Function at 0x14004543a
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x258
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1d0], 0xfffffffffffffffe
mov rsi, rcx
mov qword [rcx + 0x48], rdx
lea rbx, [rbp - 0x34]
xor edi, edi
mov r8d, 0x118
mov rcx, rbx
xor edx, edx
call fcn.14006a3b0
mov dword [rbx - 4], 0x11c
mov byte [rbx + 0x116], 1
xor ecx, ecx
mov edx, 0x80
mov r8b, 1
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
lea rcx, [rbp - 0x38]
mov edx, 0x80
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
sete byte [rsi + 0x5c]
and dword [rbp + 0x1c8], 0
lea rax, [rbp + 0x198]
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push 1
pop r9
mov rcx, 0xffffffff80000002
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400455e5
mov rcx, qword [rbp + 0x198]
mov qword [rbp + 0x170], rcx
lea r8, [rsi + 0x50]
lea rdx, str.CurrentMajorVersionNumber
call fcn.140045b80
test al, al
je 0x1400455d7
lea r8, [rsi + 0x54]
mov rcx, qword [rbp + 0x198]
lea rdx, str.CurrentMinorVersionNumber
call fcn.140045b80
test al, al
je 0x1400455d7
mov rcx, qword [rbp + 0x198]
lea rax, [rbp + 0x148]
mov dword [rax], 0xa
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x20], rax
lea rdx, str.CurrentBuildNumber
lea r9, [rbp + 0x108]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1400455d7
cmp dword [rbp + 0x108], 1
jne 0x1400455d7
mov eax, dword [rbp + 0x148]
mov byte [rbp + rax + 0x1a0], 0
lea rcx, [rbp - 0x38]
lea rdx, [rbp + 0x1a0]
call fcn.140002b86
lea rcx, [rbp - 0x38]
lea rdx, [rbp + 0x128]
call fcn.14000d4f8
mov ebx, eax
lea rcx, [rbp - 0x38]
call fcn.1400049ea
test bl, bl
je 0x1400455d7
mov eax, dword [rbp + 0x128]
mov dword [rsi + 0x58], eax
mov rcx, qword [rbp + 0x198]
lea rdx, [0x1400a062e]
lea r8, [rbp + 0x1c8]
call fcn.140045b80
mov edi, eax
jmp 0x1400455d9
xor edi, edi
lea rcx, [rbp + 0x170]
call fcn.140045bce
lea rdx, [0x140092520]
lea rbx, [rbp + 0x170]
mov rcx, rbx
call fcn.14000e3a2
lea rcx, [rbp + 0x1a0]
mov rdx, rbx
call fcn.14004a948
lea rcx, [rbp + 0x1a0]
lea rdx, [rbp - 0x38]
call fcn.1400140f8
mov ebx, eax
lea rcx, [rbp + 0x1a0]
call fcn.140004a1e
lea rcx, [rbp + 0x170]
call fcn.140004a1e
test bl, bl
je 0x14004591b
mov ebx, dword [rbp - 0x1c]
and qword [rbp + 0x1b0], 0
xorps xmm0, xmm0
movaps xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b8], 0xf
test bl, 1
je 0x140045674
lea rdx, str.Debug_
lea rcx, [rbp + 0x1a0]
call fcn.1400043ba
test bl, 4
je 0x14004568c
lea rdx, str.Patched_
lea rcx, [rbp + 0x1a0]
call fcn.1400043ba
test bl, 2
je 0x1400456a4
lea rdx, str.Prerelease_
lea rcx, [rbp + 0x1a0]
call fcn.1400043ba
test bl, 8
je 0x1400456bc
lea rdx, str.Private_
lea rcx, [rbp + 0x1a0]
call fcn.1400043ba
test bl, 0x20
je 0x1400456d4
lea rdx, str.Special_
lea rcx, [rbp + 0x1a0]
call fcn.1400043ba
mov r9, qword [rbp + 0x1b0]
test r9, r9
je 0x1400456fb
dec r9
lea rcx, [rbp + 0x1a0]
lea rdx, [rbp + 0x170]
xor r8d, r8d
call fcn.14000dcd6
jmp 0x140045731
movaps xmm0, xmmword [rbp + 0x1a0]
movaps xmm1, xmmword [rbp + 0x1b0]
and qword [rbp + 0x1b0], 0
movaps xmmword [rbp + 0x180], xmm1
movaps xmmword [rbp + 0x170], xmm0
mov qword [rbp + 0x1b8], 0xf
mov byte [rbp + 0x1a0], 0
lea rcx, [rbp + 0x1a0]
call fcn.1400049ea
mov eax, dword [rbp - 0x18]
not eax
test eax, 0x40004
lea rax, str.Windows_NT
lea rdx, str.Unknown
cmove rdx, rax
lea r14, [rbp + 0x1a0]
mov rcx, r14
call fcn.140002b86
test dil, dil
je 0x140045776
mov r8d, dword [rbp + 0x1c8]
jmp 0x1400457a2
mov eax, dword [rbp - 0x30]
mov ecx, eax
shr ecx, 0x10
mov dword [rsi + 0x50], ecx
mov ecx, 0xffff
and eax, ecx
mov dword [rsi + 0x54], eax
mov r8d, dword [rbp - 0x2c]
mov eax, r8d
shr eax, 0x10
mov dword [rsi + 0x58], eax
and r8d, ecx
mov dword [rbp + 0x1c8], r8d
lea rdx, [0x140095d49]
lea rcx, [rbp + 0x108]
call fcn.14004bf98
lea r15, [rsi + 0x28]
lea rbx, [rbp + 0x108]
mov rcx, r15
mov rdx, rbx
call fcn.14000a456
mov rcx, rbx
call fcn.1400049ea
mov rdi, qword [rbp + 0x180]
test rdi, rdi
je 0x140045851
mov byte [rbp + 0x1cd], 1
lea rdx, [0x14009f0c4]
lea rcx, [rbp + 0xe8]
call fcn.140002b86
mov byte [rbp + 0x1ce], 1
lea rcx, [rbp + 0x128]
lea rdx, [rbp + 0xe8]
lea r8, [rbp + 0x170]
call fcn.140023228
mov byte [rbp + 0x1cf], 1
lea r8, [0x14009f0a7]
lea rbx, [rbp + 0x148]
lea rdx, [rbp + 0x128]
mov rcx, rbx
call fcn.1400060fc
cmp qword [rbp + 0x160], 0x10
jb 0x140045858
mov rbx, qword [rbp + 0x148]
jmp 0x140045858
lea rbx, [0x1400a04bd]
test rdi, rdi
setne byte [rbp + 0x1cc]
cmp qword [rsi + 0x40], 0x10
jb 0x14004586d
mov r15, qword [rsi + 0x28]
mov qword [rbp + 0x168], rdi
mov eax, dword [rsi + 0x58]
mov ecx, dword [rsi + 0x54]
mov r9d, dword [rsi + 0x50]
cmp qword [rbp + 0x1b8], 0x10
jb 0x14004588f
mov r14, qword [rbp + 0x1a0]
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, str._s__u._u._u._s_s
lea rcx, [rbp + 0x108]
mov r8, r14
call fcn.14004bf98
add rsi, 8
lea rdi, [rbp + 0x108]
mov rcx, rsi
mov rdx, rdi
call fcn.14000a456
mov rcx, rdi
call fcn.1400049ea
cmp qword [rbp + 0x168], 0
je 0x140045903
lea rcx, [rbp + 0x148]
call fcn.1400049ea
lea rcx, [rbp + 0x128]
call fcn.1400049ea
lea rcx, [rbp + 0xe8]
call fcn.1400049ea
lea rcx, [rbp + 0x1a0]
call fcn.1400049ea
lea rcx, [rbp + 0x170]
call fcn.1400049ea
nop
add rsp, 0x258
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret