Function at 0x1400c5ca0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xd8
lea r13, str.SOFTWAREMicrosoftEdgeUpdateClientState_
mov rbx, rcx
lea rbp, [rsp + 0x60]
mov rcx, r13
mov rsi, r9
mov dword [rsp + 0x128], edx
mov r12d, r8d
lea rdi, [rsp + 0x50]
mov qword [rsp + 0x50], rbp
call sub.msvcrt.dll_wcslen
mov rdx, r13
mov rcx, rdi
lea r8, [r13 + rax*2]
call fcn.1400c5450
mov r8, qword [rsi + 8]
mov rdx, qword [rsi]
movabs rax, 0x1fffffffffffffff
sub rax, qword [rsp + 0x58]
cmp rax, r8
jb 0x1400c60c5
mov rcx, rdi
call fcn.1400f90f0
cmp r12b, 1
mov rdx, qword [rsp + 0x50]
mov rcx, 0xffffffff80000001
lea rsi, [rsp + 0xb0]
sbb rcx, 0xffffffffffffffff
mov qword [rsp + 0x20], rsi
mov r9d, 0x20219
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c5f78
mov r13, qword [rsp + 0xb0]
test r13, r13
je 0x1400c5f78
xor edx, edx
lea r15, [rsp + 0x80]
xor r9d, r9d
xor r8d, r8d
mov word [rsp + 0x80], dx
mov rcx, r13
mov r14, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, str.EBWebView
mov qword [rsp + 0x70], r15
lea r12, [rsp + 0x70]
mov qword [rsp + 0x78], 0
mov dword [rsp + 0xb0], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], 0
call r14
test eax, eax
je 0x1400c5f28
cmp eax, 0xea
je 0x1400c5f28
xor r8d, r8d
xor edx, edx
mov rcx, r12
call fcn.1400f87f0
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x70]
jmp 0x1400c5dfb
cmp word [rcx + rdx*2 - 2], 0
lea rax, [rdx - 1]
jne 0x1400c5fe0
mov rdx, rax
test rdx, rdx
jne 0x1400c5de8
mov r8, 0xffffffffffffffff
mov edx, 0x5c
mov rcx, r12
call fcn.1400ec900
cmp rax, 0xffffffffffffffff
je 0x1400c5fa8
mov r9, qword [rsp + 0x78]
add rax, 1
cmp r9, rax
jb 0x1400c60db
mov rdx, qword [rsp + 0x70]
sub r9, rax
lea r14, [rsp + 0xa0]
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x90], r14
lea rdx, [rdx + rax*2]
lea r8, [rdx + r9*2]
call fcn.1400c5450
mov rdx, qword [rsp + 0x90]
mov r8, qword [rsp + 0x98]
lea rcx, [rsp + 0x40]
call fcn.1400c5820
mov eax, dword [rsp + 0x128]
cmp dword [rsp + 0x48], eax
jae 0x1400c5ff0
pxor xmm0, xmm0
lea rax, [rbx + 0x18]
movups xmmword [rbx], xmm0
mov qword [rbx + 8], rax
lea rax, [rbx + 0x38]
movups xmmword [rbx + 0x20], xmm0
mov qword [rbx + 0x28], rax
movups xmmword [rbx + 0x10], xmm0
movups xmmword [rbx + 0x30], xmm0
movups xmmword [rbx + 0x40], xmm0
mov rcx, qword [rsp + 0x90]
cmp rcx, r14
je 0x1400c5ece
mov rax, qword [rsp + 0xa0]
lea rdx, [rax + rax + 2]
call fcn.1400fd3a0
mov rcx, qword [rsp + 0x70]
cmp rcx, r15
je 0x1400c5eea
mov rax, qword [rsp + 0x80]
lea rdx, [rax + rax + 2]
call fcn.1400fd3a0
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
cmp rcx, rbp
je 0x1400c5f0c
mov rax, qword [rsp + 0x60]
lea rdx, [rax + rax + 2]
call fcn.1400fd3a0
mov rax, rbx
add rsp, 0xd8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov edx, dword [rsp + 0xb0]
lea r12, [rsp + 0x70]
xor r8d, r8d
mov rcx, r12
shr rdx, 1
call fcn.1400f87f0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.EBWebView
mov rcx, r13
mov qword [rsp + 0x20], rax
call r14
test eax, eax
je 0x1400c5dd9
jmp 0x1400c5dcc
pxor xmm0, xmm0
lea rax, [rbx + 0x18]
movups xmmword [rbx], xmm0
mov qword [rbx + 8], rax
lea rax, [rbx + 0x38]
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x10], xmm0
mov qword [rbx + 0x28], rax
movups xmmword [rbx + 0x30], xmm0
movups xmmword [rbx + 0x40], xmm0
jmp 0x1400c5ef3
lea r14, [rsp + 0xa0]
xor eax, eax
xor r8d, r8d
mov qword [rsp + 0x98], 0
mov qword [rsp + 0x90], r14
mov rdx, r14
mov word [rsp + 0xa0], ax
jmp 0x1400c5e6d
xor r8d, r8d
mov rcx, r12
call fcn.1400f87f0
jmp 0x1400c5e00
mov rdx, r12
mov rcx, rsi
call fcn.1400c54e0
pxor xmm0, xmm0
lea rax, [rbx + 0x18]
mov rdx, qword [rsp + 0xb0]
lea rcx, [rbx + 8]
movups xmmword [rbx], xmm0
mov qword [rbx + 8], rax
mov rax, qword [rsp + 0xb8]
mov byte [rbx], 1
movups xmmword [rbx + 0x10], xmm0
lea r8, [rdx + rax*2]
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
movups xmmword [rbx + 0x40], xmm0
mov qword [rsp + 0x38], rcx
call fcn.1400c53c0
lea rax, [rbx + 0x38]
mov rdx, qword [rsp + 0x90]
lea rcx, [rbx + 0x28]
mov qword [rbx + 0x28], rax
mov rax, qword [rsp + 0x98]
lea r8, [rdx + rax*2]
call fcn.1400c53c0
mov rcx, qword [rsp + 0xb0]
lea rax, [rsp + 0xc0]
cmp rcx, rax
je 0x1400c5eaf
mov rax, qword [rsp + 0xc0]
lea rdx, [rax + rax + 2]
call fcn.1400fd3a0
jmp 0x1400c5eaf
mov rcx, r12
call fcn.1400f6bc0
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call fcn.1400f6bc0
mov rcx, rbx
call fcn.1400dbd40
lea rcx, [0x140230a82]
call fcn.1400fdea0
mov rbx, rax
jmp 0x1400c60a4
mov r8, rax
lea rdx, [0x140230b8a]
lea rcx, [0x140230ba0]
call fcn.1400fdf40
jmp 0x1400c60d1