Function at 0x14002a8b4
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
mov rbx, rcx
xor esi, esi
mov dword [rbp - 0x20], esi
call fcn.140120d54
mov dword [rbp - 0x20], 1
mov qword [rbp + 0x40], rsi
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftCommand_Processor
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea r14, [0x140171908]
test eax, eax
jne 0x14002a9ff
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14002a9ff
mov dword [rbp + 0x38], esi
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002a9f1
cmp dword [rbp + 0x38], esi
je 0x14002a9f1
lea rcx, [rbp - 0x18]
call fcn.140120d54
nop
mov edx, dword [rbp + 0x38]
add edx, 2
lea rcx, [rbp - 0x18]
call fcn.140121228
test rax, rax
je 0x14002a9e8
lea rcx, [rbp - 0x18]
call fcn.140058574
lea rcx, [rbp + 0x38]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002a9e8
lea rcx, [rbp - 0x18]
call fcn.14012148c
test al, al
jne 0x14002a9e8
xor edx, edx
lea rcx, [rbp - 0x18]
call fcn.140121ccc
mov r8, rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [0x140167d54]
lea rdx, str.__HKCU:
mov rcx, rbx
call fcn.140120f30
nop
lea rcx, [rbp - 0x18]
call fcn.140120ddc
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x40], rsi
call fcn.140123504
mov dil, al
mov cl, al
neg cl
sbb r9d, r9d
and r9d, 0x200
or r9d, 0x20019
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftCommand_Processor
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002ab30
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14002ab30
mov dword [rbp + 0x38], esi
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002ab22
cmp dword [rbp + 0x38], esi
je 0x14002ab22
lea rcx, [rbp - 0x18]
call fcn.140120d54
nop
mov edx, dword [rbp + 0x38]
add edx, 2
lea rcx, [rbp - 0x18]
call fcn.140121228
test rax, rax
je 0x14002ab19
lea rcx, [rbp - 0x18]
call fcn.140058574
lea rcx, [rbp + 0x38]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002ab19
lea rcx, [rbp - 0x18]
call fcn.14012148c
test al, al
jne 0x14002ab19
xor edx, edx
lea rcx, [rbp - 0x18]
call fcn.140121ccc
mov r8, rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [0x140167d54]
lea rdx, str.__HKLM32:
mov rcx, rbx
call fcn.140120f30
nop
lea rcx, [rbp - 0x18]
call fcn.140120ddc
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x40], rsi
test dil, dil
je 0x14002ac4f
lea rax, [rbp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftCommand_Processor
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002ac4f
mov rcx, qword [rbp + 0x40]
test rcx, rcx
je 0x14002ac4f
mov dword [rbp + 0x38], esi
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002ac45
cmp dword [rbp + 0x38], esi
je 0x14002ac45
lea rcx, [rbp - 0x18]
call fcn.140120d54
nop
mov edx, dword [rbp + 0x38]
add edx, 2
lea rcx, [rbp - 0x18]
call fcn.140121228
test rax, rax
je 0x14002ac3c
lea rcx, [rbp - 0x18]
call fcn.140058574
lea rcx, [rbp + 0x38]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002ac3c
lea rcx, [rbp - 0x18]
call fcn.14012148c
test al, al
jne 0x14002ac3c
xor edx, edx
lea rcx, [rbp - 0x18]
call fcn.140121ccc
mov r8, rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [0x140167d54]
lea rdx, str.__HKLM64:
mov rcx, rbx
call fcn.140120f30
nop
lea rcx, [rbp - 0x18]
call fcn.140120ddc
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret