Function at 0x14004de20
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xe8]
sub rsp, 0x1c0
mov qword [rbp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14035d8c0]
xor rax, rsp
mov qword [rbp + 0xb0], rax
mov rsi, rcx
mov byte [rbp - 0x60], 0
lea rcx, [rbp - 0x58]
call fcn.140015830
nop
lea rax, [0x1402f8cc8]
lea r14, [0x1402f0688]
mov rdx, r14
cmp byte [rbp - 0x60], 0
cmovne rdx, rax
mov rdi, 0xffffffffffffffff
mov rax, rdi
inc rax
cmp word [rdx + rax*2], 0
jne 0x14004de93
mov r8d, eax
lea rcx, [rbp - 0x58]
call fcn.140002a7c
mov rbx, qword [rbp - 0x58]
mov r9, rbx
xor r8d, r8d
mov edx, 0x116f0
mov rcx, qword [rsi]
call fcn.14001fdd0
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
lea r12, vtable.ATL::CAtlStringMgr.0
lea r13, vtable.ATL::CWin32Heap.0
sub eax, 1
jg 0x14004df16
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x14004e879
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14004e879
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
xor eax, eax
mov qword [rbp - 0x80], rax
mov dword [rbp - 0x78], eax
mov qword [rbp - 0x70], rax
mov r9d, 0x20019
lea r8, str.SOFTWAREMicrosoftInternet_Explorer
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x80]
call fcn.14003e3a0
lea r15, str.Internet_Explorer
mov rbx, qword [rbp - 0x80]
test eax, eax
jne 0x14004e5a2
mov dword [rsp + 0x30], 0x64
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
lea rdx, str.svcVersion
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004dfac
mov eax, dword [rsp + 0x68]
dec eax
cmp eax, 1
ja 0x14004dfac
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x14004e016
test al, 1
jne 0x14004dfac
shr rax, 1
cmp word [rbp + rax*2 + 0x3e], 0
je 0x14004e01c
mov dword [rsp + 0x34], 0x64
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x6c]
xor r8d, r8d
lea rdx, str.Version
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14004e5a2
mov eax, dword [rsp + 0x6c]
dec eax
cmp eax, 1
ja 0x14004e5a2
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x14004e016
test al, 1
jne 0x14004e5a2
shr rax, 1
cmp word [rbp + rax*2 + 0x3e], 0
je 0x14004e01c
jmp 0x14004e5a2
xor eax, eax
mov word [rbp + 0x40], ax
lea rax, [rsp + 0x38]
mov qword [rbp - 0x68], rax
call fcn.140011f18
mov rcx, rax
test rax, rax
je 0x14004e881
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, r12
jne 0x14004e88c
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x40]
cmp rax, 0x10000
jae 0x14004e076
lea rax, [rbp + 0x40]
movzx edx, ax
lea rcx, [rsp + 0x38]
call fcn.140012700
jmp 0x14004e09c
lea rcx, [rbp + 0x40]
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14004e080
mov r8d, eax
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x38]
call fcn.140002a7c
nop
lea rcx, [rsp + 0x40]
call fcn.140015830
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x40]
call fcn.140002b88
mov edx, 0x2c
lea rcx, [rsp + 0x40]
call fcn.14007d3d0
mov r9, qword [rsp + 0x40]
xor r8d, r8d
mov edx, 0x1160c
mov rcx, qword [rsi]
call fcn.14001fdd0
nop
lea rcx, [rsp + 0x38]
call fcn.14004b190
mov byte [rbp - 0x40], 1
lea rcx, [rbp - 0x38]
call fcn.140015830
nop
lea r9, [rbp - 0x40]
xor r8d, r8d
mov edx, 0x116f0
mov rcx, rsi
call fcn.1400855d0
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004e153
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x14004e893
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14004e893
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
call fcn.140011f18
mov rcx, rax
test rax, rax
je 0x14004e89b
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, r12
jne 0x14004e8a6
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
add rax, 0x18
mov qword [rsp + 0x70], rax
cmp r15, 0x10000
jae 0x14004e19e
movzx edx, r15w
lea rcx, [rsp + 0x70]
call fcn.140012700
jmp 0x14004e1bd
mov rax, rdi
inc rax
cmp word [r15 + rax*2], 0
jne 0x14004e1a1
mov r8d, eax
mov rdx, r15
