Function at 0x1400123c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xf]
sub rsp, 0xd0
mov rax, qword [0x140090008]
xor rax, rsp
mov qword [rbp - 1], rax
mov r14, r9
mov rsi, r8
mov r13, rdx
mov rax, qword [rbp + 0x6f]
mov qword [rsp + 0x38], rax
mov r15, qword [rbp + 0x77]
mov r12, qword [rbp + 0x7f]
xor eax, eax
mov qword [rbp - 0x79], rax
mov ebx, eax
mov qword [rsp + 0x40], rax
lea r8, [rbp - 0x79]
mov rdx, rsi
mov rcx, qword [rcx]
call fcn.1400128c0
xor eax, eax
cmp qword [rbp - 0x79], rax
je 0x1400126a2
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp - 0x79]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ecx, eax
xor edx, edx
test eax, eax
jne 0x140012465
mov rbx, qword [rsp + 0x30]
mov qword [rsp + 0x40], rbx
jmp 0x14001247a
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
test eax, eax
js 0x1400126a2
mov qword [rsp + 0x20], rdx
mov r9, r14
lea rdx, [0x1400732f0]
mov rcx, rbx
call fcn.14001220c
test eax, eax
jne 0x14001249d
lea esi, [rax + 3]
jmp 0x1400126a7
mov r8d, 0x32
lea rdx, [rbp - 0x71]
mov rcx, rsi
call qword [sym.imp.ole32.dll_StringFromGUID2]
lea rdx, [rbp - 0x71]
or rsi, 0xffffffffffffffff
mov rax, rsi
xor ecx, ecx
inc rax
cmp word [rdx + rax*2], cx
jne 0x1400124bd
mov r8d, eax
lea rdx, [rbp - 0x71]
mov rcx, r14
call fcn.1400148dc
xor ecx, ecx
test eax, eax
js 0x1400126e9
lea rdx, [0x1400732e8]
mov rax, rsi
inc rax
cmp word [rdx + rax*2], cx
jne 0x1400124e9
mov r8d, eax
mov rcx, r14
call fcn.1400148dc
xor ecx, ecx
test eax, eax
js 0x1400126f1
mov qword [rsp + 0x20], rcx
mov r9, r14
lea rdx, [0x140073308]
mov rcx, rbx
call fcn.14001220c
xor ecx, ecx
test eax, eax
jne 0x14001252c
lea esi, [rcx + 4]
jmp 0x1400126a7
mov qword [rsp + 0x20], rcx
mov r9, r14
lea rdx, [0x140073320]
mov rcx, rbx
call fcn.14001220c
xor ecx, ecx
test eax, eax
jne 0x140012551
lea esi, [rcx + 5]
jmp 0x1400126a7
lea rdx, str.n_a_
inc rsi
cmp word [rdx + rsi*2], cx
jne 0x140012558
mov r8d, esi
mov rcx, r14
call fcn.1400148dc
test eax, eax
js 0x1400126e1
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9, r14
lea rdx, str.MinEdition
mov rcx, rbx
call fcn.14001220c
xor r14d, r14d
test eax, eax
jne 0x14001259f
lea esi, [rax + 6]
jmp 0x1400126a7
test r15, r15
je 0x140012674
mov rdx, qword [r13]
mov esi, 4
test rdx, rdx
je 0x140012610
test rbx, rbx
je 0x14001266d
mov dword [rsp + 0x38], r14d
mov dword [rsp + 0x30], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
test eax, eax
jne 0x1400125ff
cmp dword [rsp + 0x38], esi
jne 0x1400125fa
cmp dword [rsp + 0x30], esi
je 0x1400125ff
mov dword [r15], r14d
jmp 0x140012610
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
test eax, eax
jns 0x140012674
test rbx, rbx
je 0x14001266d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x38], esi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, [0x14007111c]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
test eax, eax
jne 0x14001265c
cmp dword [rsp + 0x30], esi
jne 0x140012657
cmp dword [rsp + 0x38], esi
je 0x14001265c
mov dword [r15], r14d
jmp 0x14001266d
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
test eax, eax
jns 0x140012674
mov esi, 7
jmp 0x1400126a7
test r12, r12
je 0x14001269d
mov r8, r12
lea rdx, str.InprocServer32
lea rcx, [rsp + 0x40]
call fcn.14000f664
mov rbx, qword [rsp + 0x40]
test eax, eax
jns 0x14001269d
mov esi, 8
jmp 0x1400126a7
mov esi, r14d
jmp 0x1400126a7
mov esi, 2
test rbx, rbx
je 0x1400126b6
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, esi
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.140052570
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbx
pop rbp
ret
mov ecx, eax
call fcn.140002fa4
int3
mov ecx, eax
call fcn.140002fa4
int3
mov ecx, eax
call fcn.140002fa4
int3