Function at 0x140047cc0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x258
movaps xmmword [rsp + 0x240], xmm6
mov r13, rdx
mov rdi, rcx
mov rax, qword [0x14037e040]
xor rax, rsp
mov qword [rsp + 0x238], rax
lea rax, [rsp + 0x228]
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax - 8], rax
mov rsi, qword [r8]
mov r12, qword [r8 + 8]
lea rcx, [rsp + 0x220]
mov qword [rsp + 0x1e8], rcx
mov qword [rsp + 0x1f0], rax
cmp rsi, r12
je 0x140047db3
lea rbx, [rsp + 0x70]
lea r14, [rsp + 0x200]
lea r15, [rsp + 0x1e8]
movsx rcx, byte [rsi + 0x17]
mov rax, rsi
test rcx, rcx
jns 0x140047d56
mov rcx, qword [rsi + 8]
mov rax, qword [rsi]
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x208], rcx
test rcx, rcx
js 0x140048411
sete cl
test rax, rax
setne al
or al, cl
je 0x140048411
mov rcx, rbx
mov rdx, r14
call fcn.14005fd80
mov rcx, r15
mov rdx, rbx
call fcn.1401d4c60
cmp byte [rsp + 0x87], 0
jns 0x140047daa
mov rcx, qword [rsp + 0x70]
call fcn.14016b728
add rsi, 0x18
cmp rsi, r12
jne 0x140047d42
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x200]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x1402faf80]
movaps xmmword [rbx], xmm0
mov rcx, rbx
call fcn.14005e4b0
cmp byte [r13 + 0x17], 0
mov r8, r13
jns 0x140047de9
mov r8, qword [r13]
mov rcx, rbx
mov rdx, rdi
mov r9d, ntohl
call fcn.14005e650
test eax, eax
je 0x140047f8a
mov edi, eax
mov ecx, 2
call fcn.140124de0
xor al, 1
cmp edi, 2
sete cl
or cl, al
jne 0x140047f40
lea rdx, str.....chromeinstaller_setup_setup_util.cc
lea rbx, [rsp + 0x70]
mov rcx, rbx
mov r8d, 0x196
mov r9d, 2
call fcn.1400740b0
lea rcx, [rsp + 0x80]
lea rdx, str.Failed_to_open
mov r8d, 0xf
call fcn.1400fd720
mov rcx, rax
mov rdx, r13
call fcn.14006d1a0
lea rdx, str.__result_
mov r8d, ntohl
mov rcx, rax
call fcn.1400fd720
mov rcx, rax
mov edx, edi
call fcn.140025090
mov rcx, rbx
call fcn.140074680
jmp 0x140047f40
lea rdx, [0x14030619a]
lea rcx, [rsp + 0x200]
mov r8b, 1
call fcn.14005e7f0
test eax, eax
je 0x140047f18
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, 2
call fcn.140124de0
test al, al
je 0x140047f18
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.....chromeinstaller_setup_setup_util.cc
lea rdi, [rsp + 0x70]
mov rcx, rdi
mov r8d, 0x1e0
mov r9d, 2
call fcn.1401dd1d0
lea rcx, [rsp + 0x80]
lea rdx, str.Failed_to_delete_key
mov r8d, 0x15
call fcn.1400fd720
mov rcx, rax
mov rdx, qword [rsp + 0x68]
call fcn.14006d1a0
mov rcx, rdi
call fcn.1401dd240
cmp byte [rsp + 0x1e7], 0
jns 0x140047f2f
mov rcx, qword [rsp + 0x1d0]
call fcn.14016b728
lea rcx, [rsp + 0x1e8]
mov rdx, qword [rcx + 8]
call fcn.14004ad50
lea rcx, [rsp + 0x200]
call fcn.14005e770
lea rcx, [rsp + 0x220]
mov rdx, qword [rcx + 8]
call fcn.14004ad50
mov rcx, qword [rsp + 0x238]
xor rcx, rsp
call fcn.14016cc60
movaps xmm6, xmmword [rsp + 0x240]
add rsp, 0x258
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x68], r13
movabs rbp, 0x7fffffffffffffff
lea rax, [rsp + 0x1f0]
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov qword [rax - 8], rax
mov ecx, 0x208
call fcn.14016b6ec
lea rdi, [rsp + 0x1d0]
mov qword [rdi], rax
lea r12, [rbp + 0x105]
mov qword [rdi + 0x10], r12
mov qword [rdi + 8], 0x100
mov r8d, 0x202
mov rcx, rax
xor edx, edx
call fcn.1401a5660
mov al, 0x80
mov ebx, 0xa
lea r14, [rsp + 0x1cc]
mov rsi, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
xor r13d, r13d
xor r15d, r15d
jmp 0x140048118
cmp qword [rsp + 0x1f8], 0
je 0x140047e8f
lea rsi, [rsp + 0x1e8]
mov rdx, qword [rsi + 8]
mov rcx, rsi
call fcn.14004ad50
lea rax, [rsp + 0x1f0]
mov qword [rsi], rax
xorps xmm6, xmm6
movups xmmword [rsi + 8], xmm6
mov esi, 0xa
mov edi, 0x7fff
lea r14, [rsp + 0x1d0]
lea r15, [rsp + 0x1cc]
mov r12, qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ebx, ebx
xor r13d, r13d
jmp 0x1400484c9
mov r9, rax
and r9, rbp
dec r9
cmp r9, rdx
jae 0x140048109
mov rdx, qword [rsp + 0x1d8]
jmp 0x1400480c2
cmp eax, 0xea
jne 0x140048004
movsx rcx, byte [rsp + 0x1e7]
test rcx, rcx
mov rax, qword [rsp + 0x1e0]
lea rdx, [rax + rax - 2]
mov r8d, 0x14
cmovs r8, rdx
lea r9, [rbp - 8]
cmp r8, r9
ja 0x140048915
test cl, cl
js 0x140048064
mov rdx, rcx
cmp rdx, r8
cmova r8, rdx
mov r9d, 0xa
mov edx, 0xa
cmp r8, 0xb
jb 0x1400480f4
mov rdx, r8
and rdx, 0xfffffffffffffffc
add rdx, 4
or r8, 3
cmp r8, 0xb
cmove r8, rdx
mov rdx, r8
test cl, cl
js 0x140048a47
cmp rdx, r9
je 0x140048109
mov rcx, rdi
call fcn.140040270
mov al, byte [rsp + 0x1e7]
mov r12, qword [rsp + 0x1e0]
and r12, rbp
dec r12
test al, al
cmovns r12, rbx
mov rcx, r12
shr rcx, 0x20
neg rcx
mov edx, 0
sbb edx, edx
or edx, r12d
mov dword [rsp + 0x1cc], edx
test al, al
jns 0x1400481c0
mov rax, qword [rsp + 0x1d8]
cmp rax, rdx
jb 0x1400481d4
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x1d8], rdx
mov word [rax + rdx*2], 0
cmp byte [rsp + 0x1e7], 0
mov r8, rdi
jns 0x14004817f
mov r8, qword [rsp + 0x1d0]
mov rcx, qword [rsp + 0x200]
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov edx, r13d
mov r9, r14
call rsi
test eax, eax
je 0x14004820d
cmp eax, 0x103
jne 0x140048080
xor r13d, r13d
test r15b, 1
mov r15d, 0
jne 0x140048109
jmp 0x140048004
movzx eax, al
cmp rax, rdx
jb 0x1400481d4
mov byte [rsp + 0x1e7], dl
mov rax, rdi
jmp 0x140048164
sub rdx, rax
mov rcx, rdi
xor r8d, r8d
call fcn.140111ac0
jmp 0x14004816a
mov r15b, 1
jmp 0x140048109
sub rdx, rax
mov rcx, rdi
xor r8d, r8d
call fcn.140111ac0
jmp 0x140048245
cmp rax, rdx
jb 0x1400481ec
mov byte [rsp + 0x1e7], dl
mov rax, rdi
jmp 0x14004823f
mov edx, dword [rsp + 0x1cc]
movsx rax, byte [rsp + 0x1e7]
test rax, rax
jns 0x1400481fc
mov rax, qword [rsp + 0x1d8]
cmp rax, rdx
jb 0x1400481ec
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x1d8], rdx
mov word [rax + rdx*2], 0
mov r8, qword [rsp + 0x1f0]
movzx edx, byte [rsp + 0x1e7]
mov rax, qword [rsp + 0x1d0]
mov rcx, qword [rsp + 0x1d8]
test r8, r8
jne 0x1400486e1
test dl, dl
cmovns rcx, rdx
cmovns rax, rdi
mov qword [rsp + 0x1b8], rax
mov qword [rsp + 0x1c0], rcx
test rcx, rcx
js 0x140048411
sete cl
test rax, rax
setne al
or al, cl
je 0x140048411
lea rcx, [rsp + 0x1b8]
call fcn.14005fd70
test al, al
je 0x140048347
movsx rcx, byte [rsp + 0x1e7]
test rcx, rcx
cmovs rcx, qword [rsp + 0x1d8]
mov rax, qword [rsp + 0x1d0]
cmovns rax, rdi
mov qword [rsp + 0x1a8], rax
mov qword [rsp + 0x1b0], rcx
test rcx, rcx
js 0x140048411
sete cl
test rax, rax
setne al
or al, cl
je 0x140048411
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x1a8]
call fcn.14005fd80
mov rcx, qword [rsp + 0x228]
movzx eax, byte [rsp + 0x87]
test rcx, rcx
jne 0x140048811
xor r12d, r12d
test al, al
jns 0x14004833e
mov rcx, qword [rsp + 0x70]
call fcn.14016b728
test r12b, r12b
jne 0x1400483f1
cmp byte [rsp + 0x1e7], 0
mov rdx, rdi
jns 0x14004835c
mov rdx, qword [rsp + 0x1d0]
lea rcx, [rsp + 0x200]
mov r8b, 1
call fcn.14005e7f0
test eax, eax
je 0x1400481e4
mov ecx, 2
call fcn.140124de0
test al, al
je 0x1400483f1
lea r12, [rsp + 0x70]
mov rcx, r12
lea rdx, str.....chromeinstaller_setup_setup_util.cc
mov r8d, 0x1d1
mov r9d, 2
call fcn.1400740b0
mov r8d, 0x18
lea rcx, [rsp + 0x80]
lea rdx, str.Failed_to_delete_subkey
call fcn.1400fd720
mov rcx, rax
mov rdx, rdi
call fcn.14006d1a0
mov r8d, ntohl
mov rcx, rax
lea rdx, str._under_path
call fcn.1400fd720
mov rcx, rax
mov rdx, qword [rsp + 0x68]
call fcn.14006d1a0
mov rcx, r12
call fcn.140074680
lea rcx, [rsp + 0x1e8]
lea rdx, [rsp + 0x70]
mov r8, rdi
mov r9, rdi
call fcn.140112000
inc r13d
jmp 0x140048109
ud2
mov r9, rax
and r9, rbp
dec r9
cmp r9, rdx
jae 0x1400484c9
mov rdx, qword [rsp + 0x1d8]
jmp 0x140048482
cmp eax, 0xea
jne 0x140047f18
cmp dword [rsp + 0x1cc], 0x7ffe
ja 0x140047f18
movsx rcx, byte [rsp + 0x1e7]
test rcx, rcx
mov rax, qword [rsp + 0x1e0]
lea rdx, [rax + rax - 2]
mov r8d, 0x14
cmovs r8, rdx
lea r9, [rbp - 8]
cmp r8, r9
ja 0x140048915
test cl, cl
js 0x140048413
mov rdx, rcx
cmp rdx, r8
cmova r8, rdx
mov r9d, 0xa
mov edx, 0xa
cmp r8, 0xb
jb 0x1400484b4
mov rdx, r8
and rdx, 0xfffffffffffffffc
add rdx, 4
or r8, 3
cmp r8, 0xb
cmove r8, rdx
mov rdx, r8
test cl, cl
js 0x140048a55
cmp rdx, r9
je 0x1400484c9
mov rcx, r14
call fcn.140040270
movsx rax, byte [rsp + 0x1e7]
mov rcx, qword [rsp + 0x1e0]
and rcx, rbp
dec rcx
test rax, rax
cmovns rcx, rsi
cmp rcx, 0x8000
movsx edx, cx
cmovae edx, edi
mov dword [rsp + 0x1cc], edx
test rax, rax
jns 0x140048578
mov rax, qword [rsp + 0x1d8]
cmp rax, rdx
jb 0x140048589
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x1d8], rdx
mov word [rax + rdx*2], 0
cmp byte [rsp + 0x1e7], 0
mov r8, r14
jns 0x140048538
mov r8, qword [rsp + 0x1d0]
mov rcx, qword [rsp + 0x200]
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov edx, ebx
mov r9, r15
call r12
test eax, eax
je 0x1400485b6
cmp eax, 0x103
jne 0x14004842f
xor ebx, ebx
test r13b, 1
mov r13d, 0
jne 0x1400484c9
jmp 0x140047f18
cmp rax, rdx
jb 0x140048589
mov byte [rsp + 0x1e7], dl
mov rax, r14
jmp 0x14004851d
sub rdx, rax
mov rcx, r14
xor r8d, r8d
call fcn.140111ac0
jmp 0x140048523
mov r13b, 1
jmp 0x1400484c9
cmp rax, rdx
jb 0x1400486ce
mov byte [rsp + 0x1e7], dl
mov rax, r14
jmp 0x1400485ec
mov edx, dword [rsp + 0x1cc]
movsx rax, byte [rsp + 0x1e7]
test rax, rax
jns 0x1400485a1
mov rax, qword [rsp + 0x1d8]
cmp rax, rdx
jb 0x1400486ce
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x1d8], rdx
mov word [rax + rdx*2], 0
mov rcx, qword [rsp + 0x1f0]
mov rdx, qword [rsp + 0x1d0]
test rcx, rcx
jne 0x140048922
mov al, byte [rsp + 0x1e7]
test al, al
cmovns rdx, r14
lea rcx, [rsp + 0x200]
call fcn.14005ec10
test eax, eax
je 0x140048599
mov ecx, 2
call fcn.140124de0
test al, al
je 0x1400486af
lea rsi, [rsp + 0x70]
mov rcx, rsi
lea rdx, str.....chromeinstaller_setup_setup_util.cc
mov r8d, 0x20e
mov r9d, 2
call fcn.1400740b0
mov r8d, 0x17
lea rcx, [rsp + 0x80]
lea rdx, str.Failed_to_delete_value
call fcn.1400fd720
mov rcx, rax
mov rdx, r14
call fcn.14006d1a0
mov r8d, 8
mov rcx, rax
lea rdx, str._in_key
call fcn.1400fd720
mov rcx, rax
mov rdx, qword [rsp + 0x68]
call fcn.14006d1a0
mov rcx, rsi
mov esi, 0xa
call fcn.140074680
lea rcx, [rsp + 0x1e8]
lea rdx, [rsp + 0x70]
mov r8, r14
mov r9, r14
call fcn.140112000
inc ebx
jmp 0x1400484c9
sub rdx, rax
mov rcx, r14
xor r8d, r8d
call fcn.140111ac0
jmp 0x1400485f2
test dl, dl
mov r9, rdx
cmovs r9, rcx
mov r10, rdi
cmovs r10, rax
mov qword [rsp + 0x60], r9
test r9, r9
sete r9b
mov qword [rsp + 0x50], r10
test r10, r10
setne r10b
or r10b, r9b
mov byte [rsp + 0x4f], r10b
movsx r9, byte [r8 + 0x37]
mov qword [rsp + 0x58], r9
test r9, r9
js 0x140048726
lea r9, [r8 + 0x20]
jmp 0x140048733
mov r9, qword [r8 + 0x28]
mov qword [rsp + 0x58], r9
mov r9, qword [r8 + 0x20]
mov qword [rsp + 0x40], r9
cmp qword [rsp + 0x58], 0
js 0x140048411
sete r11b
cmp qword [rsp + 0x40], 0
setne r12b
or r12b, r11b
je 0x140048411
cmp qword [rsp + 0x60], 0
js 0x140048411
cmp byte [rsp + 0x4f], 0
je 0x140048411
mov r12, qword [rsp + 0x60]
mov r9, qword [rsp + 0x58]
cmp r9, r12
cmovb r12, r9
test r12, r12
je 0x1400487ab
xor r11d, r11d
mov r9, qword [rsp + 0x40]
movzx r10d, word [r9 + r11*2]
mov r9, qword [rsp + 0x50]
cmp word [r9 + r11*2], r10w
ja 0x1400487bb
jb 0x140048800
inc r11
cmp r12, r11
jne 0x14004878b
mov r9, qword [rsp + 0x58]
cmp qword [rsp + 0x60], r9
jne 0x140048a63
test r12, r12
je 0x1400487e7
xor r11d, r11d
mov r10, qword [rsp + 0x50]
movzx r10d, word [r10 + r11*2]
mov r9, qword [rsp + 0x40]
cmp word [r9 + r11*2], r10w
ja 0x140048409
jb 0x1400487fc
inc r11
cmp r12, r11
jne 0x1400487c3
mov r9, qword [rsp + 0x58]
cmp r9, qword [rsp + 0x60]
je 0x140048409
jmp 0x140048a6e
add r8, 8
mov r8, qword [r8]
test r8, r8
je 0x14004826e
jmp 0x140048711
test al, al
mov r9, qword [rsp + 0x78]
cmovns r9, rax
mov r8, qword [rsp + 0x70]
lea rdx, [rsp + 0x70]
cmovns r8, rdx
mov qword [rsp + 0x40], r9
test r9, r9
sete r9b
test r8, r8
setne dl
or dl, r9b
mov byte [rsp + 0x50], dl
movsx r10, byte [rcx + 0x37]
test r10, r10
js 0x140048853
lea r11, [rcx + 0x20]
jmp 0x14004885b
mov r10, qword [rcx + 0x28]
mov r11, qword [rcx + 0x20]
test r10, r10
js 0x140048411
sete r9b
test r11, r11
setne r12b
or r12b, r9b
je 0x140048411
cmp qword [rsp + 0x40], 0
js 0x140048411
cmp byte [rsp + 0x50], 0
je 0x140048411
mov r12, qword [rsp + 0x40]
cmp r10, r12
cmovb r12, r10
test r12, r12
je 0x1400488b9
xor r9d, r9d
movzx edx, word [r11 + r9*2]
cmp word [r8 + r9*2], dx
ja 0x1400488c4
jb 0x1400488f9
inc r9
cmp r12, r9
jne 0x1400488a3
cmp qword [rsp + 0x40], r10
jne 0x140048a79
test r12, r12
je 0x1400488e2
xor r9d, r9d
movzx edx, word [r8 + r9*2]
cmp word [r11 + r9*2], dx
ja 0x14004890d
jb 0x1400488f5
inc r9
cmp r12, r9
jne 0x1400488cc
mov r12b, 1
cmp r10, qword [rsp + 0x40]
je 0x140048330
jmp 0x140048a8b
add rcx, 8
mov rcx, qword [rcx]
xor r12d, r12d
test rcx, rcx
je 0x140048330
jmp 0x140048843
mov r12b, 1
jmp 0x140048330
lea rcx, [rsp + 0x1d0]
call fcn.1401a65b0
movsx rax, byte [rsp + 0x1e7]
test rax, rax
mov r8, rax
cmovs r8, qword [rsp + 0x1d8]
mov r9, r14
cmovs r9, rdx
mov qword [rsp + 0x50], r8
test r8, r8
sete r8b
mov rsi, r9
test r9, r9
setne r9b
or r9b, r8b
mov byte [rsp + 0x58], r9b
movsx r8, byte [rcx + 0x37]
mov qword [rsp + 0x40], r8
test r8, r8
js 0x140048974
lea r10, [rcx + 0x20]
jmp 0x140048981
mov r8, qword [rcx + 0x28]
mov qword [rsp + 0x40], r8
mov r10, qword [rcx + 0x20]
cmp qword [rsp + 0x40], 0
js 0x140048411
sete r8b
test r10, r10
setne r11b
or r11b, r8b
je 0x140048411
cmp qword [rsp + 0x50], 0
js 0x140048411
cmp byte [rsp + 0x58], 0
je 0x140048411
mov r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x40]
cmp r9, r8
cmovb r8, r9
test r8, r8
je 0x1400489e7
xor r11d, r11d
movzx r9d, word [r10 + r11*2]
cmp word [rsi + r11*2], r9w
ja 0x1400489f7
jb 0x140048a31
inc r11
cmp r8, r11
jne 0x1400489d1
mov r9, qword [rsp + 0x40]
cmp qword [rsp + 0x50], r9
jne 0x140048a84
test r8, r8
je 0x140048a15
xor r11d, r11d
movzx r9d, word [rsi + r11*2]
cmp word [r10 + r11*2], r9w
ja 0x140048a21
jb 0x140048a2d
inc r11
cmp r8, r11
jne 0x1400489ff
mov r8, qword [rsp + 0x40]
cmp r8, qword [rsp + 0x50]
jne 0x140048a96
inc ebx
mov esi, 0xa
jmp 0x1400484c9
add rcx, 8
mov rcx, qword [rcx]
test rcx, rcx
jne 0x14004895f
mov esi, 0xa
jmp 0x140048612
and rax, rbp
dec rax
mov r9, rax
jmp 0x1400480fc
and rax, rbp
dec rax
mov r9, rax
jmp 0x1400484bc
jb 0x140048800
jmp 0x1400487bb
jb 0x1400487fc
jmp 0x140048409
jb 0x1400488f9
jmp 0x1400488c4
jb 0x140048a31
jmp 0x1400489f7
jb 0x1400488f5
jmp 0x140048330
jb 0x140048a2d
jmp 0x140048a21