Function at 0x1400c4a0c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x140268998]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
mov r14, rcx
mov ecx, dword [0x14027ace8]
mov rax, qword gs:[0x58]
mov r8d, 0x14
mov rdx, qword [rax + rcx*8]
lea r15, [0x1402682f8]
mov eax, dword [rdx + r8]
cmp dword [0x1402797a4], eax
jg 0x1400c4d8d
xor esi, esi
mov rcx, r15
cmp qword [0x140268308], rsi
jbe 0x1400c4a8c
mov rdx, r14
call fcn.1400c3820
jmp 0x1400c4d5c
call fcn.1400c44dc
mov bl, sil
cmp qword [0x140268308], rsi
je 0x1400c4d49
lea rcx, [0x1401f9cc0]
call fcn.140176a80
nop
mov r8, rax
lea rdx, [0x1401f9cc0]
mov rcx, r15
call fcn.140054e80
nop
lea r12, [0x1401f9c70]
mov rcx, r12
call fcn.140176a80
nop
mov r8, rax
mov rdx, r12
mov rcx, r15
call fcn.140054e80
nop
lea rcx, str.WebResources
call fcn.140176a80
nop
mov r8, rax
lea rdx, str.WebResources
mov rcx, r15
call fcn.140054e80
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], rsi
mov rdx, r15
lea rcx, [rsp + 0x68]
call fcn.1400538c4
nop
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [str.SoftwareAdobeAdobe_AcrobatDCWebResource]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c4bfb
mov edi, 0x208
mov r8d, edi
xor edx, edx
lea rcx, [rbp - 0x50]
call fcn.140170ec0
mov dword [rsp + 0x30], edi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, qword [str.tWebResourceInstallPath]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400c4bc7
cmp dword [rsp + 0x38], 1
jne 0x1400c4bc7
mov bl, 1
mov rcx, r12
call fcn.140176a80
nop
mov r8, rax
mov rdx, r12
mov rcx, r15
call fcn.140054e80
nop
lea rcx, [rbp - 0x50]
call fcn.140176a80
nop
mov r8, rax
lea rdx, [rbp - 0x50]
mov rcx, r15
call fcn.140054e80
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x1400c4bfb
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], rsi
mov rdx, r15
lea rcx, [rbp - 0x78]
call fcn.1400538c4
lea rcx, [rbp - 0x78]
call fcn.1400c57d8
test al, al
jne 0x1400c4cd9
lea r9, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae r9, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x78]
mov rax, qword [0x140268310]
cmp rdx, rax
ja 0x1400c4c4b
mov rdi, r15
cmp rax, 8
cmovae rdi, qword [0x1402682f8]
mov qword [0x140268308], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call fcn.140170810
nop
mov word [rbx + rdi], si
jmp 0x1400c4c56
mov r8b, sil
mov rcx, r15
call fcn.14004fab8
mov r8, r12
mov rdx, r15
lea rcx, [rbp - 0x78]
call fcn.14004eea0
nop
lea rdi, str.Resource0
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400c2888
mov rcx, rax
call fcn.1400c57d8
mov bl, al
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x1400c4ca2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
call fcn.14004effc
test bl, bl
je 0x1400c4d2a
mov rcx, r12
call fcn.140176a80
nop
mov r8, rax
mov rdx, r12
mov rcx, r15
call fcn.140054e80
nop
mov rcx, rdi
call fcn.140176a80
nop
mov r8, rax
mov rdx, rdi
mov rcx, r15
call fcn.140054e80
mov rdx, r14
mov rcx, r15
call fcn.1400c3820
mov sil, al
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x1400c4d25
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c4d1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c4d87
call fcn.14016f250
nop
mov al, sil
jmp 0x1400c4d5c
mov rcx, r15
call fcn.1400c39d4
test al, al
jne 0x1400c4cd9
mov qword [r14 + 0x10], rsi
cmp qword [r14 + 0x18], 0x10
jb 0x1400c4d44
mov r14, qword [r14]
mov byte [r14], sil
jmp 0x1400c4ce7
mov qword [r14 + 0x10], rsi
cmp qword [r14 + 0x18], 0x10
jb 0x1400c4d57
mov r14, qword [r14]
mov byte [r14], sil
xor al, al
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.14016f860
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.1401767ac
nop
lea rcx, [0x1402797a4]
call fcn.14016f638
cmp dword [0x1402797a4], 0xffffffff
jne 0x1400c4a71
lea rcx, [0x1401ee9f8]
call fcn.140176a80
nop
mov r8, rax
lea rdx, [0x1401ee9f8]
mov rcx, r15
call fcn.140054f7c
lea rcx, [0x1401e8000]
call fcn.14016f490
nop
lea rcx, [0x1402797a4]
call fcn.14016f5d8
jmp 0x1400c4a71