Function at 0x140043b70
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1400b31d8]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov ecx, 0x7d01
call fcn.140057014
mov rbx, rax
mov dword [rsp + 0x58], 0x7d00
mov r8d, 0x11
lea rdx, str.c:whiteswanwssp
lea r14, [0x1400b3ff0]
mov rcx, r14
call fcn.1400097b0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetServiceswssp
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140043cd5
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x5c]
xor r8d, r8d
lea rdx, str.InstalledVersion
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140043c59
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x140043c40
mov rdx, rbx
lea rcx, [0x1400b3f60]
call fcn.1400097b0
mov dword [rsp + 0x58], 0x7d00
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x5c]
xor r8d, r8d
lea rdx, str.InstallLocation
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140043cca
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], 0
jne 0x140043c95
mov rdx, rbx
mov rcx, r14
call fcn.1400097b0
cmp qword [0x1400b4000], 0
sete bl
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x140043f58
jmp 0x140043cd5
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8d, 0x104
lea rdx, [rbp + 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rbp + 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140043cf2
lea rdx, [rbp + 0x60]
mov rcx, r14
call fcn.1400097b0
cmp qword [0x1400b4008], 0x10
setae r12b
mov rdi, r14
mov r15, qword [0x1400b3ff0]
cmovae rdi, r15
lea rbx, [0x14009e488]
lea r13, [0x14009e48a]
mov rsi, qword [0x1400b4000]
test rsi, rsi
je 0x140043da8
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x60]
call fcn.140059370
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rsp + rax + 0x60], 1
inc rcx
cmp rcx, r13
jne 0x140043d60
lea rax, [rsi - 1]
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
add r8, rdi
movzx eax, byte [r8]
cmp byte [rsp + rax + 0x60], 0
jne 0x140043da3
cmp r8, rdi
je 0x140043da8
dec r8
movzx eax, byte [r8]
cmp byte [rsp + rax + 0x60], 0
je 0x140043d90
sub r8, rdi
jmp 0x140043daf
mov r8, 0xffffffffffffffff
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0xf
cmp rsi, r8
cmovb r8, rsi
mov rdx, r14
test r12b, r12b
cmovne rdx, r15
lea rcx, [rsp + 0x30]
call fcn.1400097b0
mov rdx, qword [0x1400b4008]
cmp rdx, 0x10
jb 0x140043e20
mov rcx, qword [0x1400b3ff0]
inc rdx
cmp rdx, 0x1000
jb 0x140043e1b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140043f88
mov rcx, r8
call fcn.140056740
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [0x1400b3ff0], xmm1
movups xmm2, xmmword [rsp + 0x40]
movups xmmword [0x1400b4000], xmm2
movdqa xmm0, xmm2
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0x10
setae r12b
mov rdi, r14
movq r15, xmm1
cmovae rdi, r15
movq rsi, xmm2
test rsi, rsi
je 0x140043ecc
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x60]
call fcn.140059370
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rsp + rax + 0x60], 1
inc rbx
cmp rbx, r13
jne 0x140043e80
mov rax, qword [rsp + 0x40]
dec rax
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
add r8, rdi
movzx eax, byte [r8]
cmp byte [rsp + rax + 0x60], 0
jne 0x140043ec7
cmp r8, rdi
je 0x140043ecc
dec r8
movzx eax, byte [r8]
cmp byte [rsp + rax + 0x60], 0
je 0x140043eb4
sub r8, rdi
jmp 0x140043ed3
mov r8, 0xffffffffffffffff
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0xf
cmp rsi, r8
cmovb r8, rsi
test r12b, r12b
cmovne r14, r15
mov rdx, r14
lea rcx, [rsp + 0x30]
call fcn.1400097b0
mov rdx, qword [0x1400b4008]
cmp rdx, 0x10
jb 0x140043f40
mov rcx, qword [0x1400b3ff0]
inc rdx
cmp rdx, 0x1000
jb 0x140043f3b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140043f88
mov rcx, r8
call fcn.140056740
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [0x1400b3ff0], xmm0
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [0x1400b4000], xmm1
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.140056720
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140065768
int3