Function at 0x140006694
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov rax, qword [0x1400592a0]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
xor esi, esi
mov ebx, edx
and qword [rsp + 0x48], rsi
mov r14, rcx
test rcx, rcx
jne 0x1400066da
xor eax, eax
jmp 0x140006935
lea rax, [rsp + 0x48]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftMediaPlayerSetup
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140006933
lea rax, str.WMFDist11RollbackTo
mov dword [rsp + 0x44], 1
test ebx, ebx
lea r8, str.WMP11RollbackTo
mov edx, 0x208
lea rcx, [rbp - 0x30]
cmove r8, rax
call fcn.140010c20
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x44]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x40], 0x80
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140006922
and dword [rsp + 0x30], eax
lea edx, [rax + 0x2e]
and dword [rsp + 0x34], eax
lea rcx, [rsp + 0x50]
and dword [rsp + 0x38], eax
lea esi, [rax + 1]
and dword [rsp + 0x3c], eax
xor ebx, ebx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
je 0x140006863
inc ebx
lea rcx, [rax + 2]
mov edx, 0x2e
mov edi, ebx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x1400067ac
sub edi, esi
je 0x14000685a
sub edi, esi
je 0x140006830
cmp edi, esi
je 0x1400067fc
test ebx, ebx
je 0x140006863
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wtoi]
nop dword [rax + rax]
mov dword [rsp + 0x38], eax
jmp 0x1400068de
lea rdx, str._lu._lu._lu._lu
lea rcx, [rsp + 0x50]
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x30]
lea rax, [rsp + 0x38]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rax
call fcn.1400025b4
jmp 0x1400068de
lea rdx, str._lu._lu._lu
lea rcx, [rsp + 0x50]
lea rax, [rsp + 0x38]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
call fcn.1400025b4
jmp 0x1400068de
lea rdx, str._lu._lu
jmp 0x1400068ca
mov edi, 0x2c
lea rcx, [rsp + 0x50]
jmp 0x140006875
inc ebx
lea rcx, [rax + 2]
mov edx, edi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x14000686f
sub ebx, esi
je 0x1400068c3
lea rcx, [rsp + 0x50]
sub ebx, esi
je 0x1400068b7
cmp ebx, esi
je 0x1400068ab
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wtoi]
nop dword [rax + rax]
mov dword [rsp + 0x30], eax
jmp 0x1400068de
lea rdx, str._lu__lu__lu__lu
jmp 0x140006808
lea rdx, str._lu__lu__lu
jmp 0x14000683c
lea rdx, str._lu__lu
lea r9, [rsp + 0x34]
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.1400025b4
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
mov edx, dword [rsp + 0x3c]
shl eax, 0x10
add ecx, eax
mov eax, dword [rsp + 0x38]
mov r8d, ecx
and r8, 0xffffffffffff0000
shl eax, 0x10
add edx, eax
movzx eax, cx
or r8, rax
mov ecx, edx
shl r8, 0x10
shr rcx, 0x10
or r8, rcx
movzx ecx, dx
shl r8, 0x10
or r8, rcx
mov qword [r14], r8
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, esi
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.1400017f0
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret