax + 0x16]
call fcn.1400e1108
mov rbx, rax
test rax, rax
je 0x14008bafa
mov rcx, rsi
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x14008b349
test rsi, rsi
jne 0x14008bafa
mov eax, r15d
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x14008b386
mov rcx, qword [rdi]
test rcx, rcx
je 0x14008b367
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r13
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14008b379
call fcn.1400e0fb8
mov qword [rdi + 8], r13
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rdi
call fcn.1400e0fb8
lock inc dword [rbx + 0x10]
mov eax, r15d
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14008b3c7
mov rcx, qword [rbx]
test rcx, rcx
je 0x14008b3a8
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14008b3ba
call fcn.1400e0fb8
mov qword [rbx + 8], r13
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.1400e0fb8
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400e1108
mov rdi, rax
test rax, rax
je 0x14008bafa
lea rcx, str.CLSID_
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi], rax
test rax, rax
je 0x14008bafa
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400e1108
mov rsi, rax
test rax, rax
je 0x14008bafa
mov qword [rax + 8], r13
mov dword [rax + 0x10], 1
mov rcx, qword [rdi]
test rcx, rcx
je 0x14008b433
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov r13d, eax
mov rcx, qword [rbx]
test rcx, rcx
je 0x14008b445
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov ebp, eax
jmp 0x14008b447
xor ebp, ebp
mov r14d, ebp
add r14d, r13d
cmp r14d, ebp
jb 0x14008bafa
mov eax, r14d
mov ecx, 0xffffffff
add rax, rax
cmp rax, rcx
ja 0x14008bafa
lea edx, [r14 + r14]
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov qword [rsi], rax
mov rcx, rax
test rax, rax
jne 0x14008b48c
test r14d, r14d
jne 0x14008bafa
jmp 0x14008b501
mov rdx, qword [rdi]
test rdx, rdx
je 0x14008b4ca
lea r9d, [r14 + 1]
add r9, r9
lea r8d, [r13 + 1]
add r8, r8
je 0x14008b4ca
cmp r9, r8
jb 0x14008b4b0
call fcn.1400e3010
jmp 0x14008b4ca
mov r8, r9
xor edx, edx
call fcn.1400e36c0
call fcn.1400e864c
mov dword [rax], 0x22
call fcn.1400e8140
mov rdx, qword [rbx]
test rdx, rdx
je 0x14008b501
mov rax, qword [rsi]
lea r8d, [rbp + 1]
mov ecx, r13d
lea rcx, [rax + rcx*2]
add r8, r8
je 0x14008b501
test rcx, rcx
jne 0x14008b4fc
call fcn.1400e864c
mov dword [rax], SafeArrayPutElement
call fcn.1400e8140
jmp 0x14008b501
call fcn.1400e3010
mov eax, r15d
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x14008b546
mov rcx, qword [rdi]
test rcx, rcx
je 0x14008b523
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], 0
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14008b539
call fcn.1400e0fb8
mov qword [rdi + 8], 0
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rdi
call fcn.1400e0fb8
mov rdx, qword [rsi]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov eax, r15d
sete dil
lock xadd dword [rsi + 0x10], eax
cmp eax, 1
jne 0x14008b5b4
mov rcx, qword [rsi]
test rcx, rcx
je 0x14008b591
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], 0
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14008b5a7
call fcn.1400e0fb8
mov qword [rsi + 8], 0
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rsi
call fcn.1400e0fb8
test dil, dil
je 0x14008ba7d
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x100]
mov dword [rsp + 0x40], 0x208
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14008b60f
lea rcx, [rsp + 0x100]
call fcn.1400e81d8
mov rcx, qword [rsp + 0x38]
mov qword [r12], rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400e1108
mov rsi, rax
test rax, rax
je 0x14008bafa
xor r12d, r12d
mov dword [rax + 0x10], 1
lea rcx, str.CLSID_
mov qword [rax + 8], r12
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsi], rax
test rax, rax
je 0x14008bafa
lea ecx, [r12 + 0x18]
call fcn.1400e1108
mov rdi, rax
test rax, rax
je 0x14008bafa
mov qword [rax + 8], r12
mov dword [rax + 0x10], 1
mov rcx, qword [rsi]
test rcx, rcx
je 0x14008b680
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov r13d, eax
jmp 0x14008b683
mov r13d, r12d
mov rcx, qword [rbx]
test rcx, rcx
je 0x14008b695
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov ebp, eax
jmp 0x14008b698
mov ebp, r12d
mov r14d, ebp
add r14d, r13d
cmp r14d, ebp
jb 0x14008bafa
mov eax, r14d
mov ecx, 0xffffffff
add rax, rax
cmp rax, rcx
ja 0x14008bafa
lea edx, [r14 + r14]
xor ecx, ecx
call qword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov qword [rdi], rax
mov rcx, rax
test rax, rax
jne 0x14008b6dd
test r14d, r14d
jne 0x14008bafa
jmp 0x14008b752
mov rdx, qword [rsi]
test rdx, rdx
je 0x14008b71b
lea r9d, [r14 + 1]
add r9, r9
lea r8d, [r13 + 1]
add r8, r8
je 0x14008b71b
cmp r9, r8
jb 0x14008b701
call fcn.1400e3010
jmp 0x14008b71b
mov r8, r9
xor edx, edx
call fcn.1400e36c0
call fcn.1400e864c
mov dword [rax], 0x22
call fcn.1400e8140
mov rdx, qword [rbx]
test rdx, rdx
je 0x14008b752
mov rax, qword [rdi]
lea r8d, [rbp + 1]
mov ecx, r13d
lea rcx, [rax + rcx*2]
add r8, r8
je 0x14008b752
test rcx, rcx
jne 0x14008b74d
call fcn.1400e864c
mov dword [rax], SafeArrayPutElement
call fcn.1400e8140
jmp 0x14008b752
call fcn.1400e3010
mov eax, r15d
lock xadd dword [rsi + 0x10], eax
cmp eax, 1
jne 0x14008b78f
mov rcx, qword [rsi]
test rcx, rcx
je 0x14008b770
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], r12
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14008b782
call fcn.1400e0fb8
mov qword [rsi + 8], r12
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rsi
call fcn.1400e0fb8
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.1400e1108
mov rsi, rax
test rax, rax
je 0x14008bafa
xor r13d, r13d
mov dword [rax + 0x10], 1
lea rcx, str.InProcServer32
mov qword [rax + 8], r13
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsi], rax
test rax, rax
je 0x14008bafa
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
lock inc dword [rdi + 0x10]
lea ecx, [r13 + 0x18]
call fcn.1400e1108
test rax, rax
je 0x14008bafa
lea r8, [rsp + 0x50]
mov rcx, rax
lea rdx, [rsp + 0x58]
call fcn.1400051c0
mov r14, rax
test rax, rax
je 0x14008bafa
mov ecx, r15d
lock xadd dword [rdi + 0x10], ecx
cmp ecx, 1
jne 0x14008b847
mov rcx, qword [rdi]
test rcx, rcx
je 0x14008b828
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r13
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14008b83a
call fcn.1400e0fb8
mov qword [rdi + 8], r13
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rdi
call fcn.1400e0fb8
mov rdx, qword [r14]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
mov eax, r15d
sete bpl
lock xadd dword [r14 + 0x10], eax
cmp eax, 1
jne 0x14008b8ae
mov rcx, qword [r14]
test rcx, rcx
je 0x14008b88f
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [r14], r13
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x14008b8a1
call fcn.1400e0fb8
mov qword [r14 + 8], r13
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, r14
call fcn.1400e0fb8
mov eax, r15d
lock xadd dword [rsi + 0x10], eax
cmp eax, 1
jne 0x14008b8eb
mov rcx, qword [rsi]
test rcx, rcx
je 0x14008b8cc
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rsi], r13
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x14008b8de
call fcn.1400e0fb8
mov qword [rsi + 8], r13
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rsi
call fcn.1400e0fb8
mov eax, r15d
lock xadd dword [rdi + 0x10], eax
cmp eax, 1
jne 0x14008b928
mov rcx, qword [rdi]
test rcx, rcx
je 0x14008b909
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rdi], r13
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14008b91b
call fcn.1400e0fb8
mov qword [rdi + 8], r13
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rdi
call fcn.1400e0fb8
test bpl, bpl
je 0x14008ba80
mov rcx, qword [rsp + 0x38]
xor edx, edx
call fcn.140089b60
mov rdi, rax
test rax, rax
je 0x14008ba70
mov rdx, r15
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], r12w
jne 0x14008b950
inc rdx
mov rcx, rdi
call fcn.1400e8fb8
mov rcx, rdi
call fcn.1400e81d8
mov rcx, qword [rsp + 0x48]
lea r8, [0x14011eaa0]
mov edx, 0x40
mov qword [rcx], rax
lea rcx, [rsp + 0x80]
call fcn.1400e86e4
mov r14, qword [rsp + 0x60]
lea rdx, [rsp + 0x48]
mov r12, qword [rsp + 0x68]
mov rcx, rdi
mov qword [r14], r13
mov qword [r12], r13
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
test eax, eax
jne 0x14008b9bd
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x14008ba68
mov rcx, rbp
call fcn.1400e8270
mov r9, rax
mov r8d, ebp
xor edx, edx
mov rcx, rdi
mov rsi, rax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x14008ba60
mov edx, dword [rsi + 0x30]
lea r8, [rsp + 0x80]
mov ecx, dword [rsi + 0x34]
mov r9d, 0x40
call fcn.1400a8720
lea rdx, [0x14011f4f8]
mov rcx, rsi
call fcn.1400ab6a0
test rax, rax
jne 0x14008ba21
lea rdx, str.ProductDescription
mov rcx, rsi
call fcn.1400ab6a0
test rax, rax
je 0x14008ba2c
mov rcx, rax
call fcn.1400e81d8
mov qword [r14], rax
lea rdx, [0x14011f518]
mov rcx, rsi
call fcn.1400ab6a0
test rax, rax
jne 0x14008ba54
lea rdx, [0x140133288]
mov rcx, rsi
call fcn.1400ab6a0
test rax, rax
je 0x14008ba60
mov rcx, rax
call fcn.1400e81d8
mov qword [r12], rax
mov rcx, rsi
call fcn.1400e825c
mov rcx, rdi
call fcn.1400e825c
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14008ba80
xor r13d, r13d
lock xadd dword [rbx + 0x10], r15d
cmp r15d, 1
jne 0x14008babc
mov rcx, qword [rbx]
test rcx, rcx
je 0x14008ba9d
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r13
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14008baaf
call fcn.1400e0fb8
mov qword [rbx + 8], r13
mov edx, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.1400e0fb8
mov r14, qword [rsp + 0x328]
mov r13, qword [rsp + 0x330]
mov rsi, qword [rsp + 0x338]
mov rbp, qword [rsp + 0x340]
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.1400e17a0
add rsp, 0x348
pop r15
pop r12
pop rdi
pop rbx
ret
mov ecx, 0x8007000e
call fcn.1400e0b70
int3