Function at 0x140020630
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2c0
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1401dd3a0]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov r15, rcx
xor esi, esi
mov dword [rsp + 0x38], esi
xor edx, edx
mov r8d, 0x208
lea rcx, [r11 - 0x248]
call fcn.1400e5f10
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREWow6432NodeSophosWeb_Intelligence
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140020f1a
mov dword [rsp + 0x38], 1
mov dword [rsp + 0x34], 0x208
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, str.Location
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140020b0f
cmp dword [rsp + 0x34], esi
jne 0x140020f0a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
lea rcx, str.swifdiag.log
call fcn.140001910
mov rdi, rax
lea rbx, str.Registry_key_for_
lea r12, str._err:
lea r14, str.SwiConfig::GetSwiInstallLocation
lea r13, str....._src_swic_srcSwiConfigFiles.cpp
test rax, rax
je 0x140020921
mov rax, qword [rax]
mov qword [rsp + 0x20], r14
mov r9, r13
lea r8, str.default
lea edx, [rsi + 1]
mov rcx, rdi
call qword [rax + 8]
test al, al
je 0x140020921
mov byte [rdi + 0xf8], 0x65
mov eax, esi
mov r8b, 0x2e
mov rcx, r13
mov edx, 1
nop word [rax + rax]
cmp r8b, 0x5c
cmove eax, edx
inc edx
inc rcx
movzx r8d, byte [rcx]
test r8b, r8b
jne 0x140020790
add rax, r13
mov qword [rdi + 0x100], rax
mov dword [rdi + 0x108], 0x2d
mov qword [rdi + 0x110], r14
mov rcx, rdi
call fcn.1400027f0
mov rsi, rax
xor edi, edi
nop dword [rax]
inc rdi
cmp byte [rdi + rbx], 0
jne 0x1400207d0
mov ecx, dword [rax + 0x430]
mov dword [rax + 0x430], 0
cmp edi, ecx
jge 0x140020820
movzx eax, byte [rax + 0x42c]
mov byte [rsp + 0x30], al
sub ecx, edi
mov ebx, ecx
nop dword [rax]
mov r8d, 1
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14002f090
sub rbx, 1
jne 0x140020800
lea rbx, str.Registry_key_for_
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call fcn.14002f090
lea rdx, str.Location
mov rcx, rsi
call fcn.140013b50
mov rbx, rax
xor esi, esi
mov rdi, rsi
lea rax, str._is_empty_
nop dword [rax]
inc rdi
cmp byte [rdi + rax], sil
jne 0x140020850
mov ecx, dword [rbx + 0x430]
mov dword [rbx + 0x430], esi
cmp edi, ecx
jge 0x1400208a0
movzx eax, byte [rbx + 0x42c]
mov byte [rsp + 0x30], al
sub ecx, edi
mov esi, ecx
nop dword [rax + rax]
mov r8d, 1
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14002f090
sub rsi, 1
jne 0x140020880
lea rax, str._is_empty_
mov r8, rdi
mov rdx, rax
mov rcx, rbx
call fcn.14002f090
mov rdi, rsi
inc rdi
cmp byte [rdi + r12], 0
jne 0x1400208b1
mov ecx, dword [rbx + 0x430]
mov dword [rbx + 0x430], esi
cmp edi, ecx
jge 0x1400208f9
movzx eax, byte [rbx + 0x42c]
mov byte [rsp + 0x30], al
sub ecx, edi
mov esi, ecx
nop word [rax + rax]
mov r8d, 1
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14002f090
sub rsi, 1
jne 0x1400208e0
mov r8, rdi
mov rdx, r12
mov rcx, rbx
call fcn.14002f090
mov edx, ebp
mov rcx, rbx
call fcn.1400146a0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 8]
lea rbx, str.Registry_key_for_
lea rcx, [0x14019e670]
call fcn.140030de0
mov rdi, rax
test rax, rax
je 0x140020f0a
mov rax, qword [rax]
mov qword [rsp + 0x20], r14
mov r9, r13
lea r8, str.default
mov edx, 1
mov rcx, rdi
call qword [rax + 8]
test al, al
je 0x140020f0a
mov byte [rdi + 0xf8], 0x65
mov eax, esi
mov r8b, 0x2e
mov rcx, r13
mov edx, 1
nop word [rax + rax]
cmp r8b, 0x5c
cmove eax, edx
inc edx
inc rcx
movzx r8d, byte [rcx]
test r8b, r8b
jne 0x140020980
add rax, r13
mov qword [rdi + 0x100], rax
mov dword [rdi + 0x108], 0x2d
mov qword [rdi + 0x110], r14
mov rcx, rdi
call fcn.1400027f0
mov rsi, rax
xor r14d, r14d
mov rdi, r14
inc rdi
cmp byte [rdi + rbx], r14b
jne 0x1400209c1
mov ecx, dword [rax + 0x430]
mov dword [rax + 0x430], r14d
cmp edi, ecx
jge 0x140020a10
movzx eax, byte [rax + 0x42c]
mov byte [rsp + 0x30], al
sub ecx, edi
mov ebx, ecx
nop word [rax + rax]
mov r8d, 1
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14002f090
sub rbx, 1
jne 0x1400209f0
lea rbx, str.Registry_key_for_
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call fcn.14002f090
lea rdx, str.Location
mov rcx, rsi
call fcn.140013b50
mov rbx, rax
mov rdi, r14
lea r13, str._is_empty_
nop word [rax + rax]
inc rdi
cmp byte [rdi + r13], r14b
jne 0x140020a40
mov ecx, dword [rax + 0x430]
mov dword [rax + 0x430], r14d
cmp edi, ecx
jge 0x140020a89
movzx eax, byte [rax + 0x42c]
mov byte [rsp + 0x30], al
sub ecx, edi
mov esi, ecx
nop dword [rax]
mov r8d, 1
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14002f090
sub rsi, 1
jne 0x140020a70
mov r8, rdi
mov rdx, r13
mov rcx, rbx
call fcn.14002f090
mov rdi, r14
nop word [rax + rax]
inc rdi
cmp byte [rdi + r12], r14b
jne 0x140020aa0
mov ecx, dword [rbx + 0x430]
mov dword [rbx + 0x430], r14d
cmp edi, ecx
jge 0x140020ae9
movzx eax, byte [rbx + 0x42c]
mov byte [rsp + 0x30], al
sub ecx, edi
mov esi, ecx
nop dword [rax]
mov r8d, 1
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14002f090
sub rsi, 1
jne 0x140020ad0
mov r8, rdi
mov rdx, r12
mov rcx, rbx
call fcn.14002f090
mov edx, ebp
mov rcx, rbx
call fcn.1400146a0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 8]
jmp 0x140020f0a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
lea rcx, str.swifdiag.log
call fcn.140001910
mov rdi, rax
lea r12, str._err:
lea rbx, str.Unable_to_read_registry_value_
lea r14, str.SwiConfig::GetSwiInstallLocation
lea r13, str....._src_swic_srcSwiConfigFiles.cpp
test rax, rax
je 0x140020d21
mov rax, qword [rax]
mov qword [rsp + 0x20], r14
mov r9, r13
lea r8, str.default
mov edx, 1
mov rcx, rdi
call qword [rax + 8]
test al, al
je 0x140020d21
mov byte [rdi + 0xf8], 0x65
mov eax, esi
mov r8b, 0x2e
mov rcx, r13
mov edx, 1
nop word [rax + rax]
cmp r8b, 0x5c
cmove eax, edx
inc edx
inc rcx
movzx r8d, byte [rcx]
test r8b, r8b
jne 0x140020b90
add rax, r13
mov qword [rdi + 0x100], rax
mov dword [rdi + 0x108], 0x32
mov qword [rdi + 0x110], r14
mov rcx, rdi
call fcn.1400027f0
mov rsi, rax
xor edi, edi
nop dword [rax]
inc rdi
cmp byte [rdi + rbx], 0
jne 0x140020bd0
mov ecx, dword [rax + 0x430]
mov dword [rax + 0x430], 0
cmp edi, ecx
jge 0x140020c20
movzx eax, byte [rax + 0x42c]
mov byte [rsp + 0x30], al
sub ecx, edi
mov ebx, ecx
nop dword [rax]
mov r8d, 1
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14002f090
sub rbx, 1
jne 0x140020c00
lea rbx, str.Unable_to_read_registry_value_
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call fcn.14002f090
lea rdx, str.Location
mov rcx, rsi
call fcn.140013b50
mov rbx, rax
xor esi, esi
mov rdi, rsi
lea rax, [0x1401a2b84]
nop dword [rax]
inc rdi
cmp byte [rdi + rax], sil
jne 0x140020c50
mov ecx, dword [rbx + 0x430]
mov dword [rbx + 0x430], esi
cmp edi, ecx
jge 0x140020ca0
movzx eax, byte [rbx + 0x42c]
mov byte [rsp + 0x30], al
sub ecx, edi
mov esi, ecx
nop dword [rax + rax]
mov r8d, 1
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14002f090
sub rsi, 1
jne 0x140020c80
lea rax, [0x1401a2b84]
mov r8, rdi
mov rdx, rax
mov rcx, rbx
call fcn.14002f090
mov rdi, rsi
inc rdi
cmp byte [rdi + r12], 0
jne 0x140020cb1
mov ecx, dword [rbx + 0x430]
mov dword [rbx + 0x430], esi
cmp edi, ecx
jge 0x140020cf9
movzx eax, byte [rbx + 0x42c]
mov byte [rsp + 0x30], al
sub ecx, edi
mov esi, ecx
nop word [rax + rax]
mov r8d, 1
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14002f090
sub rsi, 1
jne 0x140020ce0
mov r8, rdi
mov rdx, r12
mov rcx, rbx
call fcn.14002f090
mov edx, ebp
mov rcx, rbx
call fcn.1400146a0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 8]
lea rbx, str.Unable_to_read_registry_value_
lea rcx, [0x14019e670]
call fcn.140030de0
mov rdi, rax
test rax, rax
je 0x140020f0a
mov rax, qword [rax]
mov qword [rsp + 0x20], r14
mov r9, r13
lea r8, str.default
mov edx, 1
mov rcx, rdi
call qword [rax + 8]
test al, al
je 0x140020f0a
mov byte [rdi + 0xf8], 0x65
mov eax, esi
mov r8b, 0x2e
mov rcx, r13
mov edx, 1
nop word [rax + rax]
cmp r8b, 0x5c
cmove eax, edx
inc edx
inc rcx
movzx r8d, byte [rcx]
test r8b, r8b
jne 0x140020d80
add rax, r13
mov qword [rdi + 0x100], rax
mov dword [rdi + 0x108], 0x32
mov qword [rdi + 0x110], r14
mov rcx, rdi
call fcn.1400027f0
mov rsi, rax
xor r14d, r14d
mov rdi, r14
inc rdi
cmp byte [rdi + rbx], r14b
jne 0x140020dc1
mov ecx, dword [rax + 0x430]
mov dword [rax + 0x430], r14d
cmp edi, ecx
jge 0x140020e10
movzx eax, byte [rax + 0x42c]
mov byte [rsp + 0x30], al
sub ecx, edi
mov ebx, ecx
nop word [rax + rax]
mov r8d, 1
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14002f090
sub rbx, 1
jne 0x140020df0
lea rbx, str.Unable_to_read_registry_value_
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call fcn.14002f090
lea rdx, str.Location
mov rcx, rsi
call fcn.140013b50
mov rbx, rax
mov rdi, r14
lea r13, [0x1401a2b84]
nop word [rax + rax]
inc rdi
cmp byte [rdi + r13], r14b
jne 0x140020e40
mov ecx, dword [rax + 0x430]
mov dword [rax + 0x430], r14d
cmp edi, ecx
jge 0x140020e89
movzx eax, byte [rax + 0x42c]
mov byte [rsp + 0x30], al
sub ecx, edi
mov esi, ecx
nop dword [rax]
mov r8d, 1
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14002f090
sub rsi, 1
jne 0x140020e70
mov r8, rdi
mov rdx, r13
mov rcx, rbx
call fcn.14002f090
mov rdi, r14
nop word [rax + rax]
inc rdi
cmp byte [rdi + r12], r14b
jne 0x140020ea0
mov ecx, dword [rbx + 0x430]
mov dword [rbx + 0x430], r14d
cmp edi, ecx
jge 0x140020ee9
movzx eax, byte [rbx + 0x42c]
mov byte [rsp + 0x30], al
sub ecx, edi
mov esi, ecx
nop dword [rax]
mov r8d, 1
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14002f090
sub rsi, 1
jne 0x140020ed0
mov r8, rdi
mov rdx, r12
mov rcx, rbx
call fcn.14002f090
mov edx, ebp
mov rcx, rbx
call fcn.1400146a0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 8]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14002130a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
lea rcx, str.swifdiag.log
call fcn.140001910
mov rdi, rax
lea r12, str._err:
lea rbx, str.HKLM_registry_key_for_
lea r14, str.SwiConfig::GetSwiInstallLocation
lea r13, str....._src_swic_srcSwiConfigFiles.cpp
test rax, rax
je 0x140021121
mov rax, qword [rax]
mov qword [rsp + 0x20], r14
mov r9, r13
lea r8, str.default
mov edx, 1
mov rcx, rdi
call qword [rax + 8]
test al, al
je 0x140021121
mov byte [rdi + 0xf8], 0x65
mov eax, esi
mov r8b, 0x2e
mov rcx, r13
mov edx, 1
nop
cmp r8b, 0x5c
cmove eax, edx
inc edx
inc rcx
movzx r8d, byte [rcx]
test r8b, r8b
jne 0x140020f90
add rax, r13
mov qword [rdi + 0x100], rax
mov dword [rdi + 0x108], 0x38
mov qword [rdi + 0x110], r14
mov rcx, rdi
call fcn.1400027f0
mov rsi, rax
xor edi, edi
nop dword [rax]
inc rdi
cmp byte [rdi + rbx], 0
jne 0x140020fd0
mov ecx, dword [rax + 0x430]
mov dword [rax + 0x430], 0
cmp edi, ecx
jge 0x140021020
movzx eax, byte [rax + 0x42c]
mov byte [rsp + 0x30], al
sub ecx, edi
mov ebx, ecx
nop dword [rax]
mov r8d, 1
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14002f090
sub rbx, 1
jne 0x140021000
lea rbx, str.HKLM_registry_key_for_
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call fcn.14002f090
lea rdx, str.SOFTWAREWow6432NodeSophosWeb_Intelligence
mov rcx, rsi
call fcn.140013b50
mov rbx, rax
xor esi, esi
mov rdi, rsi
lea rax, str._is_missing_
nop dword [rax]
inc rdi
cmp byte [rdi + rax], sil
jne 0x140021050
mov ecx, dword [rbx + 0x430]
mov dword [rbx + 0x430], esi
cmp edi, ecx
jge 0x1400210a0
movzx eax, byte [rbx + 0x42c]
mov byte [rsp + 0x30], al
sub ecx, edi
mov esi, ecx
nop dword [rax + rax]
mov r8d, 1
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14002f090
sub rsi, 1
jne 0x140021080
lea rax, str._is_missing_
mov r8, rdi
mov rdx, rax
mov rcx, rbx
call fcn.14002f090
mov rdi, rsi
inc rdi
cmp byte [rdi + r12], 0
jne 0x1400210b1
mov ecx, dword [rbx + 0x430]
mov dword [rbx + 0x430], esi
cmp edi, ecx
jge 0x1400210f9
movzx eax, byte [rbx + 0x42c]
mov byte [rsp + 0x30], al
sub ecx, edi
mov esi, ecx
nop word [rax + rax]
mov r8d, 1
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14002f090
sub rsi, 1
jne 0x1400210e0
mov r8, rdi
mov rdx, r12
mov rcx, rbx
call fcn.14002f090
mov edx, ebp
mov rcx, rbx
call fcn.1400146a0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 8]
lea rbx, str.HKLM_registry_key_for_
lea rcx, [0x14019e670]
call fcn.140030de0
mov rdi, rax
test rax, rax
je 0x14002130a
mov rax, qword [rax]
mov qword [rsp + 0x20], r14
mov r9, r13
lea r8, str.default
mov edx, 1
mov rcx, rdi
call qword [rax + 8]
test al, al
je 0x14002130a
mov byte [rdi + 0xf8], 0x65
mov eax, esi
mov r8b, 0x2e
mov rcx, r13
mov edx, 1
nop word [rax + rax]
cmp r8b, 0x5c
cmove eax, edx
inc edx
inc rcx
movzx r8d, byte [rcx]
test r8b, r8b
jne 0x140021180
add rax, r13
mov qword [rdi + 0x100], rax
mov dword [rdi + 0x108], 0x38
mov qword [rdi + 0x110], r14
mov rcx, rdi
call fcn.1400027f0
mov rsi, rax
xor r14d, r14d
mov rdi, r14
inc rdi
cmp byte [rdi + rbx], r14b
jne 0x1400211c1
mov ecx, dword [rax + 0x430]
mov dword [rax + 0x430], r14d
cmp edi, ecx
jge 0x140021210
movzx eax, byte [rax + 0x42c]
mov byte [rsp + 0x30], al
sub ecx, edi
mov ebx, ecx
nop word [rax + rax]
mov r8d, 1
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.14002f090
sub rbx, 1
jne 0x1400211f0
lea rbx, str.HKLM_registry_key_for_
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call fcn.14002f090
lea rdx, str.SOFTWAREWow6432NodeSophosWeb_Intelligence
mov rcx, rsi
call fcn.140013b50
mov rbx, rax
mov rdi, r14
lea r13, str._is_missing_
nop word [rax + rax]
inc rdi
cmp byte [rdi + r13], r14b
jne 0x140021240
mov ecx, dword [rax + 0x430]
mov dword [rax + 0x430], r14d
cmp edi, ecx
jge 0x140021289
movzx eax, byte [rax + 0x42c]
mov byte [rsp + 0x30], al
sub ecx, edi
mov esi, ecx
nop dword [rax]
mov r8d, 1
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14002f090
sub rsi, 1
jne 0x140021270
mov r8, rdi
mov rdx, r13
mov rcx, rbx
call fcn.14002f090
mov rdi, r14
nop word [rax + rax]
inc rdi
cmp byte [rdi + r12], r14b
jne 0x1400212a0
mov ecx, dword [rbx + 0x430]
mov dword [rbx + 0x430], r14d
cmp edi, ecx
jge 0x1400212e9
movzx eax, byte [rbx + 0x42c]
mov byte [rsp + 0x30], al
sub ecx, edi
mov esi, ecx
nop dword [rax]
mov r8d, 1
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14002f090
sub rsi, 1
jne 0x1400212d0
mov r8, rdi
mov rdx, r12
mov rcx, rbx
call fcn.14002f090
mov edx, ebp
mov rcx, rbx
call fcn.1400146a0
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 8]
mov qword [rsp + 0x98], 7
xor ebx, ebx
mov qword [rsp + 0x90], rbx
mov word [rsp + 0x80], bx
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0xa0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x78]
call fcn.140001520
nop
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
lea r8d, [rbx + 3]
lea rdx, [0x1401a3938]
lea rcx, [rsp + 0x48]
call fcn.140001520
nop
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x78]
mov rcx, r15
call fcn.1400221e0
nop
cmp qword [rsp + 0x68], 8
jb 0x1400213a1
mov rcx, qword [rsp + 0x50]
call fcn.1400ddb14
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
cmp qword [rsp + 0x98], 8
jb 0x1400213d1
mov rcx, qword [rsp + 0x80]
call fcn.1400ddb14
mov rax, r15
jmp 0x1400213d4
mov rax, r15
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1400dd780
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret