Function at 0x1400288a0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xa8
mov qword [rbp - 0x61], 0xfffffffffffffffe
mov rax, qword [0x140228058]
xor rax, rsp
mov qword [rbp - 1], rax
mov r12, r9
mov rdi, r8
xor eax, eax
mov qword [rbp - 0x31], rax
xor r13d, r13d
mov qword [rbp - 0x39], r13
mov dword [rbp - 0x31], r13d
mov qword [rbp - 0x29], r13
cmp qword [rdx + 0x18], 8
jb 0x1400288f4
mov rdx, qword [rdx]
movzx r9d, byte [rbp + 0x7f]
shl r9d, 9
add r9d, 0x20019
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x39]
call fcn.14002e180
mov esi, eax
test eax, eax
jne 0x140028ba8
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x51], xmm0
mov qword [rbp - 0x41], r13
mov eax, r13d
mov dword [rbp - 0x59], eax
mov r15, qword [rbp - 0x39]
test r15, r15
je 0x140028978
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140028945
mov rdx, qword [rdi]
lea rax, [rbp - 0x59]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x55]
xor r8d, r8d
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
cmp eax, 0xea
mov eax, dword [rbp - 0x59]
je 0x140028978
test ecx, ecx
cmovne eax, r13d
mov dword [rbp - 0x59], eax
mov edx, eax
lea r8, [rbp - 0x51]
lea rcx, [rbp - 0x51]
call fcn.140022c40
mov rax, qword [rbp - 0x49]
mov rbx, qword [rbp - 0x51]
sub rax, rbx
cmp qword [rdi + 0x18], 8
jb 0x14002899c
mov rdi, qword [rdi]
test rbx, rbx
je 0x1400289b0
cmp eax, 2
jae 0x1400289b0
mov esi, 0x7a
jmp 0x140028b5c
add eax, eax
mov dword [rbp - 0x59], eax
lea rax, [rbp - 0x59]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x55]
xor r8d, r8d
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x140028b58
cmp dword [rbp - 0x55], 7
je 0x1400289ee
lea esi, [rax + 0xd]
jmp 0x140028b58
test rbx, rbx
je 0x140028a26
mov ecx, dword [rbp - 0x59]
test cl, 1
jne 0x140028a1c
mov eax, ecx
shr eax, 1
cmp eax, 1
jb 0x140028a1c
shr rcx, 1
cmp word [rbx + rcx*2 - 2], 0
jne 0x140028a1c
cmp eax, 1
jbe 0x140028a26
cmp word [rbx + rcx*2 - 