Function at 0x140022174
Capabilities:
Query or enumerate registry key
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x270], rax
mov rdi, rcx
mov r13, rdx
mov ecx, 0x98
call fcn.14003c2c4
xor r15d, r15d
test rax, rax
je 0x1400221cd
lea rdx, str.ERROR
mov rcx, rax
call fcn.140023fa0
jmp 0x1400221d0
mov rax, r15
mov qword [rdi + 0x290], rax
mov qword [rdi + 0x298], rax
test rax, rax
jne 0x1400221ed
mov eax, 0x8007000e
jmp 0x14002298c
mov qword [rax + 0x78], rdi
lea r8, [rsp + 0x60]
mov rcx, qword [rdi + 0x290]
lea rdx, [0x140045190]
mov eax, dword [rdi + 0x28]
mov dword [rsp + 0x20], 1
mov dword [rcx + 0x74], eax
mov rcx, r13
call fcn.14001c1c8
or r14, 0xffffffffffffffff
mov ebx, eax
mov r12d, 2
test eax, eax
js 0x140022244
lea rdx, str.skip
lea rcx, [rsp + 0x60]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x1400228fb
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 1
lea rdx, str.TYPE
mov rcx, r13
call fcn.14001c1c8
mov ebx, eax
test eax, eax
jns 0x140022281
lea r8, str.TYPE
lea rdx, str.ERROR:_Reg_Parser:_Missing_required_component_attribute__S._r_n
mov ecx, r12d
call fcn.140016868
jmp 0x1400228fb
mov rbx, qword [rdi + 0x290]
add rbx, 0x38
je 0x1400222f1
mov rcx, qword [rbx]
test rcx, rcx
je 0x14002229e
call fcn.14003c2b8
mov qword [rbx], r15
lea rax, [rsp + 0x60]
mov rsi, r14
inc rsi
cmp word [rax + rsi*2], r15w
jne 0x1400222a6
inc rsi
mov rax, r12
mul rsi
cmovo rax, r14
mov rcx, rax
call fcn.14003c310
mov qword [rbx], rax
test rax, rax
je 0x1400222f1
lea r8, [rsp + 0x60]
mov rdx, rsi
mov rcx, rax
call fcn.140001470
test eax, eax
jns 0x1400222f1
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400222f1
call fcn.14003c2b8
mov qword [rbx], r15
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 1
lea rdx, str.COMPONENTNAME
mov rcx, r13
call fcn.14001c1c8
mov ebx, eax
test eax, eax
jns 0x14002231f
lea r8, str.COMPONENTNAME
jmp 0x14002226d
mov rbx, qword [rdi + 0x290]
add rbx, 0x30
je 0x14002238f
mov rcx, qword [rbx]
test rcx, rcx
je 0x14002233c
call fcn.14003c2b8
mov qword [rbx], r15
lea rax, [rsp + 0x60]
mov rsi, r14
inc rsi
cmp word [rax + rsi*2], r15w
jne 0x140022344
inc rsi
mov rax, r12
mul rsi
cmovo rax, r14
mov rcx, rax
call fcn.14003c310
mov qword [rbx], rax
test rax, rax
je 0x14002238f
lea r8, [rsp + 0x60]
mov rdx, rsi
mov rcx, rax
call fcn.140001470
test eax, eax
jns 0x14002238f
mov rcx, qword [rbx]
test rcx, rcx
je 0x14002238f
call fcn.14003c2b8
mov qword [rbx], r15
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], r15d
xor edx, edx
mov rcx, r13
call fcn.14001c1c8
mov ebx, eax
test eax, eax
js 0x1400223c0
lea rcx, [rsp + 0x60]
mov rax, r14
inc rax
cmp word [rcx + rax*2], r15w
jne 0x1400223b1
test rax, rax
jne 0x1400223de
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 1
lea rdx, [0x140045410]
mov rcx, r13
call fcn.14001c1c8
mov ebx, eax
test ebx, ebx
jns 0x1400223ee
lea r8, str.DISPLAYNAME
jmp 0x14002226d
mov rbx, qword [rdi + 0x290]
add rbx, 0x18
je 0x14002245e
mov rcx, qword [rbx]
test rcx, rcx
je 0x14002240b
call fcn.14003c2b8
mov qword [rbx], r15
lea rax, [rsp + 0x60]
mov rsi, r14
inc rsi
cmp word [rax + rsi*2], r15w
jne 0x140022413
inc rsi
mov rax, r12
mul rsi
cmovo rax, r14
mov rcx, rax
call fcn.14003c310
mov qword [rbx], rax
test rax, rax
je 0x14002245e
lea r8, [rsp + 0x60]
mov rdx, rsi
mov rcx, rax
call fcn.140001470
test eax, eax
jns 0x14002245e
mov rcx, qword [rbx]
test rcx, rcx
je 0x14002245e
call fcn.14003c2b8
mov qword [rbx], r15
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 1
lea rdx, str.PRIORITY
mov rcx, r13
call fcn.14001c1c8
test eax, eax
js 0x14002248f
mov rcx, qword [rdi + 0x290]
lea rdx, [rsp + 0x60]
call fcn.1400246ec
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 1
lea rdx, str.INSTALLEDSIZE
mov rcx, r13
call fcn.14001c1c8
test eax, eax
js 0x1400224fa
mov rbx, qword [rdi + 0x290]
lea rdx, [0x1400420ec]
mov r8, r12
mov dword [rsp + 0x40], r15d
lea rcx, [rsp + 0x60]
call qword [sym.imp.msvcrt.dll__wcsnicmp]
lea rcx, [rsp + 0x60]
test eax, eax
jne 0x1400224f1
lea r8, [rsp + 0x40]
lea rdx, [0x1400420f4]
call qword [sym.imp.msvcrt.dll_swscanf]
mov eax, dword [rsp + 0x40]
jmp 0x1400224f7
call qword [sym.imp.msvcrt.dll__wtoi]
mov dword [rbx + 0x68], eax
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 1
lea rdx, str.MINIMUMVERSION
mov rcx, r13
call fcn.14001c1c8
test eax, eax
js 0x14002258a
mov rbx, qword [rdi + 0x290]
add rbx, 0x50
je 0x14002258a
mov rcx, qword [rbx]
test rcx, rcx
je 0x140022537
call fcn.14003c2b8
mov qword [rbx], r15
lea rax, [rsp + 0x60]
mov rsi, r14
inc rsi
cmp word [rax + rsi*2], r15w
jne 0x14002253f
inc rsi
mov rax, r12
mul rsi
cmovo rax, r14
mov rcx, rax
call fcn.14003c310
mov qword [rbx], rax
test rax, rax
je 0x14002258a
lea r8, [rsp + 0x60]
mov rdx, rsi
mov rcx, rax
call fcn.140001470
test eax, eax
jns 0x14002258a
mov rcx, qword [rbx]
test rcx, rcx
je 0x14002258a
call fcn.14003c2b8
mov qword [rbx], r15
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 1
lea rdx, str.SUPPORTEDRANGE
mov rcx, r13
call fcn.14001c1c8
test eax, eax
js 0x14002261a
mov rbx, qword [rdi + 0x290]
add rbx, 0x48
je 0x14002261a
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400225c7
call fcn.14003c2b8
mov qword [rbx], r15
lea rax, [rsp + 0x60]
mov rsi, r14
inc rsi
cmp word [rax + rsi*2], r15w
jne 0x1400225cf
inc rsi
mov rax, r12
mul rsi
cmovo rax, r14
mov rcx, rax
call fcn.14003c310
mov qword [rbx], rax
test rax, rax
je 0x14002261a
lea r8, [rsp + 0x60]
mov rdx, rsi
mov rcx, rax
call fcn.140001470
test eax, eax
jns 0x14002261a
mov rcx, qword [rbx]
test rcx, rcx
je 0x14002261a
call fcn.14003c2b8
mov qword [rbx], r15
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 1
lea rdx, str.INSTORDER
mov rcx, r13
call fcn.14001c1c8
mov rbx, qword [rdi + 0x290]
test eax, eax
js 0x140022687
mov r8, r12
mov dword [rsp + 0x40], r15d
lea rdx, [0x1400420ec]
lea rcx, [rsp + 0x60]
call qword [sym.imp.msvcrt.dll__wcsnicmp]
lea rcx, [rsp + 0x60]
test eax, eax
jne 0x14002267c
lea r8, [rsp + 0x40]
lea rdx, [0x1400420f4]
call qword [sym.imp.msvcrt.dll_swscanf]
mov eax, dword [rsp + 0x40]
jmp 0x140022682
call qword [sym.imp.msvcrt.dll__wtoi]
mov dword [rbx + 0x64], eax
jmp 0x14002268e
mov dword [rbx + 0x64], 0x63
mov rsi, qword [rdi + 0x290]
test r13, r13
je 0x140022876
mov rbx, qword [rsi + 0x80]
test rbx, rbx
jne 0x1400226d6
lea ecx, [rbx + 0x10]
call fcn.14003c2c4
mov rbx, rax
test rax, rax
je 0x1400226c3
mov qword [rax], r15
mov qword [rax + 8], r15
jmp 0x1400226c6
mov rbx, r15
mov qword [rsi + 0x80], rbx
test rbx, rbx
je 0x140022876
mov r12d, r15d
mov qword [rsp + 0x50], r15
mov r14d, r15d
mov ecx, r14d
test r14d, r14d
je 0x14002271c
sub ecx, 1
je 0x140022713
sub ecx, 1
je 0x14002270a
cmp ecx, 1
je 0x140022701
lea rsi, str.AddsTo
jmp 0x140022723
lea rsi, str.GainsFrom
jmp 0x140022723
lea rsi, str.ReliesUpon
jmp 0x140022723
lea rsi, str.CriticalTo
jmp 0x140022723
lea rsi, str.Definition
lea rax, [rsp + 0x50]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140022812
xor eax, eax
mov dword [rsp + 0x40], 0x80
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r8, [rbp + 0x170]
mov qword [rsp + 0x30], rax
mov edx, r15d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140022804
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x40], 0x80
lea rdx, [rbp + 0x170]
inc r15d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140022804
lea r8, [rbp + 0x170]
lea rdx, str.Reg_parser:_Adding_dependency__S._r_n
lea ecx, [rax + 4]
call fcn.140016868
mov rdx, qword [rsp + 0x48]
mov r8, rsi
mov rcx, rbx
call fcn.14001d7d8
mov rcx, qword [rsp + 0x48]
mov r12d, eax
test eax, eax
js 0x1400227fe
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x140022759
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r15d, r15d
test r12d, r12d
js 0x14002286c
inc r14d
cmp r14d, 5
jl 0x1400226e1
test r12d, r12d
js 0x14002286c
mov rbx, qword [rdi + 0x290]
mov rax, qword [rbx + 0x88]
test rax, rax
jne 0x140022861
lea ecx, [rax + 0x10]
call fcn.14003c2c4
test rax, rax
je 0x140022852
mov qword [rax], r15
mov qword [rax + 8], r15
jmp 0x140022855
mov rax, r15
mov qword [rbx + 0x88], rax
test rax, rax
je 0x14002286c
mov rdx, r13
mov rcx, rax
call fcn.140020194
mov r12d, 2
or r14, 0xffffffffffffffff
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 1
lea rdx, [0x140045410]
mov rcx, r13
call fcn.14001c1c8
mov ebx, eax
test eax, eax
jns 0x1400228c7
mov rcx, qword [rdi + 0x290]
call fcn.14002513c
test rax, rax
jne 0x1400228b5
lea r8, [0x140045410]
jmp 0x14002226d
mov r8, rax
lea rcx, [rsp + 0x60]
mov edx, 0x104
call fcn.140001470
mov rcx, qword [rdi + 0x290]
lea rdx, [rsp + 0x60]
call fcn.1400251b4
mov ebx, eax
test eax, eax
js 0x1400228ef
mov rdx, qword [rdi + 0x290]
mov rcx, rdi
call fcn.140023128
mov ebx, eax
mov eax, ebx
not eax
test eax, eax
js 0x14002298a
mov rsi, qword [rdi + 0x290]
test rsi, rsi
je 0x14002291e
mov rcx, rsi
call fcn.140024080
mov rcx, rsi
call fcn.14003c304
mov qword [rdi + 0x290], r15
mov qword [rdi + 0x298], r15
test ebx, ebx
jns 0x14002293d
mov r8d, ebx
lea rdx, str.ERROR:_Reg_Parser:_Failed_to_add_component_from_reg.__Result:_0x_x._r_n
mov ecx, r12d
call fcn.140016868
jmp 0x14002298a
mov rcx, qword [0x140050310]
cmp rcx, r14
jne 0x14002295f
mov edx, 4
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, r14
je 0x14002298a
cmp dword [0x1400516e0], 4
jl 0x14002298a
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], r15d
mov r8d, 0x3a
mov qword [rsp + 0x20], r15
lea rdx, str.Reg_Parser:_Deliberately_did_not_add_component_from_reg._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, ebx
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.14003c6c0
mov rbx, qword [rsp + 0x3d0]
add rsp, 0x380
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret