Function at 0x14002e3f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x14007f080]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rax, [rbp - 0x29]
mov qword [rbp - 0x21], rax
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x14002e7ac
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x29], rax
lea rdx, [0x14006cce4]
cmp rdx, 0x10000
jae 0x14002e45a
movzx edx, dx
lea rcx, [rbp - 0x29]
call fcn.140002950
jmp 0x14002e476
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x14002e461
lea rcx, [rbp - 0x29]
call fcn.140002da0
nop
mov dword [rbp + 0xf], 4
lea rax, [rbp - 0x19]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SoftwareProcessLasso
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002e4f1
mov dword [rbp + 0x17], 4
mov dword [rbp + 0x1b], 4
lea rax, [rbp + 0x17]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x47]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1b]
xor r8d, r8d
lea rdx, str.UpdateChecksEnabled
mov rcx, qword [rbp - 0x19]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x19]
test eax, eax
je 0x14002e701
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SoftwareProcessLasso
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002e565
mov dword [rbp + 0x1f], 4
mov dword [rbp + 0x23], 4
lea rax, [rbp + 0x1f]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xf]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x23]
xor r8d, r8d
lea rdx, str.CoreStart
mov rcx, qword [rbp - 0x11]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x11]
test eax, eax
je 0x14002e701
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 4
mov ebx, 2
mov dword [rbp + 0x13], ebx
lea rax, [rbp - 1]
mov qword [rsp + 0x20], rax
lea r9d, [rbx - 1]
xor r8d, r8d
lea rdx, str.SoftwareProcessLasso
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002e5e0
mov dword [rbp + 0x2f], 4
mov dword [rbp + 0x33], 4
lea rax, [rbp + 0x2f]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x4b]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x33]
xor r8d, r8d
lea rdx, str.UpdateChecksEnabled
mov rcx, qword [rbp - 1]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 1]
test eax, eax
je 0x14002e64e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 7]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SoftwareProcessLasso
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002e654
mov dword [rbp + 0x37], 4
mov dword [rbp + 0x3b], 4
lea rax, [rbp + 0x37]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x13]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x3b]
xor r8d, r8d
lea rdx, str.GUIStart
mov rcx, qword [rbp + 7]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 7]
test eax, eax
je 0x14002e793
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x21]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SoftwareProcessLasso
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002e6c8
mov dword [rbp + 0x3f], 4
mov dword [rbp + 0x43], 4
lea rax, [rbp + 0x3f]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x13]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x43]
xor r8d, r8d
lea rdx, str.GUIStart
mov rcx, qword [rbp - 0x21]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x21]
test eax, eax
je 0x14002e79e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp + 0x13], ebx
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r9d, ebx
call fcn.14002fbb0
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.14003f1d0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rax, [rbp - 9]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.SoftwareProcessLasso
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002e778
mov dword [rbp + 0x27], 4
mov dword [rbp + 0x2b], 4
lea rax, [rbp + 0x27]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xf]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x2b]
xor r8d, r8d
lea rdx, str.CoreStart
mov rcx, qword [rbp - 9]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp - 9]
test eax, eax
je 0x14002e785
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 4
mov dword [rbp + 0xf], edi
jmp 0x14002e56a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [rbp + 0xf]
jmp 0x14002e56a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14002e6cb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, dword [rbp + 0x13]
jmp 0x14002e6cb
mov ecx, 0x80004005
call fcn.1400018b0
int3