Function at 0x14002aa90
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x88
mov qword [rbp + 7], 0xfffffffffffffffe
cmp byte [0x1401bfc11], 0
jne 0x14002aac6
movzx eax, byte [0x1401c4d67]
jmp 0x14002afe5
mov byte [0x1401bfc11], 0
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x39], rax
lea rdx, str.XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX0000000
test rdx, 0xffffffffffff0000
jne 0x14002ab16
movzx ebx, dx
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x14002ab26
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp - 0x39]
call fcn.1400025a0
jmp 0x14002ab26
mov r8d, 0x27
lea rcx, [rbp - 0x39]
call fcn.1400022b0
nop
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x21], rax
lea rdx, str.XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
test rdx, 0xffffffffffff0000
jne 0x14002ab6f
movzx ebx, dx
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x14002ab7f
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp - 0x21]
call fcn.1400025a0
jmp 0x14002ab7f
mov r8d, 0x20
lea rcx, [rbp - 0x21]
call fcn.1400022b0
nop
mov rax, qword [rbp - 0x39]
mov r8d, dword [rax - 0x10]
mov rax, qword [rbp - 0x21]
sub r8d, dword [rax - 0x10]
lea rdx, [rbp + 0x7f]
lea rcx, [rbp - 0x39]
call fcn.14001a5c0
nop
xor r13d, r13d
mov rax, qword [rbp + 0x7f]
mov ecx, dword [rax - 0x10]
test ecx, ecx
je 0x14002ad50
js 0x14002ad45
cmp word [rax], 0x30
jne 0x14002ad50
lea r8d, [rcx - 1]
lea rdx, [rbp - 0x19]
lea rcx, [rbp + 0x7f]
call fcn.14001a5c0
nop
mov r14, qword [rax]
lea rdx, [r14 - 0x18]
mov rcx, qword [rbp + 0x7f]
lea rbx, [rcx - 0x18]
cmp rdx, rbx
je 0x14002acf8
cmp dword [rbx + 0x10], 0
jl 0x14002ac23
mov rax, qword [rbx]
cmp qword [rdx], rax
jne 0x14002ac23
mov rcx, rdx
call fcn.140002400
mov rdi, rax
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14002ac16
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rbp + 0x7f], rax
jmp 0x14002acf8
movsxd rdi, dword [r14 - 0x10]
test edi, edi
jne 0x14002ac7f
mov rdi, qword [rbx]
cmp dword [rbx + 8], 0
je 0x14002acf8
cmp dword [rbx + 0x10], 0
jge 0x14002ac59
cmp dword [rcx - 0xc], 0
jl 0x14002ad19
mov dword [rcx - 0x10], r13d
mov rax, qword [rbp + 0x7f]
mov word [rax], r13w
jmp 0x14002acf8
lock add dword [rbx + 0x10], 0xffffffff
jg 0x14002ac6c
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x7f], rax
jmp 0x14002acf8
test r14, r14
je 0x14002ad3a
mov r12d, dword [rcx - 0x10]
mov rsi, r14
sub rsi, rcx
sar rsi, 1
test edi, edi
js 0x14002ad2f
mov edx, 1
sub edx, dword [rbx + 0x10]
mov eax, dword [rbx + 0xc]
sub eax, edi
or eax, edx
jge 0x14002acbd
mov edx, edi
lea rcx, [rbp + 0x7f]
call fcn.1400023a0
mov rcx, qword [rbp + 0x7f]
lea rbx, [rdi + rdi]
movsxd rdx, dword [rcx - 0xc]
mov r9, rbx
add rdx, rdx
cmp rsi, r12
ja 0x14002acdb
lea r8, [rcx + rsi*2]
call fcn.1400ceaf4
jmp 0x14002ace3
mov r8, r14
call fcn.1400cebf0
mov rax, qword [rbp + 0x7f]
cmp edi, dword [rax - 0xc]
jg 0x14002ad24
mov dword [rax - 0x10], edi
mov rax, qword [rbp + 0x7f]
mov word [rbx + rax], r13w
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002aba0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14002aba0
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 0x80070057
call fcn.140001920
int3
mov ecx, 0x80070057
call fcn.140001920
nop
mov ecx, 0x80070057
call fcn.140001920
int3
mov rcx, qword [0x1401c6948]
test rcx, rcx
je 0x14002ad62
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x31], rax
lea rdx, str.SoftwareBrowserExten
test rdx, 0xffffffffffff0000
jne 0x14002adab
movzx ebx, dx
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x14002adbb
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp - 0x31]
call fcn.1400025a0
jmp 0x14002adbb
mov r8d, 0x15
lea rcx, [rbp - 0x31]
call fcn.1400022b0
nop
lea r8, str.sionsProxySettings_
lea rdx, [rbp - 0x31]
lea rcx, [rbp - 0x11]
call fcn.14001a720
nop
lea r8, [rbp + 0x7f]
mov rdx, rax
lea rcx, [rbp - 1]
call fcn.14000f690
nop
lea rcx, [0x1401c6948]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
setne bl
mov rdx, qword [rbp - 1]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002ae24
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x11]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002ae3d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x31]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002ae55
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
jne 0x14002af95
mov dword [rbp + 0x77], r13d
mov dword [rbp + 0x67], r13d
mov dword [rbp + 0x6f], 4
lea rcx, [0x1401bc9a8]
mov rax, qword [0x1401bc9a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x29], rax
lea rdx, str.UseLoc
test rdx, 0xffffffffffff0000
jne 0x14002aeb5
movzx ebx, dx
mov ecx, ebx
call fcn.1400019e0
test rax, rax
je 0x14002aec5
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp - 0x29]
call fcn.1400025a0
jmp 0x14002aec5
mov r8d, 6
lea rcx, [rbp - 0x29]
call fcn.1400022b0
nop
lea r8, str.alSettings
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 9]
call fcn.14001a720
nop
lea rcx, [rbp + 0x6f]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x67]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x77]
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [0x1401c6948]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
setne bl
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002af21
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002af39
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test bl, bl
je 0x14002af86
mov ecx, dword [0x1401c4d60]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x66666667
imul r8d
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
shl eax, 2
sub r8d, eax
cmp r8d, 8
jne 0x14002af95
lea ecx, [r8 - 4]
call fcn.1400cea88
mov ecx, dword [0x1401c4d60]
mov dword [rax], ecx
jmp 0x14002af95
cmp dword [rbp + 0x67], 0
setne bl
mov byte [0x1401c4d67], bl
jmp 0x14002af97
xor bl, bl
mov rdx, qword [rbp + 0x7f]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002afb0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002afc9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rbp - 0x39]
lea rdx, [rax - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14002afe2
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, bl
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret