Function at 0x14002ba70
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xd0
mov rax, r9
mov r12, r8
mov r15, rdx
mov r13, rcx
test rcx, rcx
je 0x14002bded
cmp qword [rcx + 8], 0
je 0x14002bded
test rdx, rdx
je 0x14002bded
mov r14, qword [rdx + 8]
test r14, r14
je 0x14002bded
cmp qword [rdx + 0x10], 0
je 0x14002bded
test r8, r8
je 0x14002bded
test rax, rax
je 0x14002bded
cmp qword [rbp + 0x7f], 0
je 0x14002bded
xor edi, edi
lea rsi, str.HKEY_LOCAL_MACHINE
nop dword [rax + rax]
mov rcx, qword [rsi]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rcx + rbx*2], 0
jne 0x14002bb10
mov r8, rbx
mov rdx, r14
call fcn.14021f144
test eax, eax
je 0x14002bb43
inc rdi
add rsi, 0x10
mov rax, rdi
cmp rdi, 0xa
jb 0x14002bb00
cmp rax, 0xa
je 0x14002bded
movzx ecx, word [r14 + rbx*2]
lea rax, [r14 + rbx*2]
cmp cx, 0x5c
je 0x14002bb61
test cx, cx
jne 0x14002bded
cmp cx, 0x5c
jne 0x14002bb6f
movzx ecx, word [rax + 2]
add rax, 2
cmp cx, 0x5c
je 0x14002bb61
add rdi, rdi
xor r14d, r14d
test cx, cx
mov edx, r14d
lea rcx, str.HKEY_LOCAL_MACHINE
mov r9d, 0x20119
cmovne rdx, rax
lea rax, [rbp - 0x49]
mov rcx, qword [rcx + rdi*8 + 8]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002bcbc
mov rcx, qword [rbp - 0x49]
lea rax, [0x140029d30]
mov qword [rbp - 0x31], rax
lea rax, [0x140029da0]
mov qword [rbp - 0x39], rax
lea rax, [0x140029db0]
mov qword [rbp - 0x29], rax
lea rax, [0x140029e20]
mov qword [rbp - 0x21], rax
lea rax, [rbp - 0x41]
mov qword [rbp - 0x19], rax
mov rax, qword [r15 + 0x10]
mov dword [rbp - 0x41], r14d
mov qword [rbp - 1], r14
mov qword [rbp + 7], r14
mov qword [rbp + 0xf], 0xffffffffffffffff
mov qword [rbp - 0x11], rcx
mov qword [rbp - 9], rax
test rax, rax
je 0x14002bcb6
test rcx, rcx
je 0x14002bcb6
mov qword [rsp + 0x58], r14
lea rax, [rbp + 0x5f]
mov qword [rsp + 0x50], r14
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
mov qword [rsp + 0x40], r14
xor edx, edx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x14002bcb2
mov esi, dword [rbp + 0x5f]
cmp esi, 4
jae 0x14002bc60
lea esi, [rax + 4]
jmp 0x14002bc63
add esi, 2
mov ebx, 1
mov ecx, esi
mov edx, ebx
call fcn.1402122f4
mov rdi, rax
test rax, rax
je 0x14002bcb2
mov rdx, qword [rbp - 9]
lea r9, [rbp - 0x51]
mov rcx, qword [rbp - 0x11]
xor r8d, r8d
mov qword [rbp - 1], rax
lea rax, [rbp + 7]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov dword [rbp + 7], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
cmp eax, 2
jbe 0x14002bcc6
mov rcx, rdi
call fcn.1402122e0
mov rcx, qword [rbp - 0x49]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 3
jmp 0x14002bdf2
mov eax, dword [rbp + 7]
lea rsi, [r15 + 0x19]
test ecx, ecx
mov dword [rbp + 0xb], r14d
mov rcx, qword [r13 + 8]
cmovne eax, r14d
mov dword [rbp + 7], eax
test rcx, rcx
je 0x14002bdca
test rsi, rsi
je 0x14002bdca
mov r14, qword [rbp + 0x77]
mov rdx, rsi
mov r8, r14
call fcn.1400285a0
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14002bd10
lea ebx, [rax + 0xb]
jmp 0x14002bdc7
mov rax, qword [rbp - 0x39]
lea rcx, [0x140029da0]
cmp rax, rcx
jne 0x14002bd30
mov rax, qword [rbp - 0x19]
cmp qword [rax + 0x40], 0
je 0x14002bd3f
mov eax, dword [rax + 0x48]
jmp 0x14002bd3a
mov rcx, qword [rbp - 0x19]
call qword [case.0x14004822f.0]
test rax, rax
jne 0x14002bd7d
movups xmm0, xmmword [rsi]
mov rax, qword [rbp + 0x7f]
xor r14d, r14d
movups xmmword [r12], xmm0
mov qword [rax], r14
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [r12 + 0x10], xmm1
test rdi, rdi
je 0x14002bd78
mov rcx, qword [rdi + 8]
cmp rcx, 0xffffffffffffffff
je 0x14002bd70
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.1402122e0
mov ebx, r14d
jmp 0x14002bdca
mov rax, qword [rbp + 0x7f]
lea r8, [rbp - 0x41]
mov r9, r12
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, r13
call fcn.140029240
mov ebx, eax
test rdi, rdi
je 0x14002bdb7
mov rcx, qword [rdi + 8]
cmp rcx, 0xffffffffffffffff
je 0x14002bdaf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.1402122e0
test ebx, ebx
je 0x14002bdc7
mov rcx, qword [r13 + 8]
mov rdx, r14
call fcn.1400289d0
xor r14d, r14d
mov rcx, qword [rbp - 1]
call fcn.1402122e0
mov rcx, qword [rbp - 0x49]
mov qword [rbp + 7], 0
mov qword [rbp - 1], r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x14002bdf2
mov eax, 1
mov rbx, qword [rsp + 0x118]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret