Function at 0x14002d500
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x980]
sub rsp, 0xa80
mov r15d, r8d
mov byte [rsp + 0x50], 0
mov rsi, rdx
mov dword [rsp + 0x30], 4
mov r14, r9
lea r8, [rbp + 0x50]
xor r12d, r12d
mov edx, r15d
mov r9d, 0x104
mov dword [rbp + 0x9c0], r12d
mov ebx, 0x3f3
call fcn.14002caa0
mov edi, r15d
mov r13d, 0x200
and edi, 0x100
test r15b, 4
jne 0x14002d6b9
test edi, edi
mov ebx, 0x100
cmove ebx, r13d
or ebx, 0x20019
cmp dword [0x140129f48], r12d
jne 0x14002d5f7
lea rax, [rsp + 0x38]
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x50]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test eax, eax
jne 0x14002d6b9
mov rcx, qword [rsp + 0x38]
lea rax, [rbp + 0x9c0]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x50]
mov dword [rbp + 0x9c0], 0x100
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x14002d6a4
mov qword [rsp + 0x28], r12
lea r8, [rbp + 0x50]
mov r9d, 0x7fffffff
mov qword [rsp + 0x20], r12
mov edx, 0x104
lea rcx, [rbp + 0x160]
call fcn.14002b9c0
lea rax, [rsp + 0x38]
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x160]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x14002d6b9
mov qword [rsp + 0x28], r12
lea rcx, [rbp + 0x368]
mov r9d, 0x7fffffff
mov qword [rsp + 0x20], r12
mov r8, rsi
mov dword [rbp + 0x9c0], 0x100
mov edx, 0x104
call fcn.14002b9c0
mov rcx, qword [rsp + 0x38]
lea rax, [rbp + 0x9c0]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x50]
xor r8d, r8d
lea rdx, [rbp + 0x368]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x14002d80d
test r15b, 1
jne 0x14002d7fd
test edi, edi
mov ebx, 0x100
cmove ebx, r13d
or ebx, 0x20019
cmp dword [0x140129f48], r12d
jne 0x14002d743
lea rax, [rsp + 0x40]
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
test eax, eax
jne 0x14002d801
mov rcx, qword [rsp + 0x40]
lea rax, [rbp + 0x9c0]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x50]
mov dword [rbp + 0x9c0], 0x100
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jmp 0x14002d7f0
mov qword [rsp + 0x28], r12
lea r8, [rbp + 0x50]
mov r9d, 0x7fffffff
mov qword [rsp + 0x20], r12
mov edx, 0x104
lea rcx, [rbp + 0x570]
call fcn.14002b9c0
lea rax, [rsp + 0x40]
mov r9d, ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x570]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x14002d801
mov qword [rsp + 0x28], r12
lea rcx, [rbp + 0x778]
mov r9d, 0x7fffffff
mov qword [rsp + 0x20], r12
mov r8, rsi
mov dword [rbp + 0x9c0], 0x100
mov edx, 0x104
call fcn.14002b9c0
mov rcx, qword [rsp + 0x40]
lea rax, [rbp + 0x9c0]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x50]
xor r8d, r8d
lea rdx, [rbp + 0x778]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x40]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x14002d80d
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x14002d838
mov eax, dword [rsp + 0x30]
sub eax, 1
je 0x14002d821
cmp eax, 3
jne 0x14002d833
mov eax, dword [rsp + 0x50]
jmp 0x14002d830
xor r8d, r8d
lea rcx, [rsp + 0x50]
xor edx, edx
call fcn.1400c3658
mov dword [r14], eax
mov eax, 1
lea r11, [rsp + 0xa80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret