Function at 0x140002660
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x140046350]
xor rax, rsp
mov qword [rbp + 0x190], rax
xor r12d, r12d
mov r15, rcx
mov rsi, rdx
lea rcx, [rbp - 0x7e]
xor edx, edx
mov r8d, 0x206
mov r14d, r12d
mov word [rbp - 0x80], r12w
call fcn.140018400
lea r13, [0x14004a700]
mov qword [rsp + 0x2f0], rdi
nop dword [rax]
mov rcx, qword [0x140049a60]
lea rax, [rsp + 0x4c]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x40]
lea r8, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov edx, r14d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x44], 0x104
mov dword [rsp + 0x4c], 4
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1400028f2
cmp dword [rsp + 0x48], 4
jne 0x1400026c0
mov ebx, r12d
inc r14d
or edi, 0xffffffff
cmp dword [0x140049a74], ebx
jbe 0x140002757
nop dword [rax]
mov eax, ebx
lea rdx, [rbp - 0x80]
imul rcx, rax, 0x210
add rcx, r13
call fcn.140016484
test eax, eax
je 0x140002755
inc ebx
cmp ebx, dword [0x140049a74]
jb 0x140002730
jmp 0x140002757
mov edi, ebx
test edi, edi
js 0x1400026c0
xor eax, eax
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
movsxd rax, edi
lea rdi, [0x140049a70]
imul rcx, rax, 0x210
lea rax, [rdi + 0xc90]
lea rbx, [rcx + rdi]
add rax, rcx
mov rcx, qword [rbx + 0xc88]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x40]
cmp rcx, rax
jae 0x14000284a
mov qword [rbx + 0xc88], rax
mov rbx, qword [rsi]
lea r9, [rsp + 0x50]
mov r8, qword [rbx + 8]
mov rcx, rsi
mov rdx, rbx
mov dword [rsp + 0x58], 0x1d37
call fcn.140001460
mov rdx, qword [rsi + 8]
movabs rcx, 0x3fffffffffffffe
sub rcx, rdx
cmp rcx, 1
jb 0x14000294d
lea rcx, [rdx + 1]
mov qword [rsi + 8], rcx
mov qword [rbx + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
lea rcx, [rbp - 0x80]
or rax, 0xffffffffffffffff
cmp word [rcx + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x140002813
lea rcx, [rsp + rax*2 + 0x78]
lea rdx, str..exe
call fcn.140016484
test eax, eax
je 0x1400026c0
mov ecx, dword [rsp + 0x40]
lea rdx, [rbp - 0x80]
call fcn.140002b70
jmp 0x1400026c0
jbe 0x1400026c0
lea rcx, [rbp - 0x80]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [rcx + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x140002860
lea rcx, [rsp + rax*2 + 0x78]
lea rdx, str..exe
call fcn.140016484
test eax, eax
je 0x140002895
mov ecx, dword [rbx + 0xc88]
call fcn.140002d80
mov qword [rbx + 0xc88], r12
jmp 0x1400028a0
mov eax, dword [rsp + 0x40]
mov qword [rbx + 0xc88], rax
mov rbx, qword [rsi]
lea r9, [rsp + 0x50]
mov rcx, rsi
mov r8, qword [rbx + 8]
mov rdx, rbx
mov dword [rsp + 0x58], 0x1d38
call fcn.140001460
mov rdx, qword [rsi + 8]
movabs rcx, 0x3fffffffffffffe
sub rcx, rdx
cmp rcx, 1
jb 0x14000295a
lea rcx, [rdx + 1]
mov qword [rsi + 8], rcx
mov qword [rbx + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
jmp 0x1400026c0
cmp eax, 0x103
jne 0x1400026c0
mov r9, qword [r15]
test r9, r9
je 0x140002923
mov rcx, qword [0x140049a60]
mov edx, 1
mov dword [rsp + 0x20], 1
lea r8d, [rdx + 3]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov rdi, qword [rsp + 0x2f0]
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1400183d0
add rsp, 0x2a0
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbx
pop rbp
ret
lea rcx, str.list_T__too_long
call fcn.140015470
int3
lea rcx, str.list_T__too_long
call fcn.140015470
int3