Function at 0x140001eb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push r14
lea rbp, [rsp - 0x588]
sub rsp, 0x688
mov rbx, rcx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov qword [rcx], r14
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x18], 7
mov word [rcx], r14w
xor r8d, r8d
lea rdx, [0x140011634]
call fcn.140001d80
mov dword [rsp + 0x30], 1
lea rcx, [rsp + 0x58]
call fcn.1400021e0
nop
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp - 0x80]
call fcn.1400048b0
lea r8, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae r8, qword [rsp + 0x58]
lea rdx, str.SOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionUninstall_ls_is1
lea rcx, [rbp - 0x80]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x180]
call fcn.1400048b0
mov dword [rbp + 0x5b8], 4
mov dword [rbp + 0x5c0], 1
lea rax, [rbp + 0x5c8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp - 0x80]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002186
lea rax, [rbp + 0x5b8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x5c0]
xor r8d, r8d
lea rdx, str.DisplayIcon
mov rcx, qword [rbp + 0x5c8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rax, [rbp + 0x5b8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x180]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x5c0]
xor r8d, r8d
lea rdx, str.DisplayIcon
mov rcx, qword [rbp + 0x5c8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002178
lea rax, [rbp + 0x180]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140002010
lea rdx, [rbp + 0x180]
mov rcx, rbx
call fcn.140001d80
mov r10, rbx
cmp qword [rbx + 0x18], 8
jb 0x140002037
mov r10, qword [rbx]
mov r11, qword [rbx + 0x10]
cmp r11, 1
jb 0x14000209e
lea rcx, [r11 - 1]
mov rax, 0xffffffffffffffff
cmp rcx, rax
cmovb rax, rcx
lea r8, [r10 + rax*2]
lea rsi, [0x140011720]
mov r9, r8
sub r9, rsi
cmp word [r8], 0x2c
jne 0x14000208f
mov edx, 1
mov rax, rsi
movzx ecx, word [rax]
cmp word [rax + r9], cx
jne 0x14000208f
add rax, 2
sub rdx, 1
jne 0x140002073
sub r8, r10
sar r8, 1
jmp 0x1400020a5
cmp r8, r10
je 0x14000209e
sub r8, 2
sub r9, 2
jmp 0x140002064
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], 7
cmp r11, r8
cmovb r8, r11
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400020cc
mov rdx, qword [rbx]
lea rcx, [rsp + 0x38]
call fcn.140001d80
lea rax, [rsp + 0x38]
cmp rbx, rax
je 0x14000213a
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14000211f
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000211a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400021da
mov rcx, r8
call fcn.1400038bc
mov qword [rbx + 0x18], 7
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rbx + 0x10], xmm1
jmp 0x140002178
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x140002178
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002173
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400021da
call fcn.1400038bc
mov rcx, qword [rbp + 0x5c8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x1400021c4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400021bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400021d4
call fcn.1400038bc
mov rax, rbx
add rsp, 0x688
pop r14
pop rsi
pop rbx
pop rbp
ret
call fcn.1400084dc
nop
call fcn.1400084dc
int3