Function at 0x164e49dc0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov byte [rsp + 8], cl
push rbp
lea rbp, [rsp - 0x840]
sub rsp, 0x940
mov rax, qword [0x16514b200]
xor rax, rsp
mov qword [rbp + 0x830], rax
mov dword [rbp - 8], 0x409
mov dword [rbp], 4
mov dword [rbp - 4], 4
call fcn.164ee1bc0
cmp qword [rax + 0x18], 7
jbe 0x164e49e18
mov rax, qword [rax]
lea rcx, [rbp - 0x10]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
xor esi, esi
test eax, eax
jne 0x164e49e80
lea rax, [rbp - 4]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
lea r9, [rbp]
xor r8d, r8d
lea rdx, str.Locale
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x164e4a007
call fcn.164fb2050
test al, al
jne 0x164e49e92
call fcn.164fb20e0
test al, al
je 0x164e49efd
call fcn.164ee1bc0
cmp qword [rax + 0x18], 7
jbe 0x164e49ea1
mov rax, qword [rax]
lea rdx, [rbp - 0x10]
mov qword [rsp + 0x20], rdx
mov r9d, 0x20219
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x164e49f05
lea rax, [rbp - 4]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
lea r9, [rbp]
xor r8d, r8d
lea rdx, str.Locale
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x164e4a007
call fcn.164e52320
mov rdi, rax
mov rcx, qword [rax]
mov rbx, qword [rcx + 0xa8]
lea rax, str.Engine
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 6
lea rax, str.Languages
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 9
lea rax, [0x1650a8710]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [0x1650f5a80]
movdqa xmmword [rbp - 0x70], xmm1
mov word [rbp - 0x80], si
movdqa xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmmword [rbp - 0x30], xmm1
mov dword [rbp - 0x20], 1
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movaps xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [str.avcfg]
movaps xmmword [rsp + 0x70], xmm1
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x70]
lea rcx, [rbp - 0x80]
call fcn.164ec1180
nop
mov dword [rbp - 0x18], 1
mov r8d, 0x409
lea rdx, [rbp - 0x80]
mov rcx, rdi
mov rax, rbx
call qword [case.0x164e9d7b8.0]
mov dword [rbp - 8], eax
lea rcx, [rbp - 0x80]
call fcn.164e54bf0
mov ebx, esi
mov r9d, dword [rbp - 8]
cmp dword [0x1651be2d4], r9d
jne 0x164e4a024
cmp byte [rbp + 0x850], 0
jne 0x164e4a024
xor eax, eax
jmp 0x164e4a54e
mov dword [0x1651be2d4], r9d
lea r8, [0x1650a915c]
mov edx, 0x14
lea rcx, [rbp + 8]
call fcn.164e43390
mov rcx, rsi
lea rdx, [0x1651bb920]
nop word [rax + rax]
movzx eax, word [rcx + rdx]
mov word [rbp + rcx + 0x30], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x164e4a050
lea rax, [rbp + 0x30]
sub rax, 2
nop word [rax + rax]
lea rax, [rax + 2]
cmp word [rax], 0
jne 0x164e4a070
lea r8, [rbp + 8]
xor edx, edx
movzx ecx, word [r8 + rdx*2]
mov word [rax + rdx*2], cx
lea rdx, [rdx + 1]
test cx, cx
jne 0x164e4a080
lea rcx, [rbp + 0x30]
sub rcx, 2
nop word [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x164e4a0a0
mov eax, dword [0x1650a8258]
mov dword [rcx], eax
lea rcx, [rbp + 0x30]
sub rcx, 2
nop word [rax + rax]
lea rcx, [rcx + 2]
cmp word [rcx], 0
jne 0x164e4a0c0
movups xmm0, xmmword [str.Base.dll]
movups xmmword [rcx], xmm0
movzx eax, word [0x1650a9178]
mov word [rcx + 0x10], ax
xor edx, edx
lea r8d, [rdx + 0x2a]
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rdi, rax
test rax, rax
je 0x164e4a544
mov r9d, 0x80
lea r8, str.Scan_selected_items_for_viruses
mov edx, 0x32c9
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadStringW]
mov r9d, 0x40
lea r8, str.Scan__s
mov edx, 0x32ca
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringW]
mov r9d, 0x40
lea r8, str.Scan_Recycle_Bin_using_Avast
mov edx, 0x32cc
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringW]
mov word [0x16514ccde], si
mov word [0x16514ca5e], si
mov word [0x16514cd9e], si
mov r9d, 0xc0
lea r8, str.Scans_selected_items_for_known_viruses...
mov edx, 0x32c8
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringW]
mov word [0x16514c9de], si
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0xc0
lea rax, [0x16514bfd0]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, str.Scans_selected_items_for_known_viruses...
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r9d, 0x100
lea r8, str.Avast_UI_process__AvastUI.exe__is_currently_not_running._nPlease_run_the_application_before_starting_a_scan.
mov edx, 0x32cb
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringW]
mov r9d, 0x40
lea r8, str.Create_and_add_to_backup
mov edx, 0xa0c3
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringW]
mov word [0x16514c55e], si
mov r9d, 0x40
lea r8, str.Exclude_from_backup
mov edx, 0xa0c5
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringW]
mov word [0x16514d35e], si
mov r9d, 0x40
lea r8, str.Create_a_new_backup_with_these_items
mov edx, 0xa0c4
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringW]
mov word [0x16514d3de], si
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x40
lea rax, [0x16514cce0]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, str.Create_a_new_backup_with_these_items
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r9d, 0x40
lea r8, [0x16514c1a0]
mov edx, 0xa0c6
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringW]
mov word [0x16514c21e], si
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x40
lea rax, str.Exclude_selected_items
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [0x16514c1a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r9d, 0x40
lea r8, str.Add_to_Backup
mov edx, 0xa0c0
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringW]
mov word [0x16514d21e], si
mov r9d, 0x40
lea r8, [0x16514c460]
mov edx, 0xa0c4
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringW]
mov word [0x16514c4de], si
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x40
lea rax, str.Backup_selected_items
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [0x16514c460]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r9d, 0x100
lea r8, str.Norton_UI_process__Norton_UI.exe__is_currently_not_running._nPlease_run_the_application_before_adding_to_backup.
mov edx, 0xa0c2
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringW]
mov word [0x16514cf9e], si
mov r9d, 0x80
lea r8, str.Shred_selected_items_by_avast_
mov edx, 0xa099
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringW]
mov r9d, 0x40
lea r8, str.Shred_by_avast_
mov edx, 0xa09a
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringW]
mov r9d, 0x40
lea r8, str.Shred_recycle_bin_by_avast_
mov edx, 0xa09d
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringW]
mov word [0x16514ccde], si
mov word [0x16514ca5e], si
mov word [0x16514d71e], si
mov r9d, 0xc0
lea r8, str.Shred_selected_items...
mov edx, 0xa09b
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringW]
mov word [0x16514d69e], si
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0xc0
lea rax, [0x16514d220]
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, str.Shred_selected_items...
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r9d, 0x100
lea r8, str.Avast_UI_process__AvastUI.exe__is_currently_not_running._nPlease_run_the_application_before_starting_a_shredder.
mov edx, 0xa09c
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringW]
mov r9d, 0x80
lea r8, str.Always_run_in_sandbox
mov edx, 0x9ca4
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringW]
mov r9d, 0x80
lea r8, str.Always_run_outside_sandbox
mov edx, 0x9ca5
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringW]
mov r9d, 0x80
lea r8, str.Run_in_sandbox
mov edx, 0x9ca6
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringW]
mov r9d, 0x80
lea r8, str.Run_outside_sandbox
mov edx, 0x9ca7
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringW]
mov word [0x16514c45e], si
mov word [0x16514c35e], si
mov word [0x16514bfce], si
mov word [0x16514c65e], si
mov r9d, 0x80
lea r8, str.File_Insight
mov edx, 0xa0be
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringW]
mov word [0x16514c19e], si
mov r9d, 0x80
lea r8, [0x16514ca60]
mov edx, 0xa0bf
mov rcx, rdi
call qword [sym.imp.USER32.dll_LoadStringW]
mov word [0x16514cb5e], si
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
lea rax, str.File_threat_information
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, [0x16514ca60]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x164e4a54c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, ebx
mov rcx, qword [rbp + 0x830]
xor rcx, rsp
call fcn.165001080
lea r11, [rsp + 0x940]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret