Function at 0x1400e91a0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x268
movaps xmmword [rsp + 0x250], xmm6
mov r13, rdx
mov rdi, rcx
mov rax, qword [0x1404fe040]
xor rax, rsp
mov qword [rsp + 0x248], rax
lea rax, [rsp + 0x238]
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax - 8], rax
mov rsi, qword [r8]
mov r12, qword [r8 + 8]
lea rcx, [rsp + 0x230]
mov qword [rsp + 0x1f8], rcx
mov qword [rsp + 0x200], rax
cmp rsi, r12
je 0x1400e927b
lea rbx, [rsp + 0x80]
lea r14, [rsp + 0x210]
lea r15, [rsp + 0x1f8]
movsx rax, byte [rsi + 0x17]
mov rcx, rsi
test rax, rax
jns 0x1400e9235
mov rax, qword [rsi + 8]
mov rcx, qword [rsi]
mov qword [rsp + 0x210], rcx
mov qword [rsp + 0x218], rax
mov rcx, rbx
mov rdx, r14
call fcn.1400ff980
mov rcx, r15
mov rdx, rbx
call fcn.140304830
cmp byte [rsp + 0x97], 0
jns 0x1400e9272
mov rcx, qword [rsp + 0x80]
call fcn.140296608
add rsi, 0x18
cmp rsi, r12
jne 0x1400e9221
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rbx, [rsp + 0x210]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [0x140470090]
movaps xmmword [rbx], xmm0
mov rcx, rbx
call fcn.1400fd730
cmp byte [r13 + 0x17], 0
mov r8, r13
jns 0x1400e92b1
mov r8, qword [r13]
mov rcx, rbx
mov rdx, rdi
mov r9d, ntohl
call fcn.1400fd8f0
test eax, eax
je 0x1400e935a
mov edi, eax
mov ecx, 2
call fcn.14020f6a0
xor al, 1
cmp edi, 2
sete cl
or cl, al
jne 0x1400e9485
lea rdx, str.....chromeinstaller_setup_setup_util.cc
lea rbx, [rsp + 0x80]
mov rcx, rbx
mov r8d, 0x153
mov r9d, 2
call fcn.140114680
lea rcx, [rsp + 0x90]
lea rdx, str.Failed_to_open
mov r8d, 0xf
call fcn.1401e0d00
mov rcx, rax
mov rdx, r13
call fcn.14010d1c0
lea rdx, str.__result_
mov r8d, ntohl
mov rcx, rax
call fcn.1401e0d00
mov rcx, rax
mov edx, edi
call fcn.1400c24e0
mov rcx, rbx
call fcn.140114c90
jmp 0x1400e9485
mov qword [rsp + 0x78], r13
movabs rsi, 0x7fffffffffffffff
lea rax, [rsp + 0x200]
xorps xmm6, xmm6
movups xmmword [rax], xmm6
mov qword [rax - 8], rax
mov ecx, 0x208
call fcn.1402965cc
lea rdi, [rsp + 0x1e0]
mov qword [rdi], rax
lea rcx, [rsi + 0x105]
mov qword [rdi + 0x10], rcx
mov qword [rdi + 8], 0x100
mov r8d, 0x202
mov rcx, rax
xor edx, edx
call fcn.1402d26c0
mov r13d, 0xa
lea r14, [rsp + 0x1dc]
mov r12, qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
xor ebp, ebp
xor ebx, ebx
jmp 0x1400e961e
lea rdx, [0x14047b3ea]
lea rcx, [rsp + 0x210]
mov r8b, 1
call fcn.1400fdaa0
test eax, eax
je 0x1400e945d
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, 2
call fcn.14020f6a0
test al, al
je 0x1400e945d
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x20], eax
lea rdx, str.....chromeinstaller_setup_setup_util.cc
lea rdi, [rsp + 0x80]
mov rcx, rdi
mov r8d, 0x19d
mov r9d, 2
call fcn.14030e0f0
lea rcx, [rsp + 0x90]
lea rdx, str.Failed_to_delete_key
mov r8d, 0x15
call fcn.1401e0d00
mov rcx, rax
mov rdx, qword [rsp + 0x78]
call fcn.14010d1c0
mov rcx, rdi
call fcn.14030e160
cmp byte [rsp + 0x1f7], 0
jns 0x1400e9474
mov rcx, qword [rsp + 0x1e0]
call fcn.140296608
lea rcx, [rsp + 0x1f8]
mov rdx, qword [rcx + 8]
call fcn.1400ebdf0
lea rcx, [rsp + 0x210]
call fcn.1400fda20
lea rcx, [rsp + 0x230]
mov rdx, qword [rcx + 8]
call fcn.1400ebdf0
mov rcx, qword [rsp + 0x248]
xor rcx, rsp
cmp rcx, qword [0x1404fe040]
je 0x1400e94bd
call fcn.140297b50
int3
movaps xmm6, xmmword [rsp + 0x250]
add rsp, 0x268
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
cmp eax, 0x103
jne 0x1400e94f0
xor ebp, ebp
test bl, 1
mov ebx, 0
jne 0x1400e961e
cmp qword [rsp + 0x208], 0
je 0x1400e93d1
lea rdi, [rsp + 0x1f8]
mov rdx, qword [rdi + 8]
mov rcx, rdi
call fcn.1400ebdf0
lea rax, [rsp + 0x200]
mov qword [rdi], rax
xorps xmm6, xmm6
movups xmmword [rdi + 8], xmm6
mov r13d, 0xa
mov ebp, 0x7fff
lea r14, [rsp + 0x1e0]
lea r15, [rsp + 0x1dc]
mov rdi, qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ebx, ebx
xor r12d, r12d
jmp 0x1400e9a2b
mov r9, rax
and r9, rsi
dec r9
cmp r8, r9
jbe 0x1400e9618
mov r8, qword [rsp + 0x1e8]
jmp 0x1400e95d9
sub rdx, rax
mov rcx, rdi
xor r8d, r8d
call fcn.1401f9a00
jmp 0x1400e9686
cmp rdx, rax
ja 0x1400e956d
mov byte [rsp + 0x1f7], dl
mov rax, rdi
jmp 0x1400e9680
cmp eax, 0xea
jne 0x1400e94d9
movsx rcx, byte [rsp + 0x1f7]
test rcx, rcx
mov rax, qword [rsp + 0x1f0]
lea r8, [rax + rax - 2]
mov edx, 0x14
cmovs rdx, r8
lea r9, [rsi - 8]
cmp rdx, r9
ja 0x1400e9da7
test cl, cl
js 0x1400e9551
mov r8, rcx
cmp rdx, r8
cmova r8, rdx
mov rdx, r8
or rdx, 3
cmp rdx, 0xb
mov r9d, ntohl
cmove rdx, r9
cmp r8, 0xb
mov r8d, 0xa
cmovb rdx, r8
test cl, cl
js 0x1400e9eca
cmp rdx, r8
je 0x1400e9618
mov rcx, rdi
call fcn.1400e1f50
mov r15d, ebx
mov ebx, r15d
movsx rax, byte [rsp + 0x1f7]
mov rcx, qword [rsp + 0x1f0]
and rcx, rsi
dec rcx
test rax, rax
cmovns rcx, r13
mov rdx, rcx
shr rdx, 0x20
neg rdx
mov edx, 0
sbb edx, edx
or edx, ecx
mov dword [rsp + 0x1dc], edx
test rax, rax
jns 0x1400e9580
mov rax, qword [rsp + 0x1e8]
cmp rax, rdx
jb 0x1400e956d
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x1e8], rdx
mov word [rax + rdx*2], 0
cmp byte [rsp + 0x1f7], 0
mov r8, rdi
jns 0x1400e969b
mov r8, qword [rsp + 0x1e0]
mov rcx, qword [rsp + 0x210]
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov edx, ebp
mov r9, r14
call r12
test eax, eax
jne 0x1400e9594
mov edx, dword [rsp + 0x1dc]
movsx rax, byte [rsp + 0x1f7]
test rax, rax
jns 0x1400e989f
mov rax, qword [rsp + 0x1e8]
cmp rax, rdx
jb 0x1400e98b3
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x1e8], rdx
mov word [rax + rdx*2], 0
mov r8, qword [rsp + 0x200]
movzx edx, byte [rsp + 0x1f7]
mov rcx, qword [rsp + 0x1e0]
mov rax, qword [rsp + 0x1e8]
test r8, r8
jne 0x1400e9b96
test dl, dl
cmovns rax, rdx
cmovns rcx, rdi
mov qword [rsp + 0x1c8], rcx
mov qword [rsp + 0x1d0], rax
lea rcx, [rsp + 0x1c8]
call fcn.1400ff970
test al, al
je 0x1400e97cd
movsx rax, byte [rsp + 0x1f7]
test rax, rax
cmovs rax, qword [rsp + 0x1e8]
mov rcx, qword [rsp + 0x1e0]
cmovns rcx, rdi
mov qword [rsp + 0x1b8], rcx
mov qword [rsp + 0x1c0], rax
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x1b8]
call fcn.1400ff980
mov rcx, qword [rsp + 0x238]
movzx eax, byte [rsp + 0x97]
test rcx, rcx
jne 0x1400e9caa
xor r15d, r15d
test al, al
jns 0x1400e97c4
mov rcx, qword [rsp + 0x80]
call fcn.140296608
test r15b, r15b
jne 0x1400e987d
cmp byte [rsp + 0x1f7], 0
mov rdx, rdi
jns 0x1400e97e2
mov rdx, qword [rsp + 0x1e0]
mov r15b, 1
lea rcx, [rsp + 0x210]
mov r8b, 1
call fcn.1400fdaa0
test eax, eax
je 0x1400e961b
mov ecx, 2
call fcn.14020f6a0
test al, al
je 0x1400e987d
lea r15, [rsp + 0x80]
mov rcx, r15
lea rdx, str.....chromeinstaller_setup_setup_util.cc
mov r8d, 0x18e
mov r9d, 2
call fcn.140114680
mov r8d, 0x18
lea rcx, [rsp + 0x90]
lea rdx, str.Failed_to_delete_subkey
call fcn.1401e0d00
mov rcx, rax
mov rdx, rdi
call fcn.14010d1c0
mov r8d, ntohl
mov rcx, rax
lea rdx, str._under_path
call fcn.1401e0d00
mov rcx, rax
mov rdx, qword [rsp + 0x78]
call fcn.14010d1c0
mov rcx, r15
call fcn.140114c90
lea rcx, [rsp + 0x1f8]
lea rdx, [rsp + 0x80]
mov r8, rdi
mov r9, rdi
call fcn.1401f9f30
inc ebp
jmp 0x1400e961e
cmp rdx, rax
ja 0x1400e98b3
mov byte [rsp + 0x1f7], dl
mov rax, rdi
jmp 0x1400e96f7
sub rdx, rax
mov rcx, rdi
xor r8d, r8d
call fcn.1401f9a00
jmp 0x1400e96fd
mov ecx, 2
call fcn.14020f6a0
test al, al
je 0x1400e9948
lea rcx, [rsp + 0x80]
lea rdx, str.....chromeinstaller_setup_setup_util.cc
mov r8d, 0x1cb
mov r9d, 2
call fcn.140114680
mov r8d, 0x17
lea rcx, [rsp + 0x90]
lea rdx, str.Failed_to_delete_value
call fcn.1401e0d00
mov rcx, rax
mov rdx, r14
call fcn.14010d1c0
mov r8d, 8
mov rcx, rax
lea rdx, str._in_key
call fcn.1401e0d00
mov rcx, rax
mov rdx, qword [rsp + 0x78]
call fcn.14010d1c0
lea rcx, [rsp + 0x80]
call fcn.140114c90
lea rcx, [rsp + 0x1f8]
lea rdx, [rsp + 0x80]
mov r8, r14
mov r9, r14
call fcn.1401f9f30
inc ebx
jmp 0x1400e9a2b
sub rdx, rax
mov rcx, r14
xor r8d, r8d
call fcn.1401f9a00
jmp 0x1400e99ea
sub rdx, rax
mov rcx, r14
xor r8d, r8d
call fcn.1401f9a00
jmp 0x1400e9a8d
cmp rdx, rax
ja 0x1400e996a
mov byte [rsp + 0x1f7], dl
mov rax, r14
jmp 0x1400e99e4
cmp rdx, rax
ja 0x1400e997a
mov byte [rsp + 0x1f7], dl
mov rax, r14
jmp 0x1400e9a87
mov edx, dword [rsp + 0x1dc]
movsx rax, byte [rsp + 0x1f7]
test rax, rax
jns 0x1400e998d
mov rax, qword [rsp + 0x1e8]
cmp rax, rdx
jb 0x1400e996a
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x1e8], rdx
mov word [rax + rdx*2], 0
mov rcx, qword [rsp + 0x200]
movzx eax, byte [rsp + 0x1f7]
mov rdx, qword [rsp + 0x1e0]
test rcx, rcx
jne 0x1400e9db4
test al, al
cmovns rdx, r14
lea rcx, [rsp + 0x210]
call fcn.1400fdef0
mov cl, 1
test eax, eax
jne 0x1400e98c6
mov r12d, ecx
movsx rax, byte [rsp + 0x1f7]
mov rcx, qword [rsp + 0x1f0]
and rcx, rsi
dec rcx
test rax, rax
cmovns rcx, r13
cmp rcx, 0x8000
movsx edx, cx
cmovae edx, ebp
mov dword [rsp + 0x1dc], edx
test rax, rax
jns 0x1400e999e
mov rax, qword [rsp + 0x1e8]
cmp rax, rdx
jb 0x1400e997a
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x1e8], rdx
mov word [rax + rdx*2], 0
cmp byte [rsp + 0x1f7], 0
mov r8, r14
jns 0x1400e9aa2
mov r8, qword [rsp + 0x1e0]
mov rcx, qword [rsp + 0x210]
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov edx, ebx
mov r9, r15
call rdi
test eax, eax
je 0x1400e99b2
cmp eax, 0xea
jne 0x1400e9b74
cmp dword [rsp + 0x1dc], 0x7ffe
ja 0x1400e945d
movsx rcx, byte [rsp + 0x1f7]
test rcx, rcx
mov rax, qword [rsp + 0x1f0]
lea r8, [rax + rax - 2]
mov edx, 0x14
cmovs rdx, r8
lea r9, [rsi - 8]
cmp rdx, r9
ja 0x1400e9da7
test cl, cl
js 0x1400e9b5c
mov r8, rcx
cmp rdx, r8
cmova r8, rdx
mov rdx, r8
or rdx, 3
cmp rdx, 0xb
mov r9d, ntohl
cmove rdx, r9
cmp r8, 0xb
mov r8d, 0xa
cmovb rdx, r8
test cl, cl
js 0x1400e9ed8
cmp rdx, r8
je 0x1400e9b54
mov rcx, r14
call fcn.1400e1f50
mov ecx, r12d
jmp 0x1400e9a28
mov r9, rax
and r9, rsi
dec r9
cmp r8, r9
jbe 0x1400e9b54
mov r8, qword [rsp + 0x1e8]
jmp 0x1400e9b15
cmp eax, 0x103
jne 0x1400e945d
xor ebx, ebx
test r12b, 1
mov r12d, 0
jne 0x1400e9a2b
jmp 0x1400e945d
test dl, dl
mov r9, rdx
cmovs r9, rax
mov qword [rsp + 0x60], r9
mov r9, rdi
cmovs r9, rcx
mov qword [rsp + 0x58], r9
movsx r10, byte [r8 + 0x37]
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x70], r10
test r10, r10
jns 0x1400e9bcd
mov r9, qword [r8 + 0x28]
mov qword [rsp + 0x40], r9
lea r9, [r8 + 0x20]
mov qword [rsp + 0x48], r9
mov r9, qword [r8 + 0x20]
mov qword [rsp + 0x68], r9
mov r9, qword [rsp + 0x60]
mov r10, qword [rsp + 0x40]
cmp r10, r9
cmovb r9, r10
mov qword [rsp + 0x50], r9
test r9, r9
je 0x1400e9c2a
cmp byte [rsp + 0x70], 0
mov r15, qword [rsp + 0x48]
cmovs r15, qword [rsp + 0x68]
xor r11d, r11d
movzx r10d, word [r15 + r11*2]
mov r9, qword [rsp + 0x58]
cmp word [r9 + r11*2], r10w
ja 0x1400e9c3a
jb 0x1400e9c99
inc r11
cmp qword [rsp + 0x50], r11
jne 0x1400e9c0d
mov r9, qword [rsp + 0x40]
cmp qword [rsp + 0x60], r9
jne 0x1400e9ee6
cmp qword [rsp + 0x50], 0
je 0x1400e9c80
cmp byte [rsp + 0x70], 0
mov r9, qword [rsp + 0x48]
cmovs r9, qword [rsp + 0x68]
mov qword [rsp + 0x48], r9
xor r15d, r15d
mov r10, qword [rsp + 0x58]
movzx r10d, word [r10 + r15*2]
mov r9, qword [rsp + 0x48]
cmp word [r9 + r15*2], r10w
ja 0x1400e9898
jb 0x1400e9c95
inc r15
cmp qword [rsp + 0x50], r15
jne 0x1400e9c5a
mov r9, qword [rsp + 0x40]
cmp r9, qword [rsp + 0x60]
je 0x1400e9898
jmp 0x1400e9ef1
add r8, 8
mov r8, qword [r8]
test r8, r8
je 0x1400e9726
jmp 0x1400e9bb0
test al, al
mov rdx, qword [rsp + 0x88]
cmovns rdx, rax
mov qword [rsp + 0x40], rdx
mov r8, qword [rsp + 0x80]
lea rdx, [rsp + 0x80]
cmovns r8, rdx
movsx r9, byte [rcx + 0x37]
mov qword [rsp + 0x58], r9
mov qword [rsp + 0x50], r9
test r9, r9
jns 0x1400e9cee
mov rdx, qword [rcx + 0x28]
mov qword [rsp + 0x58], rdx
lea r10, [rcx + 0x20]
mov rdx, qword [rcx + 0x20]
mov qword [rsp + 0x48], rdx
mov r11, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x58]
cmp rdx, r11
cmovb r11, rdx
test r11, r11
je 0x1400e9d37
cmp byte [rsp + 0x50], 0
mov r15, r10
cmovs r15, qword [rsp + 0x48]
xor edx, edx
movzx r9d, word [r15 + rdx*2]
cmp word [r8 + rdx*2], r9w
ja 0x1400e9d47
jb 0x1400e9d8b
inc rdx
cmp r11, rdx
jne 0x1400e9d21
mov rdx, qword [rsp + 0x58]
cmp qword [rsp + 0x40], rdx
jne 0x1400e9efc
test r11, r11
je 0x1400e9d6f
cmp byte [rsp + 0x50], 0
cmovs r10, qword [rsp + 0x48]
xor edx, edx
movzx r9d, word [r8 + rdx*2]
cmp word [r10 + rdx*2], r9w
ja 0x1400e9d9f
jb 0x1400e9d87
inc rdx
cmp r11, rdx
jne 0x1400e9d59
mov r15b, 1
mov rdx, qword [rsp + 0x58]
cmp rdx, qword [rsp + 0x40]
je 0x1400e97b3
jmp 0x1400e9f07
add rcx, 8
mov rcx, qword [rcx]
xor r15d, r15d
test rcx, rcx
je 0x1400e97b3
jmp 0x1400e9cd1
mov r15b, 1
jmp 0x1400e97b3
lea rcx, [rsp + 0x1e0]
call fcn.1402d34d0
test al, al
mov r8, qword [rsp + 0x1e8]
cmovns r8, rax
mov qword [rsp + 0x60], r8
mov r8, r14
cmovs r8, rdx
mov qword [rsp + 0x58], r8
movsx r9, byte [rcx + 0x37]
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x70], r9
test r9, r9
jns 0x1400e9df0
mov r8, qword [rcx + 0x28]
mov qword [rsp + 0x40], r8
lea r8, [rcx + 0x20]
mov qword [rsp + 0x48], r8
mov r8, qword [rcx + 0x20]
mov qword [rsp + 0x68], r8
mov r8, qword [rsp + 0x60]
mov r9, qword [rsp + 0x40]
cmp r9, r8
cmovb r8, r9
mov qword [rsp + 0x50], r8
test r8, r8
je 0x1400e9e4d
cmp byte [rsp + 0x70], 0
mov r11, qword [rsp + 0x48]
cmovs r11, qword [rsp + 0x68]
xor r10d, r10d
movzx r9d, word [r11 + r10*2]
mov r8, qword [rsp + 0x58]
cmp word [r8 + r10*2], r9w
ja 0x1400e9e5d
jb 0x1400e9eb9
inc r10
cmp qword [rsp + 0x50], r10
jne 0x1400e9e30
mov r8, qword [rsp + 0x40]
cmp qword [rsp + 0x60], r8
jne 0x1400e9f12
cmp qword [rsp + 0x50], 0
je 0x1400e9ea3
cmp byte [rsp + 0x70], 0
mov r8, qword [rsp + 0x48]
cmovs r8, qword [rsp + 0x68]
mov qword [rsp + 0x48], r8
xor r11d, r11d
mov r9, qword [rsp + 0x58]
movzx r9d, word [r9 + r11*2]
mov r8, qword [rsp + 0x48]
cmp word [r8 + r11*2], r9w
ja 0x1400e9963
jb 0x1400e9eb5
inc r11
cmp qword [rsp + 0x50], r11
jne 0x1400e9e7d
mov r8, qword [rsp + 0x40]
cmp r8, qword [rsp + 0x60]
je 0x1400e9963
jmp 0x1400e9f1a
add rcx, 8
mov rcx, qword [rcx]
test rcx, rcx
je 0x1400e9a0b
jmp 0x1400e9dd3
and rax, rsi
dec rax
mov r8, rax
jmp 0x1400e960b
and rax, rsi
dec rax
mov r8, rax
jmp 0x1400e9b47
jae 0x1400e9c3a
jmp 0x1400e9c99
jb 0x1400e9c95
jmp 0x1400e9898
jae 0x1400e9d47
jmp 0x1400e9d8b
jb 0x1400e9d87
jmp 0x1400e97b3
jae 0x1400e9e5d
jmp 0x1400e9eb9
jb 0x1400e9eb5
jmp 0x1400e9963