Function at 0x14004d640
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb8]
sub rsp, 0x190
mov qword [rbp + 8], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14035c8c0]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov r15, rcx
mov byte [rbp - 0x80], 0
lea rcx, [rbp - 0x78]
call fcn.1400154a0
nop
lea rax, [0x1402f7e88]
lea rdx, [0x1402ef4b8]
cmp byte [rbp - 0x80], 0
cmovne rdx, rax
mov rsi, 0xffffffffffffffff
mov rax, rsi
inc rax
cmp word [rdx + rax*2], 0
jne 0x14004d6b0
mov r8d, eax
lea rcx, [rbp - 0x78]
call fcn.140002a7c
mov rbx, qword [rbp - 0x78]
mov r9, rbx
xor r8d, r8d
mov edx, 0x116ef
mov rcx, qword [r15]
call fcn.14001fa50
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
lea r13, vtable.ATL::CAtlStringMgr.0
lea r14, vtable.ATL::CWin32Heap.0
sub eax, 1
jg 0x14004d733
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14004df19
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004df19
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
xor r12d, r12d
mov qword [rsp + 0x68], r12
mov dword [rsp + 0x70], r12d
mov qword [rsp + 0x78], r12
call fcn.140011b88
mov rcx, rax
test rax, rax
je 0x14004df21
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, r13
jne 0x14004df2c
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov r9d, 0x20019
lea r8, str.SOFTWAREMozillaMozilla_Firefox
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x68]
call fcn.14003d370
test eax, eax
jne 0x14004d7fc
mov dword [rsp + 0x38], 0x64
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
lea rdx, str.CurrentVersion
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004d7fc
mov eax, dword [rsp + 0x3c]
dec eax
cmp eax, 1
ja 0x14004d7fc
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x14004d88b
test al, 1
jne 0x14004d7fc
shr rax, 1
cmp word [rbp + rax*2 + 0xe], 0
je 0x14004d890
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14004d841
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14004df11
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004df11
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14004d856
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x68], r12
mov dword [rsp + 0x70], r12d
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140229da0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov word [rbp + 0x10], r12w
lea rax, [rbp + 0x10]
mov rdi, rsi
nop word [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x14004d8a0
test edi, edi
jne 0x14004d948
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14004da01
cmp dword [rdx + 0x10], 0
jge 0x14004d8e0
cmp dword [rbx - 0xc], 0
jl 0x14004df33
mov dword [rbx - 0x10], r12d
mov word [rbx], r12w
jmp 0x14004da01
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004d922
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14004df3e
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004df3e
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rdi]
mov rdx, qword [rax + 0x18]
cmp rax, r13
jne 0x14004df46
lock inc dword [rdi + 0x20]
lea rax, [rdi + 0x10]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
jmp 0x14004da01
mov r12d, dword [rbx - 0x10]
lea r14, [rbp + 0x10]
sub r14, rbx
sar r14, 1
test edi, edi
js 0x14004df4e
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14004d980
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140002a1c
mov rbx, qword [rsp + 0x30]
cmp r14, r12
ja 0x14004d9d0
lea rdx, [rbx + r14*2]
movsxd r8, edi
add r8, r8
je 0x14004d9e3
test rdx, rdx
jne 0x14004d9a8
call fcn.1402312e4
mov dword [rax], 0x16
call fcn.140231194
jmp 0x14004d9e3
movsxd rax, dword [rbx - 0xc]
add rax, rax
cmp rax, r8
jae 0x14004d9c6
call fcn.1402312e4
mov dword [rax], 0x22
call fcn.140231194
jmp 0x14004d9e3
mov rcx, rbx
call fcn.14022e750
jmp 0x14004d9e3
movsxd rdx, dword [rbx - 0xc]
mov r9d, edi
lea r8, [rbp + 0x10]
mov rcx, rbx
call fcn.140002c18
cmp edi, dword [rbx - 0xc]
jg 0x14004dfab
mov dword [rbx - 0x10], edi
movsxd rax, edi
xor r12d, r12d
mov word [rbx + rax*2], r12w
lea r14, vtable.ATL::CWin32Heap.0
cmp dword [rbx - 0x10], 0
jle 0x14004da3a
mov edx, 0x20
mov rcx, rbx
call fcn.14022e688
test rax, rax
je 0x14004da3a
sub rax, rbx
sar rax, 1
test eax, eax
js 0x14004da3a
mov r8d, 0x64
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.14003fd90
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x48]
mov qword [rbp - 0x70], rax
lea rdi, [rbx - 0x18]
mov rcx, rdi
call fcn.140002c94
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x50]
call fcn.1400154a0
nop
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x50]
call fcn.140002b88
mov edx, 0x2c
lea rcx, [rsp + 0x50]
call fcn.14007bed0
mov r9, qword [rsp + 0x50]
xor r8d, r8d
mov edx, 0x1161b
mov rcx, qword [r15]
call fcn.14001fa50
nop
lea rcx, [rsp + 0x48]
call fcn.14004a160
mov byte [rbp - 0x68], 1
lea rcx, [rbp - 0x60]
call fcn.1400154a0
nop
lea r9, [rbp - 0x68]
xor r8d, r8d
mov edx, 0x116ef
mov rcx, r15
call fcn.140085fe0
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004db0f
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14004df59
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004df59
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
call fcn.140011b88
mov rcx, rax
test rax, rax
je 0x14004df61
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, r13
jne 0x14004df6c
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, str.Firefox
cmp rdx, 0x10000
jae 0x14004db60
movzx edx, dx
lea rcx, [rsp + 0x40]
call fcn.140012370
jmp 0x14004db7b
mov rax, rsi
inc rax
cmp word [rdx + rax*2], 0
jne 0x14004db63
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.140002a7c
nop
mov rbx, qword [rsp + 0x40]
mov r9, rbx
mov r8d, dword [0x14036bb90]
mov edx, 0x116b9
mov rcx, qword [r15]
call fcn.14001fa50
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004dbde
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14004df73
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004df73
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [rsp + 0x58]
mov qword [rbp - 0x70], rax
mov rcx, rdi
call fcn.140002c94
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x60]
call fcn.1400154a0
nop
mov ebx, dword [0x14036bb90]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x60]
call fcn.140002b88
mov edx, 0x2c
lea rcx, [rsp + 0x60]
call fcn.14007bed0
mov r9, qword [rsp + 0x60]
mov r8d, ebx
mov edx, 0x116b8
mov rcx, qword [r15]
call fcn.14001fa50
nop
lea rcx, [rsp + 0x58]
call fcn.14004a160
mov byte [rbp - 0x58], 0
lea rcx, [rbp - 0x50]
call fcn.1400154a0
nop
lea r9, [rbp - 0x58]
mov r8d, dword [0x14036bb90]
mov edx, 0x1177b
mov rcx, r15
call fcn.140085fe0
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004dcb9
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14004df7b
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004df7b
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp - 0x48], 1
lea rcx, [rbp - 0x40]
call fcn.1400154a0
nop
lea r9, [rbp - 0x48]
mov r8d, dword [0x14036bb90]
mov edx, 0x1177e
mov rcx, r15
call fcn.140085fe0
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004dd2b
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14004df83
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004df83
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp - 0x38], 0
lea rcx, [rbp - 0x30]
call fcn.1400154a0
nop
lea r9, [rbp - 0x38]
mov r8d, dword [0x14036bb90]
mov edx, 0x1177c
mov rcx, r15
call fcn.140085fe0
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004dd9d
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14004df8b
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004df8b
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp - 0x28], 0
lea rcx, [rbp - 0x20]
call fcn.1400154a0
nop
lea r9, [rbp - 0x28]
mov r8d, dword [0x14036bb90]
mov edx, 0x11780
mov rcx, r15
call fcn.140085fe0
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004de0f
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14004df93
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004df93
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp - 0x18], 0
lea rcx, [rbp - 0x10]
call fcn.1400154a0
nop
lea r9, [rbp - 0x18]
mov r8d, dword [0x14036bb90]
mov edx, 0x1177f
mov rcx, r15
call fcn.140085fe0
nop
mov rdx, qword [rbp - 0x10]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004de81
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14004df9b
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004df9b
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp - 8], 0
lea rcx, [rbp]
call fcn.1400154a0
nop
lea r9, [rbp - 8]
mov r8d, dword [0x14036bb90]
mov edx, 0x1177d
mov rcx, r15
call fcn.140085fe0
nop
mov rdx, qword [rbp]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004def3
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14004dfa3
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004dfa3
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
inc dword [0x14036bb90]
mov rbx, qword [rsp + 0x30]
jmp 0x14004d7fc
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
jmp 0x14004da01
call r8
jmp 0x14004d841
call r8
jmp 0x14004d733
mov ecx, 0x80004005
call fcn.140002d3c
int3
call rdx
jmp 0x14004d76e
mov ecx, 0x80070057
call fcn.140002d3c
int3
call r8
jmp 0x14004d922
mov rcx, rdi
call rdx
nop
jmp 0x14004df03
mov ecx, 0x80070057
call fcn.140002d3c
nop
call r8
jmp 0x14004db0f
mov ecx, 0x80004005
call fcn.140002d3c
int3
call rdx
jmp 0x14004db38
call r8
jmp 0x14004dbde
call r8
jmp 0x14004dcb9
call r8
jmp 0x14004dd2b
call r8
jmp 0x14004dd9d
call r8
jmp 0x14004de0f
call r8
jmp 0x14004de81
call r8
jmp 0x14004def3
mov ecx, 0x80070057
call fcn.140002d3c
int3