Function at 0x14008dab0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rax - 0x158]
sub rsp, 0x230
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1401730f8]
xor rax, rsp
mov qword [rbp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal], rax
mov r14, rdx
mov rbx, rcx
lea rsi, [0x140102478]
mov qword [rbp - 0x20], rsi
lea r12, [0x1401025f8]
mov qword [rbp + 0x20], r12
xor r9d, r9d
lea r8, [rsp + 0x30]
lea rdx, str.ProductCode
lea rcx, [rbp - 0x20]
call fcn.140003cb0
nop
mov rcx, qword [rbx + 0x10]
mov rax, qword [rcx]
lea r8, [rbp - 0x20]
lea rdx, [rbp + 0xd0]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
nop
lea rcx, [rbp - 0x20]
call fcn.1400048d0
cmp qword [rbp + 0xe8], 0
jne 0x14008dc35
cmp byte [0x140173b48], 0
jne 0x14008db63
cmp byte [0x14017bbb1], 0
je 0x14008dc2b
lea rdi, [0x140102478]
mov qword [rbp - 0x20], rdi
lea rbx, [0x1401025f8]
mov qword [rbp + 0x20], rbx
xor r9d, r9d
lea rdx, str.IspParcelHandler.cpp
lea rcx, [rbp - 0x20]
call fcn.140006ab0
nop
mov qword [rbp + 0x80], rdi
mov qword [rbp + 0xc0], rbx
xor r9d, r9d
lea rdx, str.ISP_parcel:_cant_find_disk1_target__no_product_code_defined
lea rcx, [rbp + 0x80]
call fcn.140006ab0
nop
cmp byte [0x140173b48], 0
je 0x14008dbdb
cmp byte [0x14017bbb1], 0
jne 0x14008dbcd
call fcn.140099320
test al, al
je 0x14008dbd4
mov byte [0x14017bbb1], 1
mov byte [0x140173b48], 0
cmp byte [0x14017bbb1], 0
je 0x14008dc15
lea rdx, [rbp - 0x18]
cmp qword [rbp], 8
cmovae rdx, qword [rbp - 0x18]
lea rcx, [rbp + 0x88]
cmp qword [rbp + 0xa0], 8
cmovae rcx, qword [rbp + 0x88]
mov r8d, 0x217
call fcn.140099810
nop
lea rcx, [rbp + 0x80]
call fcn.140004280
nop
lea rcx, [rbp - 0x20]
call fcn.140004280
mov ebx, 0x80070057
jmp 0x14008debf
lea r8, [rbp + 0xd0]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstall_
lea rcx, [rbp + 0x30]
call fcn.14000ccf0
nop
xor r15d, r15d
mov edi, r15d
mov qword [rsp + 0x50], r15
mov dword [rsp + 0x58], r15d
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x38], r15
cmp qword [rbp + 0x50], 8
mov rdx, qword [rbp + 0x38]
jae 0x14008dc76
lea rdx, [rbp + 0x38]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14008dcd8
mov qword [rsp + 0x38], r15
cmp qword [rbp + 0x50], 8
mov rdx, qword [rbp + 0x38]
jae 0x14008dcae
lea rdx, [rbp + 0x38]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x14008de68
mov rdi, qword [rsp + 0x38]
mov dword [rsp + 0x58], r15d
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x58], r15d
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x30], r12
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x28], eax
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], r15
mov word [rbp - 0x68], r15w
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], r15
mov rax, qword [rbp - 0x30]
movsxd rcx, dword [rax + 4]
mov ecx, dword [rbp + rcx - 0x30]
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov r8d, 0x104
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x70]
call fcn.140009620
nop
mov byte [rax + 8], 1
mov rcx, qword [rax]
call fcn.140002ef0
mov rsi, qword [rax]
mov dword [rsp + 0x48], 0x208
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.LogFile
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x14008ddca
mov eax, dword [rsp + 0x38]
dec eax
cmp eax, 1
jbe 0x14008dda0
mov ebx, SafeArrayGetDim
jmp 0x14008ddca
test rsi, rsi
je 0x14008ddc7
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x14008ddc3
test al, 1
jne 0x14008ddbc
shr rax, 1
cmp word [rsi + rax*2 - 2], 0
je 0x14008ddc7
mov ebx, SafeArrayGetDim
jmp 0x14008ddca
mov word [rsi], r15w
mov ebx, r15d
lea rcx, [rsp + 0x70]
call fcn.140009c60
cmp qword [rbp - 0x58], 0
jne 0x14008de1b
lea rax, str.IspParcelHandler.cpp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], 0x232
mov r8d, ebx
lea rdx, str.ISP_parcel:_unable_to_obtain_log_file_path__result__x_
lea rcx, [rsp + 0x38]
call fcn.14000b8a0
test ebx, ebx
je 0x14008de14
jle 0x14008de5d
movzx ebx, bx
or ebx, 0x80070000
jmp 0x14008de5d
mov ebx, 0x80004005
jmp 0x14008de5d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x70]
call fcn.14003b930
nop
test rax, rax
lea rdx, [rax + 8]
jne 0x14008de3b
mov rdx, r15
lea rcx, [r14 + 8]
cmp rcx, rdx
je 0x14008de51
or r9, 0xffffffffffffffff
xor r8d, r8d
call fcn.140004680
nop
lea rcx, [rbp - 0x20]
call fcn.1400048d0
mov ebx, r15d
lea rcx, [rbp - 0x70]
call fcn.1400048d0
jmp 0x14008de9d
lea rax, str.IspParcelHandler.cpp
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], 0x224
mov r8d, ebx
lea rdx, str.ISP_parcel:_failed_to_open_uninstall_key__error__x
lea rcx, [rsp + 0x38]
call fcn.14000b8a0
test ebx, ebx
jle 0x14008de9d
movzx ebx, bx
or ebx, 0x80070000
test rdi, rdi
je 0x14008deb0
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], r15
mov dword [rsp + 0x58], r15d
lea rcx, [rbp + 0x30]
call fcn.1400048d0
nop
lea rcx, [rbp + 0xd0]
call fcn.1400048d0
mov eax, ebx
mov rcx, qword [rbp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal]
xor rcx, rsp
call fcn.1400b31f0
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret