Function at 0x140064870
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1948
call fcn.1400ea040
sub rsp, rax
mov qword [rsp + 0xd8], 0xfffffffffffffffe
mov rax, qword [0x14012df80]
xor rax, rsp
mov qword [rsp + 0x1930], rax
mov r15, r9
mov rbp, r8
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x20], rdx
lea r9, str.lpszOemName_s__lpszAppName_s__lpAppRegInfo_x
lea r8, str.GetApplicationInfo
lea rdx, str.CRegistryIF
mov rcx, qword [rcx]
call fcn.140080c70
xor r13d, r13d
mov r12d, r13d
mov esi, 0x410
mov rdx, rsi
lea rcx, [rsp + 0x8f0]
mov r8d, r13d
lea rdi, str.SOFTWARE
lea rax, [rsp + 0x8f0]
sub rdi, rax
nop
nop
lea rax, [rdx + 0x7ffffbee]
test rax, rax
je 0x140064934
movzx eax, word [rcx + rdi]
test ax, ax
je 0x140064934
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140064910
jmp 0x140064939
test rdx, rdx
jne 0x140064943
sub rcx, 2
mov r8d, 0x8007007a
mov word [rcx], r12w
mov edi, 0x400
test r8d, r8d
jne 0x1400649c2
mov r9d, esi
mov r8, rbx
lea rdx, [rsp + 0x8f0]
mov rcx, qword [r14 + 8]
call fcn.140012f30
test eax, eax
je 0x1400649c2
mov rdx, rdi
lea rcx, [rsp + 0xf0]
lea r8, [rsp + 0x8f0]
lea rax, [rsp + 0xf0]
sub r8, rax
nop
nop
lea rax, [rdx + 0x7ffffbfe]
test rax, rax
je 0x1400649b5
movzx eax, word [rcx + r8]
test ax, ax
je 0x1400649b5
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x140064990
jmp 0x1400649ba
test rdx, rdx
jne 0x1400649be
sub rcx, 2
mov word [rcx], r12w
lea rcx, [rsp + 0x1110]
mov r8d, r13d
lea rdx, [rsp + 0xf0]
lea rax, [rsp + 0x1110]
sub rdx, rax
lea rax, [rsi + 0x7ffffbee]
test rax, rax
je 0x140064a04
movzx eax, word [rcx + rdx]
test ax, ax
je 0x140064a04
mov word [rcx], ax
add rcx, 2
sub rsi, 1
jne 0x1400649e0
jmp 0x140064a09
test rsi, rsi
jne 0x140064a13
sub rcx, 2
mov r8d, 0x8007007a
mov word [rcx], r12w
test r8d, r8d
jne 0x140064a81
mov rdx, rbp
lea rcx, [rsp + 0x1110]
call fcn.14002ae40
lea rcx, [rsp + 0xf0]
lea rdx, [rsp + 0x1110]
lea rax, [rsp + 0xf0]
sub rdx, rax
nop
nop
nop
lea rax, [rdi + 0x7ffffbfe]
test rax, rax
je 0x140064a74
movzx eax, word [rcx + rdx]
test ax, ax
je 0x140064a74
mov word [rcx], ax
add rcx, 2
sub rdi, 1
jne 0x140064a50
jmp 0x140064a79
test rdi, rdi
jne 0x140064a7d
sub rcx, 2
mov word [rcx], r12w
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0xffffffff80000002
lea r9, str.hKey_x__lpszSubKey_s__phSubKey_x
lea r8, str.OpenSubKey
lea rdx, str.CRegistryIF
mov rcx, qword [r14]
call fcn.140081070
mov edi, r13d
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rsp + 0xf0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140064b02
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x40], rax
mov edi, 1
mov dword [rsp + 0x20], edi
lea r9, [0x1400fb428]
lea r8, str.OpenSubKey
lea rdx, str.CRegistryIF
mov rcx, qword [r14]
call fcn.140081270
test edi, edi
je 0x14006562b
mov dword [rsp + 0x88], 1
lea r8, str.caption
mov rdx, qword [rsp + 0x40]
mov rcx, r14
call fcn.1400678e0
mov qword [r15 + 0x10], rax
lea r8, str.Description
mov rdx, qword [rsp + 0x40]
mov rcx, r14
call fcn.1400678e0
mov qword [r15 + 0x18], rax
lea rbp, str.Installed_Files
mov r8, rbp
mov rdx, qword [rsp + 0x40]
mov rcx, r14
call fcn.1400678e0
mov rbx, rax
test rax, rax
je 0x140064d05
call fcn.14009d5e8
mov rdx, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x140064ba9
mov ecx, 0x80004005
call fcn.1400034f0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x80], rax
mov rax, qword [r14 + 0x10]
mov r8, qword [rax + 0x108]
cmp dword [r8 - 0x10], 0
cmove r8, r13
lea r9, [0x1400fc394]
lea rdx, str._s_s
lea rcx, [rsp + 0x80]
call fcn.14000a800
call fcn.14009d5e8
mov rdx, rax
mov ecx, r13d
test rax, rax
setne cl
test ecx, ecx
jne 0x140064c0d
mov ecx, 0x80004005
call fcn.1400034f0
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x68], rax
or rsi, 0xffffffffffffffff
test rbx, 0xffffffffffff0000
jne 0x140064c4d
movzx edi, bx
mov ecx, edi
call fcn.1400a1868
test rax, rax
je 0x140064c6d
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.14000a990
jmp 0x140064c6d
xor eax, eax
mov rcx, rsi
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.140003940
nop
mov dword [rsp + 0x20], r13d
mov r9, qword [rsp + 0x80]
lea r8, [0x140104764]
lea rdx, [rsp + 0x68]
mov rcx, qword [r14 + 8]
call fcn.140010dd0
xor r9d, r9d
mov r8w, 0x2c
mov rdi, qword [rsp + 0x68]
mov rdx, rdi
mov rcx, qword [r14 + 8]
call fcn.140010520
mov qword [r15 + 0x38], rax
mov rcx, qword [r14 + 8]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
lea rdx, [rdi - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140064cdb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
add esi, 0xffffffff
test esi, esi
jg 0x140064ee7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140064ee7
mov rdi, qword [rsp + 0x40]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
lea r9, str.hKey_x__lpszSubKey_s__phSubKey_x
lea r8, str.OpenSubKey
lea rdx, str.CRegistryIF
mov rcx, qword [r14]
call fcn.140081070
mov esi, r13d
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140064d76
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x70], rax
mov esi, 1
mov dword [rsp + 0x20], esi
lea r9, [0x1400fb428]
lea r8, str.OpenSubKey
lea rdx, str.CRegistryIF
mov rcx, qword [r14]
call fcn.140081270
test esi, esi
je 0x140064ee7
lea rcx, [rsp + 0x98]
call fcn.1400aa430
nop
lea rbx, method.CPtrArray.virtual_0
mov qword [rsp + 0x98], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [rsp + 0xc0], rax
xor r9d, r9d
lea r8, [rsp + 0x98]
mov rdx, qword [rsp + 0x70]
mov rcx, r14
call fcn.140067540
mov rsi, rax
test rax, rax
je 0x140064e50
mov ecx, 0x30
call fcn.140091360
mov rdi, rax
mov qword [rsp + 0x90], rax
test rax, rax
je 0x140064e3b
mov rcx, rax
call fcn.1400aa430
nop
mov qword [rdi], rbx
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [rdi + 0x28], rax
lea rdx, [rsp + 0x98]
mov rcx, rdi
call fcn.14005cbd0
nop
jmp 0x140064e3e
mov rdi, r13
mov qword [r15 + 0x38], rdi
mov rax, qword [rsi]
mov edx, 1
mov rcx, rsi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov qword [rsp + 0x98], rbx
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
jle 0x140064ecb
mov rdi, r13
test rdi, rdi
js 0x140064ec5
cmp rdi, rcx
jge 0x140064ec5
mov rax, qword [rsp + 0xa0]
mov r8, qword [rax + rdi*8]
test r8, r8
je 0x140064ea7
xor edx, edx
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0xa8]
add rdi, 1
cmp rdi, rcx
jl 0x140064e74
or r8, 0xffffffffffffffff
xor edx, edx
lea rcx, [rsp + 0x98]
call fcn.1400aa464
jmp 0x140064ecb
call fcn.1400a0610
int3
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
nop
lea rcx, [rsp + 0x98]
call fcn.1400aa450
lea r8, str.UninstallString
mov rdx, qword [rsp + 0x40]
mov rcx, r14
call fcn.1400678e0
mov qword [r15 + 0x30], rax
mov rdx, qword [rsp + 0x40]
mov rcx, r14
call fcn.1400672f0
mov rbp, rax
test rax, rax
je 0x140064f92
mov r12d, r13d
mov rbx, r13
mov rcx, qword [rax + 0x10]
test rcx, rcx
jle 0x140064f83
cmp qword [r15 + 0x20], 0
jne 0x140064f83
test rbx, rbx
js 0x140064f43
cmp rbx, rcx
jge 0x140064f43
test rbx, rbx
js 0x140064f7d
mov rax, qword [rbp + 8]
mov rdx, qword [rax + rbx*8]
jmp 0x140064f46
mov rdx, r13
lea rdi, str.Installed_Files
mov rsi, rdx
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
repe cmpsw word [rsi], word [rdi]
je 0x140064f67
mov rcx, qword [r14 + 8]
call fcn.140013c20
mov qword [r15 + 0x20], rax
add r12d, 1
add rbx, 1
mov rcx, qword [rbp + 0x10]
movsxd rax, r12d
cmp rax, rcx
jge 0x140064f83
jmp 0x140064f23
call fcn.1400a0610
int3
mov rax, qword [rbp]
mov edx, 1
mov rcx, rbp
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [r15 + 0x20]
test rbx, rbx
je 0x140065058
mov rdi, qword [rsp + 0x40]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rdi
lea r9, str.hKey_x__lpszSubKey_s__phSubKey_x
lea r8, str.OpenSubKey
lea rdx, str.CRegistryIF
mov rcx, qword [r14]
call fcn.140081070
mov esi, r13d
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140065010
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x78], rax
mov esi, 1
mov dword [rsp + 0x20], esi
lea r9, [0x1400fb428]
lea r8, str.OpenSubKey
lea rdx, str.CRegistryIF
mov rcx, qword [r14]
call fcn.140081270
test esi, esi
je 0x140065058
lea r8, str.Path
mov rdx, qword [rsp + 0x78]
mov rcx, r14
call fcn.1400678e0
mov qword [r15 + 0x28], rax
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x40]
lea rbp, str.Installer_Version
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbx
lea r9, str.hKey_x__lpszEntry_s
lea r8, str.GetValue
lea rdx, str.CRegistryIF
mov rcx, qword [r14]
call fcn.140081070
mov rsi, r13
mov dword [rsp + 0x5c], r13d
mov dword [rsp + 0x50], r13d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x5c]
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140065134
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x140065134
cmp dword [rsp + 0x5c], 1
jne 0x1400650d5
add eax, 2
mov dword [rsp + 0x50], eax
mov r8d, eax
mov rcx, qword [r14 + 8]
test eax, eax
je 0x140065134
mov edx, 8
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x140065134
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x5c]
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140065122
mov rsi, rdi
jmp 0x140065134
mov rcx, qword [r14 + 8]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x20], rsi
lea r9, [0x1400facf8]
lea r8, str.GetValue
lea rdx, str.CRegistryIF
mov rcx, qword [r14]
call fcn.140081270
mov r12d, 0x7fffffff
test rsi, rsi
je 0x1400652dd
xor r9d, r9d
mov r8w, 0x2e
mov rdx, rsi
mov rcx, qword [r14 + 8]
call fcn.140010520
mov rbp, rax
test rax, rax
je 0x1400652dd
mov rcx, qword [r14 + 8]
mov edx, 8
lea r8d, [rdx + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [r15 + 0x40], rax
test rax, rax
je 0x1400652ce
mov ebx, r13d
mov rsi, r13
mov rcx, qword [rbp + 0x10]
test rcx, rcx
jle 0x1400652ce
nop
nop
test rsi, rsi
js 0x1400651dd
cmp rsi, rcx
jge 0x1400651dd
test rsi, rsi
js 0x1400652c8
mov rax, qword [rbp + 8]
mov rdi, qword [rax + rsi*8]
jmp 0x1400651e0
mov rdi, r13
mov rcx, r12
lea rax, [0x1400fc3a8]
nop
nop
cmp word [rax], 0
je 0x140065202
add rax, 2
sub rcx, 1
jne 0x1400651f0
jmp 0x14006520f
test rcx, rcx
je 0x14006520f
mov rax, r12
sub rax, rcx
jmp 0x140065212
mov rax, r13
movsxd r8, eax
mov rdx, rdi
lea rcx, [0x1400fc3a8]
call fcn.1400ce2c0
test eax, eax
jne 0x140065240
lea r8d, [rax + 0x10]
lea rdx, [rsp + 0xe8]
mov rcx, rdi
call fcn.1400cf260
mov edi, eax
jmp 0x14006524b
mov rcx, rdi
call fcn.1400cf2a0
mov rdi, rax
call fcn.1400cf300
cmp dword [rax], 0x22
je 0x14006525f
call fcn.1400cf300
cmp dword [rax], 0x16
jne 0x140065266
mov rdi, 0xffffffff80000000
test ebx, ebx
jne 0x14006527e
mov ecx, r13d
cmp edi, 0x80000000
cmovne ecx, edi
mov rax, qword [r15 + 0x40]
mov dword [rax], ecx
jmp 0x1400652b0
cmp ebx, 1
jne 0x140065298
mov ecx, r13d
cmp edi, 0x80000000
cmovne ecx, edi
mov rax, qword [r15 + 0x40]
mov dword [rax + 4], ecx
jmp 0x1400652b0
cmp ebx, 2
jne 0x1400652b0
mov ecx, r13d
cmp edi, 0x80000000
cmovne ecx, edi
mov rax, qword [r15 + 0x40]
mov dword [rax + 0xc], ecx
add ebx, 1
add rsi, 1
mov rcx, qword [rbp + 0x10]
movsxd rax, ebx
cmp rax, rcx
jge 0x1400652ce
jmp 0x1400651c0
call fcn.1400a0610
int3
mov rax, qword [rbp]
mov edx, 1
mov rcx, rbp
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x40]
lea rbp, str.Invisible
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbx
lea r9, str.hKey_x__lpszEntry_s
lea r8, str.GetValue
lea rdx, str.CRegistryIF
mov rcx, qword [r14]
call fcn.140081070
mov rsi, r13
mov dword [rsp + 0x54], r13d
mov dword [rsp + 0x48], r13d
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x54]
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400653b9
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x1400653b9
cmp dword [rsp + 0x54], 1
jne 0x14006535a
add eax, 2
mov dword [rsp + 0x48], eax
mov r8d, eax
mov rcx, qword [r14 + 8]
test eax, eax
je 0x1400653b9
mov edx, 8
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1400653b9
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x54]
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400653a7
mov rsi, rdi
jmp 0x1400653b9
mov rcx, qword [r14 + 8]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x20], rsi
lea r9, [0x1400facf8]
lea r8, str.GetValue
lea rdx, str.CRegistryIF
mov rcx, qword [r14]
call fcn.140081270
test rsi, rsi
je 0x140065510
mov rdi, qword [rsp + 0x40]
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
lea r9, str.hKey_x__lpszEntry_s
lea r8, str.GetValueType
lea rdx, str.CRegistryIF
mov rcx, qword [r14]
call fcn.140081070
mov dword [rsp + 0x60], r13d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x60]
xor r8d, r8d
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rsp + 0x60]
mov dword [rsp + 0x20], edx
lea r9, [0x1400fb428]
lea r8, str.GetValueType
lea rdx, str.CRegistryIF
mov rcx, qword [r14]
call fcn.140081270
cmp dword [rsp + 0x60], 1
jne 0x1400654f2
mov rcx, r12
lea rax, [0x1400fc3a8]
nop
cmp word [rax], 0
je 0x140065482
add rax, 2
sub rcx, 1
jne 0x140065470
jmp 0x14006548c
test rcx, rcx
je 0x14006548c
sub r12, rcx
jmp 0x14006548f
mov r12, r13
movsxd r8, r12d
mov rdx, rsi
lea rcx, [0x1400fc3a8]
call fcn.1400ce2c0
test eax, eax
jne 0x1400654bd
lea r8d, [rax + 0x10]
lea rdx, [rsp + 0xe0]
mov rcx, rsi
call fcn.1400cf260
mov edi, eax
jmp 0x1400654c8
mov rcx, rsi
call fcn.1400cf2a0
mov rdi, rax
call fcn.1400cf300
cmp dword [rax], 0x22
je 0x1400654dc
call fcn.1400cf300
cmp dword [rax], 0x16
jne 0x1400654e3
mov rdi, 0xffffffff80000000
mov eax, r13d
cmp rdi, 1
sete al
mov dword [r15], eax
jmp 0x1400654fe
mov eax, r13d
cmp dword [rsi], 1
sete al
mov dword [r15], eax
mov rcx, qword [r14 + 8]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rsp + 0x40]
lea rbx, str.Flags
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rsi
lea r9, str.hKey_x__lpszEntry_s
lea r8, str.GetValue
lea rdx, str.CRegistryIF
mov rcx, qword [r14]
call fcn.140081070
mov dword [rsp + 0x58], r13d
mov dword [rsp + 0x4c], r13d
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x58]
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400655e9
mov eax, dword [rsp + 0x4c]
test eax, eax
je 0x1400655e9
cmp dword [rsp + 0x58], 1
jne 0x14006558a
add eax, 2
mov dword [rsp + 0x4c], eax
mov r8d, eax
mov rcx, qword [r14 + 8]
test eax, eax
je 0x1400655e9
mov edx, 8
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x1400655e9
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x58]
xor r8d, r8d
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400655d7
mov r13, rdi
jmp 0x1400655e9
mov rcx, qword [r14 + 8]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x20], r13
lea r9, [0x1400facf8]
lea r8, str.GetValue
lea rdx, str.CRegistryIF
mov rcx, qword [r14]
call fcn.140081270
test r13, r13
je 0x140065618
mov eax, dword [r13]
mov dword [r15 + 0x48], eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12d, dword [rsp + 0x88]
mov dword [rsp + 0x20], r12d
lea r9, [0x1400fb428]
lea r8, str.GetApplicationInfo
lea rdx, str.CRegistryIF
mov rcx, qword [r14]
call fcn.140080e70
mov eax, r12d
mov rcx, qword [rsp + 0x1930]
xor rcx, rsp
call fcn.1400cd6e0
add rsp, 0x1948
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret