Function at 0x140023c30
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x140051580]
xor rax, rsp
mov qword [rbp + 0x160], rax
xor r13d, r13d
mov rbx, rdx
mov qword [rsp + 0x48], r13
mov rsi, rcx
mov edi, r13d
mov r15d, r13d
lea r12d, [r13 + 1]
mov dword [rsp + 0x40], r12d
test rdx, rdx
jne 0x140023c8c
mov eax, 0x80004003
jmp 0x140024036
or r14, 0xffffffffffffffff
test rsi, rsi
je 0x140023d1d
mov rax, r14
inc rax
cmp word [rcx + rax*2], r13w
jne 0x140023c9c
lea r12, [rax*2 + 1]
mov rcx, r12
call fcn.14000130c
mov r15, rax
test rax, rax
jne 0x140023cc8
mov eax, 0x8007000e
jmp 0x140024036
mov qword [rsp + 0x38], r13
mov r9d, r14d
mov qword [rsp + 0x30], r13
mov r8, rsi
mov dword [rsp + 0x28], r12d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], r15
mov edi, 0x80004005
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop dword [rax + rax]
mov esi, 0x200
test eax, eax
je 0x140023d10
mov r8, r15
mov edx, esi
mov rcx, rbx
mov edi, r13d
call fcn.1400176a4
mov rcx, r15
call fcn.1400012c0
jmp 0x140023de4
lea rax, [rsp + 0x48]
mov esi, 0x200
mov r9d, r12d
mov dword [rsp + 0x44], esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftMediaPlayerSetup
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140023dae
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, str.UDBBaseURL
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
nop dword [rax + rax]
test eax, eax
jne 0x140023d98
cmp dword [rsp + 0x40], r12d
jne 0x140023d98
mov r15d, r12d
mov byte [rbx + 0x1ff], r13b
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test r15d, r15d
jne 0x140023e01
mov rcx, qword [0x140051e60]
mov r9d, esi
mov r8, rbx
mov edx, 0x277e
call qword [sym.imp.USER32.dll_LoadStringA]
nop dword [rax + rax]
test eax, eax
jne 0x140023e01
call fcn.140015998
mov edi, eax
test eax, eax
jle 0x140023de4
movzx edi, ax
or edi, 0x80070000
test edi, edi
jns 0x140023e01
mov r8d, edi
lea rdx, str.ERROR:_Unable_to_obtain_base_URL_for_UDB_file._Result:_0x_x._r_n
mov ecx, 2
call fcn.140018ed8
jmp 0x140024034
lea r15, [0x140044d7c]
mov rcx, rbx
mov rdx, r15
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strstr]
nop dword [rax + rax]
test rax, rax
jne 0x140023e8c
lea rdx, str..asp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strstr]
nop dword [rax + rax]
test rax, rax
jne 0x140023e8c
lea rdx, str..xml
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strstr]
nop dword [rax + rax]
test rax, rax
jne 0x140023e8c
mov rcx, r14
inc rcx
cmp byte [rbx + rcx], r13b
jne 0x140023e58
lea rax, [rcx - 1]
cmp rax, 0x1fe
ja 0x140023e7a
cmp byte [rcx + rbx - 1], 0x2f
je 0x140023e7a
mov word [rcx + rbx], 0x2f
lea r8, str.control.xml
mov rdx, rsi
mov rcx, rbx
call fcn.14001870c
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strstr]
nop dword [rax + rax]
test rax, rax
jne 0x140023eb1
mov r8, r15
mov rdx, rsi
mov rcx, rbx
call fcn.14001870c
inc r14
cmp byte [rbx + r14], r13b
jne 0x140023eb1
mov r15, rsi
sub r15, r14
mov rcx, r15
call fcn.14000130c
mov r14, rax
test rax, rax
je 0x140024034
lea r8, str.LANGENU
mov rdx, rsi
mov rcx, rbx
mov r12d, r13d
call fcn.14001870c
mov eax, 0xffffffff
add r15, 0xfffffffffffffff6
cmp r15, rax
jae 0x140023fea
call fcn.14003d008
lea r8, str.SoftwareMicrosoftMediaPlayer_lu._luRegistration
mov edx, 0x208
movzx ecx, word [rax + 2]
movzx r9d, word [rax]
mov dword [rsp + 0x20], ecx
lea rcx, [rsp + 0x50]
call fcn.140010420
test eax, eax
js 0x140023fea
mov dword [rsp + 0x44], r15d
lea rax, [rsp + 0x48]
mov r15d, 1
mov qword [rsp + 0x20], rax
mov r9d, r15d
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140023fea
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], r14
lea rdx, [0x140044da0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
nop dword [rax + rax]
test eax, eax
jne 0x140023fd4
cmp dword [rsp + 0x40], r15d
jne 0x140023fd4
lea r8, str.Version
mov rdx, rsi
mov rcx, rbx
call fcn.14001870c
mov r8, r14
mov rdx, rsi
mov rcx, rbx
call fcn.14001870c
lea r8, [0x140044dbc]
mov rdx, rsi
mov rcx, rbx
call fcn.14001870c
mov r12d, r15d
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
test r12d, r12d
jne 0x14002402c
lea rcx, [rsp + 0x50]
call fcn.14001b650
test eax, eax
je 0x14002402c
lea r8, str.Version
mov rdx, rsi
mov rcx, rbx
call fcn.14001870c
lea r8, [rsp + 0x50]
mov rdx, rsi
mov rcx, rbx
call fcn.14001870c
lea r8, [0x140044dbc]
mov rdx, rsi
mov rcx, rbx
call fcn.14001870c
mov rcx, r14
call fcn.1400012c0
mov eax, edi
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.140001660
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret