Function at 0x1400966c0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x248
movaps xmmword [rsp + 0x230], xmm7
movdqa xmmword [rsp + 0x220], xmm6
mov r14, rdx
mov r12, rcx
mov rax, qword [0x14017b818]
xor rax, rsp
mov qword [rsp + 0x218], rax
xor esi, esi
mov qword [rsp + 0x100], rsi
pxor xmm6, xmm6
movdqa xmmword [rsp + 0xf0], xmm6
mov qword [rsp + 0xe8], rsi
mov ecx, 0x68
call fcn.14011a310
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov qword [rsp + 0xe0], rax
lea rdx, [rsp + 0xdc]
mov dword [rdx], esi
lea rbp, [rsp + 0xd8]
mov dword [rbp], esi
lea rbx, [rsp + 0xd4]
mov dword [rbx], esi
mov word [rax + 0x18], 0x101
lea rax, [rsp + 0xd0]
mov dword [rax], esi
lea rdi, [rsp + 0xcc]
mov dword [rdi], esi
mov rcx, qword [r14]
movdqu xmmword [rsp + 0x50], xmm6
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdx
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, eax
test eax, eax
je 0x14009680a
mov ecx, 2
call fcn.14002c2f0
test al, al
je 0x140096803
lea rdx, str..._.._chrome_installer_util_registry_key_backup.cc
lea rdi, [rsp + 0x110]
mov r8d, 0x82
mov r9d, 2
mov rcx, rdi
call fcn.14002c3a0
lea rcx, [rsp + 0x118]
lea rdx, str.Failed_getting_info_of_key_to_backup__result:
call fcn.140002bb0
mov rcx, rax
mov edx, esi
call fcn.140011d90
mov rcx, rdi
call fcn.14002c830
xor esi, esi
jmp 0x140097231
mov qword [rsp + 0x60], r14
mov esi, dword [rsp + 0xd8]
mov eax, dword [rsp + 0xd0]
cmp esi, eax
cmovb esi, eax
inc esi
lea rcx, [rsp + 0xb0]
movdqa xmmword [rcx], xmm6
mov qword [rcx + 0x10], 0
mov rdx, rsi
call fcn.140078db0
test al, al
je 0x140096865
mov rcx, qword [rsp + 0xb0]
lea rdi, [rcx + rsi*2]
add rsi, rsi
xor edx, edx
mov r8, rsi
call fcn.14011d800
mov qword [rsp + 0xb8], rdi
mov esi, dword [rsp + 0xd4]
test rsi, rsi
mov rdi, qword [rsp + 0x60]
je 0x140096d1f
mov rax, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0x100]
sub rcx, rax
sar rcx, 6
cmp rcx, rsi
jae 0x1400968fb
mov rbx, qword [rsp + 0xf8]
sub rbx, rax
sar rbx, 6
mov rcx, rsi
shl rcx, 6
cmp esi, 0x40
jb 0x1400968c8
or rcx, 0x27
call fcn.14011a310
lea rbp, [rax + 0x27]
and rbp, 0xffffffffffffffe0
mov qword [rbp - 8], rax
jmp 0x1400968d0
call fcn.14011a310
mov rbp, rax
lea r14, [rsp + 0xf0]
mov rdx, qword [r14]
mov r8, qword [r14 + 8]
mov rcx, r14
mov r9, rbp
call fcn.1400980e0
mov rcx, r14
mov rdx, rbp
mov r8, rbx
mov r9, rsi
call fcn.140098140
mov eax, dword [rsp + 0xcc]
test rax, rax
mov esi, 1
cmovne rsi, rax
xorps xmm0, xmm0
lea rcx, [rsp + 0x80]
movaps xmmword [rcx], xmm0
mov qword [rcx + 0x10], 0
mov rdx, rsi
call fcn.140077160
test al, al
je 0x140096953
mov rcx, qword [rsp + 0x80]
lea rdi, [rcx + rsi]
xor edx, edx
mov r8, rsi
call fcn.14011d800
mov qword [rsp + 0x88], rdi
mov rdi, qword [rsp + 0x60]
xor r14d, r14d
mov dword [rsp + 0x70], r14d
mov dword [rsp + 0xac], r14d
mov dword [rsp + 0xa8], r14d
cmp dword [rsp + 0xd4], r14d
je 0x140096d12
movabs r13, 0x3ffffffffffffff
lea r15, [rsp + 0x130]
lea rsi, [rsp + 0xa8]
lea rbx, [rsp + 0xac]
mov eax, 7
movq xmm6, rax
pslldq xmm6, 8
xorps xmm7, xmm7
mov qword [rsp + 0x68], r12
mov r8, qword [rsp + 0xb0]
mov rax, qword [rsp + 0xb8]
sub rax, r8
shr rax, 1
mov dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
sub eax, edx
mov dword [rsp + 0xa8], eax
mov rcx, qword [rdi]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0
mov edx, r14d
lea r9, [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebp, eax
test eax, eax
je 0x140096a9b
cmp ebp, 0xea
je 0x140096a38
cmp ebp, 0x103
jne 0x14009708f
mov dword [rsp + 0xd4], r14d
jmp 0x140096d04
mov edx, dword [rsp + 0xa8]
mov rax, qword [rsp + 0x88]
sub rax, qword [rsp + 0x80]
cmp rax, rdx
jae 0x140096a64
lea rcx, [rsp + 0x80]
mov r8, rcx
call fcn.140077230
mov edx, dword [rsp + 0x70]
inc edx
mov rax, qword [rsp + 0xb8]
sub rax, qword [rsp + 0xb0]
sar rax, 1
cmp rax, rdx
jae 0x140096d04
lea rcx, [rsp + 0xb0]
mov r8, rcx
call fcn.140098200
jmp 0x140096d04
movdqu xmmword [rsp + 0x120], xmm6
mov word [rsp + 0x110], 0
movups xmmword [r15 + 0xc], xmm7
movups xmmword [r15], xmm7
mov rbp, qword [rsp + 0xf8]
mov r15, qword [rsp + 0x100]
cmp r15, rbp
je 0x140096b4a
movups xmmword [rbp + 0x10], xmm7
mov rcx, rbp
lea rdx, [rsp + 0x110]
call fcn.14000db10
lea rcx, [rbp + 0x20]
movups xmmword [rbp + 0x20], xmm7
mov qword [rbp + 0x30], 0
mov rdx, qword [rsp + 0x138]
sub rdx, qword [rsp + 0x130]
call fcn.140077160
test al, al
je 0x140096b32
mov rsi, qword [rbp + 0x20]
mov rdx, qword [rsp + 0x130]
mov rdi, qword [rsp + 0x138]
sub rdi, rdx
mov rcx, rsi
mov r8, rdi
call fcn.14011d3a0
add rdi, rsi
mov qword [rbp + 0x28], rdi
mov eax, dword [rsp + 0x148]
mov dword [rbp + 0x38], eax
add qword [rsp + 0xf8], 0x40
jmp 0x140096c83
sub r15, qword [rsp + 0xf0]
sar r15, 6
lea rbp, [r15 + 1]
mov rax, r15
shr rax, 1
mov rcx, r13
sub rcx, rax
mov rbx, rbp
cmp r15, rcx
ja 0x140096b7b
add rax, r15
cmp rax, rbp
cmovb rax, rbp
mov rbx, rax
test rbx, rbx
je 0x140096bb0
cmp rbx, r13
ja 0x14009729a
mov rcx, rbx
shl rcx, 6
cmp rcx, 0x1000
jb 0x140096bb5
or rcx, 0x27
call fcn.14011a310
lea r13, [rax + 0x27]
and r13, 0xffffffffffffffe0
mov qword [r13 - 8], rax
jmp 0x140096bbd
xor r13d, r13d
jmp 0x140096bbd
call fcn.14011a310
mov r13, rax
shl r15, 6
lea rcx, [r15 + r13]
lea r12, [r15 + r13]
add r12, 0x20
movups xmmword [r12 - 0x10], xmm7
lea rdx, [rsp + 0x110]
call fcn.14000db10
movups xmmword [r12], xmm7
mov qword [r12 + 0x10], 0
mov rdx, qword [rsp + 0x138]
sub rdx, qword [rsp + 0x130]
mov rcx, r12
call fcn.140077160
test al, al
je 0x140096c34
mov rsi, qword [r12]
mov rdx, qword [rsp + 0x130]
mov rdi, qword [rsp + 0x138]
sub rdi, rdx
mov rcx, rsi
mov r8, rdi
call fcn.14011d3a0
add rdi, rsi
mov qword [r13 + r15 + 0x28], rdi
mov eax, dword [rsp + 0x148]
mov dword [r13 + r15 + 0x38], eax
mov rdx, qword [rsp + 0xf0]
mov r8, qword [rsp + 0xf8]
lea rsi, [rsp + 0xf0]
mov rcx, rsi
mov r9, r13
call fcn.1400980e0
mov rcx, rsi
mov rdx, r13
mov r8, rbp
mov r9, rbx
call fcn.140098140
mov r12, qword [rsp + 0x68]
movabs r13, 0x3ffffffffffffff
lea r15, [rsp + 0x130]
mov rcx, r15
call fcn.1400771d0
lea rcx, [rsp + 0x110]
call fcn.1400066b0
mov rsi, qword [rsp + 0xf8]
mov rdi, qword [rsp + 0x80]
mov ebx, dword [rsp + 0xac]
mov rdx, qword [rsp + 0xb0]
lea rcx, [rsi - 0x40]
mov r8d, dword [rsp + 0x70]
mov ebp, dword [rsp + 0xa8]
call fcn.140005d40
mov dword [rsi - 8], ebx
add rsi, 0xffffffffffffffe0
add rbp, rdi
mov rcx, rsi
mov rdx, rdi
mov r8, rbp
call fcn.14008c150
inc r14d
mov rdi, qword [rsp + 0x60]
lea rsi, [rsp + 0xa8]
lea rbx, [rsp + 0xac]
cmp r14d, dword [rsp + 0xd4]
jb 0x1400969b2
lea rcx, [rsp + 0x80]
call fcn.1400771d0
cmp dword [rsp + 0xdc], 0
je 0x140096f9d
mov qword [rsp + 0x68], r12
lea r14, [rsp + 0xac]
mov dword [r14], 0
pxor xmm6, xmm6
mov r13, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
lea r12, [rsp + 0x70]
xor esi, esi
mov r8, qword [rsp + 0xb0]
mov rax, qword [rsp + 0xb8]
sub rax, r8
shr rax, 1
mov dword [rsp + 0xac], eax
mov rcx, qword [rdi]
movdqu xmmword [rsp + 0x30], xmm6
movdqu xmmword [rsp + 0x20], xmm6
mov edx, esi
mov r9, r14
call r13
mov r15d, eax
test eax, eax
je 0x140096dce
cmp r15d, 0xea
je 0x140096db0
cmp r15d, 0x103
jne 0x140097015
mov dword [rsp + 0xdc], esi
jmp 0x140096ef6
mov edx, dword [rsp + 0xac]
inc edx
lea rcx, [rsp + 0xb0]
mov r8, rcx
call fcn.140098200
jmp 0x140096ef6
movdqa xmmword [rsp + 0x90], xmm6
movdqa xmmword [rsp + 0x80], xmm6
mov qword [rsp + 0xa0], 0
mov ecx, 0x68
call fcn.14011a310
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov qword [rsp + 0x98], rax
mov word [rax + 0x18], 0x101
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x110], rax
lea rbx, [rsp + 0x118]
mov rcx, rbx
lea r15, [rsp + 0x80]
mov rdx, r15
call fcn.140097de0
mov ecx, 0x68
call fcn.14011a310
mov rdi, rax
mov rax, qword [rsp + 0xe0]
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov word [rdi + 0x18], 0
lea rbp, [rdi + 0x20]
mov rcx, rbp
lea rdx, [rsp + 0x110]
call fcn.1400984a0
mov qword [rsp + 0x20], rdi
mov rdi, qword [rsp + 0x60]
xor r8d, r8d
lea rcx, [rsp + 0xe0]
mov rdx, r12
mov r9, rbp
call fcn.140098330
mov r9, qword [rsp + 0x130]
mov r8, qword [r9]
lea rcx, [rsp + 0x130]
mov rdx, r12
call fcn.1400979a0
mov rcx, qword [rsp + 0x130]
call fcn.14011a350
mov rcx, rbx
call fcn.140096620
mov r9, qword [rsp + 0x98]
mov r8, qword [r9]
lea rcx, [rsp + 0x98]
mov rdx, r12
call fcn.1400979a0
mov rcx, qword [rsp + 0x98]
call fcn.14011a350
mov rcx, r15
call fcn.140096620
inc esi
cmp esi, dword [rsp + 0xdc]
jb 0x140096d53
lea rcx, [rsp + 0x80]
call fcn.14003ab80
mov rcx, qword [rsp + 0xe0]
mov rax, qword [rcx]
mov qword [rsp + 0x70], rax
cmp rax, rcx
mov r12, qword [rsp + 0x68]
je 0x140096f90
lea rbx, [rsp + 0x80]
lea rbp, [rsp + 0x70]
cmp qword [rax + 0x38], 8
lea r8, [rax + 0x20]
jb 0x140096f45
mov r8, qword [r8]
mov rdx, qword [rdi]
mov r9d, 0x20009
mov rcx, rbx
call fcn.14003ad50
mov esi, eax
test eax, eax
jne 0x140097112
mov rcx, qword [rsp + 0x70]
add rcx, 0x40
mov rdx, rbx
call fcn.1400966c0
test al, al
je 0x14009716d
mov rcx, rbp
call fcn.1400986b0
mov rax, qword [rsp + 0x70]
cmp rax, qword [rsp + 0xe0]
jne 0x140096f37
lea rcx, [rsp + 0x80]
call fcn.14003ade0
lea rax, [rsp + 0xf0]
cmp rax, r12
je 0x140096fde
movaps xmm0, xmmword [rsp + 0xf0]
movups xmm1, xmmword [r12]
movups xmmword [r12], xmm0
movaps xmmword [rsp + 0xf0], xmm1
mov rax, qword [r12 + 0x10]
mov rcx, qword [rsp + 0x100]
mov qword [r12 + 0x10], rcx
mov qword [rsp + 0x100], rax
add r12, 0x18
mov sil, 1
lea rax, [rsp + 0xe0]
cmp r12, rax
je 0x140097224
movaps xmm0, xmmword [rsp + 0xe0]
movups xmm1, xmmword [r12]
movups xmmword [r12], xmm0
movaps xmmword [rsp + 0xe0], xmm1
jmp 0x140097224
mov ecx, 2
call fcn.14002c2f0
test al, al
je 0x140097222
lea rdx, str..._.._chrome_installer_util_registry_key_backup.cc
lea rdi, [rsp + 0x110]
mov r8d, 0xc7
mov r9d, 2
mov rcx, rdi
call fcn.14002c3a0
lea rcx, [rsp + 0x118]
lea rdx, str.Failed_getting_name_of_subkey
call fcn.140002bb0
mov rcx, rax
mov edx, esi
call fcn.1400126b0
lea rdx, str._for_backup__result:
mov rcx, rax
call fcn.140002bb0
mov rcx, rax
mov edx, r15d
call fcn.140011d90
mov rcx, rdi
call fcn.14002c830
jmp 0x140097222
mov ecx, 2
call fcn.14002c2f0
test al, al
je 0x140097100
lea rdx, str..._.._chrome_installer_util_registry_key_backup.cc
lea rsi, [rsp + 0x110]
mov r8d, 0xa7
mov r9d, 2
mov rcx, rsi
call fcn.14002c3a0
lea rcx, [rsp + 0x118]
lea rdx, str.Failed_backing_up_value
call fcn.140002bb0
mov rcx, rax
mov edx, r14d
call fcn.1400126b0
lea rdx, str.__result:
mov rcx, rax
call fcn.140002bb0
mov rcx, rax
mov edx, ebp
call fcn.140011d90
mov rcx, rsi
call fcn.14002c830
lea rcx, [rsp + 0x80]
call fcn.1400771d0
jmp 0x140097222
mov ecx, 2
call fcn.14002c2f0
test al, al
je 0x140097215
lea rdx, str..._.._chrome_installer_util_registry_key_backup.cc
lea rdi, [rsp + 0x110]
mov r8d, 0xd7
mov r9d, 2
mov rcx, rdi
call fcn.14002c3a0
lea rcx, [rsp + 0x118]
lea rdx, str.Failed_opening_subkey__
call fcn.140002bb0
mov rdx, qword [rsp + 0x70]
cmp qword [rdx + 0x38], 7
jbe 0x1400971c8
mov rdx, qword [rdx + 0x20]
jmp 0x1400971cc
mov ecx, 2
call fcn.14002c2f0
test al, al
je 0x140097215
lea rdx, str..._.._chrome_installer_util_registry_key_backup.cc
lea rsi, [rsp + 0x110]
mov r8d, 0xdc
mov r9d, 2
mov rcx, rsi
call fcn.14002c3a0
lea rcx, [rsp + 0x118]
lea rdx, str.Failed_backing_up_subkey__
call fcn.140002bb0
mov rdx, qword [rsp + 0x70]
cmp qword [rdx + 0x38], 7
jbe 0x1400971f2
mov rdx, qword [rdx + 0x20]
jmp 0x1400971f6
add rdx, 0x20
mov rcx, rax
call fcn.14002da70
lea rdx, str.__for_backup__result:
mov rcx, rax
call fcn.140002bb0
mov rcx, rax
mov edx, esi
call fcn.140011d90
mov rcx, rdi
jmp 0x140097210
add rdx, 0x20
mov rcx, rax
call fcn.14002da70
lea rdx, [0x14014b82a]
mov rcx, rax
call fcn.140002bb0
mov rcx, rsi
call fcn.14002c830
lea rcx, [rsp + 0x80]
call fcn.14003ade0
xor esi, esi
lea rcx, [rsp + 0xb0]
call fcn.140078e30
lea rdi, [rsp + 0xe0]
mov r9, qword [rdi]
mov r8, qword [r9]
lea rdx, [rsp + 0x110]
mov rcx, rdi
call fcn.1400979a0
mov rcx, qword [rdi]
call fcn.14011a350
lea rcx, [rsp + 0xf0]
call fcn.140096620
mov rcx, qword [rsp + 0x218]
xor rcx, rsp
call fcn.14011a370
mov eax, esi
movaps xmm6, xmmword [rsp + 0x220]
movaps xmm7, xmmword [rsp + 0x230]
add rsp, 0x248
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.14011ae10
ud2