Function at 0x1400817b0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2a8
movaps xmmword [rsp + 0x290], xmm7
movaps xmmword [rsp + 0x280], xmm6
mov rsi, rcx
mov rax, qword [0x14030d038]
xor rax, rsp
mov qword [rsp + 0x278], rax
xorps xmm7, xmm7
movaps xmmword [rsp + 0x1b0], xmm7
mov qword [rsp + 0x1c0], 0
movabs r13, 0xaaaaaaaaaaaaaaaa
lea rdi, [rsp + 0x1f0]
mov qword [rdi + 0x10], r13
movaps xmm6, xmmword [0x1402ae190]
movaps xmmword [rdi], xmm6
lea r8, str.SYSTEMCurrentControlSetControlSession_Manager
mov rcx, rdi
mov rdx, 0xffffffff80000002
mov r9d, 1
call fcn.140185540
mov rdi, qword [rdi]
test rdi, rdi
je 0x140081908
lea rbp, [rsp + 0x190]
mov dword [rbp], 0
lea rbx, [rsp + 0x1d0]
movaps xmmword [rbx], xmm7
mov qword [rbx + 0x10], 0
mov edx, 1
mov rcx, rbx
call fcn.140017960
lea r9, [rsp + 0x268]
mov dword [r9], 0xaaaaaaaa
mov rax, qword [rbx]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
lea rdx, str.PendingFileRenameOperations
mov rcx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
je 0x14008190f
cmp eax, 0xea
jne 0x140081950
mov ebx, 0x8000ffff
cmp dword [rsp + 0x268], 7
jne 0x14008195e
mov edx, dword [rsp + 0x190]
test dl, 1
jne 0x14008195e
mov rax, qword [rsp + 0x1d0]
mov rcx, qword [rsp + 0x1d8]
sub rcx, rax
cmp rcx, rdx
jae 0x140081916
sub rdx, rcx
lea rbx, [rsp + 0x1d0]
mov rcx, rbx
call fcn.140017960
mov rax, qword [rbx]
jmp 0x140081923
mov ebx, 0x80070002
jmp 0x140081978
mov ebx, 0x80070002
jmp 0x14008195e
jbe 0x140081923
add rdx, rax
mov qword [rsp + 0x1d8], rdx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
lea rdx, str.PendingFileRenameOperations
lea r9, [rsp + 0x268]
mov rcx, rdi
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140081fbf
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, qword [rsp + 0x1d0]
test rcx, rcx
je 0x140081978
mov qword [rsp + 0x1d8], rcx
call fcn.140112038
lea rcx, [rsp + 0x1f0]
call fcn.1400e6d80
mov bpl, 1
cmp ebx, 0x80070002
je 0x14008235d
test ebx, ebx
js 0x140081e56
lea rcx, [rsp + 0x1f0]
mov qword [rcx + 0x10], r13
movaps xmmword [rcx], xmm6
mov rdx, rsi
call fcn.1400816e4
xorps xmm7, xmm7
movaps xmmword [rsp + 0x1d0], xmm7
mov qword [rsp + 0x1e0], 0
mov rax, qword [rsp + 0x1b0]
xor ecx, ecx
cmp rax, qword [rsp + 0x1b8]
je 0x140081e5d
lea r15, [rsp + 0x190]
lea rdi, [rsp + 0x40]
mov rbx, rax
xor r12d, r12d
xor eax, eax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
xor esi, esi
mov qword [rsp + 0x1a0], r13
movaps xmmword [rsp + 0x190], xmm6
movzx eax, byte [rbx + 0x17]
test al, al
mov rcx, qword [rbx]
cmovns rcx, rbx
mov qword [rsp + 0x180], rcx
cmovs rax, qword [rbx + 8]
mov qword [rsp + 0x188], rax
mov rcx, r15
lea rdx, [rsp + 0x180]
call fcn.1400e4ea0
mov qword [rsp + 0x50], r13
movaps xmmword [rsp + 0x40], xmm6
cmp byte [rsp + 0x1a7], 0
js 0x140081a77
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x50], rax
movaps xmm0, xmmword [rsp + 0x190]
movaps xmmword [rsp + 0x40], xmm0
jmp 0x140081a8f
mov rdx, qword [rsp + 0x190]
mov r8, qword [rsp + 0x198]
mov rcx, rdi
call fcn.1400e6dd4
lea rax, [0x1402c3180]
mov qword [rsp + 0x268], rax
mov qword [rsp + 0x270], 4
movzx eax, byte [rsp + 0x57]
test al, al
mov rcx, qword [rsp + 0x40]
cmovns rcx, rdi
mov qword [rsp + 0x258], rcx
cmovs rax, qword [rsp + 0x48]
mov qword [rsp + 0x260], rax
lea rcx, [rsp + 0x258]
lea rdx, [rsp + 0x268]
xor r8d, r8d
call fcn.1400edbf0
test al, al
je 0x140081b3e
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r8d, 4
lea rcx, [rsp + 0x240]
mov rdx, rdi
mov r9, 0xffffffffffffffff
call fcn.1400d1d6e
cmp byte [rsp + 0x57], 0
jns 0x140081b24
mov rcx, qword [rsp + 0x40]
call fcn.140112038
mov rax, qword [rsp + 0x250]
mov qword [rsp + 0x50], rax
movups xmm0, xmmword [rsp + 0x240]
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x250], r13
movaps xmmword [rsp + 0x240], xmm6
movzx eax, byte [rsp + 0x57]
test al, al
mov rcx, qword [rsp + 0x40]
mov r14, rdi
cmovns rcx, rdi
mov qword [rsp + 0x210], rcx
cmovs rax, qword [rsp + 0x48]
mov qword [rsp + 0x218], rax
lea rbp, [rsp + 0x220]
mov rcx, rbp
lea rdx, [rsp + 0x210]
call fcn.1400e4ea0
lea rdi, [rsp + 0x240]
mov rcx, rdi
mov rdx, rbp
call fcn.1400816e4
mov rcx, rbp
call fcn.1400e1350
movzx eax, byte [rsp + 0x257]
mov rdx, rax
test al, al
jns 0x140081bc1
mov rdx, qword [rsp + 0x248]
movzx ecx, byte [rsp + 0x207]
mov rbp, rcx
test cl, cl
jns 0x140081bd8
mov rbp, qword [rsp + 0x1f8]
cmp rdx, rbp
jae 0x140081be1
xor ebp, ebp
jmp 0x140081c3f
mov rdx, rbp
shr rdx, 0x20
cmp rdx, 1
mov r9d, 0
sbb r9d, r9d
lea rdx, [rsp + 0x1f0]
test cl, cl
jns 0x140081c09
mov rdx, qword [rsp + 0x1f0]
not r9d
or r9d, ebp
mov r8, rdi
test al, al
jns 0x140081c1e
mov r8, qword [rsp + 0x240]
mov qword [rsp + 0x20], rdx
mov dword [rsp + 0x28], r9d
mov ecx, 0x400
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
sete bpl
mov rcx, rdi
call fcn.1400e1350
cmp byte [rsp + 0x57], 0
jns 0x140081c58
mov rcx, qword [rsp + 0x40]
call fcn.140112038
test bpl, bpl
je 0x140081c7f
mov rcx, r15
call fcn.1400e1350
add rbx, 0x30
cmp rbx, qword [rsp + 0x1b8]
mov rdi, r14
jne 0x140081a05
jmp 0x140081e3c
mov rcx, qword [rsp + 0x38]
cmp rcx, rsi
jne 0x140081cdf
mov rdi, rsi
sub rdi, qword [rsp + 0x30]
sar rdi, 4
movabs rax, 0xaaaaaaaaaaaaaaab
imul rdi, rax
lea rax, [rdi + 1]
movabs rcx, 0x555555555555555
cmp rax, rcx
ja 0x1400823f0
lea r13, [rdi + rdi]
cmp r13, rax
cmovb r13, rax
movabs rax, 0x2aaaaaaaaaaaaaa
cmp rdi, rax
cmovae r13, rcx
test r13, r13
jne 0x140081d03
xor eax, eax
jmp 0x140081d1c
mov rdx, rbx
mov rbp, rcx
call fcn.1401d5996
add rbp, 0x30
mov rax, rbp
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x1d8], rbp
jmp 0x140081c5d
cmp r13, rcx
ja 0x1400823fd
mov rax, r13
shl rax, 4
lea rcx, [rax + rax*2]
call fcn.140112048
lea rbp, [rdi + rdi*2]
shl rbp, 4
lea r12, [rax + rbp]
lea rdi, [r13*2]
add rdi, r13
shl rdi, 4
add rdi, rax
mov rcx, r12
mov rdx, rbx
mov r13, rax
call fcn.1401d5996
add rbp, r13
add rbp, 0x30
mov rdx, qword [rsp + 0x30]
cmp rsi, rdx
mov qword [rsp + 0x38], rbp
je 0x140081e00
mov r8, rdi
movabs r13, 0xaaaaaaaaaaaaaaaa
xor ecx, ecx
mov rax, qword [rsi - 0x20]
mov qword [r12 - 0x20], rax
movups xmm0, xmmword [rsi - 0x30]
movups xmmword [r12 - 0x30], xmm0
movups xmmword [rsi - 0x30], xmm7
mov qword [rsi - 0x20], rcx
mov rax, qword [rsi - 8]
mov qword [r12 - 8], rax
movups xmm0, xmmword [rsi - 0x18]
movups xmmword [r12 - 0x18], xmm0
movups xmmword [rsi - 0x18], xmm7
mov qword [rsi - 8], rcx
lea rax, [rsi - 0x30]
add r12, 0xffffffffffffffd0
mov rsi, rax
cmp rdx, rax
jne 0x140081d71
mov rdx, qword [rsp + 0x1d0]
mov rsi, qword [rsp + 0x1d8]
mov qword [rsp + 0x1d0], r12
mov qword [rsp + 0x1d8], rbp
mov rdi, r8
mov qword [rsp + 0x1e0], r8
cmp rsi, rdx
je 0x140081e22
add rsi, 0xffffffffffffffd0
mov rcx, rsi
mov rbp, rdx
call fcn.1401d5900
mov rdx, rbp
cmp rbp, rsi
jne 0x140081de7
jmp 0x140081e22
mov qword [rsp + 0x1d0], r12
mov qword [rsp + 0x1d8], rbp
mov qword [rsp + 0x1e0], rdi
movabs r13, 0xaaaaaaaaaaaaaaaa
test rdx, rdx
je 0x140081e2f
mov rcx, rdx
call fcn.140112038
mov qword [rsp + 0x30], r12
mov rsi, rdi
jmp 0x140081c5d
mov rax, qword [rsp + 0x1b0]
mov r14, qword [rsp + 0x30]
mov rcx, r14
mov rsi, qword [rsp + 0x38]
mov rdx, rsi
jmp 0x140081e6a
xor ebp, ebp
jmp 0x14008235d
xor r12d, r12d
xor esi, esi
xor r14d, r14d
xor edx, edx
mov rbx, rax
sub rbx, rax
sub rdx, r14
mov bpl, 1
cmp rdx, rbx
je 0x14008231d
mov rbx, rsi
lea rsi, [rsp + 0x240]
mov qword [rsi + 0x10], r13
movaps xmmword [rsi], xmm6
lea r8, str.SYSTEMCurrentControlSetControlSession_Manager
mov rcx, rsi
mov rdx, 0xffffffff80000002
mov r9d, 6
call fcn.140185540
cmp qword [rsi], 0
je 0x140081eed
mov rax, rbx
sub rax, r14
sar rax, 4
movabs rcx, 0xaaaaaaaaaaaaaaab
imul rcx, rax
cmp rcx, 1
ja 0x140081f41
lea rdx, str.PendingFileRenameOperations
lea rcx, [rsp + 0x240]
call fcn.1401d0200
test eax, eax
sete bpl
jmp 0x14008230d
mov ecx, 2
call fcn.1400f34e0
test al, al
je 0x140081f3a
lea rdx, str..._.._chrome_installer_util_delete_after_reboot_helper.cc
lea rsi, [rsp + 0x40]
mov rcx, rsi
mov r8d, 0x18e
mov r9d, 2
call fcn.14019a740
lea rcx, [rsp + 0x50]
lea rdx, str.Failed_to_open_session_manager_key_for_writing.
mov r8d, 0x2f
call fcn.1400ff874
mov rcx, rsi
call fcn.140001d00
xor ebp, ebp
jmp 0x14008230d
mov rsi, rbx
mov rbx, r14
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
cmp r14, rsi
je 0x140082222
xor eax, eax
mov rcx, rbx
movzx edx, byte [rcx + 0x17]
test dl, dl
jns 0x140081f72
mov rdx, qword [rcx + 8]
movzx ebp, byte [rcx + 0x2f]
test bpl, bpl
jns 0x140081f7f
mov rbp, qword [rcx + 0x20]
add rax, rdx
add rax, rbp
add rax, 2
add rcx, 0x30
cmp rsi, rcx
jne 0x140081f66
lea rbp, [rax + 1]
lea rdx, [rax + rax]
add rdx, 2
test rdx, rdx
je 0x140082229
lea rsi, [rsp + 0x40]
mov rcx, rsi
call fcn.140017960
mov rbx, r14
mov rdi, qword [rsi]
jmp 0x14008222b
mov rdi, qword [rsp + 0x1d0]
mov r15, qword [rsp + 0x1d8]
sub r15, rdi
mov rax, r15
shr rax, 1
cmp eax, 2
jb 0x1400823d8
lea ecx, [rax - 1]
mov ebx, 0x80070057
cmp word [rdi + rcx*2], 0
jne 0x14008195e
mov ecx, 0xfffffffe
add eax, ecx
cmp word [rdi + rax*2], 0
jne 0x14008195e
movabs rax, 0x1fffffffe
and r15, rax
add r15, rdi
cmp r15, rdi
jbe 0x1400823d8
movabs r13, 0x7fffffffffffffef
lea r14, [rsp + 0x240]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x250], rax
movaps xmmword [rsp + 0x240], xmm6
mov rcx, rdi
call fcn.1401124ec
cmp rax, r13
ja 0x140082402
mov rbp, rax
cmp rax, 0xb
jae 0x140082077
mov byte [rsp + 0x257], bpl
mov rbx, r14
test rbp, rbp
jne 0x1400820aa
jmp 0x1400820bb
lea r12, [rbp + 8]
and r12, 0xfffffffffffffff8
lea rcx, [r12 + r12]
call fcn.140112048
mov rbx, rax
mov qword [rsp + 0x240], rax
lea rax, [r13 + 0x11]
or rax, r12
mov qword [rsp + 0x250], rax
mov qword [rsp + 0x248], rbp
mov r8, rbp
add r8, rbp
mov rcx, rbx
mov rdx, rdi
call fcn.1401178b0
mov word [rbx + rbp*2], 0
movzx eax, byte [rsp + 0x257]
mov rcx, rax
test al, al
jns 0x1400820d8
mov rcx, qword [rsp + 0x248]
lea rdi, [rdi + rcx*2]
add rdi, 2
cmp rdi, r15
jb 0x140082104
test al, al
jns 0x1400820f6
mov rcx, qword [rsp + 0x240]
call fcn.140112038
cmp rdi, r15
jb 0x140082031
jmp 0x1400823df
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rsp + 0x230], rax
movaps xmmword [rsp + 0x220], xmm6
mov rcx, rdi
call fcn.1401124ec
cmp rax, r13
ja 0x14008240f
mov rbp, rax
cmp rax, 0xb
jae 0x14008214f
mov byte [rsp + 0x237], bpl
lea rbx, [rsp + 0x220]
test rbp, rbp
jne 0x140082182
jmp 0x140082193
lea r12, [rbp + 8]
and r12, 0xfffffffffffffff8
lea rcx, [r12 + r12]
call fcn.140112048
mov rbx, rax
mov qword [rsp + 0x220], rax
lea rax, [r13 + 0x11]
or rax, r12
mov qword [rsp + 0x230], rax
mov qword [rsp + 0x228], rbp
mov r8, rbp
add r8, rbp
mov rcx, rbx
mov rdx, rdi
call fcn.1401178b0
mov word [rbx + rbp*2], 0
movzx ebx, byte [rsp + 0x237]
test bl, bl
jns 0x1400821ad
mov rbx, qword [rsp + 0x228]
lea rbp, [rsp + 0x40]
mov rcx, rbp
mov rdx, r14
lea r8, [rsp + 0x220]
call fcn.1401d5932
lea rcx, [rsp + 0x1b0]
mov rdx, rbp
call fcn.1401d5718
cmp byte [rsp + 0x6f], 0
jns 0x1400821e6
mov rcx, qword [rsp + 0x58]
call fcn.140112038
cmp byte [rsp + 0x57], 0
jns 0x1400821f7
mov rcx, qword [rsp + 0x40]
call fcn.140112038
cmp byte [rsp + 0x237], 0
jns 0x14008220e
mov rcx, qword [rsp + 0x220]
call fcn.140112038
lea rdi, [rdi + rbx*2]
add rdi, 2
mov al, byte [rsp + 0x257]
jmp 0x1400820e5
xor ebp, ebp
jmp 0x140082302
xor edi, edi
test rbp, rbp
jle 0x1400822ae
lea r14, [rdi + rbp*2]
add rbx, 0x18
movzx esi, byte [rbx - 1]
test sil, sil
js 0x140082247
lea rdx, [rbx - 0x18]
jmp 0x14008224f
mov rdx, qword [rbx - 0x18]
mov rsi, qword [rbx - 0x10]
lea r8, [rsi + rsi]
add r8, 2
mov rcx, rdi
call fcn.1401178b0
movzx ebp, byte [rbx + 0x17]
test bpl, bpl
js 0x14008226d
mov rdx, rbx
jmp 0x140082274
mov rdx, qword [rbx]
mov rbp, qword [rbx + 8]
lea rsi, [rdi + rsi*2]
add rsi, 2
lea r8, [rbp + 2]
add r8, rbp
mov rcx, rsi
call fcn.1401178b0
lea rdi, [rsi + rbp*2]
add rdi, 2
lea rax, [rbx + 0x18]
cmp rax, qword [rsp + 0x1d8]
je 0x1400822ae
add rbx, 0x30
cmp rdi, r14
jb 0x140082238
mov word [rdi], 0
mov r8, qword [rsp + 0x40]
mov r9, qword [rsp + 0x48]
cmp r8, r9
je 0x1400822ee
sub r9d, r8d
mov dword [rsp + 0x20], 7
lea rdx, str.PendingFileRenameOperations
lea rcx, [rsp + 0x240]
call fcn.14016ada0
test eax, eax
sete bpl
mov r9, qword [rsp + 0x40]
jmp 0x1400822f0
xor ebp, ebp
test r9, r9
je 0x140082302
mov qword [rsp + 0x48], r9
mov rcx, r9
call fcn.140112038
mov r12, qword [rsp + 0x1d0]
mov r14, r12
lea rcx, [rsp + 0x240]
call fcn.1400e6d80
mov rcx, r14
test r14, r14
je 0x140082350
mov rsi, qword [rsp + 0x1d8]
cmp rsi, r14
je 0x140082343
add rsi, 0xffffffffffffffd0
mov rcx, rsi
call fcn.1401d5900
cmp r14, rsi
jne 0x14008232f
mov rcx, r12
mov qword [rsp + 0x1d8], r14
call fcn.140112038
lea rcx, [rsp + 0x1f0]
call fcn.1400e1350
mov rdi, qword [rsp + 0x1b0]
test rdi, rdi
je 0x1400823a2
mov rsi, qword [rsp + 0x1b8]
cmp rsi, rdi
je 0x140082392
add rsi, 0xffffffffffffffd0
mov rcx, rsi
call fcn.1401d5900
cmp rdi, rsi
jne 0x140082377
mov rcx, qword [rsp + 0x1b0]
jmp 0x140082395
mov rcx, rdi
mov qword [rsp + 0x1b8], rdi
call fcn.140112038
mov rcx, qword [rsp + 0x278]
xor rcx, rsp
call fcn.140115e50
mov eax, ebp
movaps xmm6, xmmword [rsp + 0x280]
movaps xmm7, xmmword [rsp + 0x290]
add rsp, 0x2a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor ebx, ebx
jmp 0x14008195e
xor ebx, ebx
movabs r13, 0xaaaaaaaaaaaaaaaa
jmp 0x14008195e
lea rcx, [rsp + 0x1d0]
call fcn.140196430
call fcn.140112370
lea rcx, [rsp + 0x240]
call fcn.1401573b4
lea rcx, [rsp + 0x220]
call fcn.1401573b4
int3