Function at 0x14002d550
Capabilities:
Query or enumerate registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x98
mov rdi, r8
mov rbx, rdx
mov r14, rcx
mov rax, qword [0x1400a9028]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 7
mov word [rsp + 0x70], 0
mov rcx, rdx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rsi, rax
lea rcx, [rsp + 0x70]
cmp rax, 7
ja 0x14002d5c7
mov qword [rcx + 0x10], rsi
mov r8, rsi
add r8, rsi
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov word [rsp + rsi*2 + 0x70], 0
jmp 0x14002d5d2
mov rdx, rsi
mov r9, rbx
call fcn.14005c1a0
movzx eax, word [rsp + 0x70]
mov rcx, qword [rsp + 0x72]
mov qword [rsp + 0x60], rcx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x66], rcx
movups xmm0, xmmword [rsp + 0x80]
mov word [rsp + 0x70], ax
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x66]
mov qword [rsp + 0x72], rax
mov qword [rsp + 0x78], rcx
movups xmmword [rsp + 0x80], xmm0
lea rbx, [rsp + 0x40]
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 7
mov word [rbx], 0
lea r9, str.SOFTWAREMozillaFirefoxDefault_Browser_Agent
mov edx, 0x2e
mov rcx, rbx
call fcn.14005c1a0
test rdi, rdi
je 0x14002d6d3
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
cmp rcx, rax
je 0x14002d7fc
lea rdx, [rax + 1]
mov qword [rsp + 0x50], rdx
cmp rcx, 8
jb 0x14002d672
mov rbx, qword [rsp + 0x40]
mov word [rbx + rax*2], 0x5c
mov word [rbx + rax*2 + 2], 0
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov rcx, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rdx, rbx
sub rdx, rcx
cmp rdx, rax
jb 0x14002d820
lea rsi, [rcx + rax]
mov qword [rsp + 0x50], rsi
cmp rbx, 8
jb 0x14002d6b6
mov rbx, qword [rsp + 0x40]
jmp 0x14002d6bb
lea rbx, [rsp + 0x40]
lea rcx, [rbx + rcx*2]
add rax, rax
mov rdx, rdi
mov r8, rax
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rsi*2], 0
mov dword [rsp + 0x38], 4
cmp qword [rsp + 0x88], 8
jb 0x14002d6ed
mov r8, qword [rsp + 0x70]
jmp 0x14002d6f2
lea r8, [rsp + 0x70]
cmp qword [rsp + 0x58], 8
jb 0x14002d701
mov rdx, qword [rsp + 0x40]
jmp 0x14002d706
lea rdx, [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov rcx, 0xffffffff80000001
mov r9d, 0x18
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x14002d748
cmp eax, 2
jne 0x14002d758
mov qword [r14], 0
jmp 0x14002d754
mov eax, dword [rsp + 0x3c]
bts rax, 0x20
mov qword [r14], rax
xor edi, edi
jmp 0x14002d781
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
lea rdx, str.RegistryGetValueDword
mov ecx, edi
mov r8d, 0x10c
call fcn.14002fad0
mov qword [r14], 0
mov dword [r14 + 8], edi
mov rax, qword [rsp + 0x58]
cmp rax, 8
jb 0x14002d7af
mov rcx, qword [rsp + 0x40]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14002d83a
call fcn.140058840
mov rax, qword [rsp + 0x88]
cmp rax, 8
jb 0x14002d7dc
mov rcx, qword [rsp + 0x70]
lea rdx, [rax + rax]
add rdx, 2
cmp rdx, 0x1000
jae 0x14002d85d
call fcn.140058840
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140059960
mov rax, r14
add rsp, 0x98
pop rbx
pop rdi
pop rsi
pop r14
ret
mov qword [rsp + 0x20], 1
lea r9, [0x1400a19f2]
lea rcx, [rsp + 0x40]
mov edx, 1
call fcn.14005c050
jmp 0x14002d67f
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x40]
mov rdx, rax
mov r9, rdi
call fcn.14005c050
jmp 0x14002d6d3
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x14002d880
add rax, rax
add rax, 0x29
mov rdx, rax
jmp 0x14002d7aa
mov rdx, rcx
add rdx, 0xfffffffffffffff8
mov rcx, qword [rcx - 8]
sub rdx, rcx
cmp rdx, 0x20
jae 0x14002d880
add rax, rax
add rax, 0x29
mov rdx, rax
jmp 0x14002d7d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3