Function at 0x14004e930
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xe8]
sub rsp, 0x1c0
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14035d8c0]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov r12, rcx
mov byte [rbp - 0x60], 0
lea rcx, [rbp - 0x58]
call fcn.140015830
nop
lea rax, [0x1402f8cc8]
lea r13, [0x1402f0688]
mov rdx, r13
cmp byte [rbp - 0x60], 0
cmovne rdx, rax
mov rsi, 0xffffffffffffffff
mov rax, rsi
inc rax
cmp word [rdx + rax*2], 0
jne 0x14004e9a3
mov r8d, eax
lea rcx, [rbp - 0x58]
call fcn.140002a7c
mov rbx, qword [rbp - 0x58]
mov r9, rbx
xor r8d, r8d
mov edx, 0x116ef
mov rcx, qword [r12]
call fcn.14001fdd0
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
lea r14, vtable.ATL::CAtlStringMgr.0
lea rdi, vtable.ATL::CWin32Heap.0
sub eax, 1
jg 0x14004ea27
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004f44c
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rdi
jne 0x14004f44c
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
xor eax, eax
mov qword [rbp - 0x78], rax
mov dword [rbp - 0x70], eax
mov qword [rbp - 0x68], rax
call fcn.140011f18
mov rcx, rax
test rax, rax
je 0x14004f454
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, r14
jne 0x14004f45f
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
mov r9d, 0x20019
lea r8, str.SOFTWAREMozillaMozilla_Firefox
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x78]
call fcn.14003e3a0
lea r15, str.Firefox
test eax, eax
jne 0x14004eaf0
mov dword [rsp + 0x38], 0x64
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
xor r8d, r8d
lea rdx, str.CurrentVersion
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004eaf0
mov eax, dword [rsp + 0x3c]
dec eax
cmp eax, 1
ja 0x14004eaf0
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x14004eb7a
test al, 1
jne 0x14004eaf0
shr rax, 1
cmp word [rbp + rax*2 + 0x3e], 0
je 0x14004eb82
mov rcx, qword [0x14036cdf8]
cmp dword [rcx - 0x10], 0
jl 0x14004f3b0
lea rdx, str.firefox
call fcn.14022f558
test rax, rax
je 0x14004f3b0
sub rax, qword [0x14036cdf8]
sar rax, 1
test eax, eax
js 0x14004f3b0
call fcn.140011f18
mov rcx, rax
test rax, rax
je 0x14004f466
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, r14
jne 0x14004f4fc
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
add rax, 0x18
mov qword [rsp + 0x48], rax
cmp r15, 0x10000
jae 0x14004f21c
movzx edx, r15w
lea rcx, [rsp + 0x48]
call fcn.140012700
jmp 0x14004f23c
xor ecx, ecx
mov word [rbp + 0x40], cx
jmp 0x14004eb84
xor ecx, ecx
lea rax, [rbp + 0x40]
mov rdi, rsi
nop dword [rax + rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x14004eb90
test edi, edi
jne 0x14004ec3d
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14004ecfb
cmp dword [rdx + 0x10], 0
jge 0x14004ebce
cmp dword [rbx - 0xc], 0
jl 0x14004f471
mov dword [rbx - 0x10], ecx
mov word [rbx], cx
jmp 0x14004ecfb
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004ec17
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004f47c
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, vtable.ATL::CWin32Heap.0
cmp rax, r9
jne 0x14004f47c
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rdi]
mov rdx, qword [rax + 0x18]
cmp rax, r14
jne 0x14004f484
lock inc dword [rdi + 0x20]
lea rax, [rdi + 0x10]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
jmp 0x14004ecfb
mov r15d, dword [rbx - 0x10]
lea r14, [rbp + 0x40]
sub r14, rbx
sar r14, 1
test edi, edi
js 0x14004f48c
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14004ec75
mov edx, edi
lea rcx, [rsp + 0x30]
call fcn.140002a1c
mov rbx, qword [rsp + 0x30]
cmp r14, r15
ja 0x14004ecc5
lea rdx, [rbx + r14*2]
movsxd r8, edi
add r8, r8
je 0x14004ecd8
test rdx, rdx
jne 0x14004ec9d
call fcn.140232664
mov dword [rax], 0x16
call fcn.140232514
jmp 0x14004ecd8
movsxd rax, dword [rbx - 0xc]
add rax, rax
cmp rax, r8
jae 0x14004ecbb
call fcn.140232664
mov dword [rax], 0x22
call fcn.140232514
jmp 0x14004ecd8
mov rcx, rbx
call fcn.14022fad0
jmp 0x14004ecd8
movsxd rdx, dword [rbx - 0xc]
mov r9d, edi
lea r8, [rbp + 0x40]
mov rcx, rbx
call fcn.140002c18
cmp edi, dword [rbx - 0xc]
jg 0x14004f4f1
mov dword [rbx - 0x10], edi
movsxd rax, edi
xor ecx, ecx
mov word [rbx + rax*2], cx
lea r14, vtable.ATL::CAtlStringMgr.0
lea r15, str.Firefox
cmp dword [rbx - 0x10], 0
jle 0x14004ed34
mov edx, 0x20
mov rcx, rbx
call fcn.14022fa08
test rax, rax
je 0x14004ed34
sub rax, rbx
sar rax, 1
test eax, eax
js 0x14004ed34
mov r8d, 0x64
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.140040dc0
mov rbx, qword [rsp + 0x30]
lea rax, [rsp + 0x50]
mov qword [rbp - 0x80], rax
lea rdi, [rbx - 0x18]
mov rcx, rdi
call fcn.140002c94
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x58]
call fcn.140015830
nop
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x58]
call fcn.140002b88
mov edx, 0x2c
lea rcx, [rsp + 0x58]
call fcn.14007d3d0
mov r9, qword [rsp + 0x58]
xor r8d, r8d
mov edx, 0x1161b
mov rcx, qword [r12]
call fcn.14001fdd0
nop
lea rcx, [rsp + 0x50]
call fcn.14004b190
mov byte [rbp - 0x40], 1
lea rcx, [rbp - 0x38]
call fcn.140015830
nop
lea r9, [rbp - 0x40]
xor r8d, r8d
mov edx, 0x116ef
mov rcx, r12
call fcn.1400855d0
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004ee11
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004f497
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, vtable.ATL::CWin32Heap.0
cmp rax, r9
jne 0x14004f497
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
call fcn.140011f18
mov rcx, rax
test rax, rax
je 0x14004f49f
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, r14
jne 0x14004f4aa
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
add rax, 0x18
mov qword [rsp + 0x40], rax
cmp r15, 0x10000
jae 0x14004ee5c
movzx edx, r15w
lea rcx, [rsp + 0x40]
call fcn.140012700
jmp 0x14004ee7c
mov rax, rsi
nop
inc rax
cmp word [r15 + rax*2], 0
jne 0x14004ee60
mov r8d, eax
mov rdx, r15
lea rcx, [rsp + 0x40]
call fcn.140002a7c
nop
mov rbx, qword [rsp + 0x40]
mov r9, rbx
mov r8d, dword [0x14036cb90]
mov edx, 0x116b9
mov rcx, qword [r12]
call fcn.14001fdd0
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004eee7
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004f4b1
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea r9, vtable.ATL::CWin32Heap.0
cmp rax, r9
jne 0x14004f4b1
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [rsp + 0x60]
mov qword [rbp - 0x80], rax
mov rcx, rdi
call fcn.140002c94
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x68]
call fcn.140015830
nop
mov ebx, dword [0x14036cb90]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x68]
call fcn.140002b88
mov edx, 0x2c
lea rcx, [rsp + 0x68]
call fcn.14007d3d0
mov r9, qword [rsp + 0x68]
mov r8d, ebx
mov edx, 0x116b8
mov rcx, qword [r12]
call fcn.14001fdd0
nop
lea rcx, [rsp + 0x60]
call fcn.14004b190
mov byte [rbp - 0x30], 0
lea rcx, [rbp - 0x28]
call fcn.140015830
nop
lea r9, [rbp - 0x30]
mov r8d, dword [0x14036cb90]
mov edx, 0x1177b
mov rcx, r12
call fcn.1400855d0
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004efcb
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004f4c1
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
lea rdi, vtable.ATL::CWin32Heap.0
cmp rax, rdi
jne 0x14004f4b9
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14004efd2
lea rdi, vtable.ATL::CWin32Heap.0
mov byte [rbp - 0x20], 1
lea rcx, [rbp - 0x18]
call fcn.140015830
nop
lea r9, [rbp - 0x20]
mov r8d, dword [0x14036cb90]
mov edx, 0x1177e
mov rcx, r12
call fcn.1400855d0
nop
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004f044
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004f4c9
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rdi
jne 0x14004f4c9
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp - 0x10], 0
lea rcx, [rbp - 8]
call fcn.140015830
nop
lea r9, [rbp - 0x10]
mov r8d, dword [0x14036cb90]
mov edx, 0x1177c
mov rcx, r12
call fcn.1400855d0
nop
mov rdx, qword [rbp - 8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004f0b6
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004f4d1
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rdi
jne 0x14004f4d1
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp], 0
lea rcx, [rbp + 8]
call fcn.140015830
nop
lea r9, [rbp]
mov r8d, dword [0x14036cb90]
mov edx, 0x11780
mov rcx, r12
call fcn.1400855d0
nop
mov rdx, qword [rbp + 8]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004f128
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004f4d9
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rdi
jne 0x14004f4d9
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp + 0x10], 0
lea rcx, [rbp + 0x18]
call fcn.140015830
nop
lea r9, [rbp + 0x10]
mov r8d, dword [0x14036cb90]
mov edx, 0x1177f
mov rcx, r12
call fcn.1400855d0
nop
mov rdx, qword [rbp + 0x18]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004f19a
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004f4e1
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rdi
jne 0x14004f4e1
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp + 0x20], 0
lea rcx, [rbp + 0x28]
call fcn.140015830
nop
lea r9, [rbp + 0x20]
mov r8d, dword [0x14036cb90]
mov edx, 0x1177d
mov rcx, r12
call fcn.1400855d0
nop
mov rdx, qword [rbp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004f20c
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004f4e9
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rdi
jne 0x14004f4e9
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
inc dword [0x14036cb90]
mov rbx, qword [rsp + 0x30]
jmp 0x14004eaf0
mov rax, rsi
nop
inc rax
cmp word [r15 + rax*2], 0
jne 0x14004f220
mov r8d, eax
mov rdx, r15
lea rcx, [rsp + 0x48]
call fcn.140002a7c
nop
mov rbx, qword [rsp + 0x48]
mov r9, rbx
xor r8d, r8d
mov edx, 0x11717
mov rcx, qword [r12]
call fcn.14001fdd0
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004f29c
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004f503
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rdi
jne 0x14004f503
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [rsp + 0x70]
mov qword [rbp - 0x80], rax
mov rcx, qword [rsp + 0x30]
add rcx, 0xffffffffffffffe8
call fcn.140002c94
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x78]
call fcn.140015830
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x78]
call fcn.140002b88
mov edx, 0x2c
lea rcx, [rsp + 0x78]
call fcn.14007d3d0
mov r9, qword [rsp + 0x78]
xor r8d, r8d
mov edx, 0x11724
mov rcx, qword [r12]
call fcn.14001fdd0
nop
lea rcx, [rsp + 0x70]
call fcn.14004b190
mov byte [rbp - 0x50], 1
lea rcx, [rbp - 0x48]
call fcn.140015830
nop
cmp byte [rbp - 0x50], 0
lea rax, [0x1402f8cc8]
cmovne r13, rax
mov rax, rsi
nop word [rax + rax]
inc rax
cmp word [r13 + rax*2], 0
jne 0x14004f330
mov r8d, eax
mov rdx, r13
lea rcx, [rbp - 0x48]
call fcn.140002a7c
mov rbx, qword [rbp - 0x48]
mov r9, rbx
xor r8d, r8d
mov edx, 0x1171b
mov rcx, qword [r12]
call fcn.14001fdd0
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004f3ab
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004f50b
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rdi
jne 0x14004f50b
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rbx, qword [rsp + 0x30]
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14004f3ed
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r14
jne 0x14004f447
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, rdi
jne 0x14004f447
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x14004f404
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov qword [rbp - 0x78], rax
jmp 0x14004f406
xor eax, eax
mov dword [rbp - 0x70], eax
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.14022b120
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
jmp 0x14004ecfb
call r8
jmp 0x14004f3ed
call r8
jmp 0x14004ea27
mov ecx, 0x80004005
call fcn.140002d3c
int3
call rdx
jmp 0x14004ea5d
mov ecx, 0x80004005
call fcn.140002d3c
int3
mov ecx, 0x80070057
call fcn.140002d3c
int3
call r8
jmp 0x14004ec17
mov rcx, rdi
call rdx
nop
jmp 0x14004f439
mov ecx, 0x80070057
call fcn.140002d3c
nop
call r8
jmp 0x14004ee11
mov ecx, 0x80004005
call fcn.140002d3c
int3
call rdx
jmp 0x14004ee3a
call r8
jmp 0x14004eee7
call r8
jmp 0x14004efd2
call r8
jmp 0x14004efcb
call r8
jmp 0x14004f044
call r8
jmp 0x14004f0b6
call r8
jmp 0x14004f128
call r8
jmp 0x14004f19a
call r8
jmp 0x14004f20c
mov ecx, 0x80070057
call fcn.140002d3c
int3
call rdx
jmp 0x14004eb51
call r8
jmp 0x14004f29c
call r8
jmp 0x14004f3ab