Function at 0x14003640c
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0xd0
mov rax, qword [0x14008d310]
xor rax, rsp
mov qword [rbp - 1], rax
mov r14, r9
mov rsi, r8
mov r13, rdx
mov rax, qword [rbp + 0x6f]
mov qword [rsp + 0x38], rax
mov r15, qword [rbp + 0x77]
mov r12, qword [rbp + 0x7f]
xor eax, eax
mov qword [rbp - 0x79], rax
mov ebx, eax
mov qword [rsp + 0x40], rax
lea r8, [rbp - 0x79]
mov rdx, rsi
mov rcx, qword [rcx]
call fcn.1400045d8
xor eax, eax
cmp qword [rbp - 0x79], rax
je 0x1400366ee
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp - 0x79]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
xor edx, edx
test eax, eax
jne 0x1400364b1
mov rbx, qword [rsp + 0x30]
mov qword [rsp + 0x40], rbx
jmp 0x1400364c6
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
test eax, eax
js 0x1400366ee
mov qword [rsp + 0x20], rdx
mov r9, r14
lea rdx, [0x140075008]
mov rcx, rbx
call fcn.140036250
test eax, eax
jne 0x1400364e9
lea esi, [rax + 3]
jmp 0x1400366f3
mov r8d, 0x32
lea rdx, [rbp - 0x71]
mov rcx, rsi
call qword [sym.imp.ole32.dll_StringFromGUID2]
lea rdx, [rbp - 0x71]
or rsi, 0xffffffffffffffff
mov rax, rsi
xor ecx, ecx
inc rax
cmp word [rdx + rax*2], cx
jne 0x140036509
mov r8d, eax
lea rdx, [rbp - 0x71]
mov rcx, r14
call fcn.1400046e0
xor ecx, ecx
test eax, eax
js 0x140036735
lea rdx, [0x140064ca0]
mov rax, rsi
inc rax
cmp word [rdx + rax*2], cx
jne 0x140036535
mov r8d, eax
mov rcx, r14
call fcn.1400046e0
xor ecx, ecx
test eax, eax
js 0x14003673d
mov qword [rsp + 0x20], rcx
mov r9, r14
lea rdx, [0x140075020]
mov rcx, rbx
call fcn.140036250
xor ecx, ecx
test eax, eax
jne 0x140036578
lea esi, [rcx + 4]
jmp 0x1400366f3
mov qword [rsp + 0x20], rcx
mov r9, r14
lea rdx, [0x140075038]
mov rcx, rbx
call fcn.140036250
xor ecx, ecx
test eax, eax
jne 0x14003659d
lea esi, [rcx + 5]
jmp 0x1400366f3
lea rdx, str.n_a_
inc rsi
cmp word [rdx + rsi*2], cx
jne 0x1400365a4
mov r8d, esi
mov rcx, r14
call fcn.1400046e0
test eax, eax
js 0x14003672d
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9, r14
lea rdx, str.MinEdition
mov rcx, rbx
call fcn.140036250
xor r14d, r14d
test eax, eax
jne 0x1400365eb
lea esi, [rax + 6]
jmp 0x1400366f3
test r15, r15
je 0x1400366c0
mov rdx, qword [r13]
mov esi, 4
test rdx, rdx
je 0x14003665c
test rbx, rbx
je 0x1400366b9
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
test eax, eax
jne 0x14003664b
cmp dword [rsp + 0x38], esi
jne 0x140036646
cmp dword [rsp + 0x30], esi
je 0x14003664b
mov dword [r15], r14d
jmp 0x14003665c
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
test eax, eax
jns 0x1400366c0
test rbx, rbx
je 0x1400366b9
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x38], esi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, [0x140075080]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
test eax, eax
jne 0x1400366a8
cmp dword [rsp + 0x30], esi
jne 0x1400366a3
cmp dword [rsp + 0x38], esi
je 0x1400366a8
mov dword [r15], r14d
jmp 0x1400366b9
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
test eax, eax
jns 0x1400366c0
mov esi, 7
jmp 0x1400366f3
test r12, r12
je 0x1400366e9
mov r8, r12
lea rdx, str.InprocServer32
lea rcx, [rsp + 0x40]
call fcn.14000d620
mov rbx, qword [rsp + 0x40]
test eax, eax
jns 0x1400366e9
mov esi, 8
jmp 0x1400366f3
mov esi, r14d
jmp 0x1400366f3
mov esi, 2
test rbx, rbx
je 0x140036702
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, esi
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.140001020
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbx
pop rbp
ret
mov ecx, eax
call fcn.1400312f0
int3
mov ecx, eax
call fcn.1400312f0
int3
mov ecx, eax
call fcn.1400312f0
int3