Function at 0x14001d7b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1ff0]
mov eax, 0x20f0
call fcn.14002bb20
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x2140], rbx
mov rax, qword [0x140064d98]
xor rax, rsp
mov qword [rbp + 0x1fe0], rax
mov ebx, edx
mov rdi, rcx
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x40], 6
lea edx, [rax + 0x55]
lea rcx, [0x14006de90]
call fcn.14000b480
mov rcx, rax
call fcn.140005da0
mov qword [rsp + 0x50], rax
imul eax, ebx, 0x37
mov dword [rsp + 0x48], eax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x1061
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x56
lea rcx, [0x14006de90]
call fcn.14000b480
mov rcx, rax
call fcn.140005da0
mov qword [rsp + 0x50], rax
imul eax, ebx, 0xe
mov dword [rsp + 0x48], eax
lea r9, [rsp + 0x40]
mov edx, 0x1061
mov r8d, 1
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x57
lea rcx, [0x14006de90]
call fcn.14000b480
mov rcx, rax
call fcn.140005da0
mov qword [rsp + 0x50], rax
imul eax, ebx, 0x23
mov dword [rsp + 0x48], eax
lea r9, [rsp + 0x40]
mov edx, 0x1061
mov r8d, 2
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x7c], 0
mov dword [rsp + 0x78], 0
mov edx, 0x55
lea rcx, [0x14006bf80]
call fcn.14000b480
mov rcx, rax
call fcn.140005da0
mov rdx, rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001d9fb
lea edx, [rax + 0x4d]
lea rcx, [0x14006bf80]
call fcn.14000b480
mov rcx, rax
call fcn.140005da0
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x7c]
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [rsp + 0x78]
add eax, 2
mov ebx, eax
mov ecx, eax
call fcn.140002ff0
mov r15, rax
test rax, rax
je 0x14001d99e
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.14002d420
jmp 0x14001d9a1
xor r15d, r15d
mov edx, 0x4d
lea rcx, [0x14006bf80]
call fcn.14000b480
mov rcx, rax
call fcn.140005da0
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14001d9ef
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x14001da02
mov rcx, r15
call fcn.14002ba80
xor eax, eax
jmp 0x14001dd6d
xor eax, eax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
lea ecx, [rax + 0x10]
call fcn.14002ba44
mov qword [0x14006ee00], rax
mov ecx, 0x14
call fcn.14002ba44
test rax, rax
je 0x14001da4f
mov rcx, rax
call fcn.14000b270
mov rcx, rax
jmp 0x14001da51
xor ecx, ecx
mov rdx, qword [0x14006ee00]
mov qword [rdx], rcx
mov eax, dword [r15]
mov dword [rcx], eax
mov rcx, qword [rdx]
mov eax, dword [r15 + 4]
mov dword [rcx + 4], eax
mov rax, qword [rdx]
cmp dword [rax + 4], 0
je 0x14001d9fb
mov ecx, 0x12460
call fcn.140002ff0
mov rbx, rax
test rax, rax
je 0x14001dab1
xor edx, edx
mov r8d, 0x12460
mov rcx, rax
call fcn.14002d420
lea r9, [0x14000b290]
mov edx, 0x20
mov r8d, 0x923
mov rcx, rbx
call fcn.14000b5c0
jmp 0x14001dab3
xor ebx, ebx
mov rcx, qword [0x14006ee00]
mov qword [rcx + 8], rbx
mov rcx, qword [rcx]
mov eax, dword [r15 + 8]
mov dword [rcx + 8], eax
lea rbx, [r15 + 0x14]
lea rcx, [0x14006de20]
call fcn.1400290b0
lea rcx, [0x14006de78]
call fcn.1400290b0
mov edx, dword [rsp + 0x78]
lea rcx, [0x14006de20]
call fcn.140009270
mov edx, dword [rsp + 0x78]
lea rcx, [0x14006de78]
call fcn.140009270
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp - 0x20]
call fcn.14002d420
xor r12d, r12d
test rbx, rbx
je 0x14001dd62
xor edi, edi
mov rdx, qword [0x14006ee00]
nop word [rax + rax]
mov r13, rbx
mov rcx, qword [rdx + 8]
movzx eax, word [rbx]
mov word [rdi + rcx], ax
mov rcx, qword [rdx + 8]
movzx r14d, word [rcx + rdi]
add r14, rbx
movzx eax, word [rbx + 2]
mov word [rcx + rdi + 2], ax
mov rcx, qword [rdx + 8]
cmp word [rcx + rdi + 2], 0
je 0x14001dd62
movzx eax, word [rbx + 4]
mov word [rcx + rdi + 4], ax
mov rcx, qword [rdx + 8]
movzx eax, word [rbx + 6]
mov word [rdi + rcx + 6], ax
mov rcx, qword [rdx + 8]
mov eax, dword [rbx + 8]
mov dword [rdi + rcx + 8], eax
add rbx, 0x10
mov rax, qword [rdx + 8]
movzx r8d, word [rdi + rax + 2]
shr r8, 1
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.14000ad80
lea rdx, [rbp - 0x20]
lea rcx, [0x14006de78]
call fcn.14000ac40
mov rax, qword [0x14006ee00]
mov rdx, qword [rax + 8]
movzx eax, word [rdx + rdi + 2]
add rbx, rax
movzx ecx, word [rdx + rdi + 4]
sub ecx, 1
je 0x14001dd15
sub ecx, 2
je 0x14001dc45
cmp ecx, 1
je 0x14001dbf4
lea rdx, [0x140044950]
lea rcx, [0x14006de20]
call fcn.14000ac40
jmp 0x14001dd3a
movzx r9d, byte [rbx + 3]
shl r9d, 8
movzx eax, byte [rbx + 2]
add r9d, eax
shl r9d, 8
movzx eax, byte [rbx + 1]
add r9d, eax
shl r9d, 8
movzx eax, byte [rbx]
add r9d, eax
lea r8, [0x1400511b8]
mov rdx, 0xffffffffffffffff
lea rcx, [rbp - 0x60]
call fcn.14000a970
lea rdx, [rbp - 0x60]
lea rcx, [0x14006de20]
call fcn.14000ac40
jmp 0x14001dd3a
xor eax, eax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
lea rdx, [0x140044950]
lea rcx, [rbp - 0x80]
call fcn.140001e10
nop
xor esi, esi
mov rax, qword [0x14006ee00]
mov rcx, qword [rax + 8]
movzx eax, word [rcx + rdi + 6]
cmp eax, 1
js 0x14001dcf9
nop
lea rcx, [rbp - 0x60]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14001dca0
movzx r9d, byte [rbx]
mov rdx, 0xffffffffffffffff
lea rcx, [rbp - 0x60]
test rax, rax
lea r8, str.__02X
jne 0x14001dccc
lea r8, str._02X
call fcn.14000a970
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x80]
call fcn.140001fd0
inc esi
inc rbx
mov rax, qword [0x14006ee00]
mov rcx, qword [rax + 8]
movzx eax, word [rcx + rdi + 6]
dec eax
cmp esi, eax
jle 0x14001dc90
lea rdx, [rbp - 0x80]
lea rcx, [0x14006de20]
call fcn.14000abe0
nop
lea rcx, [rbp - 0x80]
call fcn.140001e70
jmp 0x14001dd3a
movzx r8d, word [rdx + rdi + 6]
shr r8, 1
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.14000ad80
lea rdx, [rbp - 0x20]
lea rcx, [0x14006de20]
call fcn.14000ac40
mov rdx, qword [0x14006ee00]
mov rax, qword [rdx + 8]
movzx ebx, word [rax + rdi]
add rbx, r13
inc r12d
add rdi, 0x20
cmp dword [r14], 0x45
je 0x14001dd62
test rbx, rbx
jne 0x14001db30
mov rcx, r15
call fcn.14002ba80
mov eax, r12d
mov rcx, qword [rbp + 0x1fe0]
xor rcx, rsp
call fcn.14002ba20
mov rbx, qword [rsp + 0x2140]
add rsp, 0x20f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret