Function at 0x14001b274
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
push r14
push r15
sub rsp, 0x90
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov rax, qword [0x1401784a8]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov r14, r9
mov rsi, r8
mov r15, rdx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
xor edi, edi
mov qword [rsp + 0x48], rdi
mov ecx, 0x208
call fcn.14000c1bc
mov qword [rsp + 0x38], rax
lea rbx, [rax + 0x208]
mov qword [rsp + 0x48], rbx
xor edx, edx
mov r8d, 0x208
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov qword [rsp + 0x40], rbx
mov r8, qword [rsp + 0x38]
sub rbx, r8
sar rbx, 1
mov eax, 0xffffffff
cmp rbx, rax
ja 0x14001b617
mov ecx, ebx
add rcx, rcx
mov rax, rcx
shr rax, 0x20
test eax, eax
jne 0x14001b61d
mov dword [rsp + 0x30], ecx
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x14001b325
mov rdx, qword [rsi]
mov rax, qword [r15]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rcx, qword [rax + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x14001b3ce
cmp ebx, 0xea
je 0x14001b3ce
mov edx, MsiPreviewDialogW
lea rcx, str.admin_appman_appvclientintegrationintegration_store_utils.cpp
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x14001b37f
inc rax
jmp 0x14001b386
lea rax, str.admin_appman_appvclientintegrationintegration_store_utils.cpp
mov rdx, rax
lea rcx, [0x14017bba0]
call fcn.140007964
shl rax, 0x34
or rbx, rax
movabs rax, 0x112100000000
or rbx, rax
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14001b3c6
mov rdx, qword [rsp + 0x48]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
call fcn.14000c220
mov rax, rbx
jmp 0x14001b5f7
mov eax, dword [rsp + 0x50]
dec eax
cmp eax, 1
jbe 0x14001b424
mov edx, MsiPreviewDialogW
lea rcx, str.admin_appman_appvclientintegrationintegration_store_utils.cpp
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x14001b3fb
inc rax
jmp 0x14001b402
lea rax, str.admin_appman_appvclientintegrationintegration_store_utils.cpp
mov rdx, rax
lea rcx, [0x14017bba0]
call fcn.140007964
mov rbx, rax
shl rbx, 0x34
movabs rax, 0x12210000000d
jmp 0x14001b3a6
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x14001b46c
mov rax, r14
cmp qword [r14 + 0x18], 8
jb 0x14001b439
mov rax, qword [r14]
mov qword [r14 + 0x10], rdi
mov word [rax], di
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14001b45d
mov rdx, qword [rsp + 0x48]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
call fcn.14000c220
movabs rax, 0x8000000000
jmp 0x14001b5f7
mov rdx, rax
mov cl, al
and cl, 1
je 0x14001b4c4
mov edx, MsiPreviewDialogW
lea rcx, str.admin_appman_appvclientintegrationintegration_store_utils.cpp
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x14001b498
inc rax
jmp 0x14001b49f
lea rax, str.admin_appman_appvclientintegrationintegration_store_utils.cpp
mov rdx, rax
lea rcx, [0x14017bba0]
call fcn.140007964
mov rbx, rax
shl rbx, 0x34
movabs rax, 0x13210000000d
jmp 0x14001b3a6
cmp ebx, 0xea
jne 0x14001b51b
shr rdx, 1
lea rcx, [rsp + 0x38]
call fcn.1400088f0
cmp qword [rsi + 0x18], 8
jb 0x14001b4e3
mov rsi, qword [rsi]
mov rax, qword [r15]
mov rcx, qword [rax + 0x20]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
mov ebx, eax
mov eax, dword [rsp + 0x30]
test ebx, ebx
je 0x14001b56d
mov edx, MsiPreviewDialogW
lea rcx, str.admin_appman_appvclientintegrationintegration_store_utils.cpp
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x14001b541
inc rax
jmp 0x14001b548
lea rax, str.admin_appman_appvclientintegrationintegration_store_utils.cpp
mov rdx, rax
lea rcx, [0x14017bba0]
call fcn.140007964
shl rax, 0x34
or rbx, rax
movabs rax, 0x142100000000
jmp 0x14001b3a6
mov ebx, eax
shr rbx, 1
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x80], 7
mov word [rsp + 0x68], di
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x68]
call fcn.14000954c
nop
mov r9, rbx
xor r8d, r8d
lea rdx, [rsp + 0x68]
mov rcx, r14
call fcn.14000f3cc
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 8
jb 0x14001b440
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
call fcn.14000c220
jmp 0x14001b440
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400d24e0
add rsp, 0x90
pop r15
pop r14
pop rdi
pop rsi
pop rbx
ret
call fcn.14001a938
nop
call fcn.14001a938
int3