Function at 0x14002bba0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xa8
mov qword [rbp - 0x29], 0xfffffffffffffffe
mov rax, qword [0x14006c0f0]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov rdi, r9
mov r14, r8
mov rsi, rcx
xor r15d, r15d
mov qword [rbp - 0x39], r15
test rdx, rdx
je 0x14002bc1c
mov qword [rbp - 0x39], r15
lea rax, [rbp - 0x39]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14002bea7
mov rsi, qword [rbp - 0x39]
mov dword [rbp - 0x45], r15d
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x45]
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14002bea7
mov eax, dword [rbp - 0x45]
sub eax, 1
je 0x14002bdfd
sub eax, 2
je 0x14002bd9b
sub eax, 1
je 0x14002bd44
cmp eax, 7
je 0x14002bc9e
mov rcx, qword [rbp + 0x5f]
mov ebx, 0x81333006
mov r9d, ebx
lea r8, str.onecoreenduserwindowsupdate_ruximplugliblibplugregistryhelper.cpp
mov edx, 0x47
call fcn.140003c18
jmp 0x14002bea7
mov dword [rbp - 0x41], r15d
mov dword [rbp - 0x49], 8
lea rax, [rbp - 0x49]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x31]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x41]
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14002bea7
cmp dword [rbp - 0x41], 0xb
je 0x14002bcfa
mov ebx, 0x8007139f
jmp 0x14002bea7
mov ebx, r15d
test ebx, ebx
js 0x14002bea7
mov rbx, qword [rbp - 0x31]
movsx rax, byte [rdi + 0x20]
cmp rax, 2
je 0x14002bdc3
add rax, 1
je 0x14002bd3e
sub rax, 1
je 0x14002bd3e
sub rax, 1
je 0x14002bd3e
sub rax, 1
je 0x14002bd3e
cmp rax, 1
je 0x14002bd3e
mov rcx, rdi
call fcn.140007e78
mov byte [rdi + 0x20], 2
jmp 0x14002bdc3
lea r9, [rbp - 0x49]
mov r8, r14
xor edx, edx
mov rcx, rsi
call fcn.140011d04
mov ebx, eax
test eax, eax
js 0x14002bea7
mov ebx, dword [rbp - 0x49]
movsx rax, byte [rdi + 0x20]
cmp rax, 1
je 0x14002bd97
add rax, 1
je 0x14002bd93
sub rax, 1
je 0x14002bd93
sub rax, 1
je 0x14002bd93
sub rax, 1
je 0x14002bd93
cmp rax, 1
je 0x14002bd93
mov rcx, rdi
call fcn.140007e78
mov byte [rdi + 0x20], 1
mov dword [rdi], ebx
jmp 0x14002bdf5
lea r9, [rbp - 0x31]
mov r8, r14
mov rcx, rsi
call fcn.140011f80
mov ebx, eax
test eax, eax
js 0x14002bea7
mov rbx, qword [rbp - 0x31]
movsx rax, byte [rdi + 0x20]
cmp rax, 3
jne 0x14002bdc8
mov qword [rdi], rbx
jmp 0x14002bdf5
add rax, 1
je 0x14002bdee
sub rax, 1
je 0x14002bdee
sub rax, 1
je 0x14002bdee
sub rax, 1
je 0x14002bdee
cmp rax, 1
je 0x14002bdee
mov rcx, rdi
call fcn.140007e78
mov qword [rdi], rbx
mov byte [rdi + 0x20], 3
mov ebx, r15d
jmp 0x14002bea7
mov qword [rbp + 0xf], r15
mov qword [rbp + 0x17], 7
mov word [rbp - 1], r15w
lea r9, [rbp - 1]
mov r8, r14
xor edx, edx
mov rcx, rsi
call fcn.140011ddc
mov ebx, eax
test eax, eax
js 0x14002be9d
lea rdx, [rbp - 1]
cmp byte [rdi + 0x20], 4
jne 0x14002be39
mov rcx, rdi
call fcn.1400077dc
jmp 0x14002be9a
lea rcx, [rbp - 0x21]
call fcn.140007da0
movsx rax, byte [rdi + 0x20]
add rax, 1
je 0x14002be6d
sub rax, 1
je 0x14002be6d
sub rax, 1
je 0x14002be6d
sub rax, 1
je 0x14002be6d
cmp rax, 1
je 0x14002be6d
mov rcx, rdi
call fcn.140007e78
movups xmm0, xmmword [rbp - 0x21]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbp - 0x11]
movups xmmword [rdi + 0x10], xmm1
mov qword [rbp - 0x11], r15
mov qword [rbp - 9], 7
mov word [rbp - 0x21], r15w
mov byte [rdi + 0x20], 4
lea rcx, [rbp - 0x21]
call fcn.140007e78
mov ebx, r15d
lea rcx, [rbp - 1]
call fcn.140007e78
nop
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x14002bebc
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.14004b4d0
add rsp, 0xa8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret