Function at 0x140028018
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push r15
sub rsp, 0x110
mov qword [r11 - 0x98], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
mov rax, qword [0x140078790]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rsi, rcx
mov r8d, 0xa
lea rdx, str.CTPMData::FromRegistry
lea rcx, [r11 - 0x88]
call fcn.14002de00
nop
xor ebx, ebx
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], ebx
mov qword [rsp + 0x60], rbx
mov r9d, 0x20019
lea r8, str.SOFTWAREDigitalPersonaDPHOSTTPMData
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.14000bad4
mov edi, 0x1fff0000
test edi, eax
je 0x1400280af
cmp eax, 0x80000000
jb 0x1400280c6
mov ecx, eax
call fcn.140032390
test eax, eax
je 0x1400280c6
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140032390
mov dword [rsp + 0x30], ebx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, [0x14004e958]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea r15, vtable.CCryptBlob_struct__CRYPTOAPI_BLOB__class__heap_allocator_.0
mov qword [rsp + 0x38], r15
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov ecx, eax
call fcn.1400331f0
test rax, rax
jne 0x14002811d
mov ecx, 0x8007000e
call fcn.140032390
mov qword [rsp + 0x48], rax
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call fcn.140034b00
nop
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, [0x14004e958]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140028172
mov eax, dword [rsp + 0x34]
sub eax, 3
neg eax
sbb eax, eax
and eax, 0xd
test edi, eax
je 0x140028184
cmp eax, 0x80000000
jb 0x14002819b
mov ecx, eax
call fcn.140032390
test eax, eax
je 0x14002819b
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.140032390
lea rdx, [0x1400556b0]
lea rcx, [rsp + 0x38]
call fcn.1400275b0
mov dword [rsp + 0x68], ebx
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x78], ebx
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call fcn.140018c60
nop
lea rax, [rsi + 0x28]
test rax, rax
lea rdi, [rsi + 0x30]
jne 0x1400281d9
mov rdi, rbx
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.140015ec0
mov rdx, rax
mov ecx, dword [rax + 0x10]
cmp ecx, dword [rax]
jae 0x14002820a
lea eax, [rcx + 1]
mov dword [rdx + 0x10], eax
cmp ecx, dword [rdx]
jae 0x14002820a
shl rcx, 4
add rcx, qword [rdx + 8]
je 0x14002820a
add rcx, 0xfffffffffffffff8
jmp 0x14002820d
mov rcx, rbx
lea rax, [rcx + 8]
neg rcx
sbb rdx, rdx
and rdx, rax
lea rax, [rdi - 8]
neg rdi
sbb rcx, rcx
and rcx, rax
mov r8d, 0x19
call fcn.140018984
nop
lea rcx, [rsp + 0x68]
call fcn.1400174d8
nop
mov qword [rsp + 0x38], r15
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140028252
call fcn.140009660
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], ebx
cmp qword [rsp + 0x50], rbx
je 0x140028272
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], ebx
jmp 0x14002827c
mov r8d, ebx
lea rdx, [0x14004ee5e]
lea rcx, [rsp + 0x90]
call fcn.140030b9c
nop
lea rcx, [rsp + 0x90]
call fcn.14002e7a8
mov eax, ebx
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.140033cb0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret