Function at 0x14008dd50
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov rax, qword [0x14058f6b8]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov r13, rcx
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
xor r14d, r14d
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], r14
mov dword [rbp - 0x58], r14d
mov rbx, 0xffffffffffffffff
mov r8d, ebx
lea rdx, [0x1405138e8]
lea rcx, [rbp - 0x70]
call fcn.140123b70
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
movups xmmword [rsp + 0x78], xmm0
mov edi, r14d
mov qword [rsp + 0x68], r14
mov r15d, r14d
mov qword [rsp + 0x70], r14
mov esi, r14d
mov qword [rsp + 0x78], r14
mov dword [rbp - 0x80], r14d
mov r14, qword [rbp - 0x70]
test r14, r14
je 0x14008ddff
cmp word [r14], si
mov rdx, r14
jne 0x14008de06
lea rdx, [0x1404d345c]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14008de9b
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x30]
call fcn.14039b120
mov dword [rbp - 0x78], 0x104
lea rax, [rbp - 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.InstallPath
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14008de90
mov r8d, ebx
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x68]
call fcn.140123b70
mov rsi, qword [rsp + 0x78]
mov r15d, dword [rsp + 0x70]
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r15d, r15d
jle 0x14008e01d
lea rdx, str.wetype_server.exe
lea rcx, [rsp + 0x68]
call fcn.140123c50
mov r15, qword [r13 + 0x108]
mov rax, qword [r15]
mov r12, qword [rax + 0x80]
mov rdi, qword [rsp + 0x68]
test rdi, rdi
je 0x14008df03
cmp word [rdi], 0
je 0x14008df03
lea rdx, [rsp + 0x78]
mov rcx, rdi
call fcn.140125a00
mov rsi, qword [rsp + 0x78]
test rsi, rsi
je 0x14008defc
cmp byte [rsi], 0
je 0x14008defc
mov rdx, rsi
mov rdi, qword [rsp + 0x68]
jmp 0x14008df0f
mov rdi, qword [rsp + 0x68]
jmp 0x14008df08
mov rsi, qword [rsp + 0x78]
lea rdx, [0x1404d34b0]
xor r13d, r13d
mov qword [rsp + 0x30], r13
movdqa xmm0, xmmword [0x140535b80]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], r13b
nop word [rax + rax]
inc rbx
cmp byte [rdx + rbx], 0
jne 0x14008df30
mov r8, rbx
lea rcx, [rsp + 0x30]
call fcn.14007cb70
nop
lea rdx, [rsp + 0x30]
mov rcx, r15
call r12
nop
lea rcx, [rsp + 0x30]
call fcn.14007cfc0
mov ecx, 2
call fcn.140312ed0
test eax, eax
je 0x14008e01d
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
lea rax, str.init_ipc_ok
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], select
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
movaps xmm1, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm1
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x50]
call fcn.140077780
nop
lea rax, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rax, qword [rbp - 0x50]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x40]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, str.EventCenter
mov qword [rsp + 0x20], rax
lea r9, str.EventCenter::initIpc
mov r8d, 0x49
lea rdx, str.C:codeWeChatPinYinwxkb01_mozcWetypeUpdateWetypeInstallerWetypeUpdateeventEventCenter.cpp
lea ecx, [r8 - 0x47]
call fcn.140077ea0
nop
lea rcx, [rbp - 0x50]
call fcn.14007cfc0
nop
test rdi, rdi
je 0x14008e02a
mov rcx, rdi
call fcn.1403a7ac0
test rsi, rsi
je 0x14008e038
mov rcx, rsi
call fcn.1403a7ac0
nop
test r14, r14
je 0x14008e045
mov rcx, r14
call fcn.1403a7ac0
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x14008e053
call fcn.1403a7ac0
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.140398000
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret