Function at 0x140073860
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x140173040]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov r14, r8
lea rdx, str.UpdateLastCheckTime
lea rcx, [rsp + 0x60]
call fcn.14003f460
mov rsi, qword [0x14017c638]
mov r9, qword [rsi + 8]
mov rdi, rsi
xor ebp, ebp
mov rax, qword [rsp + 0x60]
cmp byte [r9 + 0x19], bpl
jne 0x140073905
test rax, rax
je 0x140073aea
mov rcx, qword [r9 + 0x20]
mov r8, rax
sub r8, rcx
nop dword [rax]
movzx edx, word [rcx]
cmp dx, word [rcx + r8]
jne 0x1400738e7
add rcx, 2
test dx, dx
jne 0x1400738d0
mov ecx, ebp
jmp 0x1400738ec
sbb ecx, ecx
or ecx, 1
shr ecx, 0x1f
test cl, cl
je 0x1400738f9
mov r9, qword [r9 + 0x10]
jmp 0x1400738ff
mov rdi, r9
mov r9, qword [r9]
cmp byte [r9 + 0x19], bpl
je 0x1400738b6
cmp byte [rdi + 0x19], bpl
jne 0x140073943
mov r8, qword [rdi + 0x20]
test r8, r8
je 0x140073aea
mov rcx, rax
sub r8, rax
nop
movzx edx, word [rcx]
cmp dx, word [rcx + r8]
jne 0x140073937
add rcx, 2
test dx, dx
jne 0x140073920
mov ecx, ebp
jmp 0x14007393c
sbb ecx, ecx
or ecx, 1
shr ecx, 0x1f
test cl, cl
je 0x140073946
mov rdi, rsi
lea rdx, [rax - 0x18]
mov ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140073964
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp rdi, rsi
jne 0x140073a6e
mov dword [rsp + 0x70], ebp
mov qword [r14], rbp
mov eax, dword [0x14017c608]
or eax, 1
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ebp
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [0x14017c610]
mov rcx, qword [0x14017c600]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140073ae3
mov qword [rsp + 0x80], rbp
mov dword [rsp + 0x74], 8
mov dword [rsp + 0x78], 4
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
xor r8d, r8d
lea rdx, str.UpdateLastCheckTime
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x68]
test eax, eax
jne 0x140073add
mov rax, qword [rsp + 0x80]
mov qword [r14], rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.UpdateLastCheckTime
lea rcx, [rsp + 0x50]
call fcn.14003f460
nop
lea rdx, [rsp + 0x50]
lea rcx, [0x14017c638]
call fcn.1400746c0
mov rcx, qword [r14]
mov qword [rax], rcx
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140073a6e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str.UpdateLastCheckTime
lea rcx, [rsp + 0x58]
call fcn.14003f460
nop
lea rdx, [rsp + 0x58]
lea rcx, [0x14017c638]
call fcn.1400746c0
mov rcx, qword [rax]
mov qword [r14], rcx
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x140073ab3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, 1
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1400ff350
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [r14], rbp
xor al, al
jmp 0x140073ab5
mov ecx, 0x80004005
call fcn.140002b00
int3