Function at 0x1400e63b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov rax, qword [0x140300040]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r15, r8
mov r14, rdx
mov rsi, rcx
mov qword [rbp - 0x11], rcx
xor r12d, r12d
mov dword [rbp - 0x49], r12d
mov dword [r8], r12d
mov dword [rdx], r12d
mov rax, qword [rcx]
cmp dword [rax - 0x10], r12d
jne 0x1400e63fd
mov rdx, qword [rcx]
jmp 0x1400e6458
mov qword [rbp - 9], r12
mov qword [rbp - 9], r12
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x1400e6414
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 9], r12
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareBandizipUpdater
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400e6484
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x1400e6451
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 9], r12
mov rdx, qword [rsi]
sub rdx, 0x18
mov rdi, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400e647d
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
xor al, al
jmp 0x1400e67b5
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x1400e67de
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rbp - 0x39], rax
lea rbx, str.BuildNo
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.140018bb0
mov rdi, 0xffffffffffffffff
test al, al
jne 0x1400e64e8
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x1400e64d0
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.140018f50
nop
mov dword [rbp - 0x49], 1
lea r8, [0x14026acc4]
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x19]
call fcn.1400179b0
nop
mov dword [rbp - 0x49], 3
mov r8, rsi
mov rdx, rax
lea rcx, [rbp - 0x21]
call fcn.140029150
nop
mov ebx, 7
mov dword [rbp - 0x49], ebx
mov rdx, qword [rax]
mov dword [rbp - 1], r12d
mov dword [rbp + 7], 4
mov dword [rbp + 0xb], 4
mov dword [r14], r12d
lea rax, [rbp + 7]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 1]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xb]
xor r8d, r8d
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e664d
mov eax, dword [rbp - 1]
mov dword [r14], eax
call fcn.140019590
mov rcx, rax
test rax, rax
je 0x1400e67d3
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038ca6.0]
add rax, 0x18
mov qword [rbp - 0x41], rax
lea rbx, str.BuildNoCur
mov rdx, rbx
lea rcx, [rbp - 0x41]
call fcn.140018bb0
test al, al
jne 0x1400e65c8
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x1400e65b0
mov rdx, rbx
lea rcx, [rbp - 0x41]
call fcn.140018f50
nop
mov dword [rbp - 0x49], InitCommonControls
lea r8, [0x14026acc4]
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 0x29]
call fcn.1400179b0
nop
mov dword [rbp - 0x49], 0x1f
mov r8, rsi
mov rdx, rax
lea rcx, [rbp - 0x31]
call fcn.140029150
nop
mov ebx, 0x3f
mov dword [rbp - 0x49], ebx
mov rdx, qword [rax]
mov dword [rbp + 3], r12d
mov dword [rbp + 0xf], 4
mov dword [rbp + 0x13], 4
mov dword [r15], r12d
lea rax, [rbp + 0xf]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 3]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x13]
xor r8d, r8d
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e664d
mov eax, dword [rbp + 3]
mov dword [r15], eax
xor r14b, r14b
jmp 0x1400e6650
mov r14b, 1
test bl, 0x20
je 0x1400e6682
and ebx, 0xffffffdf
mov dword [rbp - 0x49], ebx
mov rdx, qword [rbp - 0x31]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400e667f
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov ebx, dword [rbp - 0x49]
test bl, 0x10
je 0x1400e66b4
and ebx, 0xffffffef
mov dword [rbp - 0x49], ebx
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400e66b1
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov ebx, dword [rbp - 0x49]
test bl, 8
je 0x1400e66e6
and ebx, 0xfffffff7
mov dword [rbp - 0x49], ebx
mov rdx, qword [rbp - 0x41]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400e66e3
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov ebx, dword [rbp - 0x49]
test bl, 4
je 0x1400e6718
and ebx, 0xfffffffb
mov dword [rbp - 0x49], ebx
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400e6715
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov ebx, dword [rbp - 0x49]
test bl, 2
je 0x1400e674a
and ebx, 0xfffffffd
mov dword [rbp - 0x49], ebx
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400e6747
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
mov ebx, dword [rbp - 0x49]
test bl, 1
je 0x1400e6778
and ebx, 0xfffffffe
mov dword [rbp - 0x49], ebx
mov rdx, qword [rbp - 0x39]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400e6778
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038ca6.0]
nop
mov rcx, qword [rbp - 9]
test r14b, r14b
je 0x1400e679c
test rcx, rcx
je 0x1400e678c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 9], r12
mov rcx, rsi
call fcn.1400192b0
xor al, al
jmp 0x1400e67b5
test rcx, rcx
je 0x1400e67a7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 9], r12
mov rcx, rsi
call fcn.1400192b0
mov al, 1
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1401f74b0
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.140019300
nop
mov ecx, 0x80004005
call fcn.140019300
int3