Function at 0x140002fe0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x14000e028]
xor rax, rsp
mov qword [rbp + 0x150], rax
movsd xmm0, qword [str..EXE]
lea r8, [rsp + 0x38]
movsd qword [rcx], xmm0
mov rsi, rdx
movzx eax, word [0x140009ae8]
lea rdx, str.SoftwareAdobeAdobe_AcrobatDCLanguagecurrent
mov word [rcx + 8], ax
mov rdi, rcx
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x30], 0x200
call qword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegOpenKeyW]
test eax, eax
je 0x14000317a
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000002
lea rdx, str.SoftwareAdobeAdobe_AcrobatDCLanguagecurrent
call qword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegOpenKeyW]
test eax, eax
je 0x14000317a
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareAdobeAcrobat_ReaderDCLanguagecurrent
call qword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegOpenKeyW]
test eax, eax
je 0x14000317a
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000002
lea rdx, str.SoftwareAdobeAcrobat_ReaderDCLanguagecurrent
call qword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegOpenKeyW]
test eax, eax
je 0x14000317a
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareAdobeAcrobat_ElementsDCLanguage
call qword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegOpenKeyW]
test eax, eax
je 0x1400030ef
lea r8, [rsp + 0x38]
mov rcx, 0xffffffff80000002
lea rdx, str.SoftwareAdobeAcrobat_ElementsDCLanguage
call qword [sym.imp.api_ms_win_core_registry_l2_1_0.dll_RegOpenKeyW]
test eax, eax
jne 0x140003226
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x50]
xor r8d, r8d
lea rdx, [0x140009c28]
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test ebx, ebx
jne 0x140003226
cmp dword [rsp + 0x40], 1
jne 0x140003226
cmp dword [rsp + 0x30], 4
ja 0x140003226
lea rax, [rsp + 0x50]
sub rdi, rax
lea rcx, [rsp + 0x50]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdi + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140003160
mov eax, 1
jmp 0x140003228
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov ebx, eax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test ebx, ebx
jne 0x140003226
cmp dword [rsp + 0x40], 1
jne 0x140003226
mov r8d, dword [rsp + 0x30]
cmp r8d, 4
jb 0x140003226
lea rcx, [rsp + 0x50]
mov rax, 0xffffffffffffffff
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x1400031d2
lea rdx, [rsp + rax*2 + 0x48]
sub rdi, rdx
nop word [rax + rax]
movzx eax, word [rdx]
mov word [rdi + rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x1400031f0
test rsi, rsi
je 0x14000321f
cmp r8d, 0xd
jb 0x14000321f
mov r8d, 0xd
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov eax, 1
jmp 0x140003228
xor eax, eax
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.140007360
mov rbx, qword [rsp + 0x290]
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret