Function at 0x140005030
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rsi
push r12
mov eax, 0x12c8
call fcn.1400261c0
sub rsp, rax
mov rsi, rcx
mov rax, rdx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
lea rdx, str.Adobe
xor r12d, r12d
mov rcx, rax
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x60], r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140005469
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0xa0]
lea r9, [rsp + 0x12f0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea r8, [rsp + 0x6c0]
xor edx, edx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x12e8], rbp
mov qword [rsp + 0x20], r12
mov ebp, r12d
mov dword [rsp + 0x12f0], 0x3ff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x140005456
mov qword [rsp + 0x12e0], rbx
mov qword [rsp + 0x12c0], rdi
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x68]
lea rdx, [rsp + 0x6c0]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x68], r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400053f7
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x90]
lea r9, [rsp + 0x12f0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea r8, [rsp + 0x2c0]
xor edx, edx
mov qword [rsp + 0x28], r12
mov ebx, r12d
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x12f0], 0x3ff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x1400053ec
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x70]
lea rdx, [rsp + 0x2c0]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x70], r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000539d
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x78]
lea rdx, str.Registration
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x78], r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140005392
lea r9, [rsp + 0x2c0]
lea r8, [rsp + 0x6c0]
lea rdx, str._s__s
lea rcx, [rsp + 0xac0]
mov byte [rsp + 0x1b0], r12b
call sub.msvcrt.dll_sprintf
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x88]
mov qword [rsp + 0x20], rdx
lea rdx, str.Installer
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140005289
mov rcx, qword [rsp + 0x88]
lea rax, [rsp + 0x12f0]
lea r9, [rsp + 0x12f8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1b0]
lea rdx, str.Path
xor r8d, r8d
mov dword [rsp + 0x12f0], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14000527b
mov eax, dword [rsp + 0x12f0]
add eax, 0xffffffff
mov byte [rsp + rax + 0x1b0], r12b
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x78]
lea rax, [rsp + 0x12f0]
lea r9, [rsp + 0x98]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xb0]
lea rdx, str.Serial
xor r8d, r8d
mov rcx, rdi
mov dword [rsp + 0x80], r12d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x84], r12d
mov byte [rsp + 0xb0], r12b
mov dword [rsp + 0x12f0], 0xff
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400052fc
mov eax, dword [rsp + 0x12f0]
add eax, 0xffffffff
mov byte [rsp + rax + 0xb0], r12b
lea rax, [rsp + 0x80]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0xb0]
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
cmp rcx, 0x18
jb 0x140005387
lea rax, [rsp + 0x1b0]
lea r9, [rsp + 0x80]
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0xac0]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.1400024a0
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x90]
add ebx, 1
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea r9, [rsp + 0x12f0]
lea r8, [rsp + 0x2c0]
mov edx, ebx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x12f0], 0x3ff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x140005163
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0xa0]
add ebp, 1
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea r9, [rsp + 0x12f0]
lea r8, [rsp + 0x6c0]
mov edx, ebp
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x12f0], 0x3ff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x1400050e1
mov rdi, qword [rsp + 0x12c0]
mov rbx, qword [rsp + 0x12e0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x12e8]
add rsp, 0x12c8
pop r12
pop rsi
ret