Function at 0x1400221d8
Capabilities:
Query or enumerate registry key
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x270], rax
mov rdi, rcx
mov r13, rdx
mov ecx, 0x98
call fcn.14003c414
xor r15d, r15d
test rax, rax
je 0x140022231
lea rdx, str.ERROR
mov rcx, rax
call fcn.140024000
jmp 0x140022234
mov rax, r15
mov qword [rdi + 0x290], rax
mov qword [rdi + 0x298], rax
test rax, rax
jne 0x140022251
mov eax, 0x8007000e
jmp 0x1400229f0
mov qword [rax + 0x78], rdi
lea r8, [rsp + 0x60]
mov rcx, qword [rdi + 0x290]
lea rdx, [0x140045190]
mov eax, dword [rdi + 0x28]
mov dword [rsp + 0x20], 1
mov dword [rcx + 0x74], eax
mov rcx, r13
call fcn.14001c218
or r14, 0xffffffffffffffff
mov ebx, eax
mov r12d, 2
test eax, eax
js 0x1400222a8
lea rdx, str.skip
lea rcx, [rsp + 0x60]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x14002295f
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 1
lea rdx, str.TYPE
mov rcx, r13
call fcn.14001c218
mov ebx, eax
test eax, eax
jns 0x1400222e5
lea r8, str.TYPE
lea rdx, str.ERROR:_Reg_Parser:_Missing_required_component_attribute__S._r_n
mov ecx, r12d
call fcn.1400168a8
jmp 0x14002295f
mov rbx, qword [rdi + 0x290]
add rbx, 0x38
je 0x140022355
mov rcx, qword [rbx]
test rcx, rcx
je 0x140022302
call fcn.14003c408
mov qword [rbx], r15
lea rax, [rsp + 0x60]
mov rsi, r14
inc rsi
cmp word [rax + rsi*2], r15w
jne 0x14002230a
inc rsi
mov rax, r12
mul rsi
cmovo rax, r14
mov rcx, rax
call fcn.14003c460
mov qword [rbx], rax
test rax, rax
je 0x140022355
lea r8, [rsp + 0x60]
mov rdx, rsi
mov rcx, rax
call fcn.140001470
test eax, eax
jns 0x140022355
mov rcx, qword [rbx]
test rcx, rcx
je 0x140022355
call fcn.14003c408
mov qword [rbx], r15
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 1
lea rdx, [0x140045368]
mov rcx, r13
call fcn.14001c218
mov ebx, eax
test eax, eax
jns 0x140022383
lea r8, [0x140045368]
jmp 0x1400222d1
mov rbx, qword [rdi + 0x290]
add rbx, 0x30
je 0x1400223f3
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400223a0
call fcn.14003c408
mov qword [rbx], r15
lea rax, [rsp + 0x60]
mov rsi, r14
inc rsi
cmp word [rax + rsi*2], r15w
jne 0x1400223a8
inc rsi
mov rax, r12
mul rsi
cmovo rax, r14
mov rcx, rax
call fcn.14003c460
mov qword [rbx], rax
test rax, rax
je 0x1400223f3
lea r8, [rsp + 0x60]
mov rdx, rsi
mov rcx, rax
call fcn.140001470
test eax, eax
jns 0x1400223f3
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400223f3
call fcn.14003c408
mov qword [rbx], r15
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], r15d
xor edx, edx
mov rcx, r13
call fcn.14001c218
mov ebx, eax
test eax, eax
js 0x140022424
lea rcx, [rsp + 0x60]
mov rax, r14
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140022415
test rax, rax
jne 0x140022442
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 1
lea rdx, [0x140045410]
mov rcx, r13
call fcn.14001c218
mov ebx, eax
test ebx, ebx
jns 0x140022452
lea r8, str.DISPLAYNAME
jmp 0x1400222d1
mov rbx, qword [rdi + 0x290]
add rbx, 0x18
je 0x1400224c2
mov rcx, qword [rbx]
test rcx, rcx
je 0x14002246f
call fcn.14003c408
mov qword [rbx], r15
lea rax, [rsp + 0x60]
mov rsi, r14
inc rsi
cmp word [rax + rsi*2], r15w
jne 0x140022477
inc rsi
mov rax, r12
mul rsi
cmovo rax, r14
mov rcx, rax
call fcn.14003c460
mov qword [rbx], rax
test rax, rax
je 0x1400224c2
lea r8, [rsp + 0x60]
mov rdx, rsi
mov rcx, rax
call fcn.140001470
test eax, eax
jns 0x1400224c2
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400224c2
call fcn.14003c408
mov qword [rbx], r15
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 1
lea rdx, str.PRIORITY
mov rcx, r13
call fcn.14001c218
test eax, eax
js 0x1400224f3
mov rcx, qword [rdi + 0x290]
lea rdx, [rsp + 0x60]
call fcn.140024754
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 1
lea rdx, str.INSTALLEDSIZE
mov rcx, r13
call fcn.14001c218
test eax, eax
js 0x14002255e
mov rbx, qword [rdi + 0x290]
lea rdx, [0x1400420ec]
mov r8, r12
mov dword [rsp + 0x40], r15d
lea rcx, [rsp + 0x60]
call qword [sym.imp.msvcrt.dll__wcsnicmp]
lea rcx, [rsp + 0x60]
test eax, eax
jne 0x140022555
lea r8, [rsp + 0x40]
lea rdx, [0x1400420f4]
call qword [sym.imp.msvcrt.dll_swscanf]
mov eax, dword [rsp + 0x40]
jmp 0x14002255b
call qword [sym.imp.msvcrt.dll__wtoi]
mov dword [rbx + 0x68], eax
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 1
lea rdx, str.MINIMUMVERSION
mov rcx, r13
call fcn.14001c218
test eax, eax
js 0x1400225ee
mov rbx, qword [rdi + 0x290]
add rbx, 0x50
je 0x1400225ee
mov rcx, qword [rbx]
test rcx, rcx
je 0x14002259b
call fcn.14003c408
mov qword [rbx], r15
lea rax, [rsp + 0x60]
mov rsi, r14
inc rsi
cmp word [rax + rsi*2], r15w
jne 0x1400225a3
inc rsi
mov rax, r12
mul rsi
cmovo rax, r14
mov rcx, rax
call fcn.14003c460
mov qword [rbx], rax
test rax, rax
je 0x1400225ee
lea r8, [rsp + 0x60]
mov rdx, rsi
mov rcx, rax
call fcn.140001470
test eax, eax
jns 0x1400225ee
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400225ee
call fcn.14003c408
mov qword [rbx], r15
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 1
lea rdx, str.SUPPORTEDRANGE
mov rcx, r13
call fcn.14001c218
test eax, eax
js 0x14002267e
mov rbx, qword [rdi + 0x290]
add rbx, 0x48
je 0x14002267e
mov rcx, qword [rbx]
test rcx, rcx
je 0x14002262b
call fcn.14003c408
mov qword [rbx], r15
lea rax, [rsp + 0x60]
mov rsi, r14
inc rsi
cmp word [rax + rsi*2], r15w
jne 0x140022633
inc rsi
mov rax, r12
mul rsi
cmovo rax, r14
mov rcx, rax
call fcn.14003c460
mov qword [rbx], rax
test rax, rax
je 0x14002267e
lea r8, [rsp + 0x60]
mov rdx, rsi
mov rcx, rax
call fcn.140001470
test eax, eax
jns 0x14002267e
mov rcx, qword [rbx]
test rcx, rcx
je 0x14002267e
call fcn.14003c408
mov qword [rbx], r15
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 1
lea rdx, str.INSTORDER
mov rcx, r13
call fcn.14001c218
mov rbx, qword [rdi + 0x290]
test eax, eax
js 0x1400226eb
mov r8, r12
mov dword [rsp + 0x40], r15d
lea rdx, [0x1400420ec]
lea rcx, [rsp + 0x60]
call qword [sym.imp.msvcrt.dll__wcsnicmp]
lea rcx, [rsp + 0x60]
test eax, eax
jne 0x1400226e0
lea r8, [rsp + 0x40]
lea rdx, [0x1400420f4]
call qword [sym.imp.msvcrt.dll_swscanf]
mov eax, dword [rsp + 0x40]
jmp 0x1400226e6
call qword [sym.imp.msvcrt.dll__wtoi]
mov dword [rbx + 0x64], eax
jmp 0x1400226f2
mov dword [rbx + 0x64], 0x63
mov rsi, qword [rdi + 0x290]
test r13, r13
je 0x1400228da
mov rbx, qword [rsi + 0x80]
test rbx, rbx
jne 0x14002273a
lea ecx, [rbx + 0x10]
call fcn.14003c414
mov rbx, rax
test rax, rax
je 0x140022727
mov qword [rax], r15
mov qword [rax + 8], r15
jmp 0x14002272a
mov rbx, r15
mov qword [rsi + 0x80], rbx
test rbx, rbx
je 0x1400228da
mov r12d, r15d
mov qword [rsp + 0x50], r15
mov r14d, r15d
mov ecx, r14d
test r14d, r14d
je 0x140022780
sub ecx, 1
je 0x140022777
sub ecx, 1
je 0x14002276e
cmp ecx, 1
je 0x140022765
lea rsi, [0x1400452e8]
jmp 0x140022787
lea rsi, str.GainsFrom
jmp 0x140022787
lea rsi, str.ReliesUpon
jmp 0x140022787
lea rsi, str.CriticalTo
jmp 0x140022787
lea rsi, str.Definition
lea rax, [rsp + 0x50]
mov r9d, 0x2001f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140022876
xor eax, eax
mov dword [rsp + 0x40], 0x80
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r8, [rbp + 0x170]
mov qword [rsp + 0x30], rax
mov edx, r15d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140022868
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x40], 0x80
lea rdx, [rbp + 0x170]
inc r15d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140022868
lea r8, [rbp + 0x170]
lea rdx, str.Reg_parser:_Adding_dependency__S._r_n
lea ecx, [rax + 4]
call fcn.1400168a8
mov rdx, qword [rsp + 0x48]
mov r8, rsi
mov rcx, rbx
call fcn.14001d82c
mov rcx, qword [rsp + 0x48]
mov r12d, eax
test eax, eax
js 0x140022862
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400227bd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r15d, r15d
test r12d, r12d
js 0x1400228d0
inc r14d
cmp r14d, 5
jl 0x140022745
test r12d, r12d
js 0x1400228d0
mov rbx, qword [rdi + 0x290]
mov rax, qword [rbx + 0x88]
test rax, rax
jne 0x1400228c5
lea ecx, [rax + 0x10]
call fcn.14003c414
test rax, rax
je 0x1400228b6
mov qword [rax], r15
mov qword [rax + 8], r15
jmp 0x1400228b9
mov rax, r15
mov qword [rbx + 0x88], rax
test rax, rax
je 0x1400228d0
mov rdx, r13
mov rcx, rax
call fcn.1400201f8
mov r12d, 2
or r14, 0xffffffffffffffff
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 1
lea rdx, [0x140045410]
mov rcx, r13
call fcn.14001c218
mov ebx, eax
test eax, eax
jns 0x14002292b
mov rcx, qword [rdi + 0x290]
call fcn.1400251a4
test rax, rax
jne 0x140022919
lea r8, [0x140045410]
jmp 0x1400222d1
mov r8, rax
lea rcx, [rsp + 0x60]
mov edx, 0x104
call fcn.140001470
mov rcx, qword [rdi + 0x290]
lea rdx, [rsp + 0x60]
call fcn.14002521c
mov ebx, eax
test eax, eax
js 0x140022953
mov rdx, qword [rdi + 0x290]
mov rcx, rdi
call fcn.14002318c
mov ebx, eax
mov eax, ebx
not eax
test eax, eax
js 0x1400229ee
mov rsi, qword [rdi + 0x290]
test rsi, rsi
je 0x140022982
mov rcx, rsi
call fcn.1400240e0
mov rcx, rsi
call fcn.14003c454
mov qword [rdi + 0x290], r15
mov qword [rdi + 0x298], r15
test ebx, ebx
jns 0x1400229a1
mov r8d, ebx
lea rdx, str.ERROR:_Reg_Parser:_Failed_to_add_component_from_reg.__Result:_0x_x._r_n
mov ecx, r12d
call fcn.1400168a8
jmp 0x1400229ee
mov rcx, qword [0x140050310]
cmp rcx, r14
jne 0x1400229c3
mov edx, 4
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, r14
je 0x1400229ee
cmp dword [0x1400516e0], 4
jl 0x1400229ee
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], r15d
mov r8d, 0x3a
mov qword [rsp + 0x20], r15
lea rdx, str.Reg_Parser:_Deliberately_did_not_add_component_from_reg._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, ebx
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.14003c810
mov rbx, qword [rsp + 0x3d0]
add rsp, 0x380
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret