Function at 0x140006890
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa90]
sub rsp, 0xb90
mov rax, qword [0x140051580]
xor rax, rsp
mov qword [rbp + 0xa80], rax
xor r14d, r14d
mov dword [rsp + 0x74], r8d
or rdi, 0xffffffffffffffff
mov dword [rsp + 0x68], edx
test r8d, r8d
mov qword [rbp - 0x80], r14
lea r8, str.SoftwareMicrosoftMediaPlayerSetupBlockingRefCounts_s
mov r13d, edx
mov r15, rcx
lea r9, str.SoftwareMicrosoftWindowsMediaSetupBlockingRefCounts_s
mov esi, r14d
jne 0x1400068f8
test edx, edx
cmove r8, r9
jmp 0x140006900
test r13d, r13d
jne 0x140006900
mov r8, r9
lea rcx, [rbp + 0x240]
mov edx, 0x105
lea r9, [0x140040c70]
call fcn.1400104f4
test eax, eax
js 0x140006cff
lea rax, [rbp - 0x80]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x240]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140006cff
mov rcx, qword [rbp - 0x80]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], r14
xor r9d, r9d
mov qword [rsp + 0x50], r14
xor r8d, r8d
mov qword [rsp + 0x48], r14
xor edx, edx
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x60], r14d
mov dword [rsp + 0x70], 0x50
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
test eax, eax
jne 0x140006c8e
mov ecx, dword [rsp + 0x60]
mov eax, 8
mul rcx
mov ebx, r14d
mov dword [rsp + 0x64], ebx
cmovo rax, rdi
mov rcx, rax
call fcn.14000130c
mov qword [r15], rax
test rax, rax
je 0x140006cef
mov r12d, r14d
cmp dword [rsp + 0x60], r14d
jle 0x140006a6a
mov r13d, 1
mov ecx, 0x20a
call fcn.14000130c
mov rcx, qword [r15]
mov qword [rcx + r14*8], rax
mov rax, qword [r15]
cmp qword [rax + r14*8], rsi
jne 0x140006a4a
xor ebx, ebx
mov rcx, rax
test r14, r14
jle 0x140006a38
mov rcx, rax
cmp qword [rax + rbx*8], rsi
je 0x140006a2d
mov rcx, qword [rax + rbx*8]
call fcn.1400012c0
mov rax, qword [r15]
and qword [rax + rbx*8], rsi
mov rcx, qword [r15]
add rbx, r13
mov rax, rcx
cmp rbx, r14
jl 0x140006a11
mov rax, rcx
test rcx, rcx
je 0x140006a4a
call fcn.1400012c0
and qword [r15], rsi
xor eax, eax
add r12d, r13d
add r14, r13
cmp r12d, dword [rsp + 0x60]
jl 0x1400069ed
mov r13d, dword [rsp + 0x68]
xor r14d, r14d
mov ebx, esi
test rax, rax
je 0x140006cef
mov rcx, qword [rbp - 0x80]
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x70]
lea rax, [rbp + 0x660]
mov dword [rsp + 0x6c], 0x208
mov qword [rsp + 0x30], rax
lea r8, [rbp - 0x70]
mov qword [rsp + 0x28], r14
xor edx, edx
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
nop dword [rax + rax]
test eax, eax
jne 0x140006c8e
mov r12d, dword [rsp + 0x74]
mov eax, 0x104
lea r8, str.SoftwareMicrosoftMediaPlayerSetupBlockingRefCounts_s
mov rdx, rax
test r12d, r12d
jne 0x140006ade
test r13d, r13d
lea rax, str.SoftwareMicrosoftWindowsMediaSetupBlockingRefCounts_s
cmove r8, rax
jmp 0x140006aea
test r13d, r13d
jne 0x140006aea
lea r8, str.SoftwareMicrosoftWindowsMediaSetupBlockingRefCounts_s
lea rcx, [rbp + 0x30]
lea r9, [0x140040c78]
call fcn.1400104f4
test eax, eax
js 0x140006c26
xor ebx, ebx
mov dword [rsp + 0x74], 0x208
and qword [rsp + 0x78], rbx
lea rdx, [rbp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
lea eax, [rbx + 1]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140006ba3
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x74]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
lea rax, [rbp + 0x870]
xor r8d, r8d
lea rdx, [rbp - 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140006b87
lea eax, [rbx + 1]
cmp dword [rsp + 0x68], eax
cmove ebx, eax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
lea r8, [rbp + 0x870]
test ebx, ebx
jne 0x140006baa
lea r8, str.9.0.0.0
mov edx, 0x104
lea rcx, [rbp + 0x450]
call fcn.1400104bc
lea rcx, [rbp + 0x450]
call fcn.14001de88
and qword [rsp + 0x78], 0
lea rcx, [rsp + 0x78]
mov edx, r13d
mov rbx, rax
call fcn.140006674
test eax, eax
jne 0x140006bfd
lea rdx, str.ERROR:_Back_up_files_may_not_be_available_for_rollback._r_n
lea ecx, [rax + 2]
call fcn.140018e9c
mov edx, r13d
lea rcx, [rsp + 0x78]
call fcn.14000675c
cmp rbx, qword [rsp + 0x78]
jb 0x140006c22
mov rcx, qword [r15]
lea r8, [rbp + 0x660]
mov edx, 0x104
mov rcx, qword [r14 + rcx]
call fcn.1400104bc
inc esi
add r14, 8
mov ebx, dword [rsp + 0x64]
mov eax, dword [rsp + 0x60]
inc ebx
mov dword [rsp + 0x64], ebx
cmp ebx, eax
jae 0x140006c92
mov rcx, qword [rbp - 0x80]
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x70]
lea rax, [rbp + 0x660]
mov dword [rsp + 0x6c], 0x104
mov qword [rsp + 0x30], rax
lea r8, [rbp - 0x70]
and qword [rsp + 0x28], 0
mov edx, ebx
and qword [rsp + 0x20], 0
mov dword [rsp + 0x70], 0x50
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
nop dword [rax + rax]
test eax, eax
mov eax, 0x104
je 0x140006abf
mov eax, dword [rsp + 0x60]
cmp eax, esi
jle 0x140006cea
mov rcx, qword [r15]
test rcx, rcx
je 0x140006cea
mov ebx, esi
cmp esi, eax
jae 0x140006cd6
mov edi, 1
mov r14d, ebx
mov rdx, qword [rcx + r14*8]
test rdx, rdx
je 0x140006ccc
mov rcx, rdx
call fcn.1400012c0
mov rax, qword [r15]
and qword [rax + r14*8], 0
mov rcx, qword [r15]
mov eax, dword [rsp + 0x60]
add ebx, edi
cmp ebx, eax
jb 0x140006ca9
or rdi, 0xffffffffffffffff
test esi, esi
jne 0x140006cec
test rcx, rcx
je 0x140006cef
call fcn.1400012c0
and qword [r15], 0
jmp 0x140006cef
test esi, esi
cmovg edi, esi
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, edi
mov rcx, qword [rbp + 0xa80]
xor rcx, rsp
call fcn.140001660
mov rbx, qword [rsp + 0xbe0]
add rsp, 0xb90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret