Function at 0x14002a460
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xd8
mov qword [rbp - 0x51], 0xfffffffffffffffe
mov r13, rcx
xor ebx, ebx
mov dword [rbp - 0x79], ebx
mov edx, 0xae
lea rcx, [rbp - 0x71]
call fcn.140024260
mov r15, rax
cmp qword [rax + 0x18], 0x10
jb 0x14002a4a8
mov r15, qword [rax]
mov rax, qword [rbp - 0x59]
cmp rax, 0x10
jb 0x14002a4fe
inc rax
mov rcx, qword [rbp - 0x71]
cmp rax, 0x1000
jb 0x14002a4f9
test cl, 0x1f
je 0x14002a4cc
call fcn.1400e462c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14002a4db
call fcn.1400e462c
int3
sub rcx, rax
cmp rcx, 8
jae 0x14002a4ea
call fcn.1400e462c
int3
cmp rcx, 0x27
jbe 0x14002a4f6
call fcn.1400e462c
int3
mov rcx, rax
call fcn.14007b800
mov qword [rbp - 0x59], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x61], rbx
mov byte [rbp - 0x71], bl
call fcn.14000bcc0
mov rcx, rax
test rax, rax
jne 0x14002a525
mov ecx, 0x80004005
call fcn.14000b790
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [r13], rax
mov r12d, 1
mov dword [rbp - 0x79], r12d
mov dword [rbp + 0x77], r12d
call fcn.14000bcc0
mov rcx, rax
test rax, rax
jne 0x14002a559
mov ecx, 0x80004005
call fcn.14000b790
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x30], rdi
lea rcx, [0x14012f52c]
mov rsi, rcx
shr rsi, 0x10
or r14, 0xffffffffffffffff
test rsi, rsi
jne 0x14002a5a2
movzx ebx, cx
xor edx, edx
mov ecx, ebx
call fcn.14000b6e0
test rax, rax
je 0x14002a5c3
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14000bdc0
jmp 0x14002a5be
mov rax, r14
inc rax
cmp byte [rcx + rax], 0
jne 0x14002a5a5
mov r8d, eax
mov rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.14000c510
mov rdi, qword [rsp + 0x30]
mov dword [rbp + 0x6f], 0x104
mov edx, 0xf6
lea rcx, [rbp - 0x49]
call fcn.140024260
mov rbx, rax
mov edx, r12d
sub edx, dword [rdi - 8]
mov ecx, dword [rdi - 0xc]
sub ecx, 0x104
or ecx, edx
jge 0x14002a602
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.14000bfd0
mov rdi, qword [rsp + 0x30]
cmp qword [rbx + 0x18], 0x10
jb 0x14002a60c
mov rbx, qword [rbx]
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x77]
mov r8, rbx
mov rdx, r15
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
nop
mov rax, qword [rbp - 0x31]
cmp rax, 0x10
jb 0x14002a688
inc rax
mov rcx, qword [rbp - 0x49]
cmp rax, 0x1000
jb 0x14002a683
test cl, 0x1f
je 0x14002a656
call fcn.1400e462c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14002a665
call fcn.1400e462c
int3
sub rcx, rax
cmp rcx, 8
jae 0x14002a674
call fcn.1400e462c
int3
cmp rcx, 0x27
jbe 0x14002a680
call fcn.1400e462c
int3
mov rcx, rax
call fcn.14007b800
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.1400e520c
test eax, eax
js 0x14002a917
cmp eax, dword [rdi - 0xc]
jg 0x14002a917
mov dword [rdi - 0x10], eax
cdqe
mov byte [rax + rdi], 0
call fcn.14000bcc0
mov rcx, rax
test rax, rax
jne 0x14002a6c6
mov ecx, 0x80004005
call fcn.14000b790
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
lea rdx, [0x14012f52c]
test rsi, rsi
jne 0x14002a704
movzx esi, dx
xor edx, edx
mov ecx, esi
call fcn.14000b6e0
test rax, rax
je 0x14002a722
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14000bdc0
jmp 0x14002a71d
mov rax, r14
inc rax
cmp byte [rdx + rax], 0
jne 0x14002a707
mov r8d, eax
lea rcx, [rsp + 0x38]
call fcn.14000c510
mov rbx, qword [rsp + 0x38]
mov edx, 0xf7
lea rcx, [rbp - 0x29]
call fcn.140024260
mov rsi, rax
sub r12d, dword [rbx - 8]
mov ecx, dword [rbx - 0xc]
sub ecx, 0x104
or ecx, r12d
jge 0x14002a759
mov edx, 0x104
lea rcx, [rsp + 0x38]
call fcn.14000bfd0
mov rbx, qword [rsp + 0x38]
cmp qword [rsi + 0x18], 0x10
jb 0x14002a763
mov rsi, qword [rsi]
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x77]
mov r8, rsi
mov rdx, r15
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
nop
mov rax, qword [rbp - 0x11]
cmp rax, 0x10
jb 0x14002a7df
inc rax
mov rcx, qword [rbp - 0x29]
cmp rax, 0x1000
jb 0x14002a7da
test cl, 0x1f
je 0x14002a7ad
call fcn.1400e462c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14002a7bc
call fcn.1400e462c
int3
sub rcx, rax
cmp rcx, 8
jae 0x14002a7cb
call fcn.1400e462c
int3
cmp rcx, 0x27
jbe 0x14002a7d7
call fcn.1400e462c
int3
mov rcx, rax
call fcn.14007b800
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400e520c
test eax, eax
js 0x14002a90c
cmp eax, dword [rbx - 0xc]
jg 0x14002a90c
mov dword [rbx - 0x10], eax
cdqe
mov byte [rax + rbx], 0
mov dword [rbp + 0x7f], 0
mov dword [rbp + 0x6f], 4
mov dword [rbp + 0x77], 4
mov edx, 0xf8
lea rcx, [rbp - 9]
call fcn.140024260
cmp qword [rax + 0x18], 0x10
jb 0x14002a832
mov rax, qword [rax]
lea r8, [rbp + 0x6f]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x7f]
mov qword [rsp + 0x20], r8
lea r9, [rbp + 0x77]
mov r8, rax
mov rdx, r15
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov rax, qword [rbp + 0xf]
cmp rax, 0x10
jb 0x14002a8b1
inc rax
mov rcx, qword [rbp - 9]
cmp rax, 0x1000
jb 0x14002a8ac
test cl, 0x1f
je 0x14002a87f
call fcn.1400e462c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14002a88e
call fcn.1400e462c
int3
sub rcx, rax
cmp rcx, 8
jae 0x14002a89d
call fcn.1400e462c
int3
cmp rcx, 0x27
jbe 0x14002a8a9
call fcn.1400e462c
int3
mov rcx, rax
call fcn.14007b800
mov eax, dword [rbp + 0x7f]
mov dword [rsp + 0x20], eax
mov r9, rbx
mov r8, rdi
lea rdx, str._s__s__d
mov rcx, r13
call fcn.14000bb10
nop
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002a8e9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x14002a907
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, r13
jmp 0x14002a922
mov ecx, 0x80070057
call fcn.14000b790
nop
mov ecx, 0x80070057
call fcn.14000b790
nop
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret