Function at 0x14000cb30
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x2780]
mov eax, 0x2880
call fcn.14002dba0
sub rsp, rax
mov rax, qword [0x14003e008]
xor rax, rsp
mov qword [rbp + 0x2770], rax
mov rsi, r9
mov r14, r8
mov rdi, rdx
mov rbx, rcx
and qword [rsp + 0x38], 0
and qword [r9], 0
xor edx, edx
mov r8d, 0x2600
lea rcx, [rsp + 0x48]
call fcn.140017680
mov dword [rsp + 0x40], 0x2608
mov dword [rsp + 0x44], 0x2f
or r9, 0xffffffffffffffff
mov r8, rbx
mov edx, 0x80
lea rcx, [rsp + 0x48]
call fcn.14001b968
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.RelativeCachePath
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov r12d, 1
mov r13d, 0x80070002
cmp ebx, r13d
jne 0x14000cc13
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x48]
call fcn.140017680
mov ebx, r12d
test ebx, ebx
js 0x14000cf51
mov dword [rsp + 0x30], 0x1048
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x250]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.RelativeSourcePath
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp ebx, r13d
jne 0x14000cc79
xor edx, edx
mov r8d, 0x1048
lea rcx, [rbp + 0x250]
call fcn.140017680
mov ebx, r12d
test ebx, ebx
js 0x14000cf51
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x12b0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Priority
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp ebx, r13d
jne 0x14000ccd2
mov dword [rbp + 0x12b0], r12d
mov ebx, r12d
test ebx, ebx
js 0x14000cf51
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1298]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Signed
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp ebx, r13d
jne 0x14000cd2b
and dword [rbp + 0x1298], 0
mov ebx, r12d
test ebx, ebx
js 0x14000cf51
mov dword [rsp + 0x30], 4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x129c]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.HashType
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp ebx, r13d
jne 0x14000cd87
xor eax, eax
mov dword [rbp + 0x129c], eax
mov ebx, r12d
jmp 0x14000cd8d
mov eax, dword [rbp + 0x129c]
test ebx, ebx
js 0x14000cf51
add eax, 0xffff7ffd
cmp eax, r12d
ja 0x14000ce1c
mov dword [rsp + 0x30], 0x14
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2550]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Hash
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jne 0x14000ce04
lea rax, [rbp + 0x2550]
mov qword [rbp + 0x12a8], rax
mov eax, dword [rsp + 0x30]
mov dword [rbp + 0x12a0], eax
or dword [rsp + 0x44], 0x10
jmp 0x14000ce1c
cmp ebx, r13d
jne 0x14000ce14
and qword [rbp + 0x12a8], 0
mov ebx, r12d
test ebx, ebx
js 0x14000cf51
mov dword [rsp + 0x30], 0x100
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2670]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.PreferredSource
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp ebx, r13d
jne 0x14000ce7a
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x2670]
call fcn.140017680
mov ebx, r12d
test ebx, ebx
js 0x14000cf51
mov dword [rsp + 0x30], 0x100
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2570]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.ContainerResource
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
cmp ebx, r13d
jne 0x14000cee0
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x2570]
call fcn.140017680
mov ebx, r12d
test ebx, ebx
js 0x14000cf51
lea r9, [rsp + 0x38]
xor r8d, r8d
lea rdx, [rsp + 0x40]
mov rcx, r14
call fcn.14000ca80
mov ebx, eax
mov rdi, qword [rsp + 0x38]
test eax, eax
js 0x14000cf30
mov rax, qword [rdi]
lea r8, [rbp + 0x2570]
lea rdx, [rbp + 0x2670]
mov rcx, rdi
mov rax, qword [rax + 0xf0]
call qword [0x14002f570]
mov ebx, eax
test eax, eax
js 0x14000cf30
mov qword [rsi], rdi
xor edi, edi
test rdi, rdi
je 0x14000cf51
mov rax, qword [rdi + 8]
movsxd rcx, dword [rax + 4]
add rcx, 8
add rcx, rdi
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14002f570]
mov eax, ebx
mov rcx, qword [rbp + 0x2770]
xor rcx, rsp
call fcn.140015940
add rsp, 0x2880
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret