Function at 0x140016228
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov rax, qword [0x14003e090]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r12b, cl
call fcn.14001849c
xor r13d, r13d
cmp al, r13b
je 0x140016273
mov eax, 0x80004005
jmp 0x140016604
lea rax, [0x140037fb8]
lea rdx, [rsp + 0x40]
mov cl, r12b
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r13
call fcn.140015a68
mov rax, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call qword [rax + 8]
lea r15, [0x140037450]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r15
call fcn.140014ff8
lea rax, str.HKCUSoftwareGoogleUpdate_
mov qword [rsp + 0x30], r13
lea rdx, str.HKLMSoftwareGoogleUpdate_
cmp r12b, r13b
cmove rdx, rax
lea rcx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0xf003f
call fcn.14000c500
cmp eax, r13d
mov ebx, eax
jl 0x14001642b
mov rcx, qword [rsp + 0x58]
lea rdx, [0x140038d20]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r13d
jne 0x140016325
mov ebx, r13d
jmp 0x14001642b
mov rax, qword [section..data]
lea rcx, section..data
call qword [rax + 0x18]
lea rcx, [rsp + 0xb0]
mov dword [rsp + 0xb0], r13d
lea rbx, [rax + 0x18]
xor eax, eax
mov qword [rsp + 0x60], rbx
mov dword [rsp + 0xb4], eax
mov dword [rsp + 0xb8], eax
mov dword [rsp + 0xbc], eax
call qword [sym.imp.ole32.dll_CoCreateGuid]
or r14d, 0xffffffff
cmp eax, r13d
mov edi, eax
jl 0x1400163c6
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x88]
call fcn.140006b08
lea rcx, [rsp + 0x60]
mov rdx, rax
call fcn.140003024
mov rdx, qword [rsp + 0x88]
mov eax, r14d
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], eax
add eax, r14d
cmp eax, r13d
jg 0x1400163be
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x60]
mov edi, r13d
cmp edi, r13d
jge 0x1400163ea
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
cmp eax, r13d
jg 0x140016429
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
jmp 0x140016429
lea rdx, [0x140038d20]
lea rcx, [rsp + 0x50]
mov r9d, 1
mov r8, rbx
call fcn.14000cc10
cmp eax, r13d
mov edi, eax
jge 0x140016458
lea rdx, [rbx - 0x18]
mov ecx, r14d
lock xadd dword [rdx + 0x10], ecx
add ecx, r14d
cmp ecx, r13d
jg 0x140016429
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov ebx, edi
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], r15
call fcn.14000c424
mov rax, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call qword [rax + 0x10]
lea rcx, [rsp + 0x40]
call fcn.14000c28c
mov eax, ebx
jmp 0x140016604
lea rcx, [0x14003f7e8]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
add qword [0x14003fc40], 1
lea rcx, [0x14003f7e8]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x80], r13
call fcn.140015684
cmp eax, r13d
jl 0x1400165b1
mov rax, qword [rsp + 0x70]
cmp rax, r13
je 0x1400165b1
mov rdx, qword [rsp + 0x78]
sub rdx, rax
sar rdx, 3
cmp rdx, r13
je 0x1400165b1
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x98], r13
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0xa8], r13
call fcn.140005b78
cmp al, r13b
je 0x14001654d
mov rax, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
cmp rsi, rax
mov rbp, rax
jbe 0x140016517
call fcn.14001c0e0
mov rax, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
cmp rsi, rax
jbe 0x140016517
call fcn.14001c0e0
cmp rsi, rbp
mov rdi, qword [rsp + 0x98]
je 0x140016545
sub rsi, rdi
cmp rdi, r13
je 0x140016538
lea rdx, [rsi + rdi]
mov rcx, rdi
call fcn.140002eec
add rdi, 8
lea rax, [rsi + rdi]
cmp rax, rbp
jne 0x140016527
mov qword [rsp + 0xa0], rdi
lea rdx, [rsp + 0x90]
mov cl, r12b
call fcn.140015b60
lea rcx, [rsp + 0x68]
mov edi, eax
call fcn.140005878
lea rdx, [rbx - 0x18]
mov ecx, r14d
lock xadd dword [rdx + 0x10], ecx
add ecx, r14d
cmp ecx, r13d
jg 0x140016587
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], r15
call fcn.14000c424
mov rax, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call qword [rax + 0x10]
lea rcx, [rsp + 0x40]
call fcn.14000c28c
mov eax, edi
jmp 0x140016604
lea rcx, [rsp + 0x68]
call fcn.140005878
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
cmp eax, r13d
jg 0x1400165d9
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], r15
call fcn.14000c424
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x40]
call qword [rdx + 0x10]
lea rcx, [rsp + 0x40]
call fcn.14000c28c
mov eax, 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.14001cdd0
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret