Function at 0x140044ec0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x940
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x998], rbx
mov rax, qword [0x1400d2478]
xor rax, rsp
mov qword [rsp + 0x930], rax
movzx edi, r8b
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x90], 7
xor r15d, r15d
mov qword [rsp + 0x88], r15
mov word [rsp + 0x78], r15w
lea r8d, [r15 + 0x41]
lea rdx, str.PSWindowsInstallerUtilities::PSWIUTIL_IsProductSuspendedExecution
lea rcx, [rsp + 0x70]
call fcn.140001870
nop
xor r12b, r12b
lea r9, [rsp + 0x78]
cmp qword [rsp + 0x90], 8
cmovae r9, qword [rsp + 0x78]
lea rax, str.Function_start
mov qword [rsp + 0x20], rax
lea edx, [r15 + 0x32]
lea r8d, [r15 + 1]
mov rcx, rsi
call fcn.1400144a0
mov word [rsp + 0xf0], r15w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0xf2]
call fcn.1400719a0
mov qword [rsp + 0x58], r15
mov ebx, 0xf003f
cmp byte [0x1400d5081], r12b
jne 0x140044fa5
call fcn.14001dc80
test al, al
jne 0x140044fa5
xor r13b, r13b
jmp 0x140044fb2
movzx r13d, byte [0x1400d3748]
test r13b, r13b
jne 0x140044fbc
test dil, dil
je 0x140044fce
jmp 0x140045402
mov eax, 0x200
mov ecx, 0x100
test dil, dil
cmovne eax, ecx
or ebx, eax
mov edi, r15d
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInstallerRollbackScripts
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140045402
mov ebp, r15d
cmp edi, 0xea
je 0x140045010
test edi, edi
jne 0x1400453f7
mov word [rsp + 0x300], r15w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x302]
call fcn.1400719a0
mov dword [rsp + 0x60], 0x104
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x300]
mov edx, ebp
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
test eax, eax
jne 0x1400453f0
mov word [rsp + 0xa0], r15w
xor eax, eax
mov qword [rsp + 0xa2], rax
mov qword [rsp + 0xaa], rax
mov qword [rsp + 0xb2], rax
mov qword [rsp + 0xba], rax
mov qword [rsp + 0xc2], rax
mov qword [rsp + 0xca], rax
mov qword [rsp + 0xd2], rax
mov qword [rsp + 0xda], rax
mov qword [rsp + 0xe2], rax
mov dword [rsp + 0xea], eax
mov word [rsp + 0x40], r15w
mov word [rsp + 0x720], r15w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x722]
call fcn.1400719a0
mov dword [rsp + 0x54], 0x104
mov word [rsp + 0x510], r15w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x512]
call fcn.1400719a0
mov dword [rsp + 0x50], 0x104
lea r8, [rsp + 0x300]
mov edx, 0x104
lea rcx, [rsp + 0xf0]
call fcn.140065de0
test r13b, r13b
je 0x1400452dc
mov dword [rsp + 0x48], r15d
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.IsWow64Process
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x140045177
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x48]
call rbx
cmp dword [rsp + 0x48], 0
je 0x1400452dc
mov qword [rsp + 0x48], r15
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.Wow64DisableWow64FsRedirection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004528d
lea rcx, [rsp + 0x48]
call rax
test eax, eax
setne al
cmp al, 1
jne 0x140045298
lea r9, [rsp + 0x78]
cmp qword [rsp + 0x90], 8
cmovae r9, qword [rsp + 0x78]
lea rax, str.DeshabilitarWow64FsRedirection
mov qword [rsp + 0x20], rax
mov edx, 0x1e
lea r8d, [rdx - 0x1d]
mov rcx, rsi
call fcn.1400144a0
mov ebx, 1
mov rax, qword [0x1400d5200]
test rax, rax
je 0x14004524f
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x510]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x54]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x720]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x64]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0xf0]
call rax
mov ebx, eax
lea rcx, str.Kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.Wow64RevertWow64FsRedirection
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14004527d
mov rcx, qword [rsp + 0x48]
call rax
jmp 0x140045339
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x140045339
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_SetLastError]
lea r9, [rsp + 0x78]
cmp qword [rsp + 0x90], 8
cmovae r9, qword [rsp + 0x78]
lea rax, str.DeshabilitarWow64FsRedirection
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
lea rax, str.Error___i__return_by_function___s_
mov qword [rsp + 0x20], rax
mov edx, 0xa
lea r8d, [rdx - 9]
mov rcx, rsi
call fcn.1400144a0
jmp 0x140045341
mov ebx, 1
mov rax, qword [0x1400d5200]
test rax, rax
je 0x140045339
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x510]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x54]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x720]
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x64]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0xf0]
call rax
mov ebx, eax
test ebx, ebx
jne 0x1400453f0
mov rdx, r14
lea rcx, [rsp + 0xa0]
call fcn.140067a28
test rax, rax
jne 0x1400453a3
lea r9, [rsp + 0x78]
cmp qword [rsp + 0x90], 8
cmovae r9, qword [rsp + 0x78]
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x28], rax
lea rax, str.Parameter___s_:__s
mov qword [rsp + 0x20], rax
mov edx, 0x1e
lea r8d, [rdx - 0x1d]
mov rcx, rsi
call fcn.1400144a0
jmp 0x1400453f0
lea r9, [rsp + 0x78]
cmp qword [rsp + 0x90], 8
cmovae r9, qword [rsp + 0x78]
lea rax, str.TRUE
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x28], rax
lea rax, str.Parameter___s_:__s
mov qword [rsp + 0x20], rax
mov edx, reloc.Cabinet.dll_FDICreate
lea r8d, [rdx - 0x13]
mov rcx, rsi
call fcn.1400144a0
mov r12b, 1
inc ebp
jmp 0x140045000
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r9, [rsp + 0x78]
cmp qword [rsp + 0x90], 8
cmovae r9, qword [rsp + 0x78]
movzx eax, r12b
mov dword [rsp + 0x28], eax
lea rax, str.Return_code___i_
mov qword [rsp + 0x20], rax
mov edx, 0x28
lea r8d, [rdx - 0x27]
mov rcx, rsi
call fcn.1400144a0
lea r9, [rsp + 0x78]
cmp qword [rsp + 0x90], 8
cmovae r9, qword [rsp + 0x78]
lea rax, str.Function_end
mov qword [rsp + 0x20], rax
mov edx, 0x32
lea r8d, [rdx - 0x31]
mov rcx, rsi
call fcn.1400144a0
nop
cmp qword [rsp + 0x90], 8
jb 0x140045487
mov rcx, qword [rsp + 0x78]
call fcn.140065920
mov al, r12b
jmp 0x14004548a
mov al, r12b
mov rcx, qword [rsp + 0x930]
xor rcx, rsp
call fcn.140064b70
mov rbx, qword [rsp + 0x998]
add rsp, 0x940
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret