Function at 0x1400e9770
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x258
movaps xmmword [rsp + 0x240], xmm6
mov r13, rdx
mov rdi, rcx
mov rax, qword [0x140516040]
xor rax, rsp
mov qword [rsp + 0x238], rax
lea rax, [rsp + 0x228]
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax - 8], rax
mov rsi, qword [r8]
mov r12, qword [r8 + 8]
lea rcx, [rsp + 0x220]
mov qword [rsp + 0x1e8], rcx
mov qword [rsp + 0x1f0], rax
cmp rsi, r12
je 0x1400e9863
lea rbx, [rsp + 0x70]
lea r14, [rsp + 0x200]
lea r15, [rsp + 0x1e8]
movsx rcx, byte [rsi + 0x17]
mov rax, rsi
test rcx, rcx
jns 0x1400e9806
mov rcx, qword [rsi + 8]
mov rax, qword [rsi]
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x208], rcx
test rcx, rcx
js 0x1400e9ec3
sete cl
test rax, rax
setne al
or al, cl
je 0x1400e9ec3
mov rcx, rbx
mov rdx, r14
call fcn.140101270
mov rcx, r15
mov rdx, rbx
call fcn.14030a9c0
cmp byte [rsp + 0x87], 0
jns 0x1400e985a
mov rcx, qword [rsp + 0x70]
call fcn.14029a668
add rsi, 0x18
cmp rsi, r12
jne 0x1400e97f2
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x200]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x140484a40]
movaps xmmword [rbx], xmm0
mov rcx, rbx
call fcn.1400ff660
cmp byte [r13 + 0x17], 0
mov r8, r13
jns 0x1400e9899
mov r8, qword [r13]
mov rcx, rbx
mov rdx, rdi
mov r9d, ntohl
call fcn.1400ff820
test eax, eax
je 0x1400e9a44
mov edi, eax
mov ecx, 2
call fcn.140212c30
xor al, 1
cmp edi, 2
sete cl
or cl, al
jne 0x1400e99f0
lea rdx, str.....chromeinstaller_setup_setup_util.cc
lea rbx, [rsp + 0x70]
mov rcx, rbx
mov r8d, 0x19b
mov r9d, 2
call fcn.1401165d0
lea rcx, [rsp + 0x80]
lea rdx, str.Failed_to_open
mov r8d, 0xf
call fcn.1401e8c50
mov rcx, rax
mov rdx, r13
call fcn.14010f120
lea rdx, str.__result_
mov r8d, ntohl
mov rcx, rax
call fcn.1401e8c50
mov rcx, rax
mov edx, edi
call fcn.1400c2c60
mov rcx, rbx
call fcn.140116bd0
jmp 0x1400e99f0
lea rdx, [0x14049177a]
lea rcx, [rsp + 0x200]
mov r8b, 1
call fcn.1400ff9d0
test eax, eax
je 0x1400e99c8
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, 2
call fcn.140212c30
test al, al
je 0x1400e99c8
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.....chromeinstaller_setup_setup_util.cc
lea rdi, [rsp + 0x70]
mov rcx, rdi
mov r8d, 0x1e5
mov r9d, 2
call fcn.140313cd0
lea rcx, [rsp + 0x80]
lea rdx, str.Failed_to_delete_key
mov r8d, 0x15
call fcn.1401e8c50
mov rcx, rax
mov rdx, qword [rsp + 0x68]
call fcn.14010f120
mov rcx, rdi
call fcn.140313d40
cmp byte [rsp + 0x1e7], 0
jns 0x1400e99df
mov rcx, qword [rsp + 0x1d0]
call fcn.14029a668
lea rcx, [rsp + 0x1e8]
mov rdx, qword [rcx + 8]
call fcn.1400ec630
lea rcx, [rsp + 0x200]
call fcn.1400ff950
lea rcx, [rsp + 0x220]
mov rdx, qword [rcx + 8]
call fcn.1400ec630
mov rcx, qword [rsp + 0x238]
xor rcx, rsp
cmp rcx, qword [0x140516040]
je 0x1400e9a28
call fcn.14029bbb0
int3
movaps xmm6, xmmword [rsp + 0x240]
add rsp, 0x258
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x68], r13
movabs rbp, 0x7fffffffffffffff
lea rax, [rsp + 0x1f0]
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov qword [rax - 8], rax
mov ecx, 0x208
call fcn.14029a62c
lea rdi, [rsp + 0x1d0]
mov qword [rdi], rax
lea r12, [rbp + 0x105]
mov qword [rdi + 0x10], r12
mov qword [rdi + 8], 0x100
mov r8d, 0x202
mov rcx, rax
xor edx, edx
call fcn.1402d9b60
mov al, 0x80
mov ebx, 0xa
lea r14, [rsp + 0x1cc]
mov rsi, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
xor r13d, r13d
xor r15d, r15d
jmp 0x1400e9bca
cmp qword [rsp + 0x1f8], 0
je 0x1400e993f
lea rsi, [rsp + 0x1e8]
mov rdx, qword [rsi + 8]
mov rcx, rsi
call fcn.1400ec630
lea rax, [rsp + 0x1f0]
mov qword [rsi], rax
xorps xmm6, xmm6
movups xmmword [rsi + 8], xmm6
mov esi, 0xa
mov edi, 0x7fff
lea r14, [rsp + 0x1d0]
lea r15, [rsp + 0x1cc]
mov r12, qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ebx, ebx
xor r13d, r13d
jmp 0x1400e9f73
mov r9, rax
and r9, rbp
dec r9
cmp r9, rdx
jae 0x1400e9bbb
mov rdx, qword [rsp + 0x1d8]
jmp 0x1400e9b7c
cmp eax, 0xea
jne 0x1400e9abe
movsx rcx, byte [rsp + 0x1e7]
test rcx, rcx
mov rax, qword [rsp + 0x1e0]
lea rdx, [rax + rax - 2]
mov r8d, 0x14
cmovs r8, rdx
lea r9, [rbp - 8]
cmp r8, r9
ja 0x1400ea3bf
test cl, cl
js 0x1400e9b1e
mov rdx, rcx
cmp rdx, r8
cmova r8, rdx
mov rdx, r8
or rdx, 3
cmp rdx, 0xb
mov r9d, ntohl
cmove rdx, r9
cmp r8, 0xb
mov r8d, 0xa
cmovb rdx, r8
test cl, cl
js 0x1400ea4f1
cmp rdx, r8
je 0x1400e9bbb
mov rcx, rdi
call fcn.1400e2570
mov al, byte [rsp + 0x1e7]
mov r12, qword [rsp + 0x1e0]
and r12, rbp
dec r12
test al, al
cmovns r12, rbx
mov rcx, r12
shr rcx, 0x20
neg rcx
mov edx, 0
sbb edx, edx
or edx, r12d
mov dword [rsp + 0x1cc], edx
test al, al
jns 0x1400e9c72
mov rax, qword [rsp + 0x1d8]
cmp rax, rdx
jb 0x1400e9c86
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x1d8], rdx
mov word [rax + rdx*2], 0
cmp byte [rsp + 0x1e7], 0
mov r8, rdi
jns 0x1400e9c31
mov r8, qword [rsp + 0x1d0]
mov rcx, qword [rsp + 0x200]
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov edx, r13d
mov r9, r14
call rsi
test eax, eax
je 0x1400e9cbf
cmp eax, 0x103
jne 0x1400e9b3a
xor r13d, r13d
test r15b, 1
mov r15d, 0
jne 0x1400e9bbb
jmp 0x1400e9abe
movzx eax, al
cmp rax, rdx
jb 0x1400e9c86
mov byte [rsp + 0x1e7], dl
mov rax, rdi
jmp 0x1400e9c16
sub rdx, rax
mov rcx, rdi
xor r8d, r8d
call fcn.1401fd630
jmp 0x1400e9c1c
mov r15b, 1
jmp 0x1400e9bbb
sub rdx, rax
mov rcx, rdi
xor r8d, r8d
call fcn.1401fd630
jmp 0x1400e9cf7
cmp rax, rdx
jb 0x1400e9c9e
mov byte [rsp + 0x1e7], dl
mov rax, rdi
jmp 0x1400e9cf1
mov edx, dword [rsp + 0x1cc]
movsx rax, byte [rsp + 0x1e7]
test rax, rax
jns 0x1400e9cae
mov rax, qword [rsp + 0x1d8]
cmp rax, rdx
jb 0x1400e9c9e
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x1d8], rdx
mov word [rax + rdx*2], 0
mov r8, qword [rsp + 0x1f0]
movzx edx, byte [rsp + 0x1e7]
mov rax, qword [rsp + 0x1d0]
mov rcx, qword [rsp + 0x1d8]
test r8, r8
jne 0x1400ea18b
test dl, dl
cmovns rcx, rdx
cmovns rax, rdi
mov qword [rsp + 0x1b8], rax
mov qword [rsp + 0x1c0], rcx
test rcx, rcx
js 0x1400e9ec3
sete cl
test rax, rax
setne al
or al, cl
je 0x1400e9ec3
lea rcx, [rsp + 0x1b8]
call fcn.140101260
test al, al
je 0x1400e9df9
movsx rcx, byte [rsp + 0x1e7]
test rcx, rcx
cmovs rcx, qword [rsp + 0x1d8]
mov rax, qword [rsp + 0x1d0]
cmovns rax, rdi
mov qword [rsp + 0x1a8], rax
mov qword [rsp + 0x1b0], rcx
test rcx, rcx
js 0x1400e9ec3
sete cl
test rax, rax
setne al
or al, cl
je 0x1400e9ec3
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x1a8]
call fcn.140101270
mov rcx, qword [rsp + 0x228]
movzx eax, byte [rsp + 0x87]
test rcx, rcx
jne 0x1400ea2bb
xor r12d, r12d
test al, al
jns 0x1400e9df0
mov rcx, qword [rsp + 0x70]
call fcn.14029a668
test r12b, r12b
jne 0x1400e9ea3
cmp byte [rsp + 0x1e7], 0
mov rdx, rdi
jns 0x1400e9e0e
mov rdx, qword [rsp + 0x1d0]
lea rcx, [rsp + 0x200]
mov r8b, 1
call fcn.1400ff9d0
test eax, eax
je 0x1400e9c96
mov ecx, 2
call fcn.140212c30
test al, al
je 0x1400e9ea3
lea r12, [rsp + 0x70]
mov rcx, r12
lea rdx, str.....chromeinstaller_setup_setup_util.cc
mov r8d, 0x1d6
mov r9d, 2
call fcn.1401165d0
mov r8d, 0x18
lea rcx, [rsp + 0x80]
lea rdx, str.Failed_to_delete_subkey
call fcn.1401e8c50
mov rcx, rax
mov rdx, rdi
call fcn.14010f120
mov r8d, ntohl
mov rcx, rax
lea rdx, str._under_path
call fcn.1401e8c50
mov rcx, rax
mov rdx, qword [rsp + 0x68]
call fcn.14010f120
mov rcx, r12
call fcn.140116bd0
lea rcx, [rsp + 0x1e8]
lea rdx, [rsp + 0x70]
mov r8, rdi
mov r9, rdi
call fcn.1401fdb70
inc r13d
jmp 0x1400e9bbb
ud2
mov r9, rax
and r9, rbp
dec r9
cmp r9, rdx
jae 0x1400e9f73
mov rdx, qword [rsp + 0x1d8]
jmp 0x1400e9f34
cmp eax, 0xea
jne 0x1400e99c8
cmp dword [rsp + 0x1cc], 0x7ffe
ja 0x1400e99c8
movsx rcx, byte [rsp + 0x1e7]
test rcx, rcx
mov rax, qword [rsp + 0x1e0]
lea rdx, [rax + rax - 2]
mov r8d, 0x14
cmovs r8, rdx
lea r9, [rbp - 8]
cmp r8, r9
ja 0x1400ea3bf
test cl, cl
js 0x1400e9ec5
mov rdx, rcx
cmp rdx, r8
cmova r8, rdx
mov rdx, r8
or rdx, 3
cmp rdx, 0xb
mov r9d, ntohl
cmove rdx, r9
cmp r8, 0xb
mov r8d, 0xa
cmovb rdx, r8
test cl, cl
js 0x1400ea4ff
cmp rdx, r8
je 0x1400e9f73
mov rcx, r14
call fcn.1400e2570
movsx rax, byte [rsp + 0x1e7]
mov rcx, qword [rsp + 0x1e0]
and rcx, rbp
dec rcx
test rax, rax
cmovns rcx, rsi
cmp rcx, 0x8000
movsx edx, cx
cmovae edx, edi
mov dword [rsp + 0x1cc], edx
test rax, rax
jns 0x1400ea022
mov rax, qword [rsp + 0x1d8]
cmp rax, rdx
jb 0x1400ea033
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x1d8], rdx
mov word [rax + rdx*2], 0
cmp byte [rsp + 0x1e7], 0
mov r8, r14
jns 0x1400e9fe2
mov r8, qword [rsp + 0x1d0]
mov rcx, qword [rsp + 0x200]
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov edx, ebx
mov r9, r15
call r12
test eax, eax
je 0x1400ea060
cmp eax, 0x103
jne 0x1400e9ee1
xor ebx, ebx
test r13b, 1
mov r13d, 0
jne 0x1400e9f73
jmp 0x1400e99c8
cmp rax, rdx
jb 0x1400ea033
mov byte [rsp + 0x1e7], dl
mov rax, r14
jmp 0x1400e9fc7
sub rdx, rax
mov rcx, r14
xor r8d, r8d
call fcn.1401fd630
jmp 0x1400e9fcd
mov r13b, 1
jmp 0x1400e9f73
cmp rax, rdx
jb 0x1400ea178
mov byte [rsp + 0x1e7], dl
mov rax, r14
jmp 0x1400ea096
mov edx, dword [rsp + 0x1cc]
movsx rax, byte [rsp + 0x1e7]
test rax, rax
jns 0x1400ea04b
mov rax, qword [rsp + 0x1d8]
cmp rax, rdx
jb 0x1400ea178
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x1d8], rdx
mov word [rax + rdx*2], 0
mov rcx, qword [rsp + 0x1f0]
mov rdx, qword [rsp + 0x1d0]
test rcx, rcx
jne 0x1400ea3cc
mov al, byte [rsp + 0x1e7]
test al, al
cmovns rdx, r14
lea rcx, [rsp + 0x200]
call fcn.1400ffe20
test eax, eax
je 0x1400ea043
mov ecx, 2
call fcn.140212c30
test al, al
je 0x1400ea159
lea rsi, [rsp + 0x70]
mov rcx, rsi
lea rdx, str.....chromeinstaller_setup_setup_util.cc
mov r8d, 0x213
mov r9d, 2
call fcn.1401165d0
mov r8d, 0x17
lea rcx, [rsp + 0x80]
lea rdx, str.Failed_to_delete_value
call fcn.1401e8c50
mov rcx, rax
mov rdx, r14
call fcn.14010f120
mov r8d, 8
mov rcx, rax
lea rdx, str._in_key
call fcn.1401e8c50
mov rcx, rax
mov rdx, qword [rsp + 0x68]
call fcn.14010f120
mov rcx, rsi
mov esi, 0xa
call fcn.140116bd0
lea rcx, [rsp + 0x1e8]
lea rdx, [rsp + 0x70]
mov r8, r14
mov r9, r14
call fcn.1401fdb70
inc ebx
jmp 0x1400e9f73
sub rdx, rax
mov rcx, r14
xor r8d, r8d
call fcn.1401fd630
jmp 0x1400ea09c
test dl, dl
mov r9, rdx
cmovs r9, rcx
mov r10, rdi
cmovs r10, rax
mov qword [rsp + 0x60], r9
test r9, r9
sete r9b
mov qword [rsp + 0x50], r10
test r10, r10
setne r10b
or r10b, r9b
mov byte [rsp + 0x4f], r10b
movsx r9, byte [r8 + 0x37]
mov qword [rsp + 0x58], r9
test r9, r9
js 0x1400ea1d0
lea r9, [r8 + 0x20]
jmp 0x1400ea1dd
mov r9, qword [r8 + 0x28]
mov qword [rsp + 0x58], r9
mov r9, qword [r8 + 0x20]
mov qword [rsp + 0x40], r9
cmp qword [rsp + 0x58], 0
js 0x1400e9ec3
sete r11b
cmp qword [rsp + 0x40], 0
setne r12b
or r12b, r11b
je 0x1400e9ec3
cmp qword [rsp + 0x60], 0
js 0x1400e9ec3
cmp byte [rsp + 0x4f], 0
je 0x1400e9ec3
mov r12, qword [rsp + 0x60]
mov r9, qword [rsp + 0x58]
cmp r9, r12
cmovb r12, r9
test r12, r12
je 0x1400ea255
xor r11d, r11d
mov r9, qword [rsp + 0x40]
movzx r10d, word [r9 + r11*2]
mov r9, qword [rsp + 0x50]
cmp word [r9 + r11*2], r10w
ja 0x1400ea265
jb 0x1400ea2aa
inc r11
cmp r12, r11
jne 0x1400ea235
mov r9, qword [rsp + 0x58]
cmp qword [rsp + 0x60], r9
jne 0x1400ea50d
test r12, r12
je 0x1400ea291
xor r11d, r11d
mov r10, qword [rsp + 0x50]
movzx r10d, word [r10 + r11*2]
mov r9, qword [rsp + 0x40]
cmp word [r9 + r11*2], r10w
ja 0x1400e9ebb
jb 0x1400ea2a6
inc r11
cmp r12, r11
jne 0x1400ea26d
mov r9, qword [rsp + 0x58]
cmp r9, qword [rsp + 0x60]
je 0x1400e9ebb
jmp 0x1400ea518
add r8, 8
mov r8, qword [r8]
test r8, r8
je 0x1400e9d20
jmp 0x1400ea1bb
test al, al
mov r9, qword [rsp + 0x78]
cmovns r9, rax
mov r8, qword [rsp + 0x70]
lea rdx, [rsp + 0x70]
cmovns r8, rdx
mov qword [rsp + 0x40], r9
test r9, r9
sete r9b
test r8, r8
setne dl
or dl, r9b
mov byte [rsp + 0x50], dl
movsx r10, byte [rcx + 0x37]
test r10, r10
js 0x1400ea2fd
lea r11, [rcx + 0x20]
jmp 0x1400ea305
mov r10, qword [rcx + 0x28]
mov r11, qword [rcx + 0x20]
test r10, r10
js 0x1400e9ec3
sete r9b
test r11, r11
setne r12b
or r12b, r9b
je 0x1400e9ec3
cmp qword [rsp + 0x40], 0
js 0x1400e9ec3
cmp byte [rsp + 0x50], 0
je 0x1400e9ec3
mov r12, qword [rsp + 0x40]
cmp r10, r12
cmovb r12, r10
test r12, r12
je 0x1400ea363
xor r9d, r9d
movzx edx, word [r11 + r9*2]
cmp word [r8 + r9*2], dx
ja 0x1400ea36e
jb 0x1400ea3a3
inc r9
cmp r12, r9
jne 0x1400ea34d
cmp qword [rsp + 0x40], r10
jne 0x1400ea523
test r12, r12
je 0x1400ea38c
xor r9d, r9d
movzx edx, word [r8 + r9*2]
cmp word [r11 + r9*2], dx
ja 0x1400ea3b7
jb 0x1400ea39f
inc r9
cmp r12, r9
jne 0x1400ea376
mov r12b, 1
cmp r10, qword [rsp + 0x40]
je 0x1400e9de2
jmp 0x1400ea535
add rcx, 8
mov rcx, qword [rcx]
xor r12d, r12d
test rcx, rcx
je 0x1400e9de2
jmp 0x1400ea2ed
mov r12b, 1
jmp 0x1400e9de2
lea rcx, [rsp + 0x1d0]
call fcn.1402da920
movsx rax, byte [rsp + 0x1e7]
test rax, rax
mov r8, rax
cmovs r8, qword [rsp + 0x1d8]
mov r9, r14
cmovs r9, rdx
mov qword [rsp + 0x50], r8
test r8, r8
sete r8b
mov rsi, r9
test r9, r9
setne r9b
or r9b, r8b
mov byte [rsp + 0x58], r9b
movsx r8, byte [rcx + 0x37]
mov qword [rsp + 0x40], r8
test r8, r8
js 0x1400ea41e
lea r10, [rcx + 0x20]
jmp 0x1400ea42b
mov r8, qword [rcx + 0x28]
mov qword [rsp + 0x40], r8
mov r10, qword [rcx + 0x20]
cmp qword [rsp + 0x40], 0
js 0x1400e9ec3
sete r8b
test r10, r10
setne r11b
or r11b, r8b
je 0x1400e9ec3
cmp qword [rsp + 0x50], 0
js 0x1400e9ec3
cmp byte [rsp + 0x58], 0
je 0x1400e9ec3
mov r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x40]
cmp r9, r8
cmovb r8, r9
test r8, r8
je 0x1400ea491
xor r11d, r11d
movzx r9d, word [r10 + r11*2]
cmp word [rsi + r11*2], r9w
ja 0x1400ea4a1
jb 0x1400ea4db
inc r11
cmp r8, r11
jne 0x1400ea47b
mov r9, qword [rsp + 0x40]
cmp qword [rsp + 0x50], r9
jne 0x1400ea52e
test r8, r8
je 0x1400ea4bf
xor r11d, r11d
movzx r9d, word [rsi + r11*2]
cmp word [r10 + r11*2], r9w
ja 0x1400ea4cb
jb 0x1400ea4d7
inc r11
cmp r8, r11
jne 0x1400ea4a9
mov r8, qword [rsp + 0x40]
cmp r8, qword [rsp + 0x50]
jne 0x1400ea540
inc ebx
mov esi, 0xa
jmp 0x1400e9f73
add rcx, 8
mov rcx, qword [rcx]
test rcx, rcx
jne 0x1400ea409
mov esi, 0xa
jmp 0x1400ea0bc
and rax, rbp
dec rax
mov r8, rax
jmp 0x1400e9bae
and rax, rbp
dec rax
mov r8, rax
jmp 0x1400e9f66
jb 0x1400ea2aa
jmp 0x1400ea265
jb 0x1400ea2a6
jmp 0x1400e9ebb
jb 0x1400ea3a3
jmp 0x1400ea36e
jb 0x1400ea4db
jmp 0x1400ea4a1
jb 0x1400ea39f
jmp 0x1400e9de2
jb 0x1400ea4d7
jmp 0x1400ea4cb