Function at 0x4016f0
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x8f8
xor r8d, r8d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x940], rcx
mov r9d, edx
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x948], edx
lea rdx, str.SOFTWAREPythonPythonCore
mov qword [rsp + 0x48], rax
call rax
lea rcx, str.HKLM
lea rdx, str.HKCU
cmp qword [rsp + 0x940], 0xffffffff80000002
cmove rdx, rcx
mov qword [rsp + 0x58], rdx
test eax, eax
jne 0x401bd0
mov rax, qword [0x0044c808]
lea rdx, [0x0044c820]
imul rsi, rax, 0x214
add rsi, rdx
cmp rax, 0x63
ja 0x401c84
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r15d, r15d
lea r14, [rsp + 0x80]
mov qword [rsp + 0x50], rax
jmp 0x401805
lea rax, [rsp + 0x68]
lea rdi, [rsi + 0xc]
mov rcx, qword [rsp + 0x78]
xor edx, edx
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x64]
mov dword [rsp + 0x68], 0x207
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x78]
mov r12d, eax
mov rax, qword [rsp + 0x50]
call rax
test r12d, r12d
jne 0x401928
cmp dword [rsp + 0x64], 1
je 0x401980
add r15d, 1
cmp qword [0x0044c808], 0x63
ja 0x401900
mov rcx, qword [rsp + 0x70]
mov r9d, 8
mov r8, r14
mov edx, r15d
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x401be8
mov r9d, 3
mov r8, r14
mov edx, 4
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcsncpy_s]
lea rbx, [rsp + 0x90]
lea rax, str.SOFTWAREPythonPythonCore
mov r8, 0xffffffffffffffff
lea r9, str._ls_lsInstallPath
mov edx, 0x30
mov rcx, rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
mov rbp, qword [sym.imp.msvcrt.dll__snwprintf_s]
call rbp
lea rax, [rsp + 0x78]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x948]
mov rcx, qword [rsp + 0x940]
mov rax, qword [rsp + 0x48]
call rax
test eax, eax
je 0x4017a0
xor edx, edx
mov r9d, 0x400
mov r8d, eax
mov ecx, 0x1200
lea rdi, [rsp + 0xf0]
mov dword [rsp + 0x28], 0x400
add r15d, 1
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rdx, qword [rsp + 0x58]
mov r9, rdi
mov r8, rbx
lea rcx, str._ls_ls:__ls
call fcn.004015a0
cmp qword [0x0044c808], 0x63
jbe 0x401805
nop
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x50]
call rax
nop
add rsp, 0x8f8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r8d, r12d
xor edx, edx
mov r9d, 0x400
mov ecx, 0x1200
lea rdi, [rsp + 0xf0]
mov dword [rsp + 0x28], 0x400
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rdx, qword [rsp + 0x58]
mov r9, rdi
mov r8, rbx
lea rcx, str._ls_ls:__ls_n
call fcn.004015a0
jmp 0x4017f3
mov eax, dword [rsp + 0x68]
shr eax, 1
lea edx, [rax - 1]
mov dword [rsp + 0x68], edx
lea edx, [rax - 2]
cmp word [rsi + rdx*2 + 0xc], 0x5c
jne 0x40199c
mov dword [rsp + 0x68], edx
mov rcx, qword [0x00406200]
test rcx, rcx
je 0x4017f3
lea rbx, [0x00406200]
mov r12, rdi
nop word cs:[rax + rax]
mov eax, dword [rsp + 0x68]
mov edx, 0x104
mov qword [rsp + 0x20], rcx
lea r9, str._ls_ls
sub edx, eax
lea r10, [rsi + rax*2 + 0xc]
lea rax, str.python.exe
mov rcx, r10
mov r8, rdx
mov qword [rsp + 0x28], rax
call rbp
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [rsp + 0x6c], eax
cmp eax, 0xffffffff
je 0x401b78
test al, 0x10
jne 0x401a70
xor edi, edi
cmp qword [0x0044c808], 0
lea r13, [0x0044c82c]
jne 0x401a34
jmp 0x401a88
add rdi, 1
add r13, 0x214
cmp rdi, qword [0x0044c808]
jae 0x401a88
mov rdx, r13
mov rcx, r12
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x401a20
mov rdx, r12
lea rcx, str.locate_pythons_for_key:__ls:_already_found_n
call fcn.004015a0
mov rcx, qword [rbx + 8]
add rbx, 8
test rcx, rcx
je 0x4017f3
lea r12, [rsi + 0xc]
jmp 0x4019c0
mov r8d, eax
mov rdx, r12
lea rcx, str.locate_pythons_for_key:__ls_is_a_directory_n
call fcn.004015a0
jmp 0x401a53
lea rdx, [rsp + 0x6c]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
test eax, eax
je 0x401c60
mov r8d, dword [rsp + 0x6c]
cmp r8d, 6
je 0x401c78
test r8d, r8d
jne 0x401c40
mov dword [rsi + 8], 0x20
mov edx, 0x20
mov rcx, r12
call sub.msvcrt.dll_wcschr
test rax, rax
je 0x401afb
mov rcx, r12
call sub.msvcrt.dll_wcslen
lea rcx, [rsi + 0xe]
mov rdx, r12
lea rdi, [rax + rax]
mov r8, rdi
call sub.msvcrt.dll_memmove
mov eax, 0x22
mov word [rsi + 0xc], ax
mov dword [rsi + rdi + 0xe], 0x22
mov r8d, dword [rsi + 8]
mov rdx, r12
lea rcx, str.locate_pythons_for_key:__ls_is_a__dbit_executable_n
call fcn.004015a0
mov rax, qword [0x0044c808]
lea rdx, [rsi + 0x214]
add rax, 1
mov qword [0x0044c808], rax
cmp rax, 0x63
ja 0x401900
mov rax, qword [rsi]
lea rdi, [rsi + 0x21c]
and rdi, 0xfffffffffffffff8
mov qword [rsi + 0x214], rax
mov rax, qword [rsi + 0x20c]
mov qword [rsi + 0x420], rax
mov rax, rdx
sub rax, rdi
lea ecx, [rax + 0x214]
sub rsi, rax
mov eax, ecx
shr eax, 3
mov ecx, eax
rep movsq qword [rdi], qword [rsi]
mov rsi, rdx
jmp 0x401a53
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdi, [rsp + 0xf0]
xor edx, edx
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x400
mov r8d, eax
mov ecx, 0x1200
mov r9d, 0x400
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov r8, rdi
mov rdx, r12
lea rcx, str.locate_pythons_for_key:__ls:__ls
call fcn.004015a0
jmp 0x401a53
lea rcx, str.locate_pythons_for_key:_unable_to_open_PythonCore_key_in__ls_n
call fcn.004015a0
jmp 0x40190d
cmp eax, 0x103
je 0x401900
xor edx, edx
mov r9d, 0x400
mov r8d, eax
mov ecx, 0x1200
lea rbx, [rsp + 0xf0]
mov dword [rsp + 0x28], 0x400
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov r8, rbx
mov rdx, r14
lea rcx, str.Cant_enumerate_registry_key_for_version__ls:__ls_n
call fcn.004015a0
jmp 0x401900
mov dword [rsi + 8], 0
mov rdx, r12
lea rcx, str.locate_pythons_for_key:__ls:_invalid_binary_type:__X_n
call fcn.004015a0
jmp 0x401a53
mov rdx, r12
lea rcx, str.Failure_getting_binary_type:__ls_n
call fcn.004015a0
jmp 0x401a53
mov dword [rsi + 8], 0x40
jmp 0x401abd
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], rax
jmp 0x401900