Function at 0x140002460
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push r15
mov rax, recv
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14000246a
sub rsp, 0x28
mov rax, qword [rsp + 0xc0]
mov qword [0x14006a700], rax
mov dword [rsp + 0x78], 0
push qword [0x140069cdc]
pop rcx
call fcn.14000d0d4
mov rcx, qword [0x140069cec]
call fcn.14000d244
mov rcx, qword [0x140069cec]
call fcn.14000d258
or rax, rax
je 0x140002502
push qword [0x140069cdc]
pop rcx
call fcn.14000d168
mov rbp, qword [0x140069cf4]
lea rax, [rbp + 0x10]
mov rax, rax
push rax
mov rbp, qword [0x140069ce4]
lea rax, [rbp + 0x10]
mov rcx, rax
pop r9
movabs r8, 0x1400678b8
mov rdx, 0x44
call fcn.1400042ec
jmp 0x1400024ae
push qword [0x140069cec]
pop rcx
call fcn.14000d0d4
sub rsp, 8
lea rax, [rsp + 0x30]
mov rax, rax
push rax
push 1
push 0
movabs rax, str.HARDWAREDEVICEMAPSERIALCOMM
push rax
movabs rax, 0x80000002
push rax
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.dll_RegOpenKeyExW
add rsp, 0x30
mov r15, rax
and r15, r15
jne 0x140002784
push qword [0x14006a700]
sub rsp, 8
push qword [0x14006a700]
push 0x400
pop rcx
pop rdx
sub rsp, 0x20
call fcn.140011b70
add rsp, 0x28
lea rcx, [rsp + 0x40]
pop rdx
call fcn.140014100
mov qword [rsp + 0x30], 0x400
push 0
push 0
push 0
push 0
lea rax, [rsp + 0x50]
mov rax, rax
push rax
mov rax, qword [rsp + 0x60]
mov rax, rax
push rax
push qword [rsp + 0x80]
push qword [rsp + 0x60]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.dll_RegEnumValueW
add rsp, 0x40
mov r15, rax
and r15, r15
jne 0x140002773
push qword [0x14006a700]
sub rsp, 8
push qword [0x14006a700]
push qword [rsp + 0x48]
push qword [rsp + 0x58]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.140011bd0
add rsp, 0x28
lea rcx, [rsp + 0x48]
pop rdx
call fcn.140014100
push qword [rsp + 0x40]
movabs rcx, 0x140067028
pop rdx
call fcn.1400141d0
or rax, rax
je 0x140002634
jmp 0x14000277a
mov qword [rsp + 0x30], 0x400
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x30]
mov rax, rax
push rax
mov rax, qword [rsp + 0x40]
mov rax, rax
push rax
lea rax, [rsp + 0x58]
mov rax, rax
push rax
push 0
push qword [rsp + 0x60]
push qword [rsp + 0x50]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call sub.ADVAPI32.dll_RegQueryValueExW
add rsp, 0x30
mov r15, rax
and r15, r15
jne 0x140002764
movabs rax, str.Serial
push rax
push qword [rsp + 0x48]
pop rcx
pop rdx
call fcn.140011630
mov r15, rax
and r15, r15
jne 0x1400026fc
movabs rax, 0x1400675e2
push rax
push qword [rsp + 0x48]
pop rcx
pop rdx
call fcn.140011630
mov r15, rax
and r15, r15
jne 0x1400026e9
movabs rax, str.USBSER
push rax
push qword [rsp + 0x48]
pop rcx
pop rdx
call fcn.140011630
mov r15, rax
and r15, r15
jne 0x1400026e9
jmp 0x1400026f2
mov rax, 1
jmp 0x1400026f5
xor rax, rax
and rax, rax
jne 0x1400026fc
jmp 0x140002705
mov rax, 1
jmp 0x140002708
xor rax, rax
and rax, rax
je 0x140002764
push qword [0x140069cec]
pop rcx
call fcn.14000d168
mov rcx, qword [rsp + 0x38]
push qword [0x14006a700]
sub rsp, 0x28
call fcn.140014230
add rsp, 0x28
mov rbp, qword [0x140069cf4]
lea rcx, [rbp + 0x10]
pop rdx
call fcn.140014100
mov rcx, qword [rsp + 0x40]
push qword [0x14006a700]
sub rsp, 0x28
call fcn.140014230
add rsp, 0x28
lea rcx, [rbp + 0x18]
pop rdx
call fcn.140014100
mov r15, qword [rsp + 0x50]
inc r15
mov qword [rsp + 0x50], r15
jmp 0x140002775
jmp 0x14000277a
jmp 0x140002589
push qword [rsp + 0x28]
pop rcx
call sub.ADVAPI32.dll_RegCloseKey
movsxd r15, dword [0x140069c84]
and r15, r15
jne 0x140002890
mov rcx, qword [0x140069cec]
call fcn.14000d244
mov rcx, qword [0x140069cec]
call fcn.14000d258
or rax, rax
je 0x14000288e
mov rbp, qword [0x140069cf4]
mov rcx, qword [rbp + 0x10]
push qword [0x14006a700]
sub rsp, 0x28
call fcn.140014230
add rsp, 0x28
lea rcx, [rsp + 0x88]
pop rdx
call fcn.140014100
mov rcx, qword [0x140069cdc]
call fcn.14000d244
mov rcx, qword [0x140069cdc]
call fcn.14000d258
or rax, rax
je 0x140002837
mov rbp, qword [0x140069cf4]
push qword [rbp + 0x10]
mov rbp, qword [0x140069ce4]
mov rcx, qword [rbp + 0x10]
pop rdx
call fcn.1400141d0
or rax, rax
je 0x140002835
movabs rdx, 0x140067028
lea rcx, [rsp + 0x80]
call fcn.1400142a0
jmp 0x1400027ed
push qword [rsp + 0x80]
movabs rcx, 0x140067028
pop rdx
call fcn.1400141d0
or rax, rax
jne 0x140002889
mov rbp, qword [0x140069cf4]
lea rax, [rbp + 0x10]
mov rax, rax
push rax
movabs rax, 0x140069c94
mov rcx, rax
pop r9
movabs r8, 0x1400678b8
mov rdx, 0x44
call fcn.1400042ec
jmp 0x14000288e
jmp 0x1400027a0
jmp 0x14000289a
mov dword [0x140069c84], 0
mov rcx, qword [rsp + 0x80]
push qword [0x14006a700]
sub rsp, 0x28
call fcn.140014230
add rsp, 0x28
pop rax
add rax, qword [0x14006a720]
jmp 0x1400028d2
push rax
mov rcx, qword [rsp + 0x78]
sub rsp, 0x28
call fcn.140014400
add rsp, 0x28
mov rcx, qword [rsp + 0x88]
sub rsp, 0x28
call fcn.140014400
add rsp, 0x28
mov rcx, qword [rsp + 0x48]
sub rsp, 0x28
call fcn.140014400
add rsp, 0x28
mov rcx, qword [rsp + 0x40]
sub rsp, 0x28
call fcn.140014400
add rsp, 0x28
pop rax
add rsp, 0x88
pop r15
pop rbp
ret