Function at 0x14000291d
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov r14, rdx
mov qword [rsp + 0x50], rcx
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov rdx, r8
mov r8, r9
call fcn.140092713
lea rsi, [rsp + 0x4c]
mov dword [rsi], 0x800
lea r15, [rsp + 0x5c]
and dword [r15], 0
mov ecx, 0x800
call fcn.1400e805c
mov rdi, rax
lea r12, [rsp + 0x60]
mov qword [r12], rax
mov qword [r12 + 8], rdx
and qword [r12 + 0x10], 0
mov rbx, qword [rbx]
mov rbp, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
mov rcx, r14
mov rdx, rbx
xor r8d, r8d
mov r9, r15
call rbp
cmp eax, 0xea
jne 0x1400029bc
mov edx, dword [rsp + 0x4c]
mov rcx, r12
call fcn.14004b849
mov rdi, qword [rsp + 0x60]
jmp 0x14000298a
mov r13d, eax
test eax, eax
jne 0x1400029d8
mov ebp, dword [rsp + 0x5c]
cmp ebp, 0xb
jbe 0x140002a1b
movabs r13, 0xde00000002
jmp 0x1400029e0
shl r13, 0x20
or r13, 2
mov rdx, qword [rsp + 0x68]
mov rcx, rdi
call fcn.1400eef2b
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.14009a8f1
mov rax, qword [rsp + 0x50]
mov qword [rax + 8], r13
and qword [rax], 0
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov esi, dword [rsp + 0x4c]
mov r14, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.14009a8f1
cmp bpl, 7
ja 0x140002d9e
movzx eax, bpl
mov ecx, 0x86
bt ecx, eax
jae 0x140002d9e
mov dword [rsp + 0x48], ebp
mov qword [rsp + 0x90], r14
mov ebx, esi
and ebx, 0xfffffffe
add rbx, rdi
lea r14, [rsp + 0x60]
mov qword [r14], 1
xorps xmm0, xmm0
movups xmmword [r14 + 8], xmm0
mov rdx, rsi
shr rdx, 2
bt esi, 1
adc rdx, 0
mov rcx, r14
call fcn.1400eef6d
xor r13d, r13d
lea r15, [rsp + 0x30]
mov rbp, rdi
test r13w, r13w
je 0x140002aa2
mov ecx, r12d
jmp 0x140002ab3
cmp rbp, rbx
je 0x140002c31
movzx ecx, word [rbp]
add rbp, 2
mov eax, ecx
and eax, 0xf800
cmp ax, 0xd800
jne 0x140002acf
cmp cx, 0xdbff
jbe 0x140002b3f
xor r13d, r13d
jmp 0x140002b78
movzx eax, cx
shl rax, 0x10
mov rsi, rax
shr rsi, 0x10
cmp esi, 0x7f
ja 0x140002b11
mov rdx, qword [rsp + 0x70]
cmp rdx, qword [rsp + 0x68]
jne 0x140002afb
mov rcx, r14
call fcn.1400eef52
mov rdx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
mov byte [rax + rdx], sil
inc rdx
mov qword [rsp + 0x70], rdx
xor r13d, r13d
jmp 0x140002a97
and dword [rsp + 0x30], 0
cmp esi, 0x800
jae 0x140002b65
shr rax, 0x16
or al, 0xc0
mov byte [rsp + 0x30], al
and sil, 0x3f
or sil, 0x80
mov byte [rsp + 0x31], sil
mov eax, 2
jmp 0x140002c16
cmp rbp, rbx
je 0x140002b72
movzx eax, word [rbp]
add rbp, 2
mov edx, eax
add edx, 0x2000
mov r13w, 1
cmp dx, 0xfc00
jae 0x140002bae
mov r12d, eax
jmp 0x140002b78
cmp esi, 0x10000
jae 0x140002bd9
xor r13d, r13d
jmp 0x140002b82
xor r13d, r13d
mov rbp, rbx
and dword [rsp + 0x30], 0
mov esi, 0xfffd
mov eax, esi
shr eax, 0xc
or al, 0xe0
mov byte [rsp + 0x30], al
mov eax, esi
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x31], al
and sil, 0x3f
or sil, 0x80
mov byte [rsp + 0x32], sil
mov eax, 3
jmp 0x140002c19
movzx eax, ax
and ecx, 0x3ff
and eax, 0x3ff
shl rcx, 0x1a
shl rax, 0x10
or rax, rcx
movabs rcx, 0x100000000
add rax, rcx
jmp 0x140002ad6
mov rcx, rax
shr rcx, 0x22
or cl, 0xf0
mov byte [rsp + 0x30], cl
mov rcx, rax
shr rcx, 0x1c
and cl, 0x3f
or cl, 0x80
mov byte [rsp + 0x31], cl
shr rax, 0x16
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x32], al
and sil, 0x3f
or sil, 0x80
mov byte [rsp + 0x33], sil
mov eax, 4
xor r13d, r13d
lea r8, [rsp + rax]
add r8, 0x30
mov rcx, r14
mov rdx, r15
call fcn.1400eee4a
jmp 0x140002a97
mov r15, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
mov rax, qword [rsp + 0x70]
inc rax
mov esi, dword [rsp + 0x48]
cmp rax, 1
je 0x140002c5e
lea rbx, [rax - 1]
cmp byte [r15 + rax - 2], 0
mov rax, rbx
je 0x140002c47
jmp 0x140002c60
xor ebx, ebx
cmp sil, 7
jne 0x140002d30
lea rsi, [rsp + 0x30]
mov qword [rsi], 1
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
and dword [rsp + 0x88], 0
xor r14d, r14d
xor ebp, ebp
mov rax, r12
mov r12, rbx
sub r12, rbp
cmovb r12, rax
lea rax, [r15 + rbp]
mov edx, 0
cmovae rdx, rax
jb 0x140002d42
cmp r12, 0xf
ja 0x140002cc4
xor r8d, r8d
cmp r12, r8
je 0x140002cd3
cmp byte [rdx + r8], 0
je 0x140002cda
inc r8
jmp 0x140002cb3
xor ecx, ecx
mov r8, r12
call fcn.14001d3d0
mov r8, rdx
jmp 0x140002cdf
mov r8, r12
xor eax, eax
jmp 0x140002cdf
mov eax, 1
cmp rax, 1
jne 0x140002d42
add r8, rbp
mov rbp, r8
inc rbp
je 0x140002c8a
cmp rbp, rbx
ja 0x140002c8a
add r8, r15
mov al, byte [r8]
cmp al, byte [rsp + 0x88]
jne 0x140002c8a
add r14, r15
mov rcx, rsi
mov rdx, r14
call fcn.1400eee4a
mov rcx, rsi
lea rdx, [0x1401d4038]
lea r8, [0x1401d4039]
call fcn.1400eee4a
mov r14, rbp
jmp 0x140002c8a
mov rax, qword [rsp + 0x50]
mov qword [rax], r15
mov qword [rax + 8], r13
mov qword [rax + 0x10], rbx
jmp 0x140002d8a
add r14, r15
add rbx, r15
lea r12, [rsp + 0x30]
mov rcx, r12
mov rdx, r14
mov r8, rbx
call fcn.1400eee4a
mov rax, qword [r12 + 0x10]
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [r12]
movups xmmword [rcx], xmm0
test r13, r13
mov esi, dword [rsp + 0x48]
je 0x140002d8a
mov edx, 1
mov rcx, r15
mov r8, r13
call fcn.140002892
cmp sil, 0xc
mov r14, qword [rsp + 0x90]
je 0x140002a07
jmp 0x140002db5
movabs rax, 0xde00000002
mov rcx, qword [rsp + 0x50]
mov qword [rcx + 8], rax
and qword [rcx], 0
mov rcx, rdi
mov rdx, r14
call fcn.1400eef2b
jmp 0x140002a07