Function at 0x14000320c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x1f8]
sub rsp, 0x2f0
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
xor edi, edi
mov ebx, edx
and qword [rsp + 0x48], rdi
mov rsi, rcx
test rcx, rcx
jne 0x140003253
xor eax, eax
jmp 0x14000345e
lea rax, [rsp + 0x48]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftMediaPlayerSetup
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000345c
and dword [rsp + 0x40], edi
lea rax, str.WMFDist11RollbackTo
test ebx, ebx
mov dword [rsp + 0x44], 1
lea r8, str.WMP11RollbackTo
mov edx, 0x208
cmove r8, rax
lea rcx, [rbp - 0x30]
call fcn.1400014f8
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x44]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x40], 0x80
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140003451
and dword [rsp + 0x30], eax
lea edi, [rax + 1]
and dword [rsp + 0x34], eax
lea rcx, [rsp + 0x50]
and dword [rsp + 0x38], eax
and dword [rsp + 0x3c], eax
xor ebx, ebx
jmp 0x14000330d
inc ebx
lea rcx, [rax + 2]
mov edx, 0x2e
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
jne 0x140003307
mov ecx, ebx
sub ecx, edi
je 0x1400033f1
sub ecx, edi
je 0x1400033c9
cmp ecx, edi
lea rcx, [rsp + 0x50]
je 0x14000339c
test ebx, ebx
je 0x140003351
call qword [sym.imp.msvcrt.dll__wtoi]
mov dword [rsp + 0x38], eax
jmp 0x14000340d
inc ebx
lea rcx, [rax + 2]
mov edx, 0x2c
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
jne 0x14000334b
lea rcx, [rsp + 0x50]
sub ebx, edi
je 0x140003393
sub ebx, edi
je 0x14000338a
cmp ebx, edi
je 0x140003381
call qword [sym.imp.msvcrt.dll__wtoi]
mov dword [rsp + 0x30], eax
jmp 0x14000340d
lea rdx, str._lu__lu__lu__lu
jmp 0x1400033a3
lea rdx, str._lu__lu__lu
jmp 0x1400033d5
lea rdx, str._lu__lu
jmp 0x1400033fd
lea rdx, str._lu._lu._lu._lu
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x30]
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll_swscanf]
jmp 0x14000340d
lea rdx, str._lu._lu._lu
lea rcx, [rsp + 0x50]
lea rax, [rsp + 0x38]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
call qword [sym.imp.msvcrt.dll_swscanf]
jmp 0x14000340d
lea rdx, str._lu._lu
lea rcx, [rsp + 0x50]
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x30]
call qword [sym.imp.msvcrt.dll_swscanf]
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
mov edx, dword [rsp + 0x3c]
shl eax, 0x10
add ecx, eax
mov eax, dword [rsp + 0x38]
mov r8d, ecx
and r8, 0xffffffffffff0000
shl eax, 0x10
add edx, eax
movzx eax, cx
or r8, rax
mov ecx, edx
shl r8, 0x10
shr rcx, 0x10
or r8, rcx
movzx ecx, dx
shl r8, 0x10
or r8, rcx
mov qword [rsi], r8
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.14003c6c0
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret