Function at 0x180054db0
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
sub rsp, 0x310
mov qword [rsp + 0xb8], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rsi
mov rax, qword [0x18013e1e0]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov r13, rdx
mov rsi, rcx
mov qword [r11 - 0x278], rdx
xor r9d, r9d
lea r8, str.version
lea rdx, [rsp + 0x70]
mov rcx, r13
call fcn.18007dc10
nop
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x180054e55
mov ecx, dword [rax + 0xc]
test ecx, ecx
je 0x180054e55
mov rdx, qword [rax + 0x30]
test rdx, rdx
je 0x180054e55
test ecx, ecx
jle 0x180054e2f
mov rdx, qword [rdx]
xor ebx, ebx
jmp 0x180054e34
xor ebx, ebx
mov rdx, rbx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [0x180144960]
call fcn.180014810
jmp 0x180054e57
xor ebx, ebx
xor r9d, r9d
lea r8, str.toolbarname
lea rdx, [rsp + 0x60]
mov rcx, r13
call fcn.18007dc10
nop
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x180054eb4
mov ecx, dword [rax + 0xc]
test ecx, ecx
je 0x180054eb4
mov rdx, qword [rax + 0x30]
test rdx, rdx
je 0x180054eb4
test ecx, ecx
jle 0x180054e92
mov rdx, qword [rdx]
jmp 0x180054e95
mov rdx, rbx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [0x180144910]
call fcn.180014810
xor r9d, r9d
lea r8, str.appid
lea rdx, [rsp + 0x50]
mov rcx, r13
call fcn.18007dc10
nop
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x180054f11
mov ecx, dword [rax + 0xc]
test ecx, ecx
je 0x180054f11
mov rdx, qword [rax + 0x30]
test rdx, rdx
je 0x180054f11
test ecx, ecx
jle 0x180054eef
mov rdx, qword [rdx]
jmp 0x180054ef2
mov rdx, rbx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [0x180144938]
call fcn.180014810
xor r9d, r9d
lea r8, str.urlbase
lea rdx, [rsp + 0x48]
mov rcx, r13
call fcn.18007dc10
nop
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x180054f6e
mov ecx, dword [rax + 0xc]
test ecx, ecx
je 0x180054f6e
mov rdx, qword [rax + 0x30]
test rdx, rdx
je 0x180054f6e
test ecx, ecx
jle 0x180054f4c
mov rdx, qword [rdx]
jmp 0x180054f4f
mov rdx, rbx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsi + 0x6d0]
call fcn.180014810
xor r9d, r9d
lea r8, str.imgbase
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.18007dc10
nop
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x180054fcb
mov ecx, dword [rax + 0xc]
test ecx, ecx
je 0x180054fcb
mov rdx, qword [rax + 0x30]
test rdx, rdx
je 0x180054fcb
test ecx, ecx
jle 0x180054fa9
mov rdx, qword [rdx]
jmp 0x180054fac
mov rdx, rbx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsi + 0x680]
call fcn.180014810
xor r9d, r9d
lea r8, str.clientversion
lea rdx, [rsp + 0x78]
mov rcx, r13
call fcn.18007dc10
nop
mov rax, qword [rsp + 0x78]
test rax, rax
je 0x180055028
mov ecx, dword [rax + 0xc]
test ecx, ecx
je 0x180055028
mov rdx, qword [rax + 0x30]
test rdx, rdx
je 0x180055028
test ecx, ecx
jle 0x180055006
mov rdx, qword [rdx]
jmp 0x180055009
mov rdx, rbx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsi + 0x6a8]
call fcn.180014810
xor r9d, r9d
lea r8, str.toolbar_height
lea rdx, [rsp + 0x80]
mov rcx, r13
call fcn.18007dc10
nop
mov rax, qword [rsp + 0x80]
test rax, rax
je 0x18005507e
mov ecx, dword [rax + 0xc]
test ecx, ecx
je 0x18005507e
mov rdx, qword [rax + 0x30]
test rdx, rdx
je 0x18005507e
test ecx, ecx
jle 0x180055069
mov rcx, qword [rdx]
jmp 0x18005506c
mov rcx, rbx
call fcn.1800c1918
cdq
xor eax, edx
sub eax, edx
mov dword [0x1801441a8], eax
jmp 0x180055088
mov dword [0x1801441a8], 0x1a
xor r9d, r9d
lea r8, str.hours_inactive
lea rdx, [rsp + 0x68]
mov rcx, r13
call fcn.18007dc10
nop
mov rax, qword [rsp + 0x68]
test rax, rax
je 0x180055159
cmp dword [rax + 0xc], 0
je 0x180055159
cmp qword [rax + 0x30], 0
je 0x180055159
cmp dword [rax + 0xc], 0
jle 0x1800550d2
mov rcx, qword [rax + 0x30]
mov rdx, qword [rcx]
jmp 0x1800550d5
mov rdx, rbx
mov qword [rsp + 0xe0], 7
mov qword [rsp + 0xd8], rbx
mov word [rsp + 0xc8], bx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0xc0]
call fcn.180014810
cmp qword [rsp + 0xd8], 0
je 0x180055141
lea rcx, [rsp + 0xc8]
cmp qword [rsp + 0xe0], 8
cmovae rcx, qword [rsp + 0xc8]
call fcn.1800c1918
mov dword [rsi + 0x3a0], eax
cmp qword [rsp + 0xe0], 8
jb 0x180055159
mov rcx, qword [rsp + 0xc8]
call fcn.1800bf8b4
mov r12, rbx
mov qword [rsp + 0x88], rbx
mov dword [rsp + 0x90], ebx
call fcn.180069830
mov edi, 0x20219
mov ecx, 0x20119
test eax, eax
cmovne edi, ecx
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstallF009657E_18AE_4744_A253_2FE9452A0BDC
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800552f9
mov r12, qword [rsp + 0x30]
mov qword [rsp + 0x88], r12
and edi, 0x300
mov dword [rsp + 0x90], edi
mov word [rsp + 0xf0], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0xf2]
call fcn.1800c31a0
mov dword [rsp + 0x38], 0x208
mov dword [rsp + 0x30], ebx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.DisplayVersion
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov ecx, dword [rsp + 0x38]
test ecx, ecx
je 0x1800552a1
mov edx, dword [rsp + 0x30]
test edx, edx
je 0x180055297
cmp edx, 2
jbe 0x180055277
cmp edx, 7
jne 0x180055297
test cl, 1
jne 0x18005526d
mov eax, ecx
shr eax, 1
cmp eax, 1
jb 0x18005526d
mov rdx, rcx
shr rdx, 1
cmp word [rsp + rdx*2 + 0xee], 0
jne 0x18005526d
cmp eax, 1
jbe 0x1800552a9
cmp word [rsp + rdx*2 + 0xec], 0
je 0x1800552a9
mov word [rsp + 0xf0], bx
jmp 0x1800552d9
test cl, 1
jne 0x18005528d
mov rax, rcx
shr rax, 1
cmp word [rsp + rax*2 + 0xee], 0
je 0x1800552a9
mov word [rsp + 0xf0], bx
jmp 0x1800552d9
mov word [rsp + 0xf0], bx
jmp 0x1800552d9
mov word [rsp + 0xf0], bx
test edi, edi
jne 0x1800552d9
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xf0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsi + 0x530]
lea rdx, [rsp + 0xf0]
call fcn.180014810
test r12, r12
je 0x1800552f2
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12, rbx
mov qword [rsp + 0x88], rbx
mov dword [rsp + 0x90], ebx
xor r9d, r9d
lea r8, str.update
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.18007dc10
nop
cmp qword [rsp + 0x30], 0
je 0x180055531
xor r9d, r9d
lea r8, str.newversion
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x30]
call fcn.18007dc10
nop
mov rax, qword [rsp + 0xa0]
test rax, rax
je 0x18005537d
cmp dword [rax + 0xc], 0
jle 0x18005537d
mov rcx, qword [rax + 0x30]
mov rdx, qword [rcx]
test rdx, rdx
je 0x18005537d
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r8, rcx
je 0x18005537d
lea rcx, [rsi + 0x448]
call fcn.180014810
xor r9d, r9d
lea r8, str.download_link
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x30]
call fcn.18007dc10
nop
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x1800553d7
cmp dword [rax + 0xc], 0
jle 0x1800553d7
mov rcx, qword [rax + 0x30]
mov rdx, qword [rcx]
test rdx, rdx
je 0x1800553d7
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r8, rcx
je 0x1800553d7
lea rcx, [rsi + 0x4e0]
call fcn.180014810
xor r9d, r9d
lea r8, str.cmdline
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x30]
call fcn.18007dc10
nop
mov rax, qword [rsp + 0xa8]
test rax, rax
je 0x180055437
cmp dword [rax + 0xc], 0
jle 0x180055437
mov rcx, qword [rax + 0x30]
mov rdx, qword [rcx]
test rdx, rdx
je 0x180055437
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r8, rcx
je 0x180055437
lea rcx, [rsi + 0x4b8]
call fcn.180014810
xor r9d, r9d
lea r8, str.no_updates_msg
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x30]
call fcn.18007dc10
nop
mov rax, qword [rsp + 0x98]
test rax, rax
je 0x180055497
cmp dword [rax + 0xc], 0
jle 0x180055497
mov rcx, qword [rax + 0x30]
mov rdx, qword [rcx]
test rdx, rdx
je 0x180055497
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r8, rcx
je 0x180055497
lea rcx, [rsi + 0x3d0]
call fcn.180014810
xor r9d, r9d
lea r8, str.update_msg
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.18007dc10
nop
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x1800554f2
cmp dword [rax + 0xc], 0
jle 0x1800554f2
mov rdx, qword [rax + 0x30]
mov rdx, qword [rdx]
test rdx, rdx
je 0x1800554f2
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov r8, rcx
je 0x1800554f2
lea rcx, [rsi + 0x3f8]
call fcn.180014810
nop
lea rcx, [rsp + 0x38]
call fcn.18007d5c0
nop
lea rcx, [rsp + 0x98]
call fcn.18007d5c0
nop
lea rcx, [rsp + 0xa8]
call fcn.18007d5c0
nop
lea rcx, [rsp + 0x58]
call fcn.18007d5c0
nop
lea rcx, [rsp + 0xa0]
call fcn.18007d5c0
lea rcx, [rsi + 0x530]
mov rax, qword [rsi + 0x6c0]
cmp qword [rsi + 0x6c8], 8
jb 0x180055552
mov r9, qword [rsi + 0x6b0]
jmp 0x180055559
lea r9, [rsi + 0x6b0]
mov qword [rsp + 0x20], rax
mov r8, qword [rcx + 0x18]
xor edx, edx
call fcn.180013670
test eax, eax
je 0x180055577
mov dword [rsi + 0x678], 1
lea rcx, [rsp + 0x30]
call fcn.18007d5c0
nop
test r12, r12
je 0x180055591
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x68]
call fcn.18007d5c0
nop
lea rcx, [rsp + 0x80]
call fcn.18007d5c0
nop
lea rcx, [rsp + 0x78]
call fcn.18007d5c0
nop
lea rcx, [rsp + 0x40]
call fcn.18007d5c0
nop
lea rcx, [rsp + 0x48]
call fcn.18007d5c0
nop
lea rcx, [rsp + 0x50]
call fcn.18007d5c0
nop
lea rcx, [rsp + 0x60]
call fcn.18007d5c0
nop
lea rcx, [rsp + 0x70]
call fcn.18007d5c0
nop
mov rcx, r13
call fcn.18007d5c0
mov eax, 1
jmp 0x18005560a
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.1800bf8d0
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret