Function at 0x14002d6d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1ff0]
mov eax, 0x20f0
call fcn.14003d9b0
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x2140], rbx
mov rax, qword [0x14007b658]
xor rax, rsp
mov qword [rbp + 0x1fe0], rax
mov ebx, edx
mov rdi, rcx
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x40], 6
lea edx, [rax + 0x55]
lea rcx, [0x14008da10]
call fcn.14000a780
mov rcx, rax
call fcn.140009de0
mov qword [rsp + 0x50], rax
imul eax, ebx, 0x37
mov dword [rsp + 0x48], eax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x1061
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x56
lea rcx, [0x14008da10]
call fcn.14000a780
mov rcx, rax
call fcn.140009de0
mov qword [rsp + 0x50], rax
imul eax, ebx, 0xe
mov dword [rsp + 0x48], eax
lea r9, [rsp + 0x40]
mov edx, 0x1061
mov r8d, 1
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x57
lea rcx, [0x14008da10]
call fcn.14000a780
mov rcx, rax
call fcn.140009de0
mov qword [rsp + 0x50], rax
imul eax, ebx, 0x23
mov dword [rsp + 0x48], eax
lea r9, [rsp + 0x40]
mov edx, 0x1061
mov r8d, 2
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x7c], 0
mov dword [rsp + 0x78], 0
mov edx, 0x55
lea rcx, [0x140088710]
call fcn.14000a780
mov rcx, rax
call fcn.140009de0
mov rdx, rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002d91b
lea edx, [rax + 0x4d]
lea rcx, [0x140088710]
call fcn.14000a780
mov rcx, rax
call fcn.140009de0
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x7c]
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [rsp + 0x78]
add eax, 2
mov ebx, eax
mov ecx, eax
call fcn.140009a50
mov r15, rax
test rax, rax
je 0x14002d8be
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.14003f490
jmp 0x14002d8c1
xor r15d, r15d
mov edx, 0x4d
lea rcx, [0x140088710]
call fcn.14000a780
mov rcx, rax
call fcn.140009de0
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14002d90f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x14002d922
mov rcx, r15
call fcn.14003d894
xor eax, eax
jmp 0x14002dc8b
xor eax, eax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
lea ecx, [rax + 0x10]
call fcn.14003d858
mov qword [0x14008e648], rax
mov ecx, 0x14
call fcn.14003d858
test rax, rax
je 0x14002d96f
mov rcx, rax
call fcn.140016960
mov rcx, rax
jmp 0x14002d971
xor ecx, ecx
mov rdx, qword [0x14008e648]
mov qword [rdx], rcx
mov eax, dword [r15]
mov dword [rcx], eax
mov rcx, qword [rdx]
mov eax, dword [r15 + 4]
mov dword [rcx + 4], eax
mov rax, qword [rdx]
cmp dword [rax + 4], 0
je 0x14002d91b
mov ecx, 0x12460
call fcn.140009a50
mov rbx, rax
test rax, rax
je 0x14002d9d1
xor edx, edx
mov r8d, 0x12460
mov rcx, rax
call fcn.14003f490
lea r9, [0x140016980]
mov edx, 0x20
mov r8d, 0x923
mov rcx, rbx
call fcn.140016cd0
jmp 0x14002d9d3
xor ebx, ebx
mov rcx, qword [0x14008e648]
mov qword [rcx + 8], rbx
mov rcx, qword [rcx]
mov eax, dword [r15 + 8]
mov dword [rcx + 8], eax
lea rbx, [r15 + 0x14]
lea rcx, [0x14008d988]
call fcn.14003a540
lea rcx, [0x14008d9e0]
call fcn.14003a540
mov edx, dword [rsp + 0x78]
lea rcx, [0x14008d988]
call fcn.1400148d0
mov edx, dword [rsp + 0x78]
lea rcx, [0x14008d9e0]
call fcn.1400148d0
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp - 0x20]
call fcn.14003f490
xor r12d, r12d
test rbx, rbx
je 0x14002dc80
xor edi, edi
mov rdx, qword [0x14008e648]
nop word [rax + rax]
mov r13, rbx
mov rcx, qword [rdx + 8]
movzx eax, word [rbx]
mov word [rdi + rcx], ax
mov rcx, qword [rdx + 8]
movzx r14d, word [rcx + rdi]
add r14, rbx
movzx eax, word [rbx + 2]
mov word [rcx + rdi + 2], ax
mov rcx, qword [rdx + 8]
cmp word [rcx + rdi + 2], 0
je 0x14002dc80
movzx eax, word [rbx + 4]
mov word [rcx + rdi + 4], ax
mov rcx, qword [rdx + 8]
movzx eax, word [rbx + 6]
mov word [rdi + rcx + 6], ax
mov rcx, qword [rdx + 8]
mov eax, dword [rbx + 8]
mov dword [rdi + rcx + 8], eax
add rbx, 0x10
mov rax, qword [rdx + 8]
movzx r8d, word [rdi + rax + 2]
shr r8, 1
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.140016440
lea rdx, [rbp - 0x20]
lea rcx, [0x14008d9e0]
call fcn.140016320
mov rax, qword [0x14008e648]
mov rdx, qword [rax + 8]
movzx eax, word [rdx + rdi + 2]
add rbx, rax
movzx ecx, word [rdx + rdi + 4]
sub ecx, 1
je 0x14002dc33
sub ecx, 2
je 0x14002db63
cmp ecx, 1
je 0x14002db14
lea rdx, [0x140055950]
lea rcx, [0x14008d988]
call fcn.140016320
jmp 0x14002dc58
movzx r9d, byte [rbx + 3]
shl r9d, 8
movzx eax, byte [rbx + 2]
add r9d, eax
shl r9d, 8
movzx eax, byte [rbx + 1]
add r9d, eax
shl r9d, 8
movzx eax, byte [rbx]
add r9d, eax
lea r8, [0x1400630bc]
mov edx, 0x20
lea rcx, [rbp - 0x60]
call fcn.14000e0c0
lea rdx, [rbp - 0x60]
lea rcx, [0x14008d988]
call fcn.140016320
jmp 0x14002dc58
xor eax, eax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
lea rdx, [0x140055950]
lea rcx, [rbp - 0x80]
call fcn.14000a680
nop
xor esi, esi
mov rax, qword [0x14008e648]
mov rcx, qword [rax + 8]
movzx eax, word [rcx + rdi + 6]
cmp eax, 1
js 0x14002dc17
nop dword [rax]
lea rcx, [rbp - 0x60]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14002dbc0
movzx r9d, byte [rbx]
mov edx, 0x20
lea rcx, [rbp - 0x60]
test rax, rax
lea r8, str.__.2X
jne 0x14002dbea
lea r8, str._.2X
call fcn.1400160e0
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x80]
call fcn.14000a840
inc esi
inc rbx
mov rax, qword [0x14008e648]
mov rcx, qword [rax + 8]
movzx eax, word [rcx + rdi + 6]
dec eax
cmp esi, eax
jle 0x14002dbb0
lea rdx, [rbp - 0x80]
lea rcx, [0x14008d988]
call fcn.1400162c0
nop
lea rcx, [rbp - 0x80]
call fcn.140002990
jmp 0x14002dc58
movzx r8d, word [rdx + rdi + 6]
shr r8, 1
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.140016440
lea rdx, [rbp - 0x20]
lea rcx, [0x14008d988]
call fcn.140016320
mov rdx, qword [0x14008e648]
mov rax, qword [rdx + 8]
movzx ebx, word [rax + rdi]
add rbx, r13
inc r12d
add rdi, 0x20
cmp dword [r14], 0x45
je 0x14002dc80
test rbx, rbx
jne 0x14002da50
mov rcx, r15
call fcn.14003d894
mov eax, r12d
mov rcx, qword [rbp + 0x1fe0]
xor rcx, rsp
call fcn.14003da20
mov rbx, qword [rsp + 0x2140]
add rsp, 0x20f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret