Function at 0x14001b53c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x590]
sub rsp, 0x690
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x580], rax
xor r13d, r13d
mov rbx, rdx
mov qword [rsp + 0x48], r13
mov rdi, rcx
mov esi, r13d
mov r15d, r13d
lea r12d, [r13 + 1]
mov dword [rsp + 0x40], r12d
test rdx, rdx
jne 0x14001b598
mov eax, 0x80004003
jmp 0x14001b97d
or r14, 0xffffffffffffffff
test rdi, rdi
je 0x14001b61f
mov rax, r14
inc rax
cmp word [rcx + rax*2], r13w
jne 0x14001b5a4
lea r12, [rax*2 + 1]
mov rcx, r12
call fcn.14003c310
mov r15, rax
test rax, rax
jne 0x14001b5d0
mov eax, 0x8007000e
jmp 0x14001b97d
mov qword [rsp + 0x38], r13
mov r9d, r14d
mov qword [rsp + 0x30], r13
mov r8, rdi
mov dword [rsp + 0x28], r12d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r15
mov esi, 0x80004005
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, 0x200
test eax, eax
je 0x14001b612
mov r8, r15
mov edx, edi
mov rcx, rbx
mov esi, r13d
call fcn.140013c70
mov rcx, r15
call fcn.14003c2b8
jmp 0x14001b6d8
lea rax, [rsp + 0x48]
mov edi, 0x200
mov r9d, r12d
mov dword [rsp + 0x44], edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftMediaPlayerSetup
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001b69e
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.UDBBaseURL
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14001b68e
cmp dword [rsp + 0x40], r12d
jne 0x14001b68e
mov r15d, r12d
mov byte [rbx + 0x1ff], r13b
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r15d, r15d
jne 0x14001b6f5
mov rcx, qword [0x140050d10]
mov r9d, edi
mov r8, rbx
mov edx, 0x277e
call qword [sym.imp.USER32.dll_LoadStringA]
test eax, eax
jne 0x14001b6f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 0x57
cmove eax, ecx
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x14001b6f5
mov r8d, esi
lea rdx, str.ERROR:_Unable_to_obtain_base_URL_for_UDB_file._Result:_0x_x._r_n
mov ecx, 2
call fcn.140016868
jmp 0x14001b97b
lea r15, [0x1400436cc]
mov rcx, rbx
mov rdx, r15
call qword [sym.imp.msvcrt.dll_strstr]
test rax, rax
jne 0x14001b76e
lea rdx, str..asp
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_strstr]
test rax, rax
jne 0x14001b76e
lea rdx, str..xml
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_strstr]
test rax, rax
jne 0x14001b76e
mov rcx, r14
inc rcx
cmp byte [rbx + rcx], r13b
jne 0x14001b73a
lea rax, [rcx - 1]
cmp rax, 0x1fe
ja 0x14001b75c
cmp byte [rbx + rcx - 1], 0x2f
je 0x14001b75c
mov word [rbx + rcx], 0x2f
lea r8, str.control.xml
mov rdx, rdi
mov rcx, rbx
call fcn.140015870
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_strstr]
test rax, rax
jne 0x14001b78d
mov r8, r15
mov rdx, rdi
mov rcx, rbx
call fcn.140015870
inc r14
cmp byte [rbx + r14], r13b
jne 0x14001b78d
mov r15, rdi
sub r15, r14
mov rcx, r15
call fcn.14003c310
mov r14, rax
test rax, rax
je 0x14001b97b
lea r8, str.LANGENU
mov rdx, rdi
mov rcx, rbx
mov r12d, r13d
call fcn.140015870
mov eax, 0xffffffff
add r15, 0xfffffffffffffff6
cmp r15, rax
jae 0x14001b8c9
cmp byte [0x14005175c], r13b
jne 0x14001b7ea
call fcn.14003b3ec
mov rcx, rax
jmp 0x14001b7f1
lea rcx, [0x140050340]
movzx eax, word [rcx + 2]
lea r8, str.SoftwareMicrosoftMediaPlayer_lu._luRegistration
movzx r9d, word [rcx]
mov edx, 0x208
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x20], eax
call fcn.1400017b4
test eax, eax
js 0x14001b8c9
mov dword [rsp + 0x44], r15d
lea rax, [rsp + 0x48]
mov r15d, 1
mov qword [rsp + 0x20], rax
mov r9d, r15d
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001b8c9
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], r14
lea rdx, [0x1400436f0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x14001b8b5
cmp dword [rsp + 0x40], r15d
jne 0x14001b8b5
lea r8, str.Version
mov rdx, rdi
mov rcx, rbx
call fcn.140015870
mov r8, r14
mov rdx, rdi
mov rcx, rbx
call fcn.140015870
lea r8, [0x14004370c]
mov rdx, rdi
mov rcx, rbx
call fcn.140015870
mov r12d, r15d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r12d, r12d
jne 0x14001b973
mov r8d, 0x105
lea rdx, [rbp + 0x370]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x14001b973
lea rcx, [rbp + 0x370]
call fcn.140018270
mov r15d, 0x104
lea rdx, [rbp + 0x160]
mov r8d, r15d
mov rcx, rax
call fcn.140016ef0
test eax, eax
js 0x14001b973
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0x160]
mov dword [rsp + 0x28], r15d
mov r9d, r15d
xor edx, edx
mov qword [rsp + 0x20], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x14001b973
lea r8, str.Version
mov rdx, rdi
mov rcx, rbx
call fcn.140015870
lea r8, [rsp + 0x50]
mov rdx, rdi
mov rcx, rbx
call fcn.140015870
lea r8, [0x14004370c]
mov rdx, rdi
mov rcx, rbx
call fcn.140015870
mov rcx, r14
call fcn.14003c2b8
mov eax, esi
mov rcx, qword [rbp + 0x580]
xor rcx, rsp
call fcn.14003c6c0
mov rbx, qword [rsp + 0x6e0]
add rsp, 0x690
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret