Function at 0x14004f520
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xe8]
sub rsp, 0x1c0
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14035d8c0]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov rsi, rcx
mov byte [rbp - 0x60], 0
lea rcx, [rbp - 0x58]
call fcn.140015830
nop
lea rax, [0x1402f8cc8]
lea rdx, [0x1402f0688]
cmp byte [rbp - 0x60], 0
cmovne rdx, rax
mov rdi, 0xffffffffffffffff
mov rax, rdi
inc rax
cmp word [rdx + rax*2], 0
jne 0x14004f590
mov r8d, eax
lea rcx, [rbp - 0x58]
call fcn.140002a7c
mov rbx, qword [rbp - 0x58]
mov r9, rbx
xor r8d, r8d
mov edx, 0x11720
mov rcx, qword [rsi]
call fcn.14001fdd0
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
lea r15, vtable.ATL::CAtlStringMgr.0
lea r12, vtable.ATL::CWin32Heap.0
sub eax, 1
jg 0x14004f613
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r15
jne 0x14004fee6
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x14004fee6
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
xor r13d, r13d
mov qword [rbp - 0x78], r13
mov dword [rbp - 0x70], r13d
mov qword [rbp - 0x68], r13
mov r9d, 0x20019
lea r8, str.SOFTWAREApple_Computer__Inc.Safari
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x78]
call fcn.14003e3a0
lea r14, str.Safari
test eax, eax
jne 0x14004fc3e
mov dword [rsp + 0x30], 0x64
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.Version
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004fc3e
mov eax, dword [rsp + 0x68]
dec eax
cmp eax, 1
ja 0x14004fc3e
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x14004f6b9
test al, 1
jne 0x14004fc3e
shr rax, 1
cmp word [rbp + rax*2 + 0x3e], r13w
je 0x14004f6be
jmp 0x14004fc3e
mov word [rbp + 0x40], r13w
lea rax, [rsp + 0x38]
mov qword [rbp - 0x80], rax
call fcn.140011f18
mov rcx, rax
test rax, rax
je 0x14004feee
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, r15
jne 0x14004fef9
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x40]
cmp rax, 0x10000
jae 0x14004f718
lea rax, [rbp + 0x40]
movzx edx, ax
lea rcx, [rsp + 0x38]
call fcn.140012700
jmp 0x14004f73c
lea rcx, [rbp + 0x40]
mov rax, rdi
nop
inc rax
cmp word [rcx + rax*2], 0
jne 0x14004f720
mov r8d, eax
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x38]
call fcn.140002a7c
nop
lea rcx, [rsp + 0x40]
call fcn.140015830
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x40]
call fcn.140002b88
mov edx, 0x2c
lea rcx, [rsp + 0x40]
call fcn.14007d3d0
mov r9, qword [rsp + 0x40]
xor r8d, r8d
mov edx, 0x11721
mov rcx, qword [rsi]
call fcn.14001fdd0
nop
lea rcx, [rsp + 0x38]
call fcn.14004b190
mov byte [rbp - 0x50], 1
lea rcx, [rbp - 0x48]
call fcn.140015830
nop
lea r9, [rbp - 0x50]
xor r8d, r8d
mov edx, 0x11720
mov rcx, rsi
call fcn.1400855d0
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004f7f3
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r15
jne 0x14004ff00
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x14004ff00
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
call fcn.140011f18
mov rcx, rax
test rax, rax
je 0x14004ff08
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, r15
jne 0x14004ff13
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
add rax, 0x18
mov qword [rsp + 0x70], rax
cmp r14, 0x10000
jae 0x14004f83e
movzx edx, r14w
lea rcx, [rsp + 0x70]
call fcn.140012700
jmp 0x14004f85d
mov rax, rdi
inc rax
cmp word [r14 + rax*2], 0
jne 0x14004f841
mov r8d, eax
mov rdx, r14
lea rcx, [rsp + 0x70]
call fcn.140002a7c
nop
mov rbx, qword [rsp + 0x70]
mov r9, rbx
mov r8d, dword [0x14036cb90]
mov edx, 0x116b9
mov rcx, qword [rsi]
call fcn.14001fdd0
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004f8c0
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r15
jne 0x14004ff1a
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x14004ff1a
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [rsp + 0x48]
mov qword [rbp - 0x80], rax
call fcn.140011f18
mov rcx, rax
test rax, rax
je 0x14004ff22
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, r15
jne 0x14004ff2d
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x40]
cmp rax, 0x10000
jae 0x14004f91a
lea rax, [rbp + 0x40]
movzx edx, ax
lea rcx, [rsp + 0x48]
call fcn.140012700
jmp 0x14004f93d
lea rcx, [rbp + 0x40]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x14004f921
mov r8d, eax
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.140002a7c
nop
lea rcx, [rsp + 0x50]
call fcn.140015830
nop
mov ebx, dword [0x14036cb90]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x50]
call fcn.140002b88
mov edx, 0x2c
lea rcx, [rsp + 0x50]
call fcn.14007d3d0
mov r9, qword [rsp + 0x50]
mov r8d, ebx
mov edx, 0x116b8
mov rcx, qword [rsi]
call fcn.14001fdd0
nop
lea rcx, [rsp + 0x48]
call fcn.14004b190
mov byte [rbp - 0x40], 0
lea rcx, [rbp - 0x38]
call fcn.140015830
nop
lea r9, [rbp - 0x40]
mov r8d, dword [0x14036cb90]
mov edx, 0x1177b
mov rcx, rsi
call fcn.1400855d0
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004f9fe
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r15
jne 0x14004ff34
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x14004ff34
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp - 0x30], 0
lea rcx, [rbp - 0x28]
call fcn.140015830
nop
lea r9, [rbp - 0x30]
mov r8d, dword [0x14036cb90]
mov edx, 0x1177e
mov rcx, rsi
call fcn.1400855d0
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004fa70
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r15
jne 0x14004ff3c
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x14004ff3c
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp - 0x20], 0
lea rcx, [rbp - 0x18]
call fcn.140015830
nop
lea r9, [rbp - 0x20]
mov r8d, dword [0x14036cb90]
mov edx, 0x1177c
mov rcx, rsi
call fcn.1400855d0
nop
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004fae2
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r15
jne 0x14004ff44
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x14004ff44
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp - 0x10], 0
lea rcx, [rbp - 8]
call fcn.140015830
nop
lea r9, [rbp - 0x10]
mov r8d, dword [0x14036cb90]
mov edx, 0x11780
mov rcx, rsi
call fcn.1400855d0
nop
mov rdx, qword [rbp - 8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004fb54
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r15
jne 0x14004ff4c
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x14004ff4c
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp], 0
lea rcx, [rbp + 8]
call fcn.140015830
nop
lea r9, [rbp]
mov r8d, dword [0x14036cb90]
mov edx, 0x1177f
mov rcx, rsi
call fcn.1400855d0
nop
mov rdx, qword [rbp + 8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004fbc6
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r15
jne 0x14004ff54
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x14004ff54
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp + 0x10], 1
lea rcx, [rbp + 0x18]
call fcn.140015830
nop
lea r9, [rbp + 0x10]
mov r8d, dword [0x14036cb90]
mov edx, 0x1177d
mov rcx, rsi
call fcn.1400855d0
nop
mov rdx, qword [rbp + 0x18]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004fc38
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r15
jne 0x14004ff5c
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x14004ff5c
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
inc dword [0x14036cb90]
mov rcx, qword [0x14036cdf8]
cmp dword [rcx - 0x10], 0
jl 0x14004fe99
lea rdx, str.safari
call fcn.14022f558
test rax, rax
je 0x14004fe99
mov rcx, qword [0x14036cdf8]
sub rax, rcx
sar rax, 1
test eax, eax
js 0x14004fe99
cmp dword [rcx - 0x10], 0
jl 0x14004fca2
lea rdx, str.chrome
call fcn.14022f558
test rax, rax
je 0x14004fca2
sub rax, qword [0x14036cdf8]
sar rax, 1
test eax, eax
jns 0x14004fe99
call fcn.140011f18
mov rcx, rax
test rax, rax
je 0x14004ff64
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, r15
jne 0x14004ff6f
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
add rax, 0x18
mov qword [rsp + 0x78], rax
cmp r14, 0x10000
jae 0x14004fced
movzx edx, r14w
lea rcx, [rsp + 0x78]
call fcn.140012700
jmp 0x14004fd0c
mov rax, rdi
inc rax
cmp word [r14 + rax*2], 0
jne 0x14004fcf0
mov r8d, eax
mov rdx, r14
lea rcx, [rsp + 0x78]
call fcn.140002a7c
nop
mov rbx, qword [rsp + 0x78]
mov r9, rbx
xor r8d, r8d
mov edx, 0x11717
mov rcx, qword [rsi]
call fcn.14001fdd0
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004fd6b
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r15
jne 0x14004ff76
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x14004ff76
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [rsp + 0x58]
mov qword [rbp - 0x80], rax
call fcn.140011f18
mov rcx, rax
test rax, rax
je 0x14004ff7e
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, r15
jne 0x14004ff89
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x40]
cmp rax, 0x10000
jae 0x14004fdc5
lea rax, [rbp + 0x40]
movzx edx, ax
lea rcx, [rsp + 0x58]
call fcn.140012700
jmp 0x14004fdec
lea rcx, [rbp + 0x40]
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14004fdd0
mov r8d, eax
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.140002a7c
nop
lea rcx, [rsp + 0x60]
call fcn.140015830
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x60]
call fcn.140002b88
mov edx, 0x2c
lea rcx, [rsp + 0x60]
call fcn.14007d3d0
mov r9, qword [rsp + 0x60]
xor r8d, r8d
mov edx, 0x11724
mov rcx, qword [rsi]
call fcn.14001fdd0
nop
lea rcx, [rsp + 0x58]
call fcn.14004b190
mov byte [rbp + 0x20], 1
lea rcx, [rbp + 0x28]
call fcn.140015830
nop
lea r9, [rbp + 0x20]
xor r8d, r8d
mov edx, 0x1171a
mov rcx, rsi
call fcn.1400855d0
nop
mov rdx, qword [rbp + 0x28]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14004fe99
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r15
jne 0x14004fee0
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x14004fee0
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x14004feac
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x78], r13
mov dword [rbp - 0x70], r13d
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.14022b120
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call r8
nop
jmp 0x14004fe99
call r8
jmp 0x14004f613
mov ecx, 0x80004005
call fcn.140002d3c
int3
call rdx
jmp 0x14004f6f0
call r8
jmp 0x14004f7f3
mov ecx, 0x80004005
call fcn.140002d3c
int3
call rdx
jmp 0x14004f81c
call r8
jmp 0x14004f8c0
mov ecx, 0x80004005
call fcn.140002d3c
int3
call rdx
jmp 0x14004f8f2
call r8
jmp 0x14004f9fe
call r8
jmp 0x14004fa70
call r8
jmp 0x14004fae2
call r8
jmp 0x14004fb54
call r8
jmp 0x14004fbc6
call r8
jmp 0x14004fc38
mov ecx, 0x80004005
call fcn.140002d3c
int3
call rdx
jmp 0x14004fccb
call r8
jmp 0x14004fd6b
mov ecx, 0x80004005
call fcn.140002d3c
int3
call rdx
jmp 0x14004fd9d