Function at 0x14003e830
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov qword [rbp + 0x27], 0xfffffffffffffffe
mov rsi, rcx
test rcx, rcx
je 0x14003ec1c
lea rax, [rbp - 0x49]
mov qword [rbp + 0x67], rax
call fcn.140162c14
mov rcx, rax
test rax, rax
je 0x14003ec37
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x49], rax
lea rdi, str.CurrentMajorVersionNumber
mov rdx, rdi
lea rcx, [rbp - 0x49]
call fcn.1400168b0
mov rbx, 0xffffffffffffffff
test al, al
jne 0x14003e8ba
mov rax, rbx
nop
inc rax
cmp word [rdi + rax*2], 0
jne 0x14003e8a0
mov r8d, eax
mov rdx, rdi
lea rcx, [rbp - 0x49]
call fcn.140016ad0
nop
xor r14d, r14d
mov qword [rbp - 0x21], r14
mov dword [rbp - 0x19], r14d
mov qword [rbp - 0x11], r14
mov dword [rbp + 0x67], r14d
lea r9d, [r14 + 1]
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x21]
call fcn.140024490
test eax, eax
je 0x14003e8fe
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x14003ec01
jmp 0x14003ebfb
mov dword [rbp + 0x7f], 4
lea rax, [rbp + 0x7f]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x67]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x41]
xor r8d, r8d
mov rdx, qword [rbp - 0x49]
mov rdi, qword [rbp - 0x21]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003ebf3
cmp dword [rbp - 0x41], 4
jne 0x14003ebf3
mov eax, dword [rbp + 0x67]
mov dword [rbp - 0x2d], eax
test rdi, rdi
je 0x14003e955
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x49]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003e972
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbp - 0x51]
mov qword [rbp + 0x6f], rax
call fcn.140162c14
mov rcx, rax
test rax, rax
je 0x14003ec42
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x51], rax
lea rdi, str.CurrentMinorVersionNumber
mov rdx, rdi
lea rcx, [rbp - 0x51]
call fcn.1400168b0
test al, al
jne 0x14003e9cd
mov rax, rbx
inc rax
cmp word [rdi + rax*2], 0
jne 0x14003e9b3
mov r8d, eax
mov rdx, rdi
lea rcx, [rbp - 0x51]
call fcn.140016ad0
nop
mov qword [rbp - 9], r14
mov dword [rbp - 1], r14d
mov qword [rbp + 7], r14
mov dword [rbp + 0x6f], r14d
mov r9d, 1
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 9]
call fcn.140024490
test eax, eax
je 0x14003ea16
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x14003ea0d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x51]
jmp 0x14003ec05
mov dword [rbp - 0x3d], 4
lea rax, [rbp - 0x3d]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x39]
xor r8d, r8d
mov rdx, qword [rbp - 0x51]
mov rdi, qword [rbp - 9]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003ebdb
cmp dword [rbp - 0x39], 4
jne 0x14003ebdb
mov eax, dword [rbp + 0x6f]
mov dword [rbp - 0x29], eax
test rdi, rdi
je 0x14003ea6d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x51]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003ea8a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rbp - 0x59]
mov qword [rbp + 0x77], rax
call fcn.140162c14
mov rcx, rax
test rax, rax
je 0x14003ec2c
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x59], rax
lea rdi, str.CurrentBuildNumber
mov rdx, rdi
lea rcx, [rbp - 0x59]
call fcn.1400168b0
test al, al
jne 0x14003eaea
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp word [rdi + rax*2], 0
jne 0x14003ead0
mov r8d, eax
mov rdx, rdi
lea rcx, [rbp - 0x59]
call fcn.140016ad0
nop
mov qword [rbp + 0xf], r14
mov dword [rbp + 0x17], r14d
mov qword [rbp + 0x1f], r14
mov dword [rbp + 0x77], r14d
mov r9d, 1
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersion
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0xf]
call fcn.140024490
test eax, eax
je 0x14003eb33
mov rcx, qword [rbp + 0xf]
test rcx, rcx
je 0x14003eb2a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x59]
jmp 0x14003ec05
mov dword [rbp - 0x35], 4
lea rax, [rbp - 0x35]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x77]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x31]
xor r8d, r8d
mov rdx, qword [rbp - 0x59]
mov rdi, qword [rbp + 0xf]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003ebc3
cmp dword [rbp - 0x31], 4
jne 0x14003ebc3
mov eax, dword [rbp + 0x77]
mov dword [rbp - 0x25], eax
test rdi, rdi
je 0x14003eb82
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14003eb9e
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov ecx, dword [rbp - 0x2d]
mov dword [rsi + 4], ecx
mov ecx, dword [rbp - 0x29]
mov dword [rsi + 8], ecx
mov ecx, dword [rbp - 0x25]
mov dword [rsi + 0xc], ecx
mov eax, 1
add rsp, 0xc0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
test rdi, rdi
je 0x14003eb2a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x59]
jmp 0x14003ec05
test rdi, rdi
je 0x14003ea0d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x51]
jmp 0x14003ec05
test rdi, rdi
je 0x14003ec01
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x49]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x14003ec1c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
add rsp, 0xc0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.140012800
int3
mov ecx, 0x80004005
call fcn.140012800
int3
mov ecx, 0x80004005
call fcn.140012800
int3