Function at 0x300066cc
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
mov r11, rsp
sub rsp, 0x48
xor r12d, r12d
mov rsi, r8
mov rdi, rdx
cmp rcx, r12
mov rbp, rcx
mov qword [r11 - 0x18], r12
mov qword [r11 - 0x10], r12
mov dword [r11 + 0x50], r12d
mov dword [r11 + 0x38], r12d
je 0x3000695a
cmp word [rcx], r12w
je 0x3000695a
cmp r8, r12
je 0x3000695a
lea rax, [r11 - 0x18]
mov rdx, rcx
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [r11 - 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r14d, 0x80070000
movzx ebx, ax
or ebx, r14d
cmp eax, r12d
cmovle ebx, eax
cmp ebx, r12d
jl 0x3000686a
mov rdx, qword [str.CurVer]
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, r14d
cmp eax, r12d
cmovle ebx, eax
cmp ebx, r12d
jl 0x3000686a
mov rcx, qword [rsp + 0x38]
xor edx, edx
cmp rdi, r12
je 0x300067f5
mov eax, dword [rsi]
lea r8, [rsp + 0x98]
mov r9, rdi
add eax, eax
mov dword [rsp + 0x80], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call fcn.30003bd4
cmp eax, r12d
mov ebx, eax
jl 0x3000691b
cmp dword [rsp + 0x98], 1
je 0x300067dd
cmp dword [rsp + 0x98], 2
jne 0x30006859
cmp dword [rsp + 0x80], 2
jbe 0x30006859
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x30006919
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x98]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x98], r12d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, r14d
cmp eax, r12d
cmovle ebx, eax
mov eax, r12d
cmp ebx, r12d
cmovge eax, dword [rsp + 0x98]
cmp ebx, r12d
jl 0x3000691b
cmp eax, 1
je 0x3000684d
cmp eax, 2
jne 0x30006859
mov eax, dword [rsp + 0x80]
cmp eax, 2
ja 0x30006863
mov ebx, 0x80004005
jmp 0x3000691b
shr eax, 1
jmp 0x30006919
lea rdx, str.InfoPath.Document
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
cmp eax, r12d
jne 0x3000691b
cmp rdi, r12
je 0x30006906
mov ecx, dword [rsi]
mov ebx, r12d
cmp rcx, r12
je 0x3000689b
cmp rcx, 0x7fffffff
jbe 0x300068a0
mov ebx, 0x80070057
cmp ebx, r12d
jl 0x3000691b
cmp rcx, r12
mov ebx, r12d
je 0x300068e5
lea r8, str.InfoPath.Document.1
mov edx, 0x7ffffffe
sub rdx, rcx
sub r8, rdi
lea rax, [rdx + rcx]
cmp rax, r12
je 0x300068e0
movzx eax, word [r8 + rdi]
cmp ax, r12w
je 0x300068e0
mov word [rdi], ax
add rdi, 2
sub rcx, 1
jne 0x300068bf
cmp rcx, r12
jne 0x300068ee
sub rdi, 2
mov ebx, 0x8007007a
cmp ebx, r12d
mov word [rdi], r12w
jl 0x3000691b
lea rcx, str.InfoPath.Document.1
call qword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x30006916
lea rcx, str.InfoPath.Document.1
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov ebx, r12d
mov dword [rsi], eax
mov rcx, qword [rsp + 0x30]
cmp rcx, r12
je 0x30006948
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx ecx, ax
or ecx, r14d
cmp eax, r12d
cmovle ecx, eax
mov rax, qword [rsp + 0x30]
cmp ecx, r12d
cmovge rax, r12
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x38]
cmp rcx, r12
je 0x3000695f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x3000695f
mov ebx, 0x80070057
mov eax, ebx
add rsp, 0x48
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret