Function at 0x1400e3fc0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xa0
mov rax, qword [0x1402fa010]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r15, r8
mov r14, rdx
mov rsi, rcx
mov qword [rbp - 0x11], rcx
xor r12d, r12d
mov dword [rbp - 0x49], r12d
mov dword [r8], r12d
mov dword [rdx], r12d
mov rax, qword [rcx]
cmp dword [rax - 0x10], r12d
jne 0x1400e400d
mov rdx, qword [rcx]
jmp 0x1400e4068
mov qword [rbp - 9], r12
mov qword [rbp - 9], r12
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x1400e4024
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 9], r12
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareBandizipUpdater
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400e4094
mov rcx, qword [rbp - 9]
test rcx, rcx
je 0x1400e4061
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 9], r12
mov rdx, qword [rsi]
sub rdx, 0x18
mov rdi, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400e408d
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
xor al, al
jmp 0x1400e43c5
call fcn.1400195b0
mov rcx, rax
test rax, rax
je 0x1400e43ee
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
add rax, 0x18
mov qword [rbp - 0x39], rax
lea rbx, str.BuildNo
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.140018bd0
mov rdi, 0xffffffffffffffff
test al, al
jne 0x1400e40f8
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x1400e40e0
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.140018f70
nop
mov dword [rbp - 0x49], 1
lea r8, [0x140265c84]
lea rdx, [rbp - 0x39]
lea rcx, [rbp - 0x19]
call fcn.1400179d0
nop
mov dword [rbp - 0x49], 3
mov r8, rsi
mov rdx, rax
lea rcx, [rbp - 0x21]
call fcn.140029020
nop
mov ebx, 7
mov dword [rbp - 0x49], ebx
mov rdx, qword [rax]
mov dword [rbp - 1], r12d
mov dword [rbp + 7], 4
mov dword [rbp + 0xb], 4
mov dword [r14], r12d
lea rax, [rbp + 7]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 1]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xb]
xor r8d, r8d
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e425d
mov eax, dword [rbp - 1]
mov dword [r14], eax
call fcn.1400195b0
mov rcx, rax
test rax, rax
je 0x1400e43e3
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
add rax, 0x18
mov qword [rbp - 0x41], rax
lea rbx, str.BuildNoCur
mov rdx, rbx
lea rcx, [rbp - 0x41]
call fcn.140018bd0
test al, al
jne 0x1400e41d8
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rbx + r8*2], 0
jne 0x1400e41c0
mov rdx, rbx
lea rcx, [rbp - 0x41]
call fcn.140018f70
nop
mov dword [rbp - 0x49], InitCommonControls
lea r8, [0x140265c84]
lea rdx, [rbp - 0x41]
lea rcx, [rbp - 0x29]
call fcn.1400179d0
nop
mov dword [rbp - 0x49], 0x1f
mov r8, rsi
mov rdx, rax
lea rcx, [rbp - 0x31]
call fcn.140029020
nop
mov ebx, 0x3f
mov dword [rbp - 0x49], ebx
mov rdx, qword [rax]
mov dword [rbp + 3], r12d
mov dword [rbp + 0xf], 4
mov dword [rbp + 0x13], 4
mov dword [r15], r12d
lea rax, [rbp + 0xf]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 3]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x13]
xor r8d, r8d
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400e425d
mov eax, dword [rbp + 3]
mov dword [r15], eax
xor r14b, r14b
jmp 0x1400e4260
mov r14b, 1
test bl, 0x20
je 0x1400e4292
and ebx, 0xffffffdf
mov dword [rbp - 0x49], ebx
mov rdx, qword [rbp - 0x31]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400e428f
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
mov ebx, dword [rbp - 0x49]
test bl, 0x10
je 0x1400e42c4
and ebx, 0xffffffef
mov dword [rbp - 0x49], ebx
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400e42c1
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
mov ebx, dword [rbp - 0x49]
test bl, 8
je 0x1400e42f6
and ebx, 0xfffffff7
mov dword [rbp - 0x49], ebx
mov rdx, qword [rbp - 0x41]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400e42f3
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
mov ebx, dword [rbp - 0x49]
test bl, 4
je 0x1400e4328
and ebx, 0xfffffffb
mov dword [rbp - 0x49], ebx
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400e4325
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
mov ebx, dword [rbp - 0x49]
test bl, 2
je 0x1400e435a
and ebx, 0xfffffffd
mov dword [rbp - 0x49], ebx
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400e4357
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
mov ebx, dword [rbp - 0x49]
test bl, 1
je 0x1400e4388
and ebx, 0xfffffffe
mov dword [rbp - 0x49], ebx
mov rdx, qword [rbp - 0x39]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400e4388
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rcx, qword [rbp - 9]
test r14b, r14b
je 0x1400e43ac
test rcx, rcx
je 0x1400e439c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 9], r12
mov rcx, rsi
call fcn.1400192d0
xor al, al
jmp 0x1400e43c5
test rcx, rcx
je 0x1400e43b7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 9], r12
mov rcx, rsi
call fcn.1400192d0
mov al, 1
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1401f3bf0
add rsp, 0xa0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.140019320
nop
mov ecx, 0x80004005
call fcn.140019320
int3