Function at 0x14002a410
Capabilities:
Query or enumerate registry value
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r14
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x160], rax
and qword [rsp + 0x40], 0
mov rdi, rcx
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
jne 0x14002a46a
lea edx, [rcx + 4]
call fcn.140016188
mov rcx, qword [0x140050310]
cmp rcx, 0xffffffffffffffff
je 0x14002a496
cmp dword [0x1400516e0], 3
jl 0x14002a496
and dword [rsp + 0x34], 0
lea r9, [rsp + 0x34]
and qword [rsp + 0x20], 0
lea rdx, str.Gathering_existing_system_service_data..._r_n
mov r8d, 0x2b
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rdi + 0x20]
test rdx, rdx
je 0x14002a4a7
mov rcx, rdi
call fcn.14002a21c
lea rax, [rsp + 0x40]
mov r14d, 1
mov r9d, r14d
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftMediaPlayerPreferences
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r12d, 0x140
test eax, eax
jne 0x14002a766
and dword [rsp + 0x34], eax
lea r9, [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rdx, str.LegacyContentProviderFound
lea rax, [rsp + 0x34]
mov dword [rsp + 0x30], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002a63e
cmp dword [rsp + 0x34], r14d
jne 0x14002a63e
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x38], 0x208
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.LegacyContentProviderName
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002a63e
cmp dword [rsp + 0x30], r14d
jne 0x14002a63e
movzx eax, word [rsp + 0x50]
cmp ax, word [0x14003f4a0]
mov rbx, qword [rdi + 0x10]
je 0x14002a628
jmp 0x14002a5bf
mov rax, qword [rbx]
test rax, rax
je 0x14002a5c4
cmp qword [rax], 0
lea rdx, [0x14003f4a0]
lea rcx, [rsp + 0x50]
cmovne rdx, qword [rax]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x14002a5de
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x14002a595
mov rcx, r12
call fcn.14003c414
test rax, rax
je 0x14002a5ea
mov rcx, rax
call fcn.140026794
mov rbx, rax
jmp 0x14002a5ec
mov rax, qword [rbx]
mov dword [rax + 0x110], r14d
jmp 0x14002a628
xor ebx, ebx
test rbx, rbx
je 0x14002a628
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140016d18
mov dword [rbx + 0x110], r14d
test eax, eax
jne 0x14002a618
mov rdx, rbx
mov rcx, rdi
call fcn.14002817c
test eax, eax
je 0x14002a628
mov rcx, rbx
call fcn.140026888
mov rcx, rbx
call fcn.14003c454
lea r8, [rsp + 0x50]
mov ecx, 3
lea rdx, str.__Legacy_service_is:__S._r_n
call fcn.1400168a8
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x38], 0x208
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.DefaultSubscriptionService
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002a75b
cmp dword [rsp + 0x30], r14d
jne 0x14002a75b
movzx eax, word [rsp + 0x50]
cmp ax, word [0x14003f4a0]
mov rbx, qword [rdi + 0x10]
je 0x14002a745
jmp 0x14002a6c9
mov rax, qword [rbx]
test rax, rax
je 0x14002a6ce
cmp qword [rax], 0
lea rdx, [0x14003f4a0]
lea rcx, [rsp + 0x50]
cmovne rdx, qword [rax]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x14002a6e8
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x14002a69f
mov rcx, r12
call fcn.14003c414
test rax, rax
je 0x14002a6f4
mov rcx, rax
call fcn.140026794
mov rbx, rax
jmp 0x14002a6f6
mov rax, qword [rbx]
mov dword [rax + 0x114], r14d
jmp 0x14002a745
xor ebx, ebx
test rbx, rbx
je 0x14002a745
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140016d18
mov dword [rbx + 0x114], r14d
test eax, eax
jne 0x14002a735
xor edx, edx
mov rcx, rbx
call fcn.140026e2c
test eax, eax
je 0x14002a72e
mov rdx, rbx
mov rcx, rdi
call fcn.14002817c
jmp 0x14002a731
mov eax, r14d
test eax, eax
je 0x14002a745
mov rcx, rbx
call fcn.140026888
mov rcx, rbx
call fcn.14003c454
lea r8, [rsp + 0x50]
mov ecx, 3
lea rdx, str.__Previous_service_is:__S._r_n
call fcn.1400168a8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x40]
mov r9d, r14d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftMediaPlayerPreferences
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002a8af
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x50]
mov dword [rsp + 0x34], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.OEMServiceOverride11
mov dword [rsp + 0x30], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14002a8a4
cmp dword [rsp + 0x34], r14d
jne 0x14002a8a4
movzx eax, word [0x14003f4a0]
cmp word [rsp + 0x50], ax
je 0x14002a8a4
mov rbx, qword [rdi + 0x10]
jmp 0x14002a825
mov rax, qword [rbx]
test rax, rax
je 0x14002a82a
cmp qword [rax], 0
lea rdx, [0x14003f4a0]
lea rcx, [rsp + 0x50]
cmovne rdx, qword [rax]
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x14002a844
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x14002a7fb
mov rcx, r12
call fcn.14003c414
test rax, rax
je 0x14002a850
mov rcx, rax
call fcn.140026794
mov rbx, rax
jmp 0x14002a852
mov rax, qword [rbx]
mov dword [rax + 0x118], r14d
jmp 0x14002a88e
xor ebx, ebx
test rbx, rbx
je 0x14002a88e
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140016d18
mov dword [rbx + 0x118], r14d
test eax, eax
jne 0x14002a87e
mov rdx, rbx
mov rcx, rdi
call fcn.14002817c
test eax, eax
je 0x14002a88e
mov rcx, rbx
call fcn.140026888
mov rcx, rbx
call fcn.14003c454
lea r8, [rsp + 0x50]
mov ecx, 3
lea rdx, str.__OEM_service_override_is:__S._r_n
call fcn.1400168a8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.14003c810
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop r12
pop rbp
ret