Function at 0x140009cc4
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x388]
sub rsp, 0x480
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x370], rax
lea rax, [rsp + 0x50]
xor r14d, r14d
mov r9d, 0x20019
mov qword [rsp + 0x50], r14
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionSetupWindowsFeaturesWindowsMediaVersion
mov rcx, 0xffffffff80000002
mov edi, 1
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140009f72
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r14
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x14003fa00]
mov dword [rsp + 0x48], 3
mov dword [rsp + 0x4c], 8
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140009f67
cmp dword [rsp + 0x48], 3
jne 0x140009f67
mov r8d, 0x105
lea rdx, [rbp + 0x160]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140009f67
lea rcx, [rbp + 0x160]
call fcn.140018270
mov r8d, 0x100
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.140016ef0
test eax, eax
js 0x140009f67
movzx eax, word [rsp + 0x40]
lea rcx, [rsp + 0x60]
mov esi, dword [rsp + 0x40]
mov ebx, r14d
and rsi, 0xffffffffffff0000
mov dword [rsp + 0x30], r14d
or rsi, rax
mov dword [rsp + 0x34], r14d
mov eax, dword [rsp + 0x44]
shr rax, 0x10
shl rsi, 0x10
or rsi, rax
mov dword [rsp + 0x38], r14d
movzx eax, word [rsp + 0x44]
shl rsi, 0x10
or rsi, rax
mov dword [rsp + 0x3c], r14d
jmp 0x140009e1f
add ebx, edi
lea rcx, [rax + 2]
mov edx, 0x2e
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
jne 0x140009e19
mov ecx, ebx
sub ecx, edi
je 0x140009f03
sub ecx, edi
je 0x140009edb
cmp ecx, edi
lea rcx, [rsp + 0x60]
je 0x140009eae
test ebx, ebx
je 0x140009e63
call qword [sym.imp.msvcrt.dll__wtoi]
mov dword [rsp + 0x38], eax
jmp 0x140009f1f
add ebx, edi
lea rcx, [rax + 2]
mov edx, 0x2c
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
jne 0x140009e5d
lea rcx, [rsp + 0x60]
sub ebx, edi
je 0x140009ea5
sub ebx, edi
je 0x140009e9c
cmp ebx, edi
je 0x140009e93
call qword [sym.imp.msvcrt.dll__wtoi]
mov dword [rsp + 0x30], eax
jmp 0x140009f1f
lea rdx, str._lu__lu__lu__lu
jmp 0x140009eb5
lea rdx, str._lu__lu__lu
jmp 0x140009ee7
lea rdx, str._lu__lu
jmp 0x140009f0f
lea rdx, str._lu._lu._lu._lu
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x30]
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll_swscanf]
jmp 0x140009f1f
lea rdx, str._lu._lu._lu
lea rcx, [rsp + 0x60]
lea rax, [rsp + 0x38]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
call qword [sym.imp.msvcrt.dll_swscanf]
jmp 0x140009f1f
lea rdx, str._lu._lu
lea rcx, [rsp + 0x60]
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x30]
call qword [sym.imp.msvcrt.dll_swscanf]
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
mov edx, dword [rsp + 0x3c]
shl eax, 0x10
add ecx, eax
mov eax, dword [rsp + 0x38]
shl eax, 0x10
add edx, eax
mov r8d, ecx
and r8, 0xffffffffffff0000
movzx eax, cx
or r8, rax
movzx ecx, dx
shl r8, 0x10
mov eax, edx
shr rax, 0x10
or r8, rax
shl r8, 0x10
or r8, rcx
cmp r8, rsi
cmovb edi, r14d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rbp + 0x370]
xor rcx, rsp
call fcn.14003c6c0
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret