Function at 0x140029ee0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xa8
mov qword [rbp - 0x61], 0xfffffffffffffffe
mov rax, qword [0x14022b078]
xor rax, rsp
mov qword [rbp - 1], rax
mov r12, r9
mov rdi, r8
xor eax, eax
mov qword [rbp - 0x31], rax
xor r13d, r13d
mov qword [rbp - 0x39], r13
mov dword [rbp - 0x31], r13d
mov qword [rbp - 0x29], r13
cmp qword [rdx + 0x18], 8
jb 0x140029f34
mov rdx, qword [rdx]
movzx r9d, byte [rbp + 0x7f]
shl r9d, 9
add r9d, 0x20019
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x39]
call fcn.14002f7c0
mov esi, eax
test eax, eax
jne 0x14002a1e8
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x51], xmm0
mov qword [rbp - 0x41], r13
mov eax, r13d
mov dword [rbp - 0x59], eax
mov r15, qword [rbp - 0x39]
test r15, r15
je 0x140029fb8
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140029f85
mov rdx, qword [rdi]
lea rax, [rbp - 0x59]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x55]
xor r8d, r8d
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
cmp eax, 0xea
mov eax, dword [rbp - 0x59]
je 0x140029fb8
test ecx, ecx
cmovne eax, r13d
mov dword [rbp - 0x59], eax
mov edx, eax
lea r8, [rbp - 0x51]
lea rcx, [rbp - 0x51]
call fcn.140024280
mov rax, qword [rbp - 0x49]
mov rbx, qword [rbp - 0x51]
sub rax, rbx
cmp qword [rdi + 0x18], 8
jb 0x140029fdc
mov rdi, qword [rdi]
test rbx, rbx
je 0x140029ff0
cmp eax, 2
jae 0x140029ff0
mov esi, 0x7a
jmp 0x14002a19c
add eax, eax
mov dword [rbp - 0x59], eax
lea rax, [rbp - 0x59]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x55]
xor r8d, r8d
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x14002a198
cmp dword [rbp - 0x55], 7
je 0x14002a02e
lea esi, [rax + 0xd]
jmp 0x14002a198
test rbx, rbx
je 0x14002a066
mov ecx, dword [rbp - 0x59]
test cl, 1
jne 0x14002a05c
mov eax, ecx
shr eax, 1
cmp eax, 1
jb 0x14002a05c
shr rcx, 1
cmp word [rbx + rcx*2 - 2], 0
jne 0x14002a05c
cmp eax, 1
jbe 0x14002a066
cmp word [rbx + rcx*2 - 4], 0
je 0x14002a066
mov esi, SafeArrayDestroy
jmp 0x14002a198
mov esi, r13d
mov r14d, r13d
mov qword [rbp - 0x11], r13
mov ecx, 7
mov qword [rbp - 9], rcx
mov word [rbp - 0x21], r13w
mov rax, qword [rbp - 0x49]
mov rbx, qword [rbp - 0x51]
sub rax, rbx
test eax, eax
je 0x14002a15c
mov eax, r14d
lea r9, [rbx + rax*2]
cmp word [r9], 0
je 0x14002a15c
mov rdx, 0xffffffffffffffff
nop word [rax + rax]
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x14002a0b0
cmp rdx, rcx
ja 0x14002a0ea
lea rdi, [rbp - 0x21]
cmp rcx, 8
cmovae rdi, qword [rbp - 0x21]
mov qword [rbp - 0x11], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call fcn.14015dc80
mov word [rdi + rbx], r13w
jmp 0x14002a0f6
xor r8d, r8d
lea rcx, [rbp - 0x21]
call fcn.140016ea0
mov rbx, qword [r12]
mov rdi, qword [rbx + 8]
lea r9, [rbp - 0x21]
mov r8, rdi
mov rdx, rbx
mov rcx, r12
call fcn.14002eb30
mov rdx, qword [r12 + 8]
movabs rcx, 0x555555555555554
sub rcx, rdx
cmp rcx, 1
jb 0x14002a228
lea rcx, [rdx + 1]
mov qword [r12 + 8], rcx
mov qword [rbx + 8], rax
mov qword [rdi], rax
mov eax, dword [rbp - 0x11]
inc eax
add r14d, eax
mov rax, qword [rbp - 0x49]
mov rbx, qword [rbp - 0x51]
sub rax, rbx
mov rcx, qword [rbp - 9]
cmp r14d, eax
jb 0x14002a091
cmp rcx, 8
jb 0x14002a19c
lea rdx, [rcx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002a193
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a222
call fcn.14013f180
mov rbx, qword [rbp - 0x51]
test r15, r15
je 0x14002a1b1
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15, r13
mov rbx, qword [rbp - 0x51]
test rbx, rbx
je 0x14002a1ec
mov rdx, qword [rbp - 0x41]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x14002a1de
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002a21c
mov rcx, rbx
call fcn.14013f180
jmp 0x14002a1ec
mov r15, qword [rbp - 0x39]
test r15, r15
je 0x14002a1fa
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.14013f550
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14016111c
nop
call fcn.14016111c
nop
lea rcx, str.list_T__too_long
call fcn.14011d024
int3