lea rcx, [rsp + 0x70]
call fcn.140002a7c
nop
mov rbx, qword [rsp + 0x70]
mov r9, rbx
mov r8d, dword [0x14036cb90]
mov edx, 0x116b9
mov rcx, qword [rsi]
call fcn.14001fdd0
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004e220
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x14004e8ad
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14004e8ad
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [rsp + 0x48]
mov qword [rbp - 0x68], rax
call fcn.140011f18
mov rcx, rax
test rax, rax
je 0x14004e8b5
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, r12
jne 0x14004e8c0
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
add rax, 0x18
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x40]
cmp rax, 0x10000
jae 0x14004e27a
lea rax, [rbp + 0x40]
movzx edx, ax
lea rcx, [rsp + 0x48]
call fcn.140012700
jmp 0x14004e29d
lea rcx, [rbp + 0x40]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x14004e281
mov r8d, eax
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.140002a7c
nop
lea rcx, [rsp + 0x50]
call fcn.140015830
nop
mov ebx, dword [0x14036cb90]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x50]
call fcn.140002b88
mov edx, 0x2c
lea rcx, [rsp + 0x50]
call fcn.14007d3d0
mov r9, qword [rsp + 0x50]
mov r8d, ebx
mov edx, 0x116b8
mov rcx, qword [rsi]
call fcn.14001fdd0
nop
lea rcx, [rsp + 0x48]
call fcn.14004b190
mov byte [rbp - 0x30], 1
lea rcx, [rbp - 0x28]
call fcn.140015830
nop
lea r9, [rbp - 0x30]
mov r8d, dword [0x14036cb90]
mov edx, 0x1177b
mov rcx, rsi
call fcn.1400855d0
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004e35e
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x14004e8c7
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14004e8c7
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp - 0x20], 0
lea rcx, [rbp - 0x18]
call fcn.140015830
nop
lea r9, [rbp - 0x20]
mov r8d, dword [0x14036cb90]
mov edx, 0x1177e
mov rcx, rsi
call fcn.1400855d0
nop
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004e3d0
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x14004e8cf
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14004e8cf
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp - 0x10], 0
lea rcx, [rbp - 8]
call fcn.140015830
nop
lea r9, [rbp - 0x10]
mov r8d, dword [0x14036cb90]
mov edx, 0x1177c
mov rcx, rsi
call fcn.1400855d0
nop
mov rdx, qword [rbp - 8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004e442
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x14004e8d7
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14004e8d7
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp], 0
lea rcx, [rbp + 8]
call fcn.140015830
nop
lea r9, [rbp]
mov r8d, dword [0x14036cb90]
mov edx, 0x11780
mov rcx, rsi
call fcn.1400855d0
nop
mov rdx, qword [rbp + 8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004e4b4
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x14004e8df
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14004e8df
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp + 0x10], 0
lea rcx, [rbp + 0x18]
call fcn.140015830
nop
lea r9, [rbp + 0x10]
mov r8d, dword [0x14036cb90]
mov edx, 0x1177f
mov rcx, rsi
call fcn.1400855d0
nop
mov rdx, qword [rbp + 0x18]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004e526
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x14004e8e7
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14004e8e7
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov byte [rbp + 0x20], 0
lea rcx, [rbp + 0x28]
call fcn.140015830
nop
lea r9, [rbp + 0x20]
mov r8d, dword [0x14036cb90]
mov edx, 0x1177d
mov rcx, rsi
call fcn.1400855d0
nop
mov rdx, qword [rbp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004e598
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x14004e8ef
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14004e8ef
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
inc dword [0x14036cb90]
mov rbx, qword [rbp - 0x80]
mov rcx, qword [0x14036cdf8]
cmp dword [rcx - 0x10], 0
jl 0x14004e828
lea rdx, str.msie
call fcn.14022f558
mov rcx, qword [0x14036cdf8]
test rax, rax
je 0x14004e5d5
sub rax, rcx
sar rax, 1
test eax, eax
jns 0x14004e606
cmp dword [rcx - 0x10], 0
jl 0x14004e828
lea rdx, str.trident
call fcn.14022f558
test rax, rax
je 0x14004e828
sub rax, qword [0x14036cdf8]
sar rax, 1
test eax, eax
js 0x14004e828
call fcn.140011f18
mov rcx, rax
test rax, rax
je 0x14004e8f7
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, r12
jne 0x14004e902
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
add rax, 0x18
mov qword [rsp + 0x78], rax
cmp r15, 0x10000
jae 0x14004e651
movzx edx, r15w
lea rcx, [rsp + 0x78]
call fcn.140012700
jmp 0x14004e670
mov rax, rdi
inc rax
cmp word [r15 + rax*2], 0
jne 0x14004e654
mov r8d, eax
mov rdx, r15
lea rcx, [rsp + 0x78]
call fcn.140002a7c
nop
mov rbx, qword [rsp + 0x78]
mov r9, rbx
xor r8d, r8d
mov edx, 0x11717
mov rcx, qword [rsi]
call fcn.14001fdd0
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14004e6cf
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x14004e909
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14004e909
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [rsp + 0x58]
mov qword [rbp - 0x68], rax
call fcn.140011f18
mov rcx, rax
test rax, rax
je 0x14004e911
mov rax, qword [rax]
mov rdx, qword [rax + 0x18]
cmp rax, r12
jne 0x14004e91c
lock inc dword [rcx + 0x20]
lea rax, [rcx + 0x10]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rax, [rbp + 0x40]
cmp rax, 0x10000
jae 0x14004e729
lea rax, [rbp + 0x40]
movzx edx, ax
lea rcx, [rsp + 0x58]
call fcn.140012700
jmp 0x14004e74c
lea rcx, [rbp + 0x40]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x14004e730
mov r8d, eax
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x58]
call fcn.140002a7c
nop
lea rcx, [rsp + 0x60]
call fcn.140015830
nop
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x60]
call fcn.140002b88
mov edx, 0x2c
lea rcx, [rsp + 0x60]
call fcn.14007d3d0
mov r9, qword [rsp + 0x60]
xor r8d, r8d
mov edx, 0x11724
mov rcx, qword [rsi]
call fcn.14001fdd0
nop
lea rcx, [rsp + 0x58]
call fcn.14004b190
mov byte [rbp - 0x50], 1
lea rcx, [rbp - 0x48]
call fcn.140015830
nop
cmp byte [rbp - 0x50], 0
lea rax, [0x1402f8cc8]
cmovne r14, rax
mov rax, rdi
inc rax
cmp word [r14 + rax*2], 0
jne 0x14004e7b5
mov r8d, eax
mov rdx, r14
lea rcx, [rbp - 0x48]
call fcn.140002a7c
mov rbx, qword [rbp - 0x48]
mov r9, rbx
xor r8d, r8d
mov edx, 0x11718
mov rcx, qword [rsi]
call fcn.14001fdd0
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14004e824
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r12
jne 0x14004e873
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8, qword [rax + 8]
cmp rax, r13
jne 0x14004e873
mov r8, rdx
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
mov rbx, qword [rbp - 0x80]
test rbx, rbx
je 0x14004e83e
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov qword [rbp - 0x80], rax
jmp 0x14004e840
xor eax, eax
mov dword [rbp - 0x78], eax
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.14022b120
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call r8
nop
jmp 0x14004e824
call r8
jmp 0x14004df16
mov ecx, 0x80004005
call fcn.140002d3c
int3
call rdx
jmp 0x14004e04e
call r8
jmp 0x14004e153
mov ecx, 0x80004005
call fcn.140002d3c
int3
call rdx
jmp 0x14004e17c
call r8
jmp 0x14004e220
mov ecx, 0x80004005
call fcn.140002d3c
int3
call rdx
jmp 0x14004e252
call r8
jmp 0x14004e35e
call r8
jmp 0x14004e3d0
call r8
jmp 0x14004e442
call r8
jmp 0x14004e4b4
call r8
jmp 0x14004e526
call r8
jmp 0x14004e598
mov ecx, 0x80004005
call fcn.140002d3c
int3
call rdx
jmp 0x14004e62f
call r8
jmp 0x14004e6cf
mov ecx, 0x80004005
call fcn.140002d3c
int3
call rdx
jmp 0x14004e701