Function at 0x14001b58c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x590]
sub rsp, 0x690
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x580], rax
xor r13d, r13d
mov rbx, rdx
mov qword [rsp + 0x48], r13
mov rdi, rcx
mov esi, r13d
mov r15d, r13d
lea r12d, [r13 + 1]
mov dword [rsp + 0x40], r12d
test rdx, rdx
jne 0x14001b5e8
mov eax, 0x80004003
jmp 0x14001b9cd
or r14, 0xffffffffffffffff
test rdi, rdi
je 0x14001b66f
mov rax, r14
inc rax
cmp word [rcx + rax*2], r13w
jne 0x14001b5f4
lea r12, [rax*2 + 1]
mov rcx, r12
call fcn.14003c460
mov r15, rax
test rax, rax
jne 0x14001b620
mov eax, 0x8007000e
jmp 0x14001b9cd
mov qword [rsp + 0x38], r13
mov r9d, r14d
mov qword [rsp + 0x30], r13
mov r8, rdi
mov dword [rsp + 0x28], r12d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r15
mov esi, 0x80004005
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, 0x200
test eax, eax
je 0x14001b662
mov r8, r15
mov edx, edi
mov rcx, rbx
mov esi, r13d
call fcn.140013ca0
mov rcx, r15
call fcn.14003c408
jmp 0x14001b728
lea rax, [rsp + 0x48]
mov edi, 0x200
mov r9d, r12d
mov dword [rsp + 0x44], edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftMediaPlayerSetup
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001b6ee
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.UDBBaseURL
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14001b6de
cmp dword [rsp + 0x40], r12d
jne 0x14001b6de
mov r15d, r12d
mov byte [rbx + 0x1ff], r13b
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r15d, r15d
jne 0x14001b745
mov rcx, qword [0x140050d10]
mov r9d, edi
mov r8, rbx
mov edx, 0x277e
call qword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x14001b745
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 0x57
cmove eax, ecx
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x14001b745
mov r8d, esi
lea rdx, str.ERROR:_Unable_to_obtain_base_URL_for_UDB_file._Result:_0x_x._r_n
mov ecx, 2
call fcn.1400168a8
jmp 0x14001b9cb
lea r15, [0x1400436cc]
mov rcx, rbx
mov rdx, r15
call qword [sym.imp.msvcrt.dll_strstr]
test rax, rax
jne 0x14001b7be
lea rdx, str..asp
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_strstr]
test rax, rax
jne 0x14001b7be
lea rdx, str..xml
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_strstr]
test rax, rax
jne 0x14001b7be
mov rcx, r14
inc rcx
cmp byte [rbx + rcx], r13b
jne 0x14001b78a
lea rax, [rcx - 1]
cmp rax, 0x1fe
ja 0x14001b7ac
cmp byte [rbx + rcx - 1], 0x2f
je 0x14001b7ac
mov word [rbx + rcx], 0x2f
lea r8, str.control.xml
mov rdx, rdi
mov rcx, rbx
call fcn.1400158b0
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_strstr]
test rax, rax
jne 0x14001b7dd
mov r8, r15
mov rdx, rdi
mov rcx, rbx
call fcn.1400158b0
inc r14
cmp byte [rbx + r14], r13b
jne 0x14001b7dd
mov r15, rdi
sub r15, r14
mov rcx, r15
call fcn.14003c460
mov r14, rax
test rax, rax
je 0x14001b9cb
lea r8, str.LANGENU
mov rdx, rdi
mov rcx, rbx
mov r12d, r13d
call fcn.1400158b0
mov eax, 0xffffffff
add r15, 0xfffffffffffffff6
cmp r15, rax
jae 0x14001b919
cmp byte [0x14005175c], r13b
jne 0x14001b83a
call fcn.14003b558
mov rcx, rax
jmp 0x14001b841
lea rcx, [0x140050340]
movzx eax, word [rcx + 2]
lea r8, str.SoftwareMicrosoftMediaPlayer_lu._luRegistration
movzx r9d, word [rcx]
mov edx, 0x208
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x20], eax
call fcn.1400017b4
test eax, eax
js 0x14001b919
mov dword [rsp + 0x44], r15d
lea rax, [rsp + 0x48]
mov r15d, 1
mov qword [rsp + 0x20], rax
mov r9d, r15d
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001b919
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], r14
lea rdx, [0x1400436f0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14001b905
cmp dword [rsp + 0x40], r15d
jne 0x14001b905
lea r8, str.Version
mov rdx, rdi
mov rcx, rbx
call fcn.1400158b0
mov r8, r14
mov rdx, rdi
mov rcx, rbx
call fcn.1400158b0
lea r8, [0x14004370c]
mov rdx, rdi
mov rcx, rbx
call fcn.1400158b0
mov r12d, r15d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r12d, r12d
jne 0x14001b9c3
mov r8d, 0x105
lea rdx, [rbp + 0x370]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14001b9c3
lea rcx, [rbp + 0x370]
call fcn.1400182b8
mov r15d, 0x104
lea rdx, [rbp + 0x160]
mov r8d, r15d
mov rcx, rax
call fcn.140016f30
test eax, eax
js 0x14001b9c3
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x160]
mov dword [rsp + 0x28], r15d
mov r9d, r15d
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x14001b9c3
lea r8, str.Version
mov rdx, rdi
mov rcx, rbx
call fcn.1400158b0
lea r8, [rsp + 0x50]
mov rdx, rdi
mov rcx, rbx
call fcn.1400158b0
lea r8, [0x14004370c]
mov rdx, rdi
mov rcx, rbx
call fcn.1400158b0
mov rcx, r14
call fcn.14003c408
mov eax, esi
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.14003c810
mov rbx, qword [rsp + 0x6e0]
add rsp, 0x690
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret