Function at 0x14002c994
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r15
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [0x140090008]
xor rax, rsp
mov qword [rbp + 0x210], rax
mov qword [rbp - 0x10], r9
mov r13, r8
mov r12, rdx
mov rsi, rcx
mov rcx, r9
call fcn.140014770
xor r15d, r15d
mov edi, r15d
mov qword [rbp - 0x80], r15
mov dword [rbp - 0x78], r15d
mov qword [rbp - 0x70], r15
mov rcx, qword [rsi + 0xc0]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
setne byte [rsp + 0x40]
mov rax, qword [rsi + 0x10]
mov rdx, qword [rax + 0xe8]
mov rcx, qword [0x140092568]
test rdx, rdx
cmovne rcx, rdx
mov qword [rsp + 0x68], r15
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [r12]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002ca49
mov eax, r15d
mov rdi, qword [rsp + 0x68]
mov qword [rbp - 0x80], rdi
mov dword [rbp - 0x78], r15d
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
test edx, edx
jns 0x14002ca7a
cmp dx, 2
je 0x14002cecf
mov r8, qword [r12]
lea rcx, str.Error_while_accessing_list_of_extensions
call fcn.14003212c
jmp 0x14002cecf
mov rbx, r15
mov qword [rbp - 0x68], rbx
mov dword [rbp - 0x60], r15d
mov qword [rbp - 0x58], r15
cmp byte [rbp + 0x280], r15b
jne 0x14002cb08
mov rax, qword [rsi + 0x10]
mov rdx, qword [rax + 0xe8]
mov rcx, qword [0x140092568]
test rdx, rdx
cmovne rcx, rdx
mov qword [rsp + 0x70], r15
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [r13]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002cae1
mov eax, r15d
mov rbx, qword [rsp + 0x70]
mov qword [rbp - 0x68], rbx
mov dword [rbp - 0x60], r15d
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
test edx, edx
jns 0x14002cb08
mov r8, qword [r13]
lea rcx, str.Error_while_accessing_list_of_extension_types
call fcn.140032190
jmp 0x14002cec0
mov dword [rsp + 0x44], 0x105
call fcn.140002dfc
mov rcx, rax
test rax, rax
je 0x14002cf17
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8, [rbp]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
or edi, 0xffffffff
cmp eax, 0x103
je 0x14002ce96
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x14002cbfd
lea r8, [0x140073508]
mov rdx, r12
lea rcx, [rbp - 0x48]
call fcn.1400315dc
nop
lea r8, [rbp]
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.1400315dc
nop
mov r8, qword [rax]
mov edx, ebx
lea rcx, str.Error_while_enumerating_extensions_list
call fcn.140032190
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14002cbd6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14002ce54
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14002ce54
cmp dword [rsp + 0x48], 1
je 0x14002cc66
lea r8, [0x140073508]
mov rdx, r12
lea rcx, [rbp - 0x38]
call fcn.1400315dc
nop
lea r8, [rbp]
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1400315dc
nop
mov r8, qword [rax]
mov edx, 0x8000ffff
lea rcx, str.Expected_only_strings_in_enabled_extensions_list
call fcn.140032190
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14002cc5d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x38]
jmp 0x14002cbda
xor sil, sil
cmp byte [rbp + 0x280], sil
jne 0x14002cd9f
call fcn.140002dfc
mov rcx, rax
test rax, rax
je 0x14002cf0c
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
mov edx, 0x104
mov dword [rsp + 0x58], edx
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x14002ccbf
lea rcx, [rsp + 0x50]
call fcn.1400028a0
mov rbx, qword [rsp + 0x50]
lea r9, [rsp + 0x58]
mov r8, rbx
lea rdx, [rbp]
lea rcx, [rbp - 0x68]
call fcn.14000ca90
movzx edi, ax
or edi, 0x80070000
test eax, eax
cmovle edi, eax
test edi, edi
jns 0x14002cd64
lea r8, [0x140073508]
mov rdx, r13
lea rcx, [rbp - 0x28]
call fcn.1400315dc
nop
lea r8, [rbp]
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.1400315dc
nop
mov r8, qword [rax]
mov edx, edi
lea rcx, str.Could_not_query_type_for_extension.
call fcn.14003212c
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14002cd3f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14002cd5d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x50]
jmp 0x14002cd7c
lea rdx, str.Microsoft.VisualStudio.Sample
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll__wcsicmp
test eax, eax
sete sil
or edi, 0xffffffff
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14002cd96
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test sil, sil
jne 0x14002ce54
lea rdx, [rbp]
lea rcx, [rsp + 0x78]
call fcn.140009580
nop
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x78]
lea rcx, [rbp - 0x80]
call fcn.140037f44
mov ebx, eax
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
add ecx, edi
test ecx, ecx
jg 0x14002cde3
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
test ebx, ebx
jns 0x14002ce46
lea r8, [0x140073508]
mov rdx, r12
lea rcx, [rbp - 0x18]
call fcn.1400315dc
nop
lea r8, [rbp]
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.1400315dc
nop
mov r8, qword [rax]
mov edx, ebx
lea rcx, str.Error_while_retrieving_enabled_extension_path
call fcn.140032190
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
test eax, eax
jg 0x14002ce3d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x18]
jmp 0x14002cbda
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rbp - 0x10]
call fcn.1400145bc
inc r15d
mov dword [rsp + 0x44], 0x105
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
lea r8, [rbp]
mov edx, r15d
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x14002cb63
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
add eax, edi
xor r15d, r15d
test eax, eax
jg 0x14002ceb8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp - 0x68]
mov rdi, qword [rbp - 0x80]
test rbx, rbx
je 0x14002cecf
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
cmp byte [rsp + 0x40], r15b
je 0x14002cedd
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
nop
test rdi, rdi
je 0x14002ceeb
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.140052570
add rsp, 0x320
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.140002fa4
nop
mov ecx, 0x80004005
call fcn.140002fa4
int3