Function at 0x14002a540
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rbx
push r12
push r13
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc0
xor r12d, r12d
mov rax, r9
test rdx, rdx
je 0x14002a571
mov dword [rdx], r12d
test r8, r8
je 0x14002a579
mov dword [r8], r12d
test rax, rax
je 0x14002a581
mov dword [r9], r12d
mov r13, qword [rbp + 0x77]
test r13, r13
je 0x14002a58e
mov dword [r13], r12d
mov r15, qword [rbp + 0x7f]
test r15, r15
je 0x14002a59a
mov qword [r15], r12
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xb0], r14
call fcn.1402186b0
mov rbx, rax
test rax, rax
je 0x14002aa3b
mov edx, 0x5c
mov rcx, rax
call fcn.14020d544
test rax, rax
jne 0x14002a5e7
mov rcx, rbx
call fcn.1402122e0
mov eax, 1
jmp 0x14002aa40
mov word [rax], r12w
lea r9, [rax + 2]
lea rax, [rbp - 9]
mov r8, rbx
mov qword [rsp + 0x30], rax
xor edx, edx
lea rax, [rbp - 0x39]
xor ecx, ecx
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x35]
mov qword [rsp + 0x20], rax
call fcn.140029ed0
mov rcx, rbx
mov edi, eax
call fcn.1402122e0
test edi, edi
je 0x14002a62b
mov eax, edi
jmp 0x14002aa40
mov rbx, qword [rbp - 9]
mov ecx, r12d
mov esi, dword [rbp - 0x35]
mov edx, r12d
mov qword [rbp - 1], rbx
mov eax, 1
mov dword [rbp - 0x21], esi
mov r14, rbx
mov dword [rbp - 0x15], edx
mov dword [rbp - 0x1d], eax
mov dword [rbp - 0x19], ecx
mov qword [rbp + 7], rcx
test rbx, rbx
je 0x14002a94f
mov rsi, rbx
mov qword [rbp - 9], rbx
mov rdi, rbx
xor r13d, r13d
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rax, [rbp - 0x29]
mov qword [rsp + 0x58], r13
xor r9d, r9d
mov qword [rsp + 0x50], r13
xor r8d, r8d
mov qword [rsp + 0x48], r13
xor edx, edx
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x31]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x14002ac08
mov edx, dword [rbp - 0x31]
lea ecx, [rax + 1]
inc edx
add rdx, rdx
call fcn.1402122f4
mov qword [rbp - 0x11], rax
mov r15, rax
test rax, rax
je 0x14002abc3
mov ecx, dword [rbp - 0x31]
lea r9, [rbp - 0x2d]
xor eax, eax
inc ecx
mov qword [rsp + 0x38], rax
mov r8, r15
mov qword [rsp + 0x30], rax
xor edx, edx
mov dword [rbp - 0x2d], ecx
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x14002a7dc
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
call fcn.1400246f0
mov rsi, rax
test rax, rax
je 0x14002a9e9
lea rax, [rbp - 1]
mov r9, r15
mov qword [rsp + 0x30], rax
mov r8, rsi
lea rax, [rbp - 0x39]
mov rdx, r14
mov qword [rsp + 0x28], rax
mov rcx, rdi
lea rax, [rbp - 0x35]
mov qword [rsp + 0x20], rax
call fcn.140029ed0
mov r15d, eax
test eax, eax
jne 0x14002a98a
mov rcx, rsi
call fcn.1402122e0
cmp byte [rbp - 0x39], r15b
jne 0x14002a77a
mov esi, dword [rbp - 0x21]
add esi, dword [rbp - 0x35]
mov dword [rbp - 0x21], esi
inc dword [rbp - 0x1d]
mov rax, qword [rbp - 1]
cmp rax, r14
je 0x14002a797
cmp qword [rbp + 7], 0
mov r12, rax
mov r14, rax
jne 0x14002a797
mov qword [rbp + 7], rax
mov eax, dword [rbp - 0x31]
lea r9, [rbp - 0x2d]
mov r15, qword [rbp - 0x11]
inc r13d
inc eax
mov r8, r15
mov dword [rbp - 0x2d], eax
mov edx, r13d
mov rcx, qword [rdi + 8]
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x14002a713
mov rsi, qword [rbp - 9]
cmp eax, 0x103
jne 0x14002ab6c
mov edx, dword [rbp - 0x29]
mov ecx, 1
inc edx
add rdx, rdx
call fcn.1402122f4
mov r15, rax
test rax, rax
je 0x14002ab21
mov ecx, dword [rbp - 0x29]
lea r9, [rbp - 0x25]
xor eax, eax
mov r8, r15
mov qword [rsp + 0x38], rax
inc ecx
mov qword [rsp + 0x30], rax
xor edx, edx
mov dword [rbp - 0x25], ecx
mov r13d, eax
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x14002a8da
mov rdx, qword [rdi + 0x20]
mov rcx, qword [rdi + 0x18]
call fcn.1400246f0
mov rsi, rax
test rax, rax
je 0x14002aacc
lea rax, [rbp - 1]
mov r8, r15
lea r9, [rbp + 0xf]
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov rcx, r14
call fcn.14002a2e0
mov rcx, rsi
mov r14d, eax
call fcn.1402122e0
test r14d, r14d
jne 0x14002aa68
mov eax, dword [rbp - 0x15]
lea r9, [rbp - 0x25]
add eax, dword [rbp + 0xf]
inc r13d
inc dword [rbp - 0x19]
mov r8, r15
mov r14, qword [rbp - 1]
mov edx, r13d
mov dword [rbp - 0x15], eax
mov eax, dword [rbp - 0x29]
inc eax
mov dword [rbp - 0x25], eax
xor eax, eax
mov rcx, qword [rdi + 8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x14002a841
mov rsi, qword [rbp - 9]
mov rcx, r15
call fcn.1402122e0
cmp rdi, rsi
jne 0x14002a90f
mov rcx, qword [rbp + 7]
xor r13d, r13d
test rcx, rcx
mov qword [rbp + 7], r13
mov eax, r13d
mov rdi, rcx
cmove rax, r12
cmove r12, rsi
mov rsi, r12
mov qword [rbp - 9], r12
mov r12, rax
jmp 0x14002a929
mov rdi, qword [rdi]
test rdi, rdi
je 0x14002a926
cmp qword [rdi + 8], 0
jne 0x14002a926
mov rdi, qword [rdi]
test rdi, rdi
jne 0x14002a917
xor r13d, r13d
mov rcx, qword [rbp - 0x11]
call fcn.1402122e0
test rdi, rdi
jne 0x14002a670
mov esi, dword [rbp - 0x21]
mov eax, dword [rbp - 0x1d]
mov ecx, dword [rbp - 0x19]
mov edx, dword [rbp - 0x15]
mov r15, qword [rbp + 0x7f]
mov r13, qword [rbp + 0x77]
mov r8, qword [rbp + 0x5f]
test r8, r8
je 0x14002a95b
mov dword [r8], esi
mov r8, qword [rbp + 0x67]
test r8, r8
je 0x14002a967
mov dword [r8], edx
mov rdx, qword [rbp + 0x6f]
test rdx, rdx
je 0x14002a972
mov dword [rdx], eax
test r13, r13
je 0x14002a97b
mov dword [r13], ecx
test r15, r15
je 0x14002a983
mov qword [r15], rbx
xor eax, eax
jmp 0x14002aa40
mov rdi, rbx
nop dword [rax]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14002a99f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rdi + 0x18]
call fcn.1402122e0
mov rcx, qword [rdi + 0x20]
call fcn.1402122e0
mov rdi, qword [rdi]
test rdi, rdi
jne 0x14002a990
nop dword [rax]
mov rdi, qword [rbx]
mov rcx, rbx
call fcn.1402122e0
mov rbx, rdi
test rdi, rdi
jne 0x14002a9c0
mov rcx, rsi
call fcn.1402122e0
mov rcx, qword [rbp - 0x11]
call fcn.1402122e0
mov eax, r15d
jmp 0x14002aa40
mov rdi, rbx
nop dword [rax]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14002a9ff
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rdi + 0x18]
call fcn.1402122e0
mov rcx, qword [rdi + 0x20]
call fcn.1402122e0
mov rdi, qword [rdi]
test rdi, rdi
jne 0x14002a9f0
nop dword [rax]
mov rdi, qword [rbx]
mov rcx, rbx
call fcn.1402122e0
mov rbx, rdi
test rdi, rdi
jne 0x14002aa20
mov rcx, r15
call fcn.1402122e0
mov eax, 6
mov r14, qword [rsp + 0xb0]
mov rdi, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xf0]
add rsp, 0xc0
pop r15
pop r13
pop r12
pop rbx
pop rbp
ret
mov rdi, rbx
nop dword [rax + rax]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14002aa7f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rdi + 0x18]
call fcn.1402122e0
mov rcx, qword [rdi + 0x20]
call fcn.1402122e0
mov rdi, qword [rdi]
test rdi, rdi
jne 0x14002aa70
nop dword [rax]
mov rdi, qword [rbx]
mov rcx, rbx
call fcn.1402122e0
mov rbx, rdi
test rdi, rdi
jne 0x14002aaa0
mov rcx, qword [rbp - 0x11]
call fcn.1402122e0
mov rcx, r15
call fcn.1402122e0
mov eax, r14d
jmp 0x14002aa40
mov rdi, rbx
nop
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14002aadf
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rdi + 0x18]
call fcn.1402122e0
mov rcx, qword [rdi + 0x20]
call fcn.1402122e0
mov rdi, qword [rdi]
test rdi, rdi
jne 0x14002aad0
nop dword [rax]
mov rdi, qword [rbx]
mov rcx, rbx
call fcn.1402122e0
mov rbx, rdi
test rdi, rdi
jne 0x14002ab00
mov rcx, qword [rbp - 0x11]
call fcn.1402122e0
jmp 0x14002aa33
mov rdi, rbx
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14002ab33
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rdi + 0x18]
call fcn.1402122e0
mov rcx, qword [rdi + 0x20]
call fcn.1402122e0
mov rdi, qword [rdi]
test rdi, rdi
jne 0x14002ab24
nop dword [rax]
mov rdi, qword [rbx]
mov rcx, rbx
call fcn.1402122e0
mov rbx, rdi
test rdi, rdi
jne 0x14002ab50
mov r15, qword [rbp - 0x11]
jmp 0x14002aa33
mov rdi, rbx
nop
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14002ab7f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rdi + 0x18]
call fcn.1402122e0
mov rcx, qword [rdi + 0x20]
call fcn.1402122e0
mov rdi, qword [rdi]
test rdi, rdi
jne 0x14002ab70
nop dword [rax]
mov rdi, qword [rbx]
mov rcx, rbx
call fcn.1402122e0
mov rbx, rdi
test rdi, rdi
jne 0x14002aba0
mov rcx, r15
call fcn.1402122e0
lea eax, [rdi + 0xd]
jmp 0x14002aa40
mov rdi, rbx
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14002abd5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rdi + 0x18]
call fcn.1402122e0
mov rcx, qword [rdi + 0x20]
call fcn.1402122e0
mov rdi, qword [rdi]
test rdi, rdi
jne 0x14002abc6
nop
mov rdi, qword [rbx]
mov rcx, rbx
call fcn.1402122e0
mov rbx, rdi
test rdi, rdi
jne 0x14002abf0
jmp 0x14002aa3b
mov rdi, rbx
nop dword [rax + rax]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14002ac1f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rdi + 0x18]
call fcn.1402122e0
mov rcx, qword [rdi + 0x20]
call fcn.1402122e0
mov rdi, qword [rdi]
test rdi, rdi
jne 0x14002ac10
nop dword [rax]
mov rdi, qword [rbx]
mov rcx, rbx
call fcn.1402122e0
mov rbx, rdi
test rdi, rdi
jne 0x14002ac40
lea eax, [rdi + 0xd]
jmp 0x14002aa40