Function at 0x14002b850
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xa8
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov rax, qword [0x14006c100]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rdi, r9
mov r14, r8
mov rsi, rcx
xor r15d, r15d
mov qword [rbp - 0x39], r15
test rdx, rdx
je 0x14002b8cc
mov qword [rbp - 0x39], r15
lea rax, [rbp - 0x39]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14002bb57
mov rsi, qword [rbp - 0x39]
mov dword [rbp - 0x45], r15d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x45]
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14002bb57
mov eax, dword [rbp - 0x45]
sub eax, 1
je 0x14002baad
sub eax, 2
je 0x14002ba4b
sub eax, 1
je 0x14002b9f4
cmp eax, 7
je 0x14002b94e
mov rcx, qword [rbp + 0x5f]
mov ebx, 0x81333006
mov r9d, ebx
lea r8, str.onecoreenduserwindowsupdate_ruximplugliblibplugregistryhelper.cpp
mov edx, 0x47
call fcn.140003c18
jmp 0x14002bb57
mov dword [rbp - 0x41], r15d
mov dword [rbp - 0x49], 8
lea rax, [rbp - 0x49]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x31]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x41]
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14002bb57
cmp dword [rbp - 0x41], 0xb
je 0x14002b9aa
mov ebx, 0x8007139f
jmp 0x14002bb57
mov ebx, r15d
test ebx, ebx
js 0x14002bb57
mov rbx, qword [rbp - 0x31]
movsx rax, byte [rdi + 0x20]
cmp rax, 2
je 0x14002ba73
add rax, 1
je 0x14002b9ee
sub rax, 1
je 0x14002b9ee
sub rax, 1
je 0x14002b9ee
sub rax, 1
je 0x14002b9ee
cmp rax, 1
je 0x14002b9ee
mov rcx, rdi
call fcn.140007d04
mov byte [rdi + 0x20], 2
jmp 0x14002ba73
lea r9, [rbp - 0x49]
mov r8, r14
xor edx, edx
mov rcx, rsi
call fcn.1400119b4
mov ebx, eax
test eax, eax
js 0x14002bb57
mov ebx, dword [rbp - 0x49]
movsx rax, byte [rdi + 0x20]
cmp rax, 1
je 0x14002ba47
add rax, 1
je 0x14002ba43
sub rax, 1
je 0x14002ba43
sub rax, 1
je 0x14002ba43
sub rax, 1
je 0x14002ba43
cmp rax, 1
je 0x14002ba43
mov rcx, rdi
call fcn.140007d04
mov byte [rdi + 0x20], 1
mov dword [rdi], ebx
jmp 0x14002baa5
lea r9, [rbp - 0x31]
mov r8, r14
mov rcx, rsi
call fcn.140011c30
mov ebx, eax
test eax, eax
js 0x14002bb57
mov rbx, qword [rbp - 0x31]
movsx rax, byte [rdi + 0x20]
cmp rax, 3
jne 0x14002ba78
mov qword [rdi], rbx
jmp 0x14002baa5
add rax, 1
je 0x14002ba9e
sub rax, 1
je 0x14002ba9e
sub rax, 1
je 0x14002ba9e
sub rax, 1
je 0x14002ba9e
cmp rax, 1
je 0x14002ba9e
mov rcx, rdi
call fcn.140007d04
mov qword [rdi], rbx
mov byte [rdi + 0x20], 3
mov ebx, r15d
jmp 0x14002bb57
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], 7
mov word [rbp - 1], r15w
lea r9, [rbp - 1]
mov r8, r14
xor edx, edx
mov rcx, rsi
call fcn.140011a8c
mov ebx, eax
test eax, eax
js 0x14002bb4d
lea rdx, [rbp - 1]
cmp byte [rdi + 0x20], 4
jne 0x14002bae9
mov rcx, rdi
call fcn.140007614
jmp 0x14002bb4a
lea rcx, [rbp - 0x21]
call fcn.140007bd8
movsx rax, byte [rdi + 0x20]
add rax, 1
je 0x14002bb1d
sub rax, 1
je 0x14002bb1d
sub rax, 1
je 0x14002bb1d
sub rax, 1
je 0x14002bb1d
cmp rax, 1
je 0x14002bb1d
mov rcx, rdi
call fcn.140007d04
movups xmm0, xmmword [rbp - 0x21]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp - 0x11]
movups xmmword [rdi + 0x10], xmm1
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], 7
mov word [rbp - 0x21], r15w
mov byte [rdi + 0x20], 4
lea rcx, [rbp - 0x21]
call fcn.140007d04
mov ebx, r15d
lea rcx, [rbp - 1]
call fcn.140007d04
nop
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x14002bb6c
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.14004b180
add rsp, 0xa8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret