Function at 0x14002a470
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xd8
mov qword [rbp - 0x51], 0xfffffffffffffffe
mov r13, rcx
xor ebx, ebx
mov dword [rbp - 0x79], ebx
mov edx, 0xae
lea rcx, [rbp - 0x71]
call fcn.140024260
mov r15, rax
cmp qword [rax + 0x18], 0x10
jb 0x14002a4b8
mov r15, qword [rax]
mov rax, qword [rbp - 0x59]
cmp rax, 0x10
jb 0x14002a50e
inc rax
mov rcx, qword [rbp - 0x71]
cmp rax, 0x1000
jb 0x14002a509
test cl, 0x1f
je 0x14002a4dc
call fcn.1400e463c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14002a4eb
call fcn.1400e463c
int3
sub rcx, rax
cmp rcx, 8
jae 0x14002a4fa
call fcn.1400e463c
int3
cmp rcx, 0x27
jbe 0x14002a506
call fcn.1400e463c
int3
mov rcx, rax
call fcn.14007b810
mov qword [rbp - 0x59], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x61], rbx
mov byte [rbp - 0x71], bl
call fcn.14000bcc0
mov rcx, rax
test rax, rax
jne 0x14002a535
mov ecx, 0x80004005
call fcn.14000b790
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [r13], rax
mov r12d, 1
mov dword [rbp - 0x79], r12d
mov dword [rbp + 0x77], r12d
call fcn.14000bcc0
mov rcx, rax
test rax, rax
jne 0x14002a569
mov ecx, 0x80004005
call fcn.14000b790
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x30], rdi
lea rcx, [0x14012f52c]
mov rsi, rcx
shr rsi, 0x10
or r14, 0xffffffffffffffff
test rsi, rsi
jne 0x14002a5b2
movzx ebx, cx
xor edx, edx
mov ecx, ebx
call fcn.14000b6e0
test rax, rax
je 0x14002a5d3
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14000bdc0
jmp 0x14002a5ce
mov rax, r14
inc rax
cmp byte [rcx + rax], 0
jne 0x14002a5b5
mov r8d, eax
mov rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.14000c510
mov rdi, qword [rsp + 0x30]
mov dword [rbp + 0x6f], 0x104
mov edx, 0xf6
lea rcx, [rbp - 0x49]
call fcn.140024260
mov rbx, rax
mov edx, r12d
sub edx, dword [rdi - 8]
mov ecx, dword [rdi - 0xc]
sub ecx, 0x104
or ecx, edx
jge 0x14002a612
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.14000bfd0
mov rdi, qword [rsp + 0x30]
cmp qword [rbx + 0x18], 0x10
jb 0x14002a61c
mov rbx, qword [rbx]
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x77]
mov r8, rbx
mov rdx, r15
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
nop
mov rax, qword [rbp - 0x31]
cmp rax, 0x10
jb 0x14002a698
inc rax
mov rcx, qword [rbp - 0x49]
cmp rax, 0x1000
jb 0x14002a693
test cl, 0x1f
je 0x14002a666
call fcn.1400e463c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14002a675
call fcn.1400e463c
int3
sub rcx, rax
cmp rcx, 8
jae 0x14002a684
call fcn.1400e463c
int3
cmp rcx, 0x27
jbe 0x14002a690
call fcn.1400e463c
int3
mov rcx, rax
call fcn.14007b810
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.1400e521c
test eax, eax
js 0x14002a927
cmp eax, dword [rdi - 0xc]
jg 0x14002a927
mov dword [rdi - 0x10], eax
cdqe
mov byte [rax + rdi], 0
call fcn.14000bcc0
mov rcx, rax
test rax, rax
jne 0x14002a6d6
mov ecx, 0x80004005
call fcn.14000b790
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
lea rdx, [0x14012f52c]
test rsi, rsi
jne 0x14002a714
movzx esi, dx
xor edx, edx
mov ecx, esi
call fcn.14000b6e0
test rax, rax
je 0x14002a732
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14000bdc0
jmp 0x14002a72d
mov rax, r14
inc rax
cmp byte [rdx + rax], 0
jne 0x14002a717
mov r8d, eax
lea rcx, [rsp + 0x38]
call fcn.14000c510
mov rbx, qword [rsp + 0x38]
mov edx, 0xf7
lea rcx, [rbp - 0x29]
call fcn.140024260
mov rsi, rax
sub r12d, dword [rbx - 8]
mov ecx, dword [rbx - 0xc]
sub ecx, 0x104
or ecx, r12d
jge 0x14002a769
mov edx, 0x104
lea rcx, [rsp + 0x38]
call fcn.14000bfd0
mov rbx, qword [rsp + 0x38]
cmp qword [rsi + 0x18], 0x10
jb 0x14002a773
mov rsi, qword [rsi]
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x77]
mov r8, rsi
mov rdx, r15
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
nop
mov rax, qword [rbp - 0x11]
cmp rax, 0x10
jb 0x14002a7ef
inc rax
mov rcx, qword [rbp - 0x29]
cmp rax, 0x1000
jb 0x14002a7ea
test cl, 0x1f
je 0x14002a7bd
call fcn.1400e463c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14002a7cc
call fcn.1400e463c
int3
sub rcx, rax
cmp rcx, 8
jae 0x14002a7db
call fcn.1400e463c
int3
cmp rcx, 0x27
jbe 0x14002a7e7
call fcn.1400e463c
int3
mov rcx, rax
call fcn.14007b810
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400e521c
test eax, eax
js 0x14002a91c
cmp eax, dword [rbx - 0xc]
jg 0x14002a91c
mov dword [rbx - 0x10], eax
cdqe
mov byte [rax + rbx], 0
mov dword [rbp + 0x7f], 0
mov dword [rbp + 0x6f], 4
mov dword [rbp + 0x77], 4
mov edx, 0xf8
lea rcx, [rbp - 9]
call fcn.140024260
cmp qword [rax + 0x18], 0x10
jb 0x14002a842
mov rax, qword [rax]
lea r8, [rbp + 0x6f]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x7f]
mov qword [rsp + 0x20], r8
lea r9, [rbp + 0x77]
mov r8, rax
mov rdx, r15
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov rax, qword [rbp + 0xf]
cmp rax, 0x10
jb 0x14002a8c1
inc rax
mov rcx, qword [rbp - 9]
cmp rax, 0x1000
jb 0x14002a8bc
test cl, 0x1f
je 0x14002a88f
call fcn.1400e463c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14002a89e
call fcn.1400e463c
int3
sub rcx, rax
cmp rcx, 8
jae 0x14002a8ad
call fcn.1400e463c
int3
cmp rcx, 0x27
jbe 0x14002a8b9
call fcn.1400e463c
int3
mov rcx, rax
call fcn.14007b810
mov eax, dword [rbp + 0x7f]
mov dword [rsp + 0x20], eax
mov r9, rbx
mov r8, rdi
lea rdx, str._s__s__d
mov rcx, r13
call fcn.14000bb10
nop
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002a8f9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x14002a917
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, r13
jmp 0x14002a932
mov ecx, 0x80070057
call fcn.14000b790
nop
mov ecx, 0x80070057
call fcn.14000b790
nop
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret