Function at 0x14002d960
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1ff0]
mov eax, 0x20f0
call fcn.14003dfd0
sub rsp, rax
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x2140], rbx
mov rax, qword [0x14007c668]
xor rax, rsp
mov qword [rbp + 0x1fe0], rax
mov ebx, edx
mov rdi, rcx
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x40], 6
lea edx, [rax + 0x55]
lea rcx, [0x14008ea20]
call fcn.14000a780
mov rcx, rax
call fcn.140009de0
mov qword [rsp + 0x50], rax
imul eax, ebx, 0x37
mov dword [rsp + 0x48], eax
lea r9, [rsp + 0x40]
xor r8d, r8d
mov edx, 0x1061
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x56
lea rcx, [0x14008ea20]
call fcn.14000a780
mov rcx, rax
call fcn.140009de0
mov qword [rsp + 0x50], rax
imul eax, ebx, 0xe
mov dword [rsp + 0x48], eax
lea r9, [rsp + 0x40]
mov edx, 0x1061
mov r8d, 1
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x57
lea rcx, [0x14008ea20]
call fcn.14000a780
mov rcx, rax
call fcn.140009de0
mov qword [rsp + 0x50], rax
imul eax, ebx, 0x23
mov dword [rsp + 0x48], eax
lea r9, [rsp + 0x40]
mov edx, 0x1061
mov r8d, 2
mov rcx, rdi
call qword [sym.imp.USER32.dll_SendMessageW]
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x7c], 0
mov dword [rsp + 0x78], 0
mov edx, 0x55
lea rcx, [0x140089720]
call fcn.14000a780
mov rcx, rax
call fcn.140009de0
mov rdx, rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002dbab
lea edx, [rax + 0x4d]
lea rcx, [0x140089720]
call fcn.14000a780
mov rcx, rax
call fcn.140009de0
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x7c]
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [rsp + 0x78]
add eax, 2
mov ebx, eax
mov ecx, eax
call fcn.140009a50
mov r15, rax
test rax, rax
je 0x14002db4e
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.14003fab0
jmp 0x14002db51
xor r15d, r15d
mov edx, 0x4d
lea rcx, [0x140089720]
call fcn.14000a780
mov rcx, rax
call fcn.140009de0
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14002db9f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x14002dbb2
mov rcx, r15
call fcn.14003deb4
xor eax, eax
jmp 0x14002df1b
xor eax, eax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
lea ecx, [rax + 0x10]
call fcn.14003de78
mov qword [0x14008f658], rax
mov ecx, 0x14
call fcn.14003de78
test rax, rax
je 0x14002dbff
mov rcx, rax
call fcn.140016bc0
mov rcx, rax
jmp 0x14002dc01
xor ecx, ecx
mov rdx, qword [0x14008f658]
mov qword [rdx], rcx
mov eax, dword [r15]
mov dword [rcx], eax
mov rcx, qword [rdx]
mov eax, dword [r15 + 4]
mov dword [rcx + 4], eax
mov rax, qword [rdx]
cmp dword [rax + 4], 0
je 0x14002dbab
mov ecx, 0x12460
call fcn.140009a50
mov rbx, rax
test rax, rax
je 0x14002dc61
xor edx, edx
mov r8d, 0x12460
mov rcx, rax
call fcn.14003fab0
lea r9, [0x140016be0]
mov edx, 0x20
mov r8d, 0x923
mov rcx, rbx
call fcn.140016f60
jmp 0x14002dc63
xor ebx, ebx
mov rcx, qword [0x14008f658]
mov qword [rcx + 8], rbx
mov rcx, qword [rcx]
mov eax, dword [r15 + 8]
mov dword [rcx + 8], eax
lea rbx, [r15 + 0x14]
lea rcx, [0x14008e998]
call fcn.14003a910
lea rcx, [0x14008e9f0]
call fcn.14003a910
mov edx, dword [rsp + 0x78]
lea rcx, [0x14008e998]
call fcn.140014b60
mov edx, dword [rsp + 0x78]
lea rcx, [0x14008e9f0]
call fcn.140014b60
xor edx, edx
mov r8d, 0x2000
lea rcx, [rbp - 0x20]
call fcn.14003fab0
xor r12d, r12d
test rbx, rbx
je 0x14002df10
xor edi, edi
mov rdx, qword [0x14008f658]
nop word [rax + rax]
mov r13, rbx
mov rcx, qword [rdx + 8]
movzx eax, word [rbx]
mov word [rdi + rcx], ax
mov rcx, qword [rdx + 8]
movzx r14d, word [rcx + rdi]
add r14, rbx
movzx eax, word [rbx + 2]
mov word [rcx + rdi + 2], ax
mov rcx, qword [rdx + 8]
cmp word [rcx + rdi + 2], 0
je 0x14002df10
movzx eax, word [rbx + 4]
mov word [rcx + rdi + 4], ax
mov rcx, qword [rdx + 8]
movzx eax, word [rbx + 6]
mov word [rdi + rcx + 6], ax
mov rcx, qword [rdx + 8]
mov eax, dword [rbx + 8]
mov dword [rdi + rcx + 8], eax
add rbx, 0x10
mov rax, qword [rdx + 8]
movzx r8d, word [rdi + rax + 2]
shr r8, 1
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.1400166d0
lea rdx, [rbp - 0x20]
lea rcx, [0x14008e9f0]
call fcn.1400165b0
mov rax, qword [0x14008f658]
mov rdx, qword [rax + 8]
movzx eax, word [rdx + rdi + 2]
add rbx, rax
movzx ecx, word [rdx + rdi + 4]
sub ecx, 1
je 0x14002dec3
sub ecx, 2
je 0x14002ddf3
cmp ecx, 1
je 0x14002dda4
lea rdx, [0x140055950]
lea rcx, [0x14008e998]
call fcn.1400165b0
jmp 0x14002dee8
movzx r9d, byte [rbx + 3]
shl r9d, 8
movzx eax, byte [rbx + 2]
add r9d, eax
shl r9d, 8
movzx eax, byte [rbx + 1]
add r9d, eax
shl r9d, 8
movzx eax, byte [rbx]
add r9d, eax
lea r8, [0x1400630dc]
mov edx, 0x20
lea rcx, [rbp - 0x60]
call fcn.14000e2d0
lea rdx, [rbp - 0x60]
lea rcx, [0x14008e998]
call fcn.1400165b0
jmp 0x14002dee8
xor eax, eax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
lea rdx, [0x140055950]
lea rcx, [rbp - 0x80]
call fcn.14000a680
nop
xor esi, esi
mov rax, qword [0x14008f658]
mov rcx, qword [rax + 8]
movzx eax, word [rcx + rdi + 6]
cmp eax, 1
js 0x14002dea7
nop dword [rax]
lea rcx, [rbp - 0x60]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14002de50
movzx r9d, byte [rbx]
mov edx, 0x20
lea rcx, [rbp - 0x60]
test rax, rax
lea r8, str.__.2X
jne 0x14002de7a
lea r8, str._.2X
call fcn.140016370
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x80]
call fcn.14000a840
inc esi
inc rbx
mov rax, qword [0x14008f658]
mov rcx, qword [rax + 8]
movzx eax, word [rcx + rdi + 6]
dec eax
cmp esi, eax
jle 0x14002de40
lea rdx, [rbp - 0x80]
lea rcx, [0x14008e998]
call fcn.140016550
nop
lea rcx, [rbp - 0x80]
call fcn.140002990
jmp 0x14002dee8
movzx r8d, word [rdx + rdi + 6]
shr r8, 1
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.1400166d0
lea rdx, [rbp - 0x20]
lea rcx, [0x14008e998]
call fcn.1400165b0
mov rdx, qword [0x14008f658]
mov rax, qword [rdx + 8]
movzx ebx, word [rax + rdi]
add rbx, r13
inc r12d
add rdi, 0x20
cmp dword [r14], 0x45
je 0x14002df10
test rbx, rbx
jne 0x14002dce0
mov rcx, r15
call fcn.14003deb4
mov eax, r12d
mov rcx, qword [rbp + 0x1fe0]
xor rcx, rsp
call fcn.14003e040
mov rbx, qword [rsp + 0x2140]
add rsp, 0x20f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret