Function at 0x140011ee0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x490]
sub rsp, 0x590
mov rax, qword [0x140077040]
xor rax, rsp
mov qword [rbp + 0x480], rax
mov rbx, r8
mov r15, rdx
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140012479
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x140012484
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp - 0x80]
call fcn.14005af20
mov rsi, 0xffffffffffffffff
test r15, r15
jne 0x140012012
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 2]
xor r8d, r8d
mov rdx, qword [0x14007df78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001202d
mov dword [rsp + 0x60], 0x80
mov dword [rsp + 0x64], 1
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x64]
xor r8d, r8d
lea rdx, [0x140069ac0]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x140011ff4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001202d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x80]
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x140012001
lea rdx, [rbp - 0x80]
jmp 0x140012023
mov r8, rsi
inc r8
cmp word [r15 + r8*2], 0
jne 0x140012015
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.140002210
xor r12d, r12d
test rbx, rbx
jne 0x140012060
mov word [rbp - 0x80], r12w
lea r8, [rbp - 0x80]
call fcn.140013220
cmp al, 1
jne 0x14001207a
lea rax, [rbp - 0x80]
mov r8, rsi
nop
inc r8
cmp word [rax + r8*2], r12w
jne 0x140012050
lea rdx, [rbp - 0x80]
jmp 0x140012070
mov r8, rsi
inc r8
cmp word [rbx + r8*2], r12w
jne 0x140012063
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140002210
lea rcx, [rsp + 0x48]
call fcn.1400098f0
lea rcx, [rsp + 0x48]
call fcn.1400099f0
mov rbx, qword [rsp + 0x48]
cmp dword [rbx - 0x10], r12d
jne 0x1400120b5
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400122fd
mov rcx, qword [rdx]
jmp 0x1400122f6
lea rcx, [rsp + 0x40]
call fcn.1400098f0
lea rcx, [rsp + 0x40]
call fcn.1400099f0
mov rax, qword [rsp + 0x40]
cmp dword [rax - 0x10], r12d
jne 0x1400120f4
lea rdx, str.Unspecified
mov r8, rsi
nop
inc r8
cmp word [rdx + r8*2], r12w
jne 0x1400120e0
lea rcx, [rsp + 0x40]
call fcn.140002210
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x80]
call fcn.14005af20
lea r8, str.https:__activate.bitsum.com__
mov edx, 0x200
lea rcx, [rbp + 0x80]
call fcn.140040ee4
lea r14, [rbx - 0x18]
mov rcx, r14
call fcn.140002120
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
movsxd rdi, dword [rax + 8]
test edi, edi
js 0x14001246e
mov ecx, 1
sub ecx, dword [rax + 0x10]
mov eax, dword [rax + 0xc]
sub eax, edi
or eax, ecx
jge 0x140012163
mov edx, edi
lea rcx, [rsp + 0x58]
call fcn.140002b40
mov rbx, qword [rsp + 0x58]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.140041228
cmp edi, dword [rbx - 0xc]
jg 0x14001246e
mov dword [rbx - 0x10], edi
mov word [rbx + rdi*2], r12w
call fcn.140002ed0
mov rcx, rax
test rax, rax
je 0x14001248f
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
mov word [rbp - 0x80], r12w
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [0x14007df78]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001221a
mov dword [rsp + 0x68], 0x80
mov dword [rsp + 0x6c], 1
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x6c]
xor r8d, r8d
lea rdx, str.ItemName
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x80]
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x140012221
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x50]
call fcn.140002210
lea rcx, [rsp + 0x50]
call fcn.1400098f0
lea rcx, [rsp + 0x50]
call fcn.1400099f0
mov rdi, qword [rsp + 0x50]
cmp dword [rdi - 0x10], 0
jne 0x140012349
lea r9, [0x140069ac0]
mov r8, qword [0x14007df78]
call fcn.14000feb0
lea r9, [0x1400690c4]
mov r8, qword [0x14007df78]
call fcn.14000feb0
lea r9, str.ItemName
mov r8, qword [0x14007df78]
call fcn.14000feb0
lea r9, str.HardwareConfig
mov r8, qword [0x14007df78]
call fcn.14000feb0
nop
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400122c4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400122e3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov eax, esi
lock xadd dword [r14 + 0x10], eax
sub eax, 1
jg 0x1400122fd
mov rcx, qword [r14]
mov rdx, r14
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140012319
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov eax, InitCommonControls
mov rcx, qword [rbp + 0x480]
xor rcx, rsp
call fcn.1400398f0
lea r11, [rsp + 0x590]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
call fcn.140002ed0
nop
mov rcx, rax
test rax, rax
je 0x140012463
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, str.edd_actioncheck_license
lea r8, [rbp + 0x80]
lea rdx, str._s_sitem_name_slicense_s
lea rcx, [rsp + 0x70]
call fcn.140004a60
mov byte [0x14007df88], 0
mov rbx, qword [rsp + 0x70]
mov rdx, rbx
call fcn.1400124a0
mov edi, dword [0x14007df70]
cmp edi, 1
jne 0x1400123cd
test r15, r15
je 0x1400123cd
mov r8, r15
call fcn.140013100
mov r8, r15
call fcn.140013100
mov edi, dword [0x14007df70]
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400123e7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140012406
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140012425
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov eax, esi
lock xadd dword [r14 + 0x10], eax
sub eax, 1
jg 0x14001243f
mov rcx, qword [r14]
mov rax, qword [rcx]
mov rdx, r14
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14001245c
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rVariantCopy + 8]
mov eax, edi
jmp 0x14001231e
mov ecx, 0x80004005
call fcn.140002c40
nop
mov ecx, 0x80070057
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
nop
mov ecx, 0x80004005
call fcn.140002c40
int3