Function at 0x1401ce530
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], r9
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x48]
sub rsp, 0x110
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r13, r9
mov r12, rdx
xor r15d, r15d
mov dword [rbp + 0x60], r15d
mov esi, 0x200
mov eax, 0x100
cmp byte [rbp + 0x70], r15b
cmovne esi, eax
mov rcx, qword [r8]
sub rcx, 0x18
call fcn.1400026b0
lea rdi, [rax + 0x18]
mov qword [rbp - 0x80], rdi
movsxd rbx, dword [rdi - 0x10]
test ebx, ebx
jns 0x1401ce5a2
mov ecx, 0x80070057
call fcn.140001290
int3
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, ebx
or eax, ecx
jge 0x1401ce5c2
mov edx, ebx
lea rcx, [rbp - 0x80]
call fcn.140002650
mov rdi, qword [rbp - 0x80]
lea eax, [rbx + 1]
movsxd rdx, eax
mov rcx, rdi
call fcn.140253d90
cmp ebx, dword [rdi - 0xc]
jg 0x1401cef7b
mov dword [rdi - 0x10], ebx
mov word [rdi + rbx*2], r15w
mov qword [rbp - 0x40], r15
mov dword [rbp - 0x38], r15d
mov qword [rbp - 0x30], r15
lea rcx, [0x14042f270]
mov rax, qword [0x14042f270]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x78], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstall
test rdx, 0xffffffffffff0000
jne 0x1401ce638
movzx ebx, dx
xor edx, edx
mov ecx, ebx
call fcn.140001440
test rax, rax
je 0x1401ce648
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.140002960
jmp 0x1401ce648
mov r8d, 0x33
lea rcx, [rbp - 0x78]
call fcn.140002560
nop
or esi, 0x20019
mov dword [rbp - 0x48], esi
mov r9d, esi
mov r8, qword [rbp - 0x78]
mov rdx, qword [r13]
lea rcx, [rbp - 0x40]
call fcn.14000b4d0
or esi, 0xffffffff
test eax, eax
jne 0x1401cef1b
mov dword [rbp + 0x60], r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
lea rax, [rbp + 0x60]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rbx, qword [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov r13d, eax
mov dword [rbp - 0x70], eax
mov ecx, dword [rbp + 0x60]
test eax, eax
jne 0x1401ce6c7
inc ecx
mov dword [rbp + 0x60], ecx
mov r12d, r15d
mov dword [rbp - 0x58], r15d
test eax, eax
jne 0x1401ce6d9
test ecx, ecx
mov dword [rbp + 0x70], ecx
jne 0x1401ce6e0
mov dword [rbp + 0x70], 0x400
lea rcx, [0x14042f270]
mov rax, qword [0x14042f270]
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rbp - 0x60], rsi
test r13d, r13d
jne 0x1401ce705
mov eax, dword [rbp + 0x60]
test eax, eax
jne 0x1401ce70a
mov eax, 0x400
mov dword [rbp + 0x70], eax
lea edx, [rax + 1]
test edx, edx
js 0x1401cef10
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edx
or eax, ecx
jge 0x1401ce736
lea rcx, [rbp - 0x60]
call fcn.140002650
mov rsi, qword [rbp - 0x60]
lea rax, [rbp]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x70]
mov r8, rsi
mov edx, r12d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [rbp - 0x50], eax
movsxd rdx, dword [rsi - 0xc]
mov rcx, rsi
call fcn.140251840
test eax, eax
js 0x1401cef05
cmp eax, dword [rsi - 0xc]
jg 0x1401cef05
lea r13, [rsi - 0x10]
mov dword [r13], eax
cdqe
mov word [rsi + rax*2], r15w
mov rbx, qword [rbp - 0x78]
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx - 8], 0
jl 0x1401ce7bf
cmp rax, qword [rbx - 0x18]
jne 0x1401ce7bf
lea r12, [rbx - 0x18]
lock inc dword [rbx - 8]
mov rdi, qword [rbp - 0x80]
mov rsi, qword [rbp - 0x60]
jmp 0x1401ce7fa
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx - 0x10]
call qword [rax]
mov r12, rax
test rax, rax
je 0x1401ceeff
mov ecx, dword [rbx - 0x10]
mov dword [rax + 8], ecx
mov ecx, dword [rbx - 0x10]
inc ecx
movsxd rdx, ecx
lea r9, [rdx + rdx]
mov r8, rbx
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.140250f34
lea rax, [r12 + 0x18]
mov qword [rsp + 0x70], rax
mov r8d, 1
lea rdx, [0x14033ff78]
lea rcx, [rsp + 0x70]
call fcn.140002740
movsxd r11, dword [r13]
mov r14, rsi
mov rbx, qword [rsp + 0x70]
sub r14, rbx
sar r14, 1
mov r13d, dword [rbx - 0x10]
mov eax, r15d
test r11d, r11d
setns al
test eax, eax
je 0x1401ceef4
mov rdx, r11
mov rcx, rsi
call fcn.140251840
mov r15, rax
mov ecx, 0x7fffffff
sub ecx, eax
xor edx, edx
cmp ecx, r13d
setge dl
test edx, edx
je 0x1401ceee9
lea r12d, [r13 + rax]
test r12d, r12d
js 0x1401ceede
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r12d
or eax, ecx
jge 0x1401ce899
mov edx, r12d
lea rcx, [rsp + 0x70]
call fcn.140002650
mov rbx, qword [rsp + 0x70]
cmp r14, r13
ja 0x1401ce8a2
lea rsi, [rbx + r14*2]
movsxd rdx, r15d
add rdx, rdx
lea rcx, [rbx + r13*2]
mov r9, rdx
mov r8, rsi
call fcn.140250f34
cmp r12d, dword [rbx - 0xc]
jg 0x1401ceed3
mov dword [rbx - 0x10], r12d
movsxd rax, r12d
xor r15d, r15d
mov word [rbx + rax*2], r15w
mov qword [rbp - 0x28], r15
mov dword [rbp - 0x20], r15d
mov qword [rbp - 0x18], r15
mov r9d, dword [rbp - 0x48]
mov r8, rbx
mov rax, qword [rbp + 0x68]
mov rdx, qword [rax]
lea rcx, [rbp - 0x28]
call fcn.14000b4d0
test eax, eax
jne 0x1401cec2f
mov dword [rsp + 0x60], r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r15
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov r12, qword [rbp - 0x28]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov r13d, eax
mov dword [rbp - 0x70], eax
test eax, eax
jne 0x1401ce950
inc dword [rsp + 0x60]
lea rcx, [0x14042f270]
mov rax, qword [0x14042f270]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
test r13d, r13d
jne 0x1401ce977
mov edx, dword [rsp + 0x60]
test edx, edx
jne 0x1401ce97c
mov edx, 0x400
mov dword [rbp + 0x70], edx
lea r8d, [rdx + 1]
test r8d, r8d
js 0x1401ceec2
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r8d
or ecx, eax
jge 0x1401ce9b3
mov edx, r8d
lea rcx, [rsp + 0x68]
call fcn.140002650
mov edx, dword [rbp + 0x70]
mov rbx, qword [rsp + 0x68]
lea eax, [rdx + rdx]
mov dword [rbp - 0x6c], eax
mov dword [rbp + 0x70], r15d
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x54]
xor r8d, r8d
lea rdx, str.DisplayName
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401cebe4
mov eax, dword [rbp - 0x54]
cmp eax, 1
je 0x1401ce9fb
cmp eax, 2
jne 0x1401cebe4
mov ecx, dword [rbp - 0x6c]
test rbx, rbx
je 0x1401cea26
test ecx, ecx
je 0x1401cea22
test cl, 1
jne 0x1401cebe4
mov eax, ecx
shr rax, 1
cmp word [rbx + rax*2 - 2], 0
je 0x1401cea26
jmp 0x1401cebe4
mov word [rbx], r15w
shr ecx, 1
mov dword [rbp + 0x70], ecx
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.140251840
test eax, eax
js 0x1401ceeac
cmp eax, dword [rbx - 0xc]
jg 0x1401ceeac
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r15w
movsxd rsi, dword [rbx - 0x10]
test esi, esi
js 0x1401ceea1
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, ecx
jge 0x1401cea80
mov edx, esi
lea rcx, [rsp + 0x68]
call fcn.140002650
mov rbx, qword [rsp + 0x68]
lea eax, [rsi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.140253d90
cmp esi, dword [rbx - 0xc]
jg 0x1401cee96
mov dword [rbx - 0x10], esi
mov word [rbx + rsi*2], r15w
cmp dword [rbx - 0x10], 0
jl 0x1401cebe4
mov rdx, rdi
mov rcx, rbx
call fcn.1402513f0
test rax, rax
je 0x1401cebe4
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x1401cebe4
lea rcx, [0x14042f270]
mov rax, qword [0x14042f270]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x78], rbx
test r13d, r13d
jne 0x1401ceaf3
mov edx, dword [rsp + 0x60]
test edx, edx
jne 0x1401ceaf8
mov edx, 0x400
mov dword [rbp + 0x70], edx
lea r8d, [rdx + 1]
test r8d, r8d
js 0x1401cee8b
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r8d
or eax, ecx
jge 0x1401ceb2f
mov edx, r8d
lea rcx, [rsp + 0x78]
call fcn.140002650
mov edx, dword [rbp + 0x70]
mov rbx, qword [rsp + 0x78]
lea eax, [rdx + rdx]
mov dword [rbp - 0x68], eax
mov dword [rbp + 0x70], r15d
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x4c]
xor r8d, r8d
lea rdx, str.DisplayIcon
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401ceb99
mov eax, dword [rbp - 0x4c]
cmp eax, 1
je 0x1401ceb6f
cmp eax, 2
jne 0x1401ceb99
mov ecx, dword [rbp - 0x68]
test rbx, rbx
je 0x1401ceca5
test ecx, ecx
je 0x1401ceca1
test cl, 1
jne 0x1401ceb99
mov eax, ecx
shr rax, 1
cmp word [rbx + rax*2 - 2], 0
je 0x1401ceca5
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.140251840
test eax, eax
js 0x1401cee80
cmp eax, dword [rbx - 0xc]
jg 0x1401cee80
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r15w
lea rdx, [rbx - 0x18]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401cebdd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x68]
jmp 0x1401cebe7
or esi, 0xffffffff
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.140251840
test eax, eax
js 0x1401ceeb7
cmp eax, dword [rbx - 0xc]
jg 0x1401ceeb7
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r15w
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401cec28
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x70]
jmp 0x1401cec36
or esi, 0xffffffff
mov r13d, dword [rbp - 0x70]
mov r12d, dword [rbp - 0x58]
inc r12d
mov dword [rbp - 0x58], r12d
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x1401cec51
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401cec6c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401cec8a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp dword [rbp - 0x50], 0
jne 0x1401ceecd
mov rdi, qword [rbp - 0x80]
mov rbx, qword [rbp - 0x40]
jmp 0x1401ce6e0
mov word [rbx], r15w
shr ecx, 1
mov dword [rbp + 0x70], ecx
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.140251840
test eax, eax
js 0x1401cee75
cmp eax, dword [rbx - 0xc]
jg 0x1401cee75
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r15w
mov edx, 0x5c
mov rcx, rbx
call fcn.140252630
test rax, rax
jne 0x1401cecea
or esi, 0xffffffff
mov eax, esi
jmp 0x1401cecf3
sub rax, rbx
sar rax, 1
or esi, 0xffffffff
lea r8d, [rax + 1]
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x78]
call fcn.140187530
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1401ced60
cmp dword [rbx + 0x10], 0
jl 0x1401ced51
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1401ced51
call fcn.1400026b0
mov rdi, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1401ced46
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x78], rax
jmp 0x1401ced60
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x78]
call fcn.140002560
nop
mov rdx, qword [rbp - 0x10]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401ced7e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x78]
lea rcx, [rbx - 0x18]
call fcn.1400026b0
add rax, 0x18
mov rdi, qword [rbp + 0x58]
mov qword [rdi], rax
mov eax, esi
lock xadd dword [rbx - 8], eax
dec eax
test eax, eax
jg 0x1401cedb3
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401cedd3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x1401cede3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401cee03
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401cee22
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401cee41
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x1401cee51
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x1401cee6d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rdi
jmp 0x1401cef86
mov ecx, 0x80070057
call fcn.140001290
int3
mov ecx, 0x80070057
call fcn.140001290
int3
mov ecx, 0x80070057
call fcn.140001290
nop
mov ecx, 0x80070057
call fcn.140001290
int3
mov ecx, 0x80070057
call fcn.140001290
int3
mov ecx, 0x80070057
call fcn.140001290
int3
mov ecx, 0x80070057
call fcn.140001290
int3
mov ecx, 0x80070057
call fcn.140001290
nop
mov r12, qword [rbp + 0x58]
jmp 0x1401cef1b
mov ecx, 0x80070057
call fcn.140001290
int3
mov ecx, 0x80070057
call fcn.140001290
int3
mov ecx, 0x80070057
call fcn.140001290
int3
mov ecx, 0x80070057
call fcn.140001290
nop
call fcn.140002850
int3
mov ecx, 0x80070057
call fcn.140001290
int3
mov ecx, 0x80070057
call fcn.140001290
nop
lea rdx, [0x140360770]
mov rcx, r12
call fcn.140001eb0
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401cef4a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x1401cef5a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x1401cef76
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, r12
jmp 0x1401cef86
mov ecx, 0x80070057
call fcn.140001290
nop
mov rbx, qword [rsp + 0x150]
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret