Function at 0x1400048d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push r14
lea rbp, [rsp - 0x588]
sub rsp, 0x688
mov rbx, rcx
xor r14d, r14d
mov dword [rsp + 0x30], r14d
mov qword [rcx], r14
mov qword [rcx + 0x10], r14
mov qword [rcx + 0x18], 7
mov word [rcx], r14w
xor r8d, r8d
lea rdx, [0x140026a84]
call fcn.140003f30
mov dword [rsp + 0x30], 1
lea rcx, [rsp + 0x58]
call fcn.140004d50
nop
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp - 0x80]
call fcn.140009790
lea r8, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae r8, qword [rsp + 0x58]
lea rdx, str.SOFTWAREWOW6432NodeMicrosoftWindowsCurrentVersionUninstall_ls_is1
lea rcx, [rbp - 0x80]
call qword [sym.imp.USER32.dll_wsprintfW]
xor edx, edx
mov r8d, 0x400
lea rcx, [rbp + 0x180]
call fcn.140009790
mov dword [rbp + 0x5b8], 4
mov dword [rbp + 0x5c0], 1
lea rax, [rbp + 0x5c8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp - 0x80]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140004ba6
lea rax, [rbp + 0x5b8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x5c0]
xor r8d, r8d
lea rdx, str.DisplayIcon
mov rcx, qword [rbp + 0x5c8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rax, [rbp + 0x5b8]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x180]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x5c0]
xor r8d, r8d
lea rdx, str.DisplayIcon
mov rcx, qword [rbp + 0x5c8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140004b98
lea rax, [rbp + 0x180]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140004a30
lea rdx, [rbp + 0x180]
mov rcx, rbx
call fcn.140003f30
mov r10, rbx
cmp qword [rbx + 0x18], 8
jb 0x140004a57
mov r10, qword [rbx]
mov r11, qword [rbx + 0x10]
cmp r11, 1
jb 0x140004abe
lea rcx, [r11 - 1]
mov rax, 0xffffffffffffffff
cmp rcx, rax
cmovb rax, rcx
lea r8, [r10 + rax*2]
lea rsi, [0x140026b70]
mov r9, r8
sub r9, rsi
cmp word [r8], 0x2c
jne 0x140004aaf
mov edx, 1
mov rax, rsi
movzx ecx, word [rax]
cmp word [rax + r9], cx
jne 0x140004aaf
add rax, 2
sub rdx, 1
jne 0x140004a93
sub r8, r10
sar r8, 1
jmp 0x140004ac5
cmp r8, r10
je 0x140004abe
sub r8, 2
sub r9, 2
jmp 0x140004a84
mov r8, 0xffffffffffffffff
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], 7
cmp r11, r8
cmovb r8, r11
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140004aec
mov rdx, qword [rbx]
lea rcx, [rsp + 0x38]
call fcn.140003f30
lea rax, [rsp + 0x38]
cmp rbx, rax
je 0x140004b5a
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x140004b3f
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140004b3a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140004bfa
mov rcx, r8
call fcn.140007e0c
mov qword [rbx + 0x18], 7
movups xmm0, xmmword [rsp + 0x38]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rsp + 0x48]
movups xmmword [rbx + 0x10], xmm1
jmp 0x140004b98
mov rdx, qword [rsp + 0x50]
cmp rdx, 8
jb 0x140004b98
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004b93
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004bfa
call fcn.140007e0c
mov rcx, qword [rbp + 0x5c8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 8
jb 0x140004be4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004bdf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004bf4
call fcn.140007e0c
mov rax, rbx
add rsp, 0x688
pop r14
pop rsi
pop rbx
pop rbp
ret
call fcn.14000e5c4
nop
call fcn.14000e5c4
int3