Function at 0x140006964
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xab0]
sub rsp, 0xbb0
mov rax, qword [0x1400592a0]
xor rax, rsp
mov qword [rbp + 0xaa0], rax
xor r15d, r15d
mov dword [rbp - 0x7c], r8d
or r14, 0xffffffffffffffff
mov qword [rbp - 0x60], rcx
test r8d, r8d
mov qword [rbp - 0x70], r15
mov edi, r8d
mov r13d, edx
lea r8, str.SoftwareMicrosoftMediaPlayerSetupBlockingRefCounts_s
mov rsi, rcx
mov r12d, r15d
jne 0x1400069ce
test edx, edx
lea rbx, str.SoftwareMicrosoftWindowsMediaSetupBlockingRefCounts_s
cmove r8, rbx
jmp 0x1400069dc
test r13d, r13d
lea rax, str.SoftwareMicrosoftWindowsMediaSetupBlockingRefCounts_s
cmove r8, rax
lea r9, [0x140048c20]
mov edx, 0x105
lea rcx, [rbp + 0x890]
call fcn.140010e44
test eax, eax
js 0x14000707e
lea rax, [rbp - 0x70]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x890]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000707e
mov rcx, qword [rbp - 0x70]
lea rax, [rsp + 0x64]
mov qword [rsp + 0x58], r15
xor r9d, r9d
mov qword [rsp + 0x50], r15
xor r8d, r8d
mov qword [rsp + 0x48], r15
xor edx, edx
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
mov dword [rsp + 0x64], r15d
mov dword [rbp - 0x74], 0x50
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
nop dword [rax + rax]
test eax, eax
jne 0x140007004
mov ecx, dword [rsp + 0x64]
mov eax, 8
mul rcx
mov ebx, r15d
mov dword [rbp - 0x80], ebx
cmovo rax, r14
mov rcx, rax
call fcn.1400014a0
mov qword [rsi], rax
test rax, rax
je 0x14000706e
xor eax, eax
cmp dword [rsp + 0x64], eax
jle 0x140006b53
lea r14d, [rax + 1]
mov ecx, 0x20a
call fcn.1400014a0
mov rcx, qword [rsi]
xor r8d, r8d
mov qword [rcx + rbx*8], rax
mov rax, qword [rsi]
cmp qword [rax + rbx*8], r8
jne 0x140006b2d
mov edi, r8d
mov rcx, rax
test rbx, rbx
jle 0x140006b17
mov rdx, qword [rax + rdi*8]
mov rcx, rax
test rdx, rdx
je 0x140006b0f
mov rcx, rdx
call fcn.140001454
mov rax, qword [rsi]
xor r8d, r8d
mov qword [rax + rdi*8], r8
mov rcx, qword [rsi]
mov rax, rcx
add rdi, r14
cmp rdi, rbx
jl 0x140006aeb
mov rax, rcx
test rcx, rcx
je 0x140006b2d
call fcn.140001454
xor r12d, r12d
mov qword [rsi], r12
mov eax, r12d
add r15d, r14d
add rbx, r14
cmp r15d, dword [rsp + 0x64]
jl 0x140006ac3
xor r15d, r15d
mov r12d, r15d
lea r14, [r15 - 1]
test rax, rax
je 0x14000706e
mov edi, dword [rbp - 0x7c]
mov ebx, r15d
mov rcx, qword [rbp - 0x70]
lea rax, [rbp - 0x78]
mov qword [rsp + 0x38], rax
lea r9, [rbp - 0x74]
lea rax, [rbp + 0x260]
mov dword [rbp - 0x78], 0x208
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x1c0]
mov qword [rsp + 0x28], r15
xor edx, edx
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
nop dword [rax + rax]
test eax, eax
jne 0x140007004
mov qword [rbp - 0x68], r15
lea r15, str.SoftwareMicrosoftWindowsMediaSetupBlockingRefCounts_s
test r13d, r13d
lea r8, str.SoftwareMicrosoftMediaPlayerSetupBlockingRefCounts_s
lea r9, [0x140048c28]
mov edx, 0x104
cmove r8, r15
lea rcx, [rbp + 0x470]
call fcn.140010e44
xor edx, edx
test eax, eax
js 0x140006f9d
lea eax, [rdx + 1]
mov dword [rsp + 0x68], 0x208
mov dword [rsp + 0x70], eax
lea rdx, [rbp + 0x470]
lea rax, [rsp + 0x78]
xor edi, edi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rsp + 0x78], rdi
mov rcx, 0xffffffff80000000
mov ebx, edi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140006cce
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x70]
lea rax, [rbp + 0x680]
xor r8d, r8d
lea rdx, [rbp + 0x1c0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140006c6a
lea eax, [rdi + 1]
cmp dword [rsp + 0x70], eax
cmove ebx, eax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test ebx, ebx
je 0x140006cce
lea r8, [rbp + 0x680]
mov edx, 0x104
lea rax, [rbp - 0x50]
mov esi, 1
sub r8, rax
lea rcx, [rbp - 0x50]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140006cbd
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140006cbd
mov word [rcx], ax
add rcx, 2
sub rdx, rsi
jne 0x140006c9b
mov rsi, qword [rbp - 0x60]
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
jmp 0x140006d1c
lea r8, str.9.0.0.0
mov edx, 0x104
lea rax, [rbp - 0x50]
mov r14d, 1
sub r8, rax
lea rcx, [rbp - 0x50]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140006d0d
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140006d0d
mov word [rcx], ax
add rcx, 2
sub rdx, r14
jne 0x140006ceb
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
or r14, 0xffffffffffffffff
mov edx, 0x2e
mov word [rax], di
lea rcx, [rbp - 0x50]
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x78], edi
mov ebx, edi
mov dword [rsp + 0x68], edi
mov dword [rsp + 0x70], edi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
je 0x140006e1a
inc ebx
lea rcx, [rax + 2]
mov edx, 0x2e
mov edi, ebx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x140006d4f
sub edi, 1
je 0x140006dfe
sub edi, 1
je 0x140006dd8
cmp edi, 1
je 0x140006da3
xor edi, edi
test ebx, ebx
je 0x140006e1a
lea rcx, [rbp - 0x50]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wtoi]
nop dword [rax + rax]
mov dword [rsp + 0x68], eax
jmp 0x140006ec5
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x78]
lea rax, [rsp + 0x68]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea rdx, str._lu._lu._lu._lu
lea rcx, [rbp - 0x50]
call fcn.1400025b4
xor edi, edi
jmp 0x140006ec5
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x60]
lea rdx, str._lu._lu._lu
lea rcx, [rbp - 0x50]
call fcn.1400025b4
jmp 0x140006dd1
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x60]
lea rdx, str._lu._lu
lea rcx, [rbp - 0x50]
call fcn.1400025b4
jmp 0x140006dd1
lea rcx, [rbp - 0x50]
jmp 0x140006e26
inc ebx
lea rcx, [rax + 2]
mov edx, 0x2c
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x140006e20
lea rcx, [rbp - 0x50]
sub ebx, 1
je 0x140006eaf
sub ebx, 1
je 0x140006e8d
cmp ebx, 1
je 0x140006e61
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wtoi]
nop dword [rax + rax]
mov dword [rsp + 0x60], eax
jmp 0x140006ec5
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x78]
lea rax, [rsp + 0x68]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea rdx, str._lu__lu__lu__lu
call fcn.1400025b4
jmp 0x140006ec5
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x60]
lea rdx, str._lu__lu__lu
call fcn.1400025b4
jmp 0x140006ec5
lea r9, [rsp + 0x78]
lea r8, [rsp + 0x60]
lea rdx, str._lu__lu
call fcn.1400025b4
mov edx, dword [rsp + 0x70]
mov eax, dword [rsp + 0x60]
mov ecx, dword [rsp + 0x78]
shl eax, 0x10
add ecx, eax
mov qword [rsp + 0x70], rdi
mov eax, dword [rsp + 0x68]
shl eax, 0x10
add edx, eax
mov ebx, ecx
and rbx, 0xffffffffffff0000
movzx eax, cx
or rbx, rax
lea rcx, [rsp + 0x70]
mov eax, edx
shr rax, 0x10
shl rbx, 0x10
or rbx, rax
movzx eax, dx
shl rbx, 0x10
mov edx, r13d
or rbx, rax
call fcn.14000654c
test eax, eax
jne 0x140006f37
lea rdx, str.ERROR:_Back_up_files_may_not_be_available_for_rollback._r_n
lea ecx, [rax + 2]
call fcn.140019ae0
mov edx, r13d
lea rcx, [rsp + 0x70]
call fcn.140006694
cmp rbx, qword [rsp + 0x70]
jb 0x140006f95
mov rbx, qword [rbp - 0x68]
lea r8, [rbp + 0x260]
mov rax, qword [rsi]
mov edx, 0x104
mov rcx, qword [rbx + rax]
mov ebx, 1
sub r8, rcx
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140006f7f
movzx eax, word [r8 + rcx]
test ax, ax
je 0x140006f7f
mov word [rcx], ax
add rcx, 2
sub rdx, rbx
jne 0x140006f5d
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
add r12d, ebx
add qword [rbp - 0x68], 8
mov word [rax], di
mov edi, dword [rbp - 0x7c]
xor edx, edx
mov ebx, dword [rbp - 0x80]
mov ecx, dword [rsp + 0x64]
inc ebx
mov dword [rbp - 0x80], ebx
cmp ebx, ecx
jae 0x140007008
mov rcx, qword [rbp - 0x70]
lea rax, [rbp - 0x78]
mov qword [rsp + 0x38], rax
lea r9, [rbp - 0x74]
lea rax, [rbp + 0x260]
mov dword [rbp - 0x78], 0x104
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x1c0]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rdx
mov edx, ebx
mov dword [rbp - 0x74], 0x50
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
nop dword [rax + rax]
xor edx, edx
test eax, eax
je 0x140006ba9
mov ecx, dword [rsp + 0x64]
jmp 0x14000700a
mov ecx, dword [rsp + 0x64]
xor edx, edx
cmp ecx, r12d
jle 0x140007067
cmp qword [rsi], rdx
je 0x140007067
mov ebx, r12d
cmp r12d, ecx
jae 0x14000704e
mov r14d, 1
mov rax, qword [rsi]
mov edi, ebx
cmp qword [rax + rdi*8], rdx
je 0x140007043
mov rcx, qword [rax + rdi*8]
call fcn.140001454
mov rax, qword [rsi]
xor edx, edx
mov qword [rax + rdi*8], rdx
mov ecx, dword [rsp + 0x64]
add ebx, r14d
cmp ebx, ecx
jb 0x140007022
or r14, 0xffffffffffffffff
test r12d, r12d
jne 0x14000706a
mov rcx, qword [rsi]
test rcx, rcx
je 0x14000706e
call fcn.140001454
xor eax, eax
mov qword [rsi], rax
jmp 0x14000706e
test r12d, r12d
cmovg r14d, r12d
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, r14d
mov rcx, qword [rbp + 0xaa0]
xor rcx, rsp
call fcn.1400017f0
mov rbx, qword [rsp + 0xc00]
add rsp, 0xbb0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret