Function at 0x1400c75a8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x208]
sub rsp, 0x2e0
mov rax, qword [0x1402708c0]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rsi, rcx
xor edi, edi
mov ecx, dword [0x1402829b0]
mov rax, qword gs:[0x58]
mov edx, 0x14
mov rax, qword [rax + rcx*8]
add rax, rdx
or r14, 0xffffffffffffffff
lea r15, [0x1402814a8]
mov eax, dword [rax]
cmp dword [0x1402814c8], eax
jg 0x1400c7a9e
mov rcx, r15
cmp qword [0x1402814b8], rdi
jbe 0x1400c7631
mov rdx, rsi
call fcn.1400c6310
jmp 0x1400c7a68
call fcn.1400c702c
mov bl, dil
mov byte [rsp + 0x40], bl
cmp qword [0x1402814b8], rdi
je 0x1400c7a52
mov r8d, 3
lea rdx, [0x1401fedf0]
mov rcx, r15
call fcn.140054e80
mov r8d, 1
lea rdx, [0x1401feda0]
mov rcx, r15
call fcn.140054e80
mov r8d, 0xc
lea rdx, str.WebResources
mov rcx, r15
call fcn.140054e80
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rdi
mov r12, qword [0x1402814b8]
mov r13, r15
mov eax, 7
cmp qword [0x1402814c0], rax
cmova r13, qword [0x1402814a8]
movabs r15, 0x7ffffffffffffffe
cmp r12, r15
ja 0x1400c7ae7
movabs rdx, 0x7fffffffffffffff
lea ecx, [rax + 3]
mov qword [rbp - 0x48], rax
cmp r12, rax
ja 0x1400c76f6
mov qword [rbp - 0x50], r12
lea r8d, [rax + 9]
mov rdx, r13
lea rcx, [rbp - 0x60]
call fcn.1401e0580
nop
jmp 0x1400c7764
mov rbx, r12
or rbx, rax
cmp rbx, r15
jbe 0x1400c770a
mov rbx, r15
lea rcx, [rdx + rdx]
jmp 0x1400c772a
cmp rbx, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, rdx
ja 0x1400c7aed
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400c7731
call fcn.14004ea38
jmp 0x1400c7740
test rcx, rcx
je 0x1400c773d
call fcn.140172d74
jmp 0x1400c7740
mov rax, rdi
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], rbx
lea r8, [r12*2 + 2]
mov rdx, r13
mov rcx, rax
call fcn.1401e0580
nop
mov bl, byte [rsp + 0x40]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [str.SoftwareAdobeAdobe_AcrobatDCWebResource]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400c7970
mov r12d, 0x208
mov r8d, r12d
xor edx, edx
lea rcx, [rbp - 0x40]
call fcn.1401e0c20
mov dword [rsp + 0x50], r12d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
mov rdx, qword [str.tWebResourceInstallPath]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea r13, [0x1402814a8]
test eax, eax
jne 0x1400c781d
cmp dword [rsp + 0x48], 1
jne 0x1400c781d
mov bl, 1
lea r8d, [rax + 1]
lea rdx, [0x1401feda0]
mov rcx, r13
call fcn.140054e80
lea rax, [rbp - 0x40]
inc r14
cmp word [rax + r14*2], di
jne 0x1400c7804
mov r8, r14
lea rdx, [rbp - 0x40]
mov rcx, r13
call fcn.140054e80
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x1400c7977
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rdi
mov r14, qword [0x1402814b8]
mov r12, r13
mov eax, 7
cmp qword [0x1402814c0], rax
cmova r12, qword [0x1402814a8]
cmp r14, r15
ja 0x1400c7af3
mov qword [rbp - 0x68], rax
cmp r14, rax
ja 0x1400c7889
mov qword [rbp - 0x70], r14
lea r8d, [rax + 9]
mov rdx, r12
lea rcx, [rbp - 0x80]
call fcn.1401e0580
nop
jmp 0x1400c790c
mov rbx, r14
or rbx, rax
cmp rbx, r15
jbe 0x1400c78a7
mov rbx, r15
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x1400c78d6
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400c7af9
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400c78dd
call fcn.14004ea38
jmp 0x1400c78ec
test rcx, rcx
je 0x1400c78e9
call fcn.140172d74
jmp 0x1400c78ec
mov rax, rdi
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], rbx
lea r8, [r14*2 + 2]
mov rdx, r12
mov rcx, rax
call fcn.1401e0580
nop
lea rcx, [rbp - 0x80]
call fcn.1400c85b4
test al, al
je 0x1400c7977
mov rdx, rsi
mov rcx, r13
call fcn.1400c6310
mov dil, al
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x1400c7968
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400c7962
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400c7aff
call fcn.140172db0
nop
mov al, dil
jmp 0x1400c7a68
lea r13, [0x1402814a8]
lea rdx, [rbp - 0x60]
mov rcx, r13
call fcn.1400c5fec
mov rax, qword [0x1402814b8]
sub r15, rax
cmp r15, 1
jb 0x1400c7a98
mov r9, r13
cmp qword [0x1402814c0], 7
cmova r9, qword [0x1402814a8]
mov qword [rsp + 0x30], 1
lea r14, [0x1401feda0]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
mov r8, r13
mov dl, byte [rsp + 0x40]
lea rcx, [rbp - 0x80]
call fcn.140050b60
nop
lea r8, str.Resource0
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.1400c518c
mov rcx, rax
call fcn.1400c85b4
mov bl, al
lea rcx, [rbp - 0x80]
call fcn.140054cd8
mov rcx, r13
test bl, bl
je 0x1400c7a2c
mov r8d, 1
mov rdx, r14
call fcn.140054e80
mov r8d, 9
lea rdx, str.Resource0
mov rcx, r13
call fcn.140054e80
jmp 0x1400c7919
call fcn.1400c64d0
test al, al
jne 0x1400c7919
mov rax, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x1400c7a46
mov rax, qword [rsi]
mov qword [rsi + 0x10], rdi
mov byte [rax], dil
jmp 0x1400c7927
mov rax, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x1400c7a5f
mov rax, qword [rsi]
mov qword [rsi + 0x10], rdi
mov byte [rax], dil
xor al, al
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.140173230
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140054d3c
nop
lea rcx, [0x1402814c8]
call fcn.1401730a0
cmp dword [0x1402814c8], r14d
jne 0x1400c7618
xor r8d, r8d
lea rdx, [0x1401f39b0]
mov rcx, r15
call fcn.14004eb54
lea rcx, [0x1401ed030]
call fcn.140172fe0
nop
lea rcx, [0x1402814c8]
call fcn.140173034
jmp 0x1400c7618
call fcn.140054d3c
int3
call fcn.140054820
nop
call fcn.140054d3c
int3
call fcn.140054820
nop
call fcn.14017a8e4
int3