Function at 0x140047170
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x550
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x14010bfc0]
xor rax, rsp
mov qword [rsp + 0x540], rax
mov r14, rcx
lea r8, str.CDetailsDialog::PrepareBucketInfo____r_n
mov edx, 2
lea rcx, [0x14010f570]
call fcn.140001000
xor r15d, r15d
cmp dword [0x14011fc84], r15d
je 0x14004753b
lea rcx, [0x14011fbd0]
call fcn.140047dc0
mov rcx, rax
lea r12, [r14 + 0x1d8]
cmp r12, rax
je 0x140047241
mov rax, qword [rax + 0x28]
mov qword [rsp + 0x48], rax
mov rcx, qword [rcx]
mov qword [rsp + 0x40], rcx
mov rax, qword [rax]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rcx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0xb0], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x70], xmm1
mov r9b, byte [rsp + 0x38]
lea r8, [rsp + 0xb0]
lea rdx, [rsp + 0x70]
mov rcx, r12
call fcn.140004ee0
cmp qword [r14 + 0x208], r15
je 0x140047bb8
mov r13d, reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsp + 0x1d8], r13
mov qword [rsp + 0x1d0], r15
mov byte [rsp + 0x1c0], r15b
lea rbx, [0x1400c49dc]
mov rcx, rbx
call fcn.1400980d0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x1b8]
call fcn.14000352c
nop
mov qword [rsp + 0x158], r13
mov qword [rsp + 0x150], r15
mov byte [rsp + 0x140], r15b
mov rcx, rbx
call fcn.1400980d0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x138]
call fcn.14000352c
nop
mov rax, qword [r12 + 0x28]
mov rcx, qword [rax]
mov qword [rsp + 0x48], rcx
mov rax, qword [r12]
mov qword [rsp + 0x40], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbx, qword [r12 + 0x28]
cmp rbp, r15
je 0x1400472fe
cmp rbp, qword [r12]
je 0x140047303
call fcn.14009861c
cmp rsi, rbx
je 0x1400474ea
cmp rbp, r15
jne 0x14004731b
call fcn.14009861c
mov r11, r15
jmp 0x14004731f
mov r11, qword [rbp]
cmp rsi, qword [r11 + 0x28]
jne 0x14004732a
call fcn.14009861c
lea rdx, [rsp + 0xe8]
mov rcx, qword [rsi + 0x10]
call fcn.1400483c0
nop
cmp qword [rax + 0x20], 0x10
jb 0x140047349
mov rbx, qword [rax + 8]
jmp 0x14004734d
lea rbx, [rax + 8]
mov rcx, rbx
call fcn.1400980d0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x1b8]
call fcn.14000352c
nop
cmp qword [rsp + 0x108], 0x10
jb 0x140047381
mov rcx, qword [rsp + 0xf0]
call fcn.14006127c
cmp rbp, r15
jne 0x140047390
call fcn.14009861c
mov r11, r15
jmp 0x140047394
mov r11, qword [rbp]
cmp rsi, qword [r11 + 0x28]
jne 0x14004739f
call fcn.14009861c
lea rdx, [rsp + 0xc0]
mov rcx, qword [rsi + 0x10]
call fcn.1400483fc
nop
cmp qword [rax + 0x20], 0x10
jb 0x1400473be
mov rbx, qword [rax + 8]
jmp 0x1400473c2
lea rbx, [rax + 8]
mov rcx, rbx
call fcn.1400980d0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x138]
call fcn.14000352c
nop
cmp qword [rsp + 0xe0], 0x10
jb 0x1400473f6
mov rcx, qword [rsp + 0xc8]
call fcn.14006127c
lea rcx, str._b__u_
call fcn.1400980d0
mov r8, rax
lea rdx, str._b__u_
lea rcx, [r14 + 0x4a8]
call fcn.14000627c
lea rbx, [rsp + 0x1c0]
cmp qword [rsp + 0x1d8], 0x10
cmovae rbx, qword [rsp + 0x1c0]
mov rcx, rbx
call fcn.1400980d0
mov r8, rax
mov rdx, rbx
lea rcx, [r14 + 0x4a8]
call fcn.14000627c
lea rcx, str.__b___u__br_
call fcn.1400980d0
mov r8, rax
lea rdx, str.__b___u__br_
lea rcx, [r14 + 0x4a8]
call fcn.14000627c
lea rbx, [rsp + 0x140]
cmp qword [rsp + 0x158], 0x10
cmovae rbx, qword [rsp + 0x140]
mov rcx, rbx
call fcn.1400980d0
mov r8, rax
mov rdx, rbx
lea rcx, [r14 + 0x4a8]
call fcn.14000627c
lea rcx, str._br__br_
call fcn.1400980d0
mov r8, rax
lea rdx, str._br__br_
lea rcx, [r14 + 0x4a8]
call fcn.14000627c
cmp rbp, r15
jne 0x1400474d3
call fcn.14009861c
mov r11, r15
jmp 0x1400474d7
mov r11, qword [rbp]
cmp rsi, qword [r11 + 0x28]
jne 0x1400474e2
call fcn.14009861c
mov rsi, qword [rsi]
jmp 0x1400472ee
cmp qword [rsp + 0x158], 0x10
jb 0x140047502
mov rcx, qword [rsp + 0x140]
call fcn.14006127c
mov qword [rsp + 0x158], r13
mov qword [rsp + 0x150], r15
mov byte [rsp + 0x140], r15b
cmp qword [rsp + 0x1d8], 0x10
jb 0x140047bb8
mov rcx, qword [rsp + 0x1c0]
call fcn.14006127c
jmp 0x140047bb8
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x50], r15
mov esi, r15d
mov ebx, r15d
mov byte [rsp + 0x430], r15b
mov edi, 0x103
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x431]
call fcn.1400988d0
mov byte [rsp + 0x210], r15b
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x211]
call fcn.1400988d0
lea ebp, [rdi + 1]
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x34], r15d
mov byte [rsp + 0x320], r15b
mov r8, rdi
xor edx, edx
lea rcx, [rsp + 0x321]
call fcn.1400988d0
mov r13d, reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rsp + 0x200], r13
mov qword [rsp + 0x1f8], r15
mov byte [rsp + 0x1e8], r15b
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionUninstall
call fcn.1400980d0
mov r8, rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstall
lea rcx, [rsp + 0x1e0]
call fcn.14000352c
nop
call fcn.14006d8f8
mov r11, rax
mov ecx, r15d
cmp rax, r15
setne cl
cmp ecx, r15d
jne 0x14004760d
mov ecx, 0x80004005
call fcn.140001074
int3
mov rax, qword [rax]
mov rcx, r11
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x188], rax
mov qword [rsp + 0x1b0], r13
mov qword [rsp + reloc.OLEAUT32.dll_VarUI4FromI8], r15
mov byte [rsp + 0x198], r15b
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0x98], r15
mov byte [rsp + 0x88], r15b
lea rdx, [r14 + 0x480]
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rcx, [rsp + 0x80]
call fcn.140002458
xor r9d, r9d
lea r8d, [r9 + 0x79]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x188]
call fcn.1400021ac
lea rdx, [rsp + 0x1e8]
cmp qword [rsp + 0x200], 0x10
cmovae rdx, qword [rsp + 0x1e8]
mov dword [rsp + 0x28], r15d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call fcn.14004e070
cmp eax, r15d
jne 0x140047b4b
mov rdi, qword [0x14011f698]
mov r12d, 0x80
cmp ebx, r15d
je 0x1400476ee
cmp ebx, 0xea
jne 0x140047b4b
mov qword [rsp + 0x130], r13
mov qword [rsp + 0x128], r15
mov byte [rsp + 0x118], r15b
lea rcx, str.SoftwareMicrosoftWindowsCurrentVersionUninstall
call fcn.1400980d0
mov r8, rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstall
lea rcx, [rsp + 0x110]
call fcn.14000352c
nop
mov r9d, ebp
lea r8, [rsp + 0x430]
mov edx, esi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov ebx, eax
inc esi
mov byte [rsp + 0x210], r15b
lea rcx, [0x1400c55c0]
call fcn.1400980d0
mov r8, rax
lea rdx, [0x1400c55c0]
lea rcx, [rsp + 0x110]
call fcn.14000627c
lea rcx, [rsp + 0x430]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0x430]
lea rcx, [rsp + 0x110]
call fcn.14000627c
mov qword [rsp + 0x50], r15
mov dword [rsp + 0x30], ebp
lea rdx, [rsp + 0x118]
cmp qword [rsp + 0x130], 0x10
cmovae rdx, qword [rsp + 0x118]
mov dword [rsp + 0x28], r15d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call fcn.14004e070
cmp eax, r15d
jne 0x1400478cd
mov dword [rsp + 0x30], ebp
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x210]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, str.uninstallstring
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, r15d
jne 0x1400478cd
lea r9, [rsp + 0x210]
lea r8, str.Details_Link:Found_Matching_Uninstallstring____s_.__r_n
mov edx, r12d
lea rcx, [0x14010f570]
call fcn.140001000
mov rdx, rbp
lea rcx, [rsp + 0x210]
call fcn.140098dcc
mov qword [rsp + 0x180], r13
mov qword [rsp + 0x178], r15
mov byte [rsp + 0x168], r15b
lea rcx, [rsp + 0x210]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0x210]
lea rcx, [rsp + 0x160]
call fcn.14000352c
nop
mov rcx, rdi
call fcn.1400980d0
mov r9, rax
xor r8d, r8d
mov rdx, rdi
lea rcx, [rsp + 0x160]
call fcn.140005be4
cmp rax, 0xffffffffffffffff
jne 0x1400478ee
cmp qword [rsp + 0x180], 0x10
jb 0x1400478cd
mov rcx, qword [rsp + 0x168]
call fcn.14006127c
nop
cmp qword [rsp + 0x130], 0x10
jb 0x1400476dd
mov rcx, qword [rsp + 0x118]
call fcn.14006127c
jmp 0x1400476dd
mov dword [rsp + 0x30], ebp
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x320]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, str.DisplayName
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, r15d
jne 0x140047b02
lea r9, [rsp + 0x320]
lea r8, str.Details_Link:Found_DisplayName__s_.__r_n
mov edx, r12d
lea rcx, [0x14010f570]
call fcn.140001000
lea rcx, [rsp + 0x320]
call fcn.1400980d0
cmp rax, r15
je 0x1400479c4
lea rcx, str._b__u_
call fcn.1400980d0
mov r8, rax
lea rdx, str._b__u_
lea rcx, [r14 + 0x4a8]
call fcn.14000627c
lea rcx, [rsp + 0x320]
call fcn.1400980d0
mov r8, rax
lea rdx, [rsp + 0x320]
lea rcx, [r14 + 0x4a8]
call fcn.14000627c
lea rcx, str.__b___u__br_
call fcn.1400980d0
mov r8, rax
lea rdx, str.__b___u__br_
lea rcx, [r14 + 0x4a8]
call fcn.14000627c
mov dword [rsp + 0x30], r15d
mov rdi, r15
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, str.Description
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, r15d
jne 0x140047ab1
mov eax, dword [rsp + 0x30]
inc eax
mov dword [rsp + 0x30], eax
mov ecx, eax
call fcn.140061284
mov rdi, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, str.Description
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, r15d
jne 0x140047ab1
mov r9, rdi
lea r8, str.Details_Link:Found_description__s_.__r_n
mov edx, r12d
lea rcx, [0x14010f570]
call fcn.140001000
cmp rdi, r15
je 0x140047a8a
mov rcx, rdi
call fcn.1400980d0
cmp rax, r15
je 0x140047a8a
mov rcx, rdi
call fcn.1400980d0
lea rsi, [r14 + 0x4a8]
mov r8, rax
mov rdx, rdi
mov rcx, rsi
call fcn.14000627c
jmp 0x140047ad6
mov rbx, qword [rsp + 0x188]
mov rcx, rbx
call fcn.1400980d0
lea rsi, [r14 + 0x4a8]
mov r8, rax
mov rdx, rbx
mov rcx, rsi
call fcn.14000627c
jmp 0x140047ad6
mov rbx, qword [rsp + 0x188]
mov rcx, rbx
call fcn.1400980d0
lea rsi, [r14 + 0x4a8]
mov r8, rax
mov rdx, rbx
mov rcx, rsi
call fcn.14000627c
lea rcx, str._br__br_
call fcn.1400980d0
mov r8, rax
lea rdx, str._br__br_
mov rcx, rsi
call fcn.14000627c
cmp rdi, r15
je 0x140047b02
mov rcx, rdi
call fcn.14006127c
nop
cmp qword [rsp + 0x180], 0x10
jb 0x140047b1a
mov rcx, qword [rsp + 0x168]
call fcn.14006127c
mov qword [rsp + 0x180], r13
mov qword [rsp + 0x178], r15
mov byte [rsp + 0x168], r15b
cmp qword [rsp + 0x130], 0x10
jb 0x140047b4b
mov rcx, qword [rsp + 0x118]
call fcn.14006127c
nop
cmp qword [rsp + 0x1b0], 0x10
jb 0x140047b63
mov rcx, qword [rsp + 0x198]
call fcn.14006127c
mov qword [rsp + 0x1b0], r13
mov qword [rsp + reloc.OLEAUT32.dll_VarUI4FromI8], r15
mov byte [rsp + 0x198], r15b
mov rdx, qword [rsp + 0x188]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, r15d
jg 0x140047ba0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.oledlg.dll_OleUIBusyA]
nop
cmp qword [rsp + 0x200], 0x10
jb 0x140047bb8
mov rcx, qword [rsp + 0x1e8]
call fcn.14006127c
lea r8, str.CDetailsDialog::PrepareBucketInfo____r_n
mov edx, 4
lea rcx, [0x14010f570]
call fcn.140001000
mov rcx, qword [rsp + 0x540]
xor rcx, rsp
call fcn.140061100
lea r11, [rsp + 0x550]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret