Function at 0x14002a320
Capabilities:
Query or enumerate registry value
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r14
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x160], rax
and qword [rsp + 0x40], 0
mov rdi, rcx
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x14002a37a
lea edx, [rcx + 4]
call fcn.140016148
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14002a3a6
cmp dword [0x1400516e0], 3
jl 0x14002a3a6
and dword [rsp + 0x34], 0
lea r9, [rsp + 0x34]
and qword [rsp + 0x20], 0
lea rdx, str.Gathering_existing_system_service_data..._r_n
mov r8d, 0x2b
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rdi + 0x20]
test rdx, rdx
je 0x14002a3b7
mov rcx, rdi
call fcn.14002a12c
lea rax, [rsp + 0x40]
mov r14d, 1
mov r9d, r14d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftMediaPlayerPreferences
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r12d, 0x140
test eax, eax
jne 0x14002a676
and dword [rsp + 0x34], eax
lea r9, [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.LegacyContentProviderFound
lea rax, [rsp + 0x34]
mov dword [rsp + 0x30], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002a54e
cmp dword [rsp + 0x34], r14d
jne 0x14002a54e
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x38], 0x208
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.LegacyContentProviderName
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002a54e
cmp dword [rsp + 0x30], r14d
jne 0x14002a54e
movzx eax, word [rsp + 0x50]
cmp ax, word [0x14003f4a0]
mov rbx, qword [rdi + 0x10]
je 0x14002a538
jmp 0x14002a4cf
mov rax, qword [rbx]
test rax, rax
je 0x14002a4d4
cmp qword [rax], 0
lea rdx, [0x14003f4a0]
lea rcx, [rsp + 0x50]
cmovne rdx, qword [rax]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x14002a4ee
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x14002a4a5
mov rcx, r12
call fcn.14003c2c4
test rax, rax
je 0x14002a4fa
mov rcx, rax
call fcn.140026734
mov rbx, rax
jmp 0x14002a4fc
mov rax, qword [rbx]
mov dword [rax + 0x110], r14d
jmp 0x14002a538
xor ebx, ebx
test rbx, rbx
je 0x14002a538
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140016cd8
mov dword [rbx + 0x110], r14d
test eax, eax
jne 0x14002a528
mov rdx, rbx
mov rcx, rdi
call fcn.140028118
test eax, eax
je 0x14002a538
mov rcx, rbx
call fcn.140026828
mov rcx, rbx
call fcn.14003c304
lea r8, [rsp + 0x50]
mov ecx, 3
lea rdx, str.__Legacy_service_is:__S._r_n
call fcn.140016868
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x38], 0x208
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.DefaultSubscriptionService
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002a66b
cmp dword [rsp + 0x30], r14d
jne 0x14002a66b
movzx eax, word [rsp + 0x50]
cmp ax, word [0x14003f4a0]
mov rbx, qword [rdi + 0x10]
je 0x14002a655
jmp 0x14002a5d9
mov rax, qword [rbx]
test rax, rax
je 0x14002a5de
cmp qword [rax], 0
lea rdx, [0x14003f4a0]
lea rcx, [rsp + 0x50]
cmovne rdx, qword [rax]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x14002a5f8
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x14002a5af
mov rcx, r12
call fcn.14003c2c4
test rax, rax
je 0x14002a604
mov rcx, rax
call fcn.140026734
mov rbx, rax
jmp 0x14002a606
mov rax, qword [rbx]
mov dword [rax + 0x114], r14d
jmp 0x14002a655
xor ebx, ebx
test rbx, rbx
je 0x14002a655
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140016cd8
mov dword [rbx + 0x114], r14d
test eax, eax
jne 0x14002a645
xor edx, edx
mov rcx, rbx
call fcn.140026dcc
test eax, eax
je 0x14002a63e
mov rdx, rbx
mov rcx, rdi
call fcn.140028118
jmp 0x14002a641
mov eax, r14d
test eax, eax
je 0x14002a655
mov rcx, rbx
call fcn.140026828
mov rcx, rbx
call fcn.14003c304
lea r8, [rsp + 0x50]
mov ecx, 3
lea rdx, str.__Previous_service_is:__S._r_n
call fcn.140016868
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x40]
mov r9d, r14d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftMediaPlayerPreferences
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002a7bf
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x34], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.OEMServiceOverride11
mov dword [rsp + 0x30], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002a7b4
cmp dword [rsp + 0x34], r14d
jne 0x14002a7b4
movzx eax, word [0x14003f4a0]
cmp word [rsp + 0x50], ax
je 0x14002a7b4
mov rbx, qword [rdi + 0x10]
jmp 0x14002a735
mov rax, qword [rbx]
test rax, rax
je 0x14002a73a
cmp qword [rax], 0
lea rdx, [0x14003f4a0]
lea rcx, [rsp + 0x50]
cmovne rdx, qword [rax]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x14002a754
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x14002a70b
mov rcx, r12
call fcn.14003c2c4
test rax, rax
je 0x14002a760
mov rcx, rax
call fcn.140026734
mov rbx, rax
jmp 0x14002a762
mov rax, qword [rbx]
mov dword [rax + 0x118], r14d
jmp 0x14002a79e
xor ebx, ebx
test rbx, rbx
je 0x14002a79e
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140016cd8
mov dword [rbx + 0x118], r14d
test eax, eax
jne 0x14002a78e
mov rdx, rbx
mov rcx, rdi
call fcn.140028118
test eax, eax
je 0x14002a79e
mov rcx, rbx
call fcn.140026828
mov rcx, rbx
call fcn.14003c304
lea r8, [rsp + 0x50]
mov ecx, 3
lea rdx, str.__OEM_service_override_is:__S._r_n
call fcn.140016868
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.14003c6c0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r12
pop rbp
ret