Function at 0x1400edd40
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x18]
sub rsp, 0x118
mov qword [rbp - 8], 0xfffffffffffffffe
mov r13, r8
mov r12, rcx
xor r15d, r15d
mov dword [rbp + 0x78], r15d
mov esi, 0x200
mov eax, 0x100
test r9b, r9b
cmovne esi, eax
mov rcx, qword [rdx]
sub rcx, 0x18
call fcn.140001b90
lea rdi, [rax + 0x18]
mov qword [rbp - 0x80], rdi
movsxd rbx, dword [rdi - 0x10]
test ebx, ebx
jns 0x1400eddae
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, ebx
or eax, ecx
jge 0x1400eddce
mov edx, ebx
lea rcx, [rbp - 0x80]
call fcn.140001b30
mov rdi, qword [rbp - 0x80]
lea eax, [rbx + 1]
movsxd rdx, eax
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll__wcslwr_s]
cmp ebx, dword [rdi - 0xc]
jg 0x1400ee796
mov dword [rdi - 0x10], ebx
mov word [rdi + rbx*2], r15w
mov qword [rbp - 0x40], r15
mov dword [rbp - 0x38], r15d
mov qword [rbp - 0x30], r15
lea rcx, str._h_r_
mov rax, qword [str._h_r_]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp - 0x78], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstall
test rdx, 0xffffffffffff0000
jne 0x1400ede45
movzx ebx, dx
xor edx, edx
mov ecx, ebx
call fcn.140001110
test rax, rax
je 0x1400ede55
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.140004fb0
jmp 0x1400ede55
mov r8d, 0x33
lea rcx, [rbp - 0x78]
call fcn.14000c510
nop
or esi, 0x20019
mov dword [rbp - 0x48], esi
mov r9d, esi
mov r8, qword [rbp - 0x78]
mov rdx, qword [r13]
lea rcx, [rbp - 0x40]
call fcn.140002190
or esi, 0xffffffff
test eax, eax
jne 0x1400ee736
mov dword [rbp + 0x68], r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
lea rax, [rbp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rbx, qword [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov r13d, eax
mov dword [rbp - 0x70], eax
mov ecx, dword [rbp + 0x68]
test eax, eax
jne 0x1400eded4
inc ecx
mov dword [rbp + 0x68], ecx
mov r12d, r15d
mov dword [rbp - 0x58], r15d
test eax, eax
jne 0x1400edee6
test ecx, ecx
mov dword [rbp + 0x78], ecx
jne 0x1400edef0
mov dword [rbp + 0x78], 0x400
nop dword [rax]
lea rcx, str._h_r_
mov rax, qword [str._h_r_]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rsi, [rax + 0x18]
mov qword [rbp - 0x60], rsi
test r13d, r13d
jne 0x1400edf15
mov eax, dword [rbp + 0x68]
test eax, eax
jne 0x1400edf1a
mov eax, 0x400
mov dword [rbp + 0x78], eax
lea edx, [rax + 1]
test edx, edx
js 0x1400ee72b
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edx
or eax, ecx
jge 0x1400edf46
lea rcx, [rbp - 0x60]
call fcn.140001b30
mov rsi, qword [rbp - 0x60]
lea rax, [rbp]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x78]
mov r8, rsi
mov edx, r12d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [rbp - 0x50], eax
movsxd rdx, dword [rsi - 0xc]
mov rcx, rsi
call qword [sym.imp.MSVCR100.dll_wcsnlen]
test eax, eax
js 0x1400ee720
cmp eax, dword [rsi - 0xc]
jg 0x1400ee720
lea r13, [rsi - 0x10]
mov dword [r13], eax
cdqe
mov word [rsi + rax*2], r15w
mov rbx, qword [rbp - 0x78]
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x1400edfd0
cmp rax, qword [rbx - 0x18]
jne 0x1400edfd0
lea r12, [rbx - 0x18]
lock inc dword [rbx - 8]
mov rdi, qword [rbp - 0x80]
mov rsi, qword [rbp - 0x60]
jmp 0x1400ee00c
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx - 0x10]
call qword [rax]
mov r12, rax
test rax, rax
je 0x1400ee71a
mov ecx, dword [rbx - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rbx - 0x10]
inc ecx
movsxd rdx, ecx
lea r9, [rdx + rdx]
mov r8, rbx
add rdx, rdx
lea rcx, [rax + 0x18]
call qword [sym.imp.MSVCR100.dll_memcpy_s]
lea rax, [r12 + 0x18]
mov qword [rsp + 0x70], rax
mov r8d, 1
lea rdx, [0x140118dec]
lea rcx, [rsp + 0x70]
call fcn.140005090
movsxd r11, dword [r13]
mov r14, rsi
mov rbx, qword [rsp + 0x70]
sub r14, rbx
sar r14, 1
mov r13d, dword [rbx - 0x10]
mov eax, r15d
test r11d, r11d
setns al
test eax, eax
je 0x1400ee70f
mov rdx, r11
mov rcx, rsi
call qword [sym.imp.MSVCR100.dll_wcsnlen]
mov r15, rax
mov ecx, 0x7fffffff
sub ecx, eax
xor edx, edx
cmp ecx, r13d
setge dl
test edx, edx
je 0x1400ee704
lea r12d, [r13 + rax]
test r12d, r12d
js 0x1400ee6f9
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r12d
or eax, ecx
jge 0x1400ee0ac
mov edx, r12d
lea rcx, [rsp + 0x70]
call fcn.140001b30
mov rbx, qword [rsp + 0x70]
cmp r14, r13
ja 0x1400ee0b5
lea rsi, [rbx + r14*2]
movsxd rdx, r15d
add rdx, rdx
lea rcx, [rbx + r13*2]
mov r9, rdx
mov r8, rsi
call qword [sym.imp.MSVCR100.dll_memcpy_s]
cmp r12d, dword [rbx - 0xc]
jg 0x1400ee6ee
mov dword [rbx - 0x10], r12d
movsxd rax, r12d
xor r15d, r15d
mov word [rbx + rax*2], r15w
mov qword [rbp - 0x28], r15
mov dword [rbp - 0x20], r15d
mov qword [rbp - 0x18], r15
mov r9d, dword [rbp - 0x48]
mov r8, rbx
mov rax, qword [rbp + 0x70]
mov rdx, qword [rax]
lea rcx, [rbp - 0x28]
call fcn.140002190
test eax, eax
jne 0x1400ee448
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov r12, qword [rbp - 0x28]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov r13d, eax
mov dword [rbp - 0x70], eax
test eax, eax
jne 0x1400ee164
inc dword [rsp + 0x60]
lea rcx, str._h_r_
mov rax, qword [str._h_r_]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
test r13d, r13d
jne 0x1400ee18b
mov edx, dword [rsp + 0x60]
test edx, edx
jne 0x1400ee190
mov edx, 0x400
mov dword [rbp + 0x78], edx
lea r8d, [rdx + 1]
test r8d, r8d
js 0x1400ee6dd
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r8d
or ecx, eax
jge 0x1400ee1c7
mov edx, r8d
lea rcx, [rsp + 0x68]
call fcn.140001b30
mov edx, dword [rbp + 0x78]
mov rbx, qword [rsp + 0x68]
lea eax, [rdx + rdx]
mov dword [rbp - 0x6c], eax
mov dword [rbp + 0x78], r15d
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x54]
xor r8d, r8d
lea rdx, str.DisplayName
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ee3fc
mov eax, dword [rbp - 0x54]
cmp eax, 1
je 0x1400ee20f
cmp eax, 2
jne 0x1400ee3fc
mov ecx, dword [rbp - 0x6c]
test rbx, rbx
je 0x1400ee23a
test ecx, ecx
je 0x1400ee236
test cl, 1
jne 0x1400ee3fc
mov eax, ecx
shr rax, 1
cmp word [rbx + rax*2 - 2], 0
je 0x1400ee23a
jmp 0x1400ee3fc
mov word [rbx], r15w
shr ecx, 1
mov dword [rbp + 0x78], ecx
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_wcsnlen]
test eax, eax
js 0x1400ee6c7
cmp eax, dword [rbx - 0xc]
jg 0x1400ee6c7
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r15w
movsxd rsi, dword [rbx - 0x10]
test esi, esi
js 0x1400ee6bc
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, ecx
jge 0x1400ee295
mov edx, esi
lea rcx, [rsp + 0x68]
call fcn.140001b30
mov rbx, qword [rsp + 0x68]
lea eax, [rsi + 1]
movsxd rdx, eax
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll__wcslwr_s]
cmp esi, dword [rbx - 0xc]
jg 0x1400ee6b1
mov dword [rbx - 0x10], esi
mov word [rbx + rsi*2], r15w
cmp dword [rbx - 0x10], 0
jl 0x1400ee3fc
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_wcsstr]
test rax, rax
je 0x1400ee3fc
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x1400ee3fc
lea rcx, str._h_r_
mov rax, qword [str._h_r_]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x78], rbx
test r13d, r13d
jne 0x1400ee30a
mov edx, dword [rsp + 0x60]
test edx, edx
jne 0x1400ee30f
mov edx, 0x400
mov dword [rbp + 0x78], edx
lea r8d, [rdx + 1]
test r8d, r8d
js 0x1400ee6a6
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r8d
or eax, ecx
jge 0x1400ee346
mov edx, r8d
lea rcx, [rsp + 0x78]
call fcn.140001b30
mov edx, dword [rbp + 0x78]
mov rbx, qword [rsp + 0x78]
lea eax, [rdx + rdx]
mov dword [rbp - 0x68], eax
mov dword [rbp + 0x78], r15d
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x4c]
xor r8d, r8d
lea rdx, str.DisplayIcon
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ee3b0
mov eax, dword [rbp - 0x4c]
cmp eax, 1
je 0x1400ee386
cmp eax, 2
jne 0x1400ee3b0
mov ecx, dword [rbp - 0x68]
test rbx, rbx
je 0x1400ee4be
test ecx, ecx
je 0x1400ee4ba
test cl, 1
jne 0x1400ee3b0
mov eax, ecx
shr rax, 1
cmp word [rbx + rax*2 - 2], 0
je 0x1400ee4be
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_wcsnlen]
test eax, eax
js 0x1400ee69b
cmp eax, dword [rbx - 0xc]
jg 0x1400ee69b
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r15w
lea rdx, [rbx - 0x18]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400ee3f5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x68]
jmp 0x1400ee3ff
or esi, 0xffffffff
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_wcsnlen]
test eax, eax
js 0x1400ee6d2
cmp eax, dword [rbx - 0xc]
jg 0x1400ee6d2
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r15w
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400ee441
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x70]
jmp 0x1400ee44f
or esi, 0xffffffff
mov r13d, dword [rbp - 0x70]
mov r12d, dword [rbp - 0x58]
inc r12d
mov dword [rbp - 0x58], r12d
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x1400ee46a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400ee485
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400ee4a3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [rbp - 0x50], 0
jne 0x1400ee6e8
mov rdi, qword [rbp - 0x80]
mov rbx, qword [rbp - 0x40]
jmp 0x1400edef0
mov word [rbx], r15w
shr ecx, 1
mov dword [rbp + 0x78], ecx
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_wcsnlen]
test eax, eax
js 0x1400ee690
cmp eax, dword [rbx - 0xc]
jg 0x1400ee690
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r15w
mov edx, 0x5c
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_wcsrchr]
test rax, rax
jne 0x1400ee505
or esi, 0xffffffff
mov eax, esi
jmp 0x1400ee50e
sub rax, rbx
sar rax, 1
or esi, 0xffffffff
lea r8d, [rax + 1]
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x78]
call fcn.1400b4d80
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400ee57b
cmp dword [rbx + 0x10], 0
jl 0x1400ee56c
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400ee56c
call fcn.140001b90
mov rdi, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400ee561
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x78], rax
jmp 0x1400ee57b
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x78]
call fcn.14000c510
nop
mov rdx, qword [rbp - 0x10]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400ee599
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x78]
lea rcx, [rbx - 0x18]
call fcn.140001b90
add rax, 0x18
mov rdi, qword [rbp + 0x60]
mov qword [rdi], rax
mov eax, esi
lock xadd dword [rbx - 8], eax
dec eax
test eax, eax
jg 0x1400ee5ce
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400ee5ee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x1400ee5fe
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400ee61e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400ee63d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400ee65c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x1400ee66c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x1400ee688
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rdi
jmp 0x1400ee7a1
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
nop
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
nop
mov r12, qword [rbp + 0x60]
jmp 0x1400ee736
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
nop
call fcn.140066e60
int3
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 0x80070057
call fcn.140001000
nop
lea rdx, [0x140117ea0]
mov rcx, r12
call fcn.14000fdc0
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400ee765
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x1400ee775
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x1400ee791
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, r12
jmp 0x1400ee7a1
mov ecx, 0x80070057
call fcn.140001000
nop
add rsp, 0x118
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret