Function at 0x1400298b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r14
push r15
lea rbp, [rsp - 0x1ffc0]
mov eax, 0x200c0
call fcn.1402ed7b0
sub rsp, rax
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x200e0], rbx
mov qword [rsp + 0x200e8], rsi
mov qword [rsp + 0x200f0], rdi
mov rax, qword [0x14044f8c0]
xor rax, rsp
mov qword [rbp + 0x1ffb0], rax
xor r15d, r15d
mov qword [rbp - 0x80], r15
mov dword [rbp - 0x78], r15d
mov qword [rbp - 0x70], r15
call fcn.140162c14
mov rcx, rax
test rax, rax
je 0x140029d87
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea r14, [0x140393240]
mov rdx, r14
lea rcx, [rsp + 0x30]
call fcn.1400168b0
lea rdi, [r15 - 1]
test al, al
jne 0x14002996c
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [r14 + rax*2], 0
jne 0x140029950
mov r8d, eax
mov rdx, r14
lea rcx, [rsp + 0x30]
call fcn.140016ad0
nop
call fcn.140162c14
mov rcx, rax
test rax, rax
je 0x140029d92
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x48], rax
mov rdx, r14
lea rcx, [rsp + 0x48]
call fcn.1400168b0
test al, al
jne 0x1400299bc
mov rax, rdi
inc rax
cmp word [r14 + rax*2], 0
jne 0x1400299a0
mov r8d, eax
mov rdx, r14
lea rcx, [rsp + 0x48]
call fcn.140016ad0
nop
call fcn.140162c14
mov rcx, rax
test rax, rax
je 0x140029d9d
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
mov rdx, r14
lea rcx, [rsp + 0x40]
call fcn.1400168b0
test al, al
jne 0x140029a0c
mov rax, rdi
inc rax
cmp word [r14 + rax*2], 0
jne 0x1400299f0
mov r8d, eax
mov rdx, r14
lea rcx, [rsp + 0x40]
call fcn.140016ad0
nop
mov r9d, 0x20019
lea r8, str.SoftwareMicrosoftMediaPlayer
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x80]
call fcn.140024490
test eax, eax
jne 0x140029a95
mov dword [rsp + 0x38], 0xfffe
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xffb0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, str.Installation_Directory
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140029a95
mov eax, dword [rsp + 0x58]
dec eax
cmp eax, 1
ja 0x140029a95
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x140029b2b
test al, 1
jne 0x140029a95
shr rax, 1
cmp word [rbp + rax*2 + 0xffae], 0
je 0x140029b33
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140029ab4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140029ad3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140029af0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x140029aff
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x1ffb0]
xor rcx, rsp
call fcn.1402ecc20
lea r11, [rsp + 0x200c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov word [rbp + 0xffb0], r15w
lea rcx, [rbp + 0xffb0]
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140029b40
mov r8d, eax
lea rdx, [rbp + 0xffb0]
lea rcx, [rsp + 0x30]
call fcn.140016ad0
lea rcx, [rsp + 0x68]
call fcn.140041080
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140016d50
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140029b95
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8, qword [rsp + 0x48]
lea rdx, str._ProgramFiles_
lea rcx, [rsp + 0x30]
call fcn.140023cb0
test eax, eax
jne 0x140029bfc
lea rcx, [rsp + 0x70]
call fcn.140041200
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140016d50
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140029be6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8, qword [rsp + 0x40]
lea rdx, str._ProgramFiles_x86__
lea rcx, [rsp + 0x30]
call fcn.140023cb0
mov rbx, qword [rsp + 0x30]
cmp dword [rbx - 8], 1
jle 0x140029c19
mov edx, dword [rbx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.1400124b0
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x140029a95
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x7fff
xor r8d, r8d
lea rdx, str.wmplayer.exe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
mov esi, eax
test eax, eax
jne 0x140029cb4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x7fff
xor r8d, r8d
lea rdx, str.mplayer2.exe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
mov esi, eax
test eax, eax
jne 0x140029cb4
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x7fff
xor r8d, r8d
lea rdx, str.mplayer.exe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SearchPathW]
mov esi, eax
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1402f3448
test eax, eax
js 0x140029d7c
cmp eax, dword [rbx - 0xc]
jg 0x140029d7c
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r15w
test esi, esi
je 0x140029a95
lea rax, [rsp + 0x78]
mov qword [rbp - 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rbp - 0x58], rax
mov rdx, r14
lea rcx, [rsp + 0x78]
call fcn.1400169b0
mov rbx, rax
call fcn.140162c14
mov rcx, rax
test rax, rax
je 0x140029d71
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x50], rax
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x50]
call fcn.1400168b0
test al, al
jne 0x140029d5c
lea rcx, [rbp - 0x50]
mov rax, rdi
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140029d40
mov r8d, eax
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x50]
call fcn.140016ad0
nop
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.14003d4d0
jmp 0x140029a95
mov ecx, 0x80004005
call fcn.140012800
nop
mov ecx, 0x80070057
call fcn.140012800
nop
mov ecx, 0x80004005
call fcn.140012800
nop
mov ecx, 0x80004005
call fcn.140012800
nop
mov ecx, 0x80004005
call fcn.140012800
int3