Function at 0x1400274c0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3e0]
sub rsp, 0x4e0
mov rax, qword [0x1400cd038]
xor rax, rsp
mov qword [rbp + 0x3d0], rax
mov rdi, rdx
mov r15, rcx
mov qword [rsp + 0x68], rdx
xor r12d, r12d
mov dword [rsp + 0x60], r12d
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx], r12
mov qword [rdx + 8], r12
mov qword [rdx + 0x10], r12
mov rcx, rdx
call fcn.140028bf0
mov dword [rsp + 0x60], 1
mov dword [rbp - 0x3c], r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp - 0x3c]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov r14d, 0x20019
lea rbx, [0x1400babd8]
lea r13d, [r12 + 0x5c]
nop dword [rax]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9d, r14d
xor r8d, r8d
lea rdx, str.SOFTWAREAdobeAfter_Effects
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140027cff
mov dword [rbp - 0x40], r12d
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov esi, r12d
cmp dword [rbp - 0x40], r12d
jbe 0x140027cff
nop word [rax + rax]
mov dword [rbp - 0x38], 0xff
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x30]
mov edx, esi
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140027cf4
mov dword [rbp - 0x34], 0xff
lea rax, [rbp - 0x34]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1d0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov r9d, 2
lea r8, str.PluginInstallPath
lea rdx, [rbp - 0x30]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
jne 0x140027cf4
mov rcx, r12
lea rdx, [rbp - 0x30]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [rbx + rcx*2 - 2]
jne 0x14002766b
cmp rcx, 4
jne 0x140027652
jmp 0x140027cf4
mov rcx, r12
lea rdx, [rbp - 0x30]
lea r8, [0x1400babe0]
nop dword [rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x14002769a
cmp rcx, 4
jne 0x140027680
jmp 0x140027cf4
mov rcx, r12
lea rdx, [rbp - 0x30]
lea r8, str.10.0
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x1400276ca
cmp rcx, 5
jne 0x1400276b0
jmp 0x140027cf4
mov rcx, r12
lea rdx, [rbp - 0x30]
lea r8, str.10.5
nop dword [rax + rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x1400276fa
cmp rcx, 5
jne 0x1400276e0
jmp 0x140027cf4
movzx ecx, word [rbp - 0x30]
movzx edx, word [rbp - 0x2c]
movzx eax, word [rbp - 0x2e]
cmp cx, 0x31
jne 0x1400278b2
cmp ax, cx
jne 0x14002771e
test dx, dx
je 0x140027cf4
cmp cx, 0x31
jne 0x1400278b2
cmp ax, 0x32
jne 0x14002780e
test dx, dx
jne 0x14002780e
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r12w
lea rax, [rbp + 0x1d0]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x140027760
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp - 0x60]
call fcn.14001b410
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rdx, qword [rbp - 0x60]
mov rax, qword [rbp - 0x50]
lea rax, [rdx + rax*2]
lea rdx, [rbp - 0x60]
cmovae rdx, qword [rbp - 0x60]
cmp rdx, rax
je 0x1400277b3
nop
cmp word [rdx], 0x2f
jne 0x1400277aa
mov word [rdx], r13w
add rdx, 2
cmp rdx, rax
jne 0x1400277a0
mov rcx, qword [rdi]
add rcx, 0xa0
lea rdx, [rbp - 0x60]
call fcn.14001ac00
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140027cf4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027cef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027d53
jmp 0x140027cef
cmp cx, 0x31
jne 0x1400278b2
cmp ax, 0x33
jne 0x1400278b2
test dx, dx
jne 0x1400278b2
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r12w
lea rax, [rbp + 0x1d0]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x140027850
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp - 0x60]
call fcn.14001b410
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rdx, qword [rbp - 0x60]
mov rax, qword [rbp - 0x50]
lea rax, [rdx + rax*2]
lea rdx, [rbp - 0x60]
cmovae rdx, qword [rbp - 0x60]
cmp rdx, rax
je 0x1400278a3
nop
cmp word [rdx], 0x2f
jne 0x14002789a
mov word [rdx], r13w
add rdx, 2
cmp rdx, rax
jne 0x140027890
mov rcx, qword [rdi]
add rcx, 0xc0
jmp 0x1400277bd
mov rcx, r12
lea rdx, [rbp - 0x30]
lea r8, str.13.5
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x140027962
cmp rcx, 5
jne 0x1400278c0
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r12w
lea rax, [rbp + 0x1d0]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140027900
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp - 0x60]
call fcn.14001b410
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rdx, qword [rbp - 0x60]
mov rax, qword [rbp - 0x50]
lea rax, [rdx + rax*2]
lea rdx, [rbp - 0x60]
cmovae rdx, qword [rbp - 0x60]
cmp rdx, rax
je 0x140027953
nop
cmp word [rdx], 0x2f
jne 0x14002794a
mov word [rdx], r13w
add rdx, 2
cmp rdx, rax
jne 0x140027940
mov rcx, qword [rdi]
add rcx, 0xe0
jmp 0x1400277bd
mov rcx, r12
lea rdx, [rbp - 0x30]
lea r8, str.13.8
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x140027a12
cmp rcx, 5
jne 0x140027970
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r12w
lea rax, [rbp + 0x1d0]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400279b0
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp - 0x60]
call fcn.14001b410
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rdx, qword [rbp - 0x60]
mov rax, qword [rbp - 0x50]
lea rax, [rdx + rax*2]
lea rdx, [rbp - 0x60]
cmovae rdx, qword [rbp - 0x60]
cmp rdx, rax
je 0x140027a03
nop
cmp word [rdx], 0x2f
jne 0x1400279fa
mov word [rdx], r13w
add rdx, 2
cmp rdx, rax
jne 0x1400279f0
mov rcx, qword [rdi]
add rcx, 0x100
jmp 0x1400277bd
lea rax, [rbp + 0x1d0]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140027a20
mov rcx, r12
lea rdx, [rbp - 0x30]
lea r9, str.14.0
nop dword [rax]
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r9 + rcx*2 - 2]
jne 0x140027ac2
cmp rcx, 5
jne 0x140027a40
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r12w
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp - 0x60]
call fcn.14001b410
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rdx, qword [rbp - 0x60]
mov rax, qword [rbp - 0x50]
lea rax, [rdx + rax*2]
lea rdx, [rbp - 0x60]
cmovae rdx, qword [rbp - 0x60]
cmp rdx, rax
je 0x140027ab3
nop
cmp word [rdx], 0x2f
jne 0x140027aaa
mov word [rdx], r13w
add rdx, 2
cmp rdx, rax
jne 0x140027aa0
mov rcx, qword [rdi]
add rcx, 0x120
jmp 0x1400277bd
mov rcx, r12
lea rdx, [rbp - 0x30]
lea r9, str.15.0
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r9 + rcx*2 - 2]
jne 0x140027b52
cmp rcx, 5
jne 0x140027ad0
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r12w
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp - 0x60]
call fcn.14001b410
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rdx, qword [rbp - 0x60]
mov rax, qword [rbp - 0x50]
lea rax, [rdx + rax*2]
lea rdx, [rbp - 0x60]
cmovae rdx, qword [rbp - 0x60]
cmp rdx, rax
je 0x140027b43
nop
cmp word [rdx], 0x2f
jne 0x140027b3a
mov word [rdx], r13w
add rdx, 2
cmp rdx, rax
jne 0x140027b30
mov rcx, qword [rdi]
add rcx, 0x140
jmp 0x1400277bd
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r12w
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp - 0x60]
call fcn.14001b410
lea rax, [rbp - 0x60]
mov r8, qword [rbp - 0x60]
mov r9, qword [rbp - 0x48]
cmp r9, 8
cmovae rax, r8
mov r10, qword [rbp - 0x50]
lea rax, [rax + r10*2]
lea rcx, [rbp - 0x60]
cmovae rcx, r8
cmp rcx, rax
je 0x140027bbf
cmp word [rcx], 0x2f
jne 0x140027baa
mov word [rcx], r13w
add rcx, 2
cmp rcx, rax
jne 0x140027ba0
mov r9, qword [rbp - 0x48]
mov r10, qword [rbp - 0x50]
mov r8, qword [rbp - 0x60]
test r10, r10
je 0x140027cbd
mov rax, qword [rdi + 8]
cmp rax, qword [rdi + 0x10]
je 0x140027c0e
mov qword [rsp + 0x70], rax
mov qword [rax], r12
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 7
lea rcx, [rbp - 0x60]
cmp rax, rcx
je 0x140027c07
lea rdx, [rbp - 0x60]
cmp r9, 8
cmovae rdx, r8
mov r8, r10
mov rcx, rax
call fcn.14001b410
nop
add qword [rdi + 8], 0x20
jmp 0x140027c1d
lea r8, [rbp - 0x60]
mov rdx, rax
mov rcx, rdi
call fcn.140028930
lea r8, [rbp - 0x60]
lea rdx, [rsp + 0x78]
call fcn.140027d60
nop
mov rdx, qword [r15 + 0x70]
cmp rdx, qword [r15 + 0x78]
je 0x140027c65
mov qword [rdx], r12
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rax]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdx + 0x10], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
add qword [r15 + 0x70], 0x20
jmp 0x140027c72
mov r8, rax
lea rcx, [r15 + 0x68]
call fcn.140028d80
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x140027cae
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140027ca9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027d4d
call fcn.14004f3ac
lea rbx, [0x1400babd8]
mov r8, qword [rbp - 0x60]
mov r9, qword [rbp - 0x48]
cmp r9, 8
jb 0x140027cf4
lea rdx, [r9*2 + 2]
mov rax, r8
cmp rdx, 0x1000
jb 0x140027cec
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140027d53
mov rcx, r8
call fcn.14004f3ac
inc esi
cmp esi, dword [rbp - 0x40]
jb 0x1400275d0
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp - 0x3c], 0
je 0x140027d20
bt r14d, 8
jb 0x140027d20
bts r14d, 8
jmp 0x140027550
mov rax, rdi
mov rcx, qword [rbp + 0x3d0]
xor rcx, rsp
call fcn.14004f100
mov rbx, qword [rsp + 0x530]
add rsp, 0x4e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140055d18
nop
call fcn.140055d18
int3