Function at 0x140015140
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x270
mov rax, qword [0x1400208c0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdx, qword [rsp + 0x288]
mov rcx, qword [rsp + 0x280]
call fcn.1400156b0
test eax, eax
jne 0x1400155df
mov dword [rsp + 0x38], 1
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
and eax, 0x3ff
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x34]
dec eax
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0x26
ja case.0x1400151cd.3
movsxd rax, dword [rsp + 0x34]
lea rcx, [0x140000000]
mov eax, dword [rcx + rax*4 + 0x15608]
add rax, rcx
jmp rax
lea rdx, [0x1400205a0]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
lea rdx, [0x1400205a8]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
lea rdx, [0x1400205b0]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
lea rdx, [0x1400205b8]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
lea rdx, [0x1400205c0]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
lea rdx, [0x1400205c8]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
lea rdx, [0x1400205d0]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
lea rdx, [0x1400205d8]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
movzx eax, word [rsp + 0x30]
sar eax, 0xa
cmp eax, 2
jne 0x1400152c3
lea rdx, [0x1400205e0]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400152d8
lea rdx, [0x1400205e8]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
lea rdx, [0x1400205f0]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
lea rdx, [0x1400205f8]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
lea rdx, [0x140020600]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
lea rdx, [0x140020608]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
lea rdx, [0x140020610]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
lea rdx, [0x140020618]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
lea rdx, [0x140020620]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
lea rdx, [0x140020628]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
lea rdx, [0x140020630]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
lea rdx, [0x140020638]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
lea rdx, [0x140020640]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
lea rdx, [0x140020648]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
lea rdx, [0x140020650]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
lea rdx, [0x140020658]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
lea rdx, [0x140020660]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
lea rdx, [0x140020668]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
lea rdx, [0x140020670]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
lea rdx, [0x140020678]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
lea rdx, [0x140020680]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
lea rdx, [0x140020688]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
jmp 0x1400154f3
mov dword [rsp + 0x38], 0
lea rdx, [0x140020690]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
cmp qword [rsp + 0x288], 0
je 0x1400155df
cmp dword [rsp + 0x38], 0
je 0x1400155df
lea rdx, str.Language
lea rcx, str.SOFTWAREAdobeAdobe_Acrobat_
call fcn.140001ba0
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400155df
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0x3c], 0x104
lea rax, [rsp + 0x3c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
mov rdx, qword [rsp + 0x280]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400155d4
lea rdx, str.Locale_
mov rcx, qword [rsp + 0x288]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy]
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x288]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat]
lea rdx, [0x140020700]
mov rcx, qword [rsp + 0x288]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x280]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsupr]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140015df0
add rsp, 0x270
pop rdi
ret