Function at 0x14004ceb0
Capabilities:
Get file version info
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x238]
sub rsp, 0x310
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14035d8c0]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov r12, rcx
xor r15b, r15b
call fcn.140011f18
mov rcx, rax
test rax, rax
je 0x14004d6af
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
lea r14, vtable.ATL::CAtlStringMgr.0
cmp rax, r14
jne 0x14004d6ba
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rbx, [0x1402ed39c]
mov rdi, 0xffffffffffffffff
cmp rbx, 0x10000
jae 0x14004cf54
movzx edx, bx
lea rcx, [rsp + 0x70]
call fcn.140012700
jmp 0x14004cf7b
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x14004cf60
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.140002a7c
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
xor r13d, r13d
mov qword [rsp + 0x60], r13
mov qword [rbp - 0x60], r13
mov dword [rbp - 0x58], r13d
mov qword [rbp - 0x50], r13
mov r9d, 0x20019
lea r8, str.SOFTWAREClasses.pdf
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x60]
call fcn.14003e230
lea rsi, vtable.ATL::CWin32Heap.0
test eax, eax
jne 0x14004d0ac
mov dword [rsp + 0x38], r13d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x78]
xor r8d, r8d
mov rdx, rbx
mov rsi, qword [rbp - 0x60]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004d0a5
mov eax, dword [rsp + 0x78]
dec eax
cmp eax, 1
ja 0x14004d0a5
mov ebx, dword [rsp + 0x38]
shr ebx, 1
lea edx, [rbx + 1]
lea rcx, [rsp + 0x50]
call fcn.14003dfb0
mov dword [rsp + 0x7c], r13d
lea r8, [rsp + 0x7c]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.14004d810
mov r14, qword [rsp + 0x50]
lea eax, [rbx + rbx]
mov dword [rsp + 0x3c], eax
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x80]
xor r8d, r8d
lea rdx, [0x1402ed39c]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004d09e
mov eax, dword [rbp - 0x80]
dec eax
cmp eax, 1
ja 0x14004d09e
mov ebx, dword [rsp + 0x3c]
test r14, r14
je 0x14004d243
test ebx, ebx
je 0x14004d23f
test bl, 1
jne 0x14004d09e
mov eax, ebx
shr rax, 1
cmp word [r14 + rax*2 - 2], r13w
je 0x14004d243
lea r14, vtable.ATL::CAtlStringMgr.0
lea rsi, vtable.ATL::CWin32Heap.0
mov byte [rbp - 0x48], r15b
lea rcx, [rbp - 0x40]
call fcn.140015830
nop
lea rax, [0x1402f8eb8]
lea rdx, [0x1402f06c8]
cmp byte [rbp - 0x48], 0
cmovne rdx, rax
mov rax, rdi
inc rax
cmp word [rdx + rax*2], 0
jne 0x14004d0d3
mov r8d, eax
lea rcx, [rbp - 0x40]
call fcn.140002a7c
mov rbx, qword [rbp - 0x40]
mov r9, rbx
xor r8d, r8d
mov edx, 0x1174f
mov rcx, qword [r12]
call fcn.14001fd40
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004d149
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004d713
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rsi
jne 0x14004d713
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rbx, qword [rsp + 0x70]
mov r9, rbx
xor r8d, r8d
mov edx, 0x11750
mov rcx, qword [r12]
call fcn.14001fd40
nop
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x14004d176
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x60], r13
mov dword [rbp - 0x58], r13d
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14004d1cb
mov rax, qword [rsp + 0x60]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d1b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004d71b
call fcn.1400045a8
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r13
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14004d20f
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004d6a7
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rsi
jne 0x14004d6a7
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.14022aa20
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov word [r14], r13w
shr ebx, 1
test rsi, rsi
je 0x14004d257
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x60], r13
mov dword [rbp - 0x58], r13d
call fcn.140011f18
mov rcx, rax
test rax, rax
je 0x14004d6c1
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
lea r14, vtable.ATL::CAtlStringMgr.0
cmp rax, r14
jne 0x14004d6cc
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
add rax, 0x18
mov qword [rbp - 0x68], rax
lea rcx, [rbp - 0x28]
call fcn.14000a1bc
nop
mov r8d, ebx
mov rdx, qword [rsp + 0x50]
lea rcx, [rbp - 0x28]
call fcn.140009e14
lea r8, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r8, qword [rbp - 0x28]
lea rdx, str.SOFTWAREClasses_s_shellOpencommand
lea rcx, [rbp - 0x68]
call fcn.14004d730
mov r9d, 0x20019
mov r8, qword [rbp - 0x68]
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x60]
call fcn.14003e230
test eax, eax
jne 0x14004d3c3
mov dword [rsp + 0x40], r13d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x7c]
xor r8d, r8d
lea rdx, [0x1402ed39c]
mov r14, qword [rbp - 0x60]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004d3bc
mov eax, dword [rbp - 0x7c]
dec eax
cmp eax, 1
ja 0x14004d3bc
mov ebx, dword [rsp + 0x40]
shr ebx, 1
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.14003dfb0
mov dword [rbp - 0x78], r13d
lea r8, [rbp - 0x78]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
call fcn.14004d810
mov rsi, qword [rsp + 0x50]
lea eax, [rbx + rbx]
mov dword [rsp + 0x44], eax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x74]
xor r8d, r8d
lea rdx, [0x1402ed39c]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004d3bc
mov eax, dword [rbp - 0x74]
dec eax
cmp eax, 1
ja 0x14004d3bc
test rsi, rsi
je 0x14004d42b
mov eax, dword [rsp + 0x44]
test eax, eax
je 0x14004d427
test al, 1
jne 0x14004d3bc
shr rax, 1
cmp word [rsi + rax*2 - 2], 0
je 0x14004d42b
lea r14, vtable.ATL::CAtlStringMgr.0
lea rsi, vtable.ATL::CWin32Heap.0
lea rcx, [rbp - 0x28]
call fcn.140009bb8
nop
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004d0ac
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004d70b
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rsi
jne 0x14004d70b
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14004d0ac
mov word [rsi], r13w
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.140012650
nop
mov dword [rbp - 0x70], 1
lea r9, [rbp - 0x70]
lea r8, [0x1402edfc4]
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x30]
call fcn.14001def0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rbx, qword [rsp + 0x30]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x14004d4f9
cmp dword [rbx + 0x10], 0
jl 0x14004d4ea
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x14004d4ea
call fcn.140002c94
mov rsi, rax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x14004d699
mov r8, qword [rbx]
mov rcx, qword [r8]
mov r9, qword [rcx + 8]
lea rax, vtable.ATL::CAtlStringMgr.0
cmp rcx, rax
jne 0x14004d6e7
mov rcx, qword [r8 + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea rdx, vtable.ATL::CWin32Heap.0
cmp rax, rdx
jne 0x14004d6d3
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x30], rax
jmp 0x14004d4f9
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.140002a7c
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
lea r14, vtable.ATL::CAtlStringMgr.0
jg 0x14004d551
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004d6f3
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, vtable.ATL::CWin32Heap.0
cmp rax, r9
jne 0x14004d6f3
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x30]
cmp dword [rcx - 0x10], 0
je 0x14004d642
lea rdx, [rbp - 0x6c]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test eax, eax
je 0x14004d642
mov ecx, esi
call fcn.140237e90
mov rbx, rax
test rax, rax
je 0x14004d642
mov r9, rax
mov r8d, esi
mov edx, dword [rbp - 0x6c]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
mov rcx, rbx
test eax, eax
je 0x14004d63c
mov qword [rsp + 0x68], r13
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x68]
lea rdx, str.VarFileInfoTranslation
call qword [sym.imp.VERSION.dll_VerQueryValueW]
mov rax, qword [rsp + 0x68]
movzx r9d, word [rax + 2]
movzx r8d, word [rax]
lea rdx, str.StringFileInfo_04x_04xProductName
lea rcx, [rbp]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x68]
lea rdx, [rbp]
mov rcx, rbx
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x14004d639
cmp dword [rsp + 0x48], 0
jbe 0x14004d639
mov rdx, qword [rsp + 0x68]
test rdx, rdx
jne 0x14004d612
mov eax, r13d
jmp 0x14004d61f
mov rax, rdi
inc rax
cmp word [rdx + rax*2], 0
jne 0x14004d615
mov r8d, eax
lea rcx, [rsp + 0x70]
call fcn.140002a7c
mov rcx, rbx
call fcn.1402351a0
mov r15b, 1
jmp 0x14004d642
mov rcx, rbx
call fcn.1402351a0
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004d3c3
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004d703
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea rsi, vtable.ATL::CWin32Heap.0
cmp rax, rsi
jne 0x14004d6fb
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14004d3ca
lea rax, [rsi + 0x18]
mov qword [rsp + 0x30], rax
jmp 0x14004d4f9
call r8
jmp 0x14004d20f
mov ecx, 0x80004005
call fcn.140002d3c
int3
call rdx
jmp 0x14004cf25
mov ecx, 0x80004005
call fcn.140002d3c
int3
call rdx
jmp 0x14004d28b
mov rdx, rbx
call r8
lea rax, [rsi + 0x18]
mov qword [rsp + 0x30], rax
jmp 0x14004d4f9
mov rdx, rbx
mov rcx, r8
call r9
nop
jmp 0x14004d699
call r8
jmp 0x14004d551
call r8
jmp 0x14004d3ca
call r8
jmp 0x14004d3c3
call r8
jmp 0x14004d0ac
call r8
jmp 0x14004d149
call fcn.140231e34
int3