Function at 0x14002acf0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xfc0]
mov eax, 0x10c0
call fcn.140162e70
sub rsp, rax
mov rax, qword [0x140280d40]
xor rax, rsp
mov qword [rbp + 0xfb0], rax
mov r15, rcx
mov qword [rsp + 0x30], rcx
cmp dword [rcx + 0xc], 6
jb 0x14002ad72
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.BCD00000000
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002adaa
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [r15 + 0x158], 0
mov rcx, qword [rbp + 0xfb0]
xor rcx, rsp
call fcn.140162ed0
lea r11, [rsp + 0x10c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
cmp eax, 5
je 0x14002ad72
cmp eax, 0x20
je 0x14002ad72
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinPE
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002ad72
mov byte [r15 + 0x158], 1
mov dword [rsp + 0x38], 0x1000
mov dword [rbp - 0x58], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x58]
xor r8d, r8d
lea rdx, str.InstRoot
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
test ebx, ebx
jne 0x14002b123
mov eax, dword [rsp + 0x38]
shr rax, 1
xor r14d, r14d
mov word [rbp + rax*2 - 0x52], r14w
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
lea rax, [rbp - 0x50]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r14w
jne 0x14002ae63
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x68]
call fcn.14000ae10
nop
lea rcx, [rsp + 0x68]
call fcn.14000ca80
lea rcx, [rsp + 0x68]
cmp rcx, rax
je 0x14002aeab
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x14002ae9e
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.14000ad20
lea rdi, [rsp + 0x68]
mov r8, qword [rsp + 0x68]
cmp qword [rbp - 0x80], 7
cmova rdi, r8
lea rcx, [rsp + 0x68]
cmova rcx, r8
mov rax, qword [rsp + 0x78]
lea rsi, [rcx + rax*2]
lea rbx, [rsp + 0x68]
cmova rbx, r8
cmp rbx, rsi
je 0x14002aef6
sub rdi, rbx
movzx ecx, word [rbx]
call fcn.14017bd84
mov word [rbx + rdi], ax
add rbx, 2
cmp rbx, rsi
jne 0x14002aee1
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movdqa xmm1, xmmword [0x140258810]
movdqu xmmword [rsp + 0x58], xmm1
mov word [rsp + 0x48], r14w
lea rdx, [rsp + 0x48]
call fcn.14002a780
lea rdi, [rsp + 0x48]
mov r8, qword [rsp + 0x48]
cmp qword [rsp + 0x60], 7
cmova rdi, r8
lea rcx, [rsp + 0x48]
cmova rcx, r8
mov rax, qword [rsp + 0x58]
lea rsi, [rcx + rax*2]
lea rbx, [rsp + 0x48]
cmova rbx, r8
cmp rbx, rsi
je 0x14002af68
sub rdi, rbx
movzx ecx, word [rbx]
call fcn.14017bd84
mov word [rbx + rdi], ax
add rbx, 2
cmp rbx, rsi
jne 0x14002af53
lea rcx, [rsp + 0x48]
call fcn.14000ca80
lea rcx, [rsp + 0x48]
cmp rcx, rax
je 0x14002af97
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x14002af8a
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14000ad20
lea r11, [rsp + 0x68]
mov rbx, qword [rsp + 0x68]
mov r14, qword [rbp - 0x80]
cmp r14, 7
cmova r11, rbx
lea r15, [rsp + 0x48]
mov rsi, qword [rsp + 0x48]
mov r13, qword [rsp + 0x60]
cmp r13, 7
cmova r15, rsi
mov rdi, qword [rsp + 0x78]
mov rax, qword [rsp + 0x58]
cmp rdi, rax
ja 0x14002b071
sub rax, rdi
test rdi, rdi
je 0x14002b07d
lea r12, [rax + 1]
lea r12, [r15 + r12*2]
mov rcx, r15
movzx r10d, word [r11]
nop dword [rax]
nop word [rax + rax]
mov rax, r12
sub rax, rcx
sar rax, 1
mov edx, 0
je 0x14002b02c
cmp word [rcx], r10w
je 0x14002b029
cmp rax, 1
je 0x14002b02c
dec rax
add rcx, 2
cmp word [rcx], r10w
jne 0x14002b016
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x14002b071
mov r8, rdi
mov rdx, r11
test rdi, rdi
je 0x14002b068
mov r9, rcx
sub r9, r11
nop word [rax + rax]
movzx eax, word [rdx + r9]
cmp ax, word [rdx]
jne 0x14002b11a
add rdx, 2
sub r8, 1
jne 0x14002b050
sub rcx, r15
cmp rcx, 2
jb 0x14002b07d
mov rax, qword [rsp + 0x30]
mov byte [rax + 0x158], 0
cmp r13, 7
jbe 0x14002b0c1
lea rdx, [r13*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14002b0b0
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b2a5
mov rcx, rsi
call fcn.1401629f4
mov r14, qword [rbp - 0x80]
mov rbx, qword [rsp + 0x68]
movdqa xmm0, xmmword [0x140258810]
movdqu xmmword [rsp + 0x58], xmm0
xor eax, eax
mov word [rsp + 0x48], ax
cmp r14, 7
jbe 0x14002ad7a
lea rdx, [r14*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14002b10d
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b2ab
mov rcx, rbx
call fcn.1401629f4
jmp 0x14002ad7a
add rcx, 2
jmp 0x14002b000
movups xmmword [rbp - 0x78], xmm0
movdqa xmm1, xmmword [0x140258810]
movdqu xmmword [rbp - 0x68], xmm1
xor r14d, r14d
mov word [rbp - 0x78], r14w
lea rdx, [rbp - 0x78]
call fcn.14002a780
lea rdi, [rbp - 0x78]
mov r8, qword [rbp - 0x78]
cmp qword [rbp - 0x60], 7
cmova rdi, r8
lea rcx, [rbp - 0x78]
cmova rcx, r8
mov rax, qword [rbp - 0x68]
lea rsi, [rcx + rax*2]
lea rbx, [rbp - 0x78]
cmova rbx, r8
cmp rbx, rsi
je 0x14002b18b
sub rdi, rbx
movzx ecx, word [rbx]
call fcn.14017bd84
mov word [rbx + rdi], ax
add rbx, 2
cmp rbx, rsi
jne 0x14002b176
lea rcx, [rbp - 0x78]
call fcn.14000ca80
lea rcx, [rbp - 0x78]
cmp rcx, rax
je 0x14002b1b7
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x14002b1ab
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14000ad20
lea r11, [rbp - 0x78]
mov r10, qword [rbp - 0x78]
mov rbx, qword [rbp - 0x60]
cmp rbx, 7
cmova r11, r10
mov rax, qword [rbp - 0x68]
cmp rax, 2
jb 0x14002b24e
dec rax
lea rdi, [r11 + rax*2]
mov rax, r11
lea rsi, [0x14025514c]
nop word [rax + rax]
mov rcx, rdi
sub rcx, rax
sar rcx, 1
mov rdx, r14
je 0x14002b21a
cmp word [rax], 0x58
je 0x14002b217
cmp rcx, 1
je 0x14002b21a
dec rcx
add rax, 2
cmp word [rax], 0x58
jne 0x14002b204
mov rdx, rax
mov rax, rdx
test rdx, rdx
je 0x14002b24e
mov r8d, 2
mov rdx, rsi
mov r9, rax
sub r9, rsi
movzx ecx, word [rdx + r9]
cmp cx, word [rdx]
jne 0x14002b296
add rdx, 2
sub r8, 1
jne 0x14002b231
sub rax, r11
cmp rax, 2
jb 0x14002b256
mov byte [r15 + 0x158], 0
cmp rbx, 7
jbe 0x14002ad7a
lea rdx, [rbx*2 + 2]
mov rax, r10
cmp rdx, 0x1000
jb 0x14002b289
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b29f
mov rcx, r10
call fcn.1401629f4
jmp 0x14002ad7a
add rax, 2
jmp 0x14002b1f0
call fcn.14017234c
nop
call fcn.14017234c
nop
call fcn.14017234c
int3