Function at 0x140029370
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1f0]
sub rsp, 0x2f0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x14016ca00]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
mov r14, r9
mov rsi, r8
mov r15d, edx
mov rdi, qword [rbp + 0x260]
mov r9, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x1400293c4
mov rcx, qword [r8]
jmp 0x1400293c7
mov rcx, r8
mov r8d, 0x26
cmp r9, r8
cmovb r8, r9
xor r12d, r12d
or rbx, 0xffffffffffffffff
test r8, r8
je 0x14002940d
lea rdx, str.00000000_0000_0000_0000_000000000000
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x1400293fe
add rcx, 2
add rdx, 2
dec r8
jne 0x1400293e7
jmp 0x14002940d
mov r8d, 1
cmp word [rcx], ax
cmovb r8d, ebx
jmp 0x140029410
mov r8d, r12d
movsxd rax, r8d
test r8d, r8d
jne 0x14002942c
cmp r9, 0x26
jae 0x140029422
mov eax, ebx
jmp 0x14002942c
mov eax, r12d
cmp r9, 0x26
setne al
test eax, eax
je 0x1400297df
lea rcx, [rdi + 8]
cmp rcx, rsi
je 0x14002944b
mov r9, rbx
xor r8d, r8d
mov rdx, rsi
call fcn.140006b90
lea rcx, [rdi + 0x28]
cmp rcx, r14
je 0x140029462
mov r9, rbx
xor r8d, r8d
mov rdx, r14
call fcn.140006b90
mov dword [rdi], r15d
mov word [rdi + 0x88], 0x100
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], r12
mov word [rbp - 0x78], r12w
cmp qword [r14 + 0x18], 8
jb 0x140029489
mov r14, qword [r14]
cmp qword [rsi + 0x18], 8
jb 0x140029493
mov rsi, qword [rsi]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r15d
mov r9, rsi
lea r8, str.SoftwareMicrosoftCTFTIP
lea rdx, str._s_sLanguageProfile0x_08x_s
lea rcx, [rbp - 0x78]
call fcn.140061ab0
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rdx, qword [rbp - 0x78]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400297ca
mov word [rbp - 0x30], r12w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp - 0x2e]
call fcn.1400c2130
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.IconFile
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400297ca
mov qword [rbp - 0x80], 7
mov qword [rsp + 0x78], r12
mov word [rsp + 0x68], r12w
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r12
mov word [rsp + 0x48], r12w
cmp word [rbp - 0x30], ax
jne 0x140029570
mov r8, r12
jmp 0x14002958b
lea rax, [rbp - 0x30]
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140029580
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x48]
call fcn.140006900
nop
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.14001d390
movzx esi, al
cmp qword [rsp + 0x60], 8
jb 0x1400295c1
mov rcx, qword [rsp + 0x48]
call fcn.1400bd20c
test sil, sil
je 0x1400295e4
lea rcx, [rdi + 0x48]
lea rax, [rsp + 0x68]
cmp rcx, rax
je 0x1400295e4
mov r9, rbx
xor r8d, r8d
lea rdx, [rsp + 0x68]
call fcn.140006b90
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.IconIndex
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [rbp - 0x30]
mov dword [rdi + 0x8c], eax
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Display_Description
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400296eb
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], r12
mov word [rsp + 0x48], r12w
cmp word [rbp - 0x30], ax
jne 0x14002967a
mov rbx, r12
jmp 0x14002968a
lea rax, [rbp - 0x30]
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140029680
mov r8, rbx
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x48]
call fcn.140006900
nop
lea rdx, [rsp + 0x48]
lea rcx, [rbp - 0x58]
call fcn.14001d0b0
lea rcx, [rdi + 0x68]
mov rdx, rax
call fcn.14000afe0
cmp qword [rbp - 0x40], 8
jb 0x1400296c6
mov rcx, qword [rbp - 0x58]
call fcn.1400bd20c
mov qword [rbp - 0x40], 7
mov qword [rbp - 0x48], r12
mov word [rbp - 0x58], r12w
cmp qword [rsp + 0x60], 8
jb 0x14002974a
mov rcx, qword [rsp + 0x48]
call fcn.1400bd20c
jmp 0x14002974a
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Description
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp word [rbp - 0x30], 0
jne 0x14002972a
mov rbx, r12
jmp 0x14002973a
lea rax, [rbp - 0x30]
nop
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140029730
lea rcx, [rdi + 0x68]
mov r8, rbx
lea rdx, [rbp - 0x30]
call fcn.140006900
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SubstituteLayout
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140029792
xor edx, edx
lea r8d, [rax + 0x10]
lea rcx, [rbp - 0x30]
call fcn.1400be988
jmp 0x140029794
mov eax, dword [rdi]
mov dword [rdi + 4], eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
cmp qword [rbp - 0x80], 8
jb 0x1400297b5
mov rcx, qword [rsp + 0x68]
call fcn.1400bd20c
mov qword [rbp - 0x80], 7
mov qword [rsp + 0x78], r12
mov word [rsp + 0x68], r12w
jmp 0x1400297cc
xor bl, bl
cmp qword [rbp - 0x60], 8
jb 0x1400297dc
mov rcx, qword [rbp - 0x78]
call fcn.1400bd20c
movzx eax, bl
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.1400bcae0
add rsp, 0x2f0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret