Function at 0x180003780
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x100
mov rax, qword [0x180062020]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov r15, r8
mov rax, rdx
test rdx, rdx
je 0x180004233
xor r12d, r12d
mov qword [rsp + 0x40], r12
lea rdi, [r8 + 0x68]
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1800037d4
mov rdx, qword [rdi]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, 0x101
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
je 0x180003831
mov rcx, qword [0x180064be8]
cmp dword [rcx], r12d
je 0x180004231
cmp qword [rdi + 0x18], 8
jb 0x180003810
mov rdi, qword [rdi]
mov dword [rsp + 0x20], eax
mov r9, rdi
lea r8, str.Opening_registry_key__s_failed_with_error__d
lea rdx, str._OEMUninstall__::_CInstalledProducts::_GetProductInfo____
xor ecx, ecx
call fcn.180002d40
jmp 0x180004231
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov byte [rsp + 0x38], 1
mov qword [rbp - 0x21], r12
mov qword [rbp - 0x11], r12
mov qword [rbp - 9], 7
mov word [rbp - 0x21], r12w
mov r8d, 0xb
lea rdx, str.DisplayName
lea rcx, [rbp - 0x21]
call fcn.180008000
nop
mov qword [rbp - 0x41], r12
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x29], 7
mov word [rbp - 0x41], r12w
mov r8d, 0xe
lea rdx, str.DisplayVersion
lea rcx, [rbp - 0x41]
call fcn.180008000
nop
mov qword [rbp - 0x61], r12
mov qword [rbp - 0x51], r12
mov qword [rbp - 0x49], 7
mov word [rbp - 0x61], r12w
mov r8d, 0xf
lea rdx, str.UninstallString
lea rcx, [rbp - 0x61]
call fcn.180008000
nop
mov qword [rbp - 1], r12
mov qword [rbp + 0xf], r12
mov qword [rbp + 0x17], 7
mov word [rbp - 1], r12w
mov r8d, 0x10
lea rdx, str.WindowsInstaller
lea rcx, [rbp - 1]
call fcn.180008000
nop
mov dword [rsp + 0x48], r12d
mov dword [rbp - 0x7d], 1
lea rdx, [rbp - 0x21]
cmp qword [rbp - 9], 8
cmovae rdx, qword [rbp - 0x21]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x7d]
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rsi, 0xffffffffffffffff
cmp eax, 0xea
je 0x180003941
test eax, eax
jne 0x180003bfe
xorps xmm0, xmm0
mov eax, dword [rsp + 0x48]
add eax, 2
mov r14d, eax
movdqu xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x69], r12
je 0x1800039b3
cmp r14, 0x1000
jb 0x18000398e
lea rcx, [rax + 0x27]
cmp rcx, r14
jbe 0x1800043a9
call fcn.18001899c
mov rcx, rax
test rax, rax
je 0x1800043c1
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180003996
mov rcx, r14
call fcn.18001899c
mov qword [rbp - 0x79], rax
lea rbx, [rax + r14]
mov qword [rbp - 0x69], rbx
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.18001b7e0
mov qword [rbp - 0x71], rbx
lea rdx, [rbp - 0x21]
cmp qword [rbp - 9], 8
cmovae rdx, qword [rbp - 0x21]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x79]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x7d]
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x180003ba4
mov rax, qword [0x180064be8]
cmp dword [rax], 0
je 0x180003a23
cmp qword [rdi + 0x18], 8
jb 0x180003a06
mov rdi, qword [rdi]
mov dword [rsp + 0x20], ebx
mov r9, rdi
lea r8, str.Querying_display_name_for_registry_key__s_failed_with_error__d
lea rdx, str._OEMUninstall__::_CInstalledProducts::_GetProductInfo____
xor ecx, ecx
call fcn.180002d40
nop
mov rcx, qword [rbp - 0x79]
test rcx, rcx
je 0x180003a69
mov rdx, qword [rbp - 0x69]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003a58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800043c1
call fcn.180018490
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x69], r12
mov rdx, qword [rbp + 0x17]
cmp rdx, 8
jb 0x180003aa9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003aa4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800043af
call fcn.180018490
mov qword [rbp + 0xf], r12
mov qword [rbp + 0x17], 7
mov word [rbp - 1], r12w
mov rdx, qword [rbp - 0x49]
cmp rdx, 8
jb 0x180003afa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003af5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800043b5
call fcn.180018490
mov qword [rbp - 0x51], r12
mov qword [rbp - 0x49], 7
mov word [rbp - 0x61], r12w
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x180003b4b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003b46
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800043bb
call fcn.180018490
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x29], 7
mov word [rbp - 0x41], r12w
mov rdx, qword [rbp - 9]
cmp rdx, 8
jb 0x180004210
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000420b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004397
jmp 0x18000420b
mov rdx, qword [rbp - 0x79]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x180003bb0
mov rcx, r15
call fcn.180008000
nop
mov rcx, qword [rbp - 0x79]
test rcx, rcx
je 0x180003bfe
mov rdx, qword [rbp - 0x69]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003bf9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800043c1
call fcn.180018490
mov dword [rsp + 0x48], r12d
lea rdx, [rbp - 0x41]
cmp qword [rbp - 0x29], 8
cmovae rdx, qword [rbp - 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x7d]
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
je 0x180003c41
test eax, eax
jne 0x180003eff
xorps xmm0, xmm0
mov eax, dword [rsp + 0x48]
add eax, 2
mov r14d, eax
movdqu xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x69], r12
je 0x180003cb3
cmp r14, 0x1000
jb 0x180003c8e
lea rcx, [rax + 0x27]
cmp rcx, r14
jbe 0x1800043c7
call fcn.18001899c
mov rcx, rax
test rax, rax
je 0x1800043df
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180003c96
mov rcx, r14
call fcn.18001899c
mov qword [rbp - 0x79], rax
lea rbx, [rax + r14]
mov qword [rbp - 0x69], rbx
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.18001b7e0
mov qword [rbp - 0x71], rbx
lea rdx, [rbp - 0x41]
cmp qword [rbp - 0x29], 8
cmovae rdx, qword [rbp - 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x79]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x7d]
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x180003ea4
mov rax, qword [0x180064be8]
cmp dword [rax], 0
je 0x180003d23
cmp qword [rdi + 0x18], 8
jb 0x180003d06
mov rdi, qword [rdi]
mov dword [rsp + 0x20], ebx
mov r9, rdi
lea r8, str.Querying_display_version_for_registry_key__s_failed_with_error__d
lea rdx, str._OEMUninstall__::_CInstalledProducts::_GetProductInfo____
xor ecx, ecx
call fcn.180002d40
nop
mov rcx, qword [rbp - 0x79]
test rcx, rcx
je 0x180003d69
mov rdx, qword [rbp - 0x69]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003d58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800043df
call fcn.180018490
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x69], r12
mov rdx, qword [rbp + 0x17]
cmp rdx, 8
jb 0x180003da9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003da4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800043cd
call fcn.180018490
mov qword [rbp + 0xf], r12
mov qword [rbp + 0x17], 7
mov word [rbp - 1], r12w
mov rdx, qword [rbp - 0x49]
cmp rdx, 8
jb 0x180003dfa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003df5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800043d3
call fcn.180018490
mov qword [rbp - 0x51], r12
mov qword [rbp - 0x49], 7
mov word [rbp - 0x61], r12w
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x180003e4b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003e46
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800043d9
call fcn.180018490
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x29], 7
mov word [rbp - 0x41], r12w
mov rdx, qword [rbp - 9]
cmp rdx, 8
jb 0x180004210
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000420b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000439d
jmp 0x18000420b
mov rdx, qword [rbp - 0x79]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x180003eb0
lea rcx, [r15 + 0x20]
call fcn.180008000
nop
mov rcx, qword [rbp - 0x79]
test rcx, rcx
je 0x180003eff
mov rdx, qword [rbp - 0x69]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x180003efa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800043df
call fcn.180018490
mov dword [rsp + 0x48], 4
mov dword [rbp - 0x7d], 4
lea rdx, [rbp - 1]
cmp qword [rbp + 0x17], 8
cmovae rdx, qword [rbp - 1]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1f]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x7d]
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180003f4f
cmp dword [rbp + 0x1f], eax
je 0x180003f4f
or dword [r15 + 0x60], 1
mov dword [rsp + 0x48], r12d
mov dword [rbp - 0x7d], 2
lea rdx, [rbp - 0x61]
cmp qword [rbp - 0x49], 8
cmovae rdx, qword [rbp - 0x61]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x7d]
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, 0xea
je 0x180003f9b
test eax, eax
jne 0x1800040dd
xorps xmm0, xmm0
mov eax, dword [rsp + 0x48]
add eax, 2
mov r14d, eax
movdqu xmmword [rbp - 0x79], xmm0
mov qword [rbp - 0x69], r12
je 0x18000400d
cmp r14, 0x1000
jb 0x180003fe8
lea rcx, [rax + 0x27]
cmp rcx, r14
jbe 0x1800043e5
call fcn.18001899c
mov rcx, rax
test rax, rax
je 0x1800043eb
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180003ff0
mov rcx, r14
call fcn.18001899c
mov qword [rbp - 0x79], rax
lea rbx, [r14 + rax]
mov qword [rbp - 0x69], rbx
mov r8, r14
xor edx, edx
mov rcx, rax
call fcn.18001b7e0
mov qword [rbp - 0x71], rbx
lea rdx, [rbp - 0x61]
cmp qword [rbp - 0x49], 8
cmovae rdx, qword [rbp - 0x61]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x79]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x7d]
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x180004068
mov rdx, qword [rbp - 0x79]
nop word [rax + rax]
inc rsi
cmp word [rdx + rsi*2], 0
jne 0x180004050
lea rcx, [r15 + 0x40]
mov r8, rsi
call fcn.180008000
jmp 0x18000409b
mov rax, qword [0x180064be8]
cmp dword [rax], 0
je 0x18000409b
cmp qword [rdi + 0x18], 8
jb 0x18000407e
mov rdi, qword [rdi]
mov dword [rsp + 0x20], ebx
mov r9, rdi
lea r8, str.Querying_uninstall_string_for_registry_key__s_failed_with_error__d
lea rdx, str._OEMUninstall__::_CInstalledProducts::_GetProductInfo____
xor ecx, ecx
call fcn.180002d40
nop
mov rcx, qword [rbp - 0x79]
test rcx, rcx
je 0x1800040d5
mov rdx, qword [rbp - 0x69]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800040d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800043eb
call fcn.180018490
test ebx, ebx
je 0x18000425b
mov rdx, qword [rbp + 0x17]
cmp rdx, 8
jb 0x18000411d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004118
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800043f1
call fcn.180018490
mov qword [rbp + 0xf], r12
mov qword [rbp + 0x17], 7
mov word [rbp - 1], r12w
mov rdx, qword [rbp - 0x49]
cmp rdx, 8
jb 0x18000416e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004169
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800043f7
call fcn.180018490
mov qword [rbp - 0x51], r12
mov qword [rbp - 0x49], 7
mov word [rbp - 0x61], r12w
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x1800041bf
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800041ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004391
call fcn.180018490
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x29], 7
mov word [rbp - 0x41], r12w
mov rdx, qword [rbp - 9]
cmp rdx, 8
jb 0x180004210
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000420b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800043a3
call fcn.180018490
mov word [rbp - 0x21], r12w
mov qword [rbp - 9], 7
mov qword [rbp - 0x11], r12
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180004231
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.180018470
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov ebx, r12d
mov rdx, qword [rbp + 0x17]
cmp rdx, 8
jb 0x18000429e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004299
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800043f1
call fcn.180018490
mov qword [rbp + 0xf], r12
mov qword [rbp + 0x17], 7
mov word [rbp - 1], r12w
mov rdx, qword [rbp - 0x49]
cmp rdx, 8
jb 0x1800042ef
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x61]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800042ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800043f7
call fcn.180018490
mov qword [rbp - 0x51], r12
mov qword [rbp - 0x49], 7
mov word [rbp - 0x61], r12w
mov rdx, qword [rbp - 0x29]
cmp rdx, 8
jb 0x18000433c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004337
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004391
call fcn.180018490
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x29], 7
mov word [rbp - 0x41], r12w
mov rdx, qword [rbp - 9]
cmp rdx, 8
jb 0x180004210
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000420b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800043a3
jmp 0x18000420b
call fcn.180029184
nop
call fcn.180029184
int3
call fcn.180029184
int3
call fcn.180029184
nop
call fcn.180001730
nop
call fcn.180029184
nop
call fcn.180029184
nop
call fcn.180029184
nop
call fcn.180029184
int3
call fcn.180001730
nop
call fcn.180029184
nop
call fcn.180029184
nop
call fcn.180029184
nop
call fcn.180029184
int3
call fcn.180001730
int3
call fcn.180029184
nop
call fcn.180029184
nop
call fcn.180029184
int3