Function at 0x14002daf0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1ff0]
mov eax, 0x20f0
call fcn.14003e1a0
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x2140], rbx
mov rax, qword [0x14007c668]
xor rax, rsp
mov qword [rbp + 0x1fe0], rax
mov ebx, edx
mov rdi, rcx
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x40], 6
lea edx, [rax + 0x55]
lea rcx, [0x14008ea28]
call fcn.14000a850
mov rcx, rax
call fcn.140009eb0
mov qword [rsp + 0x50], rax
imul eax, ebx, 0x37
mov dword [rsp + 0x48], eax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x1061
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x56
lea rcx, [0x14008ea28]
call fcn.14000a850
mov rcx, rax
call fcn.140009eb0
mov qword [rsp + 0x50], rax
imul eax, ebx, 0xe
mov dword [rsp + 0x48], eax
lea r9, [rsp + 0x40]
mov edx, 0x1061
mov r8d, 1
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x57
lea rcx, [0x14008ea28]
call fcn.14000a850
mov rcx, rax
call fcn.140009eb0
mov qword [rsp + 0x50], rax
imul eax, ebx, 0x23
mov dword [rsp + 0x48], eax
lea r9, [rsp + 0x40]
mov edx, 0x1061
mov r8d, 2
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x7c], 0
mov dword [rsp + 0x78], 0
mov edx, 0x55
lea rcx, [0x140089728]
call fcn.14000a850
mov rcx, rax
call fcn.140009eb0
mov rdx, rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002dd3b
lea edx, [rax + 0x4d]
lea rcx, [0x140089728]
call fcn.14000a850
mov rcx, rax
call fcn.140009eb0
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x7c]
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [rsp + 0x78]
add eax, 2
mov ebx, eax
mov ecx, eax
call fcn.140009b20
mov r15, rax
test rax, rax
je 0x14002dcde
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.14003fc80
jmp 0x14002dce1
xor r15d, r15d
mov edx, 0x4d
lea rcx, [0x140089728]
call fcn.14000a850
mov rcx, rax
call fcn.140009eb0
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14002dd2f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x14002dd42
mov rcx, r15
call fcn.14003e084
xor eax, eax
jmp 0x14002e0ab
xor eax, eax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
lea ecx, [rax + 0x10]
call fcn.14003e048
mov qword [0x140091f70], rax
mov ecx, 0x14
call fcn.14003e048
test rax, rax
je 0x14002dd8f
mov rcx, rax
call fcn.140016cc0
mov rcx, rax
jmp 0x14002dd91
xor ecx, ecx
mov rdx, qword [0x140091f70]
mov qword [rdx], rcx
mov eax, dword [r15]
mov dword [rcx], eax
mov rcx, qword [rdx]
mov eax, dword [r15 + 4]
mov dword [rcx + 4], eax
mov rax, qword [rdx]
cmp dword [rax + 4], 0
je 0x14002dd3b
mov ecx, 0x12460
call fcn.140009b20
mov rbx, rax
test rax, rax
je 0x14002ddf1
xor edx, edx
mov r8d, 0x12460
mov rcx, rax
call fcn.14003fc80
lea r9, [0x140016ce0]
mov edx, 0x20
mov r8d, 0x923
mov rcx, rbx
call fcn.140017060
jmp 0x14002ddf3
xor ebx, ebx
mov rcx, qword [0x140091f70]
mov qword [rcx + 8], rbx
mov rcx, qword [rcx]
mov eax, dword [r15 + 8]
mov dword [rcx + 8], eax
lea rbx, [r15 + 0x14]
lea rcx, [0x14008e998]
call fcn.14003aaa0
lea rcx, [0x14008e9f8]
call fcn.14003aaa0
mov edx, dword [rsp + 0x78]
lea rcx, [0x14008e998]
call fcn.140014c60
mov edx, dword [rsp + 0x78]
lea rcx, [0x14008e9f8]
call fcn.140014c60
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp - 0x20]
call fcn.14003fc80
xor r12d, r12d
test rbx, rbx
je 0x14002e0a0
xor edi, edi
mov rdx, qword [0x140091f70]
nop word [rax + rax]
mov r13, rbx
mov rcx, qword [rdx + 8]
movzx eax, word [rbx]
mov word [rdi + rcx], ax
mov rcx, qword [rdx + 8]
movzx r14d, word [rcx + rdi]
add r14, rbx
movzx eax, word [rbx + 2]
mov word [rcx + rdi + 2], ax
mov rcx, qword [rdx + 8]
cmp word [rcx + rdi + 2], 0
je 0x14002e0a0
movzx eax, word [rbx + 4]
mov word [rcx + rdi + 4], ax
mov rcx, qword [rdx + 8]
movzx eax, word [rbx + 6]
mov word [rdi + rcx + 6], ax
mov rcx, qword [rdx + 8]
mov eax, dword [rbx + 8]
mov dword [rdi + rcx + 8], eax
add rbx, 0x10
mov rax, qword [rdx + 8]
movzx r8d, word [rdi + rax + 2]
shr r8, 1
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.1400167d0
lea rdx, [rbp - 0x20]
lea rcx, [0x14008e9f8]
call fcn.1400166b0
mov rax, qword [0x140091f70]
mov rdx, qword [rax + 8]
movzx eax, word [rdx + rdi + 2]
add rbx, rax
movzx ecx, word [rdx + rdi + 4]
sub ecx, 1
je 0x14002e053
sub ecx, 2
je 0x14002df83
cmp ecx, 1
je 0x14002df34
lea rdx, [0x140055950]
lea rcx, [0x14008e998]
call fcn.1400166b0
jmp 0x14002e078
movzx r9d, byte [rbx + 3]
shl r9d, 8
movzx eax, byte [rbx + 2]
add r9d, eax
shl r9d, 8
movzx eax, byte [rbx + 1]
add r9d, eax
shl r9d, 8
movzx eax, byte [rbx]
add r9d, eax
lea r8, [0x14006312c]
mov edx, 0x20
lea rcx, [rbp - 0x60]
call fcn.14000e3d0
lea rdx, [rbp - 0x60]
lea rcx, [0x14008e998]
call fcn.1400166b0
jmp 0x14002e078
xor eax, eax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
lea rdx, [0x140055950]
lea rcx, [rbp - 0x80]
call fcn.14000a750
nop
xor esi, esi
mov rax, qword [0x140091f70]
mov rcx, qword [rax + 8]
movzx eax, word [rcx + rdi + 6]
cmp eax, 1
js 0x14002e037
nop dword [rax]
lea rcx, [rbp - 0x60]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14002dfe0
movzx r9d, byte [rbx]
mov edx, 0x20
lea rcx, [rbp - 0x60]
test rax, rax
lea r8, str.__.2X
jne 0x14002e00a
lea r8, str._.2X
call fcn.140016470
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x80]
call fcn.14000a910
inc esi
inc rbx
mov rax, qword [0x140091f70]
mov rcx, qword [rax + 8]
movzx eax, word [rcx + rdi + 6]
dec eax
cmp esi, eax
jle 0x14002dfd0
lea rdx, [rbp - 0x80]
lea rcx, [0x14008e998]
call fcn.140016650
nop
lea rcx, [rbp - 0x80]
call fcn.140002990
jmp 0x14002e078
movzx r8d, word [rdx + rdi + 6]
shr r8, 1
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.1400167d0
lea rdx, [rbp - 0x20]
lea rcx, [0x14008e998]
call fcn.1400166b0
mov rdx, qword [0x140091f70]
mov rax, qword [rdx + 8]
movzx ebx, word [rax + rdi]
add rbx, r13
inc r12d
add rdi, 0x20
cmp dword [r14], 0x45
je 0x14002e0a0
test rbx, rbx
jne 0x14002de70
mov rcx, r15
call fcn.14003e084
mov eax, r12d
mov rcx, qword [rbp + 0x1fe0]
xor rcx, rsp
call fcn.14003e210
mov rbx, qword [rsp + 0x2140]
add rsp, 0x20f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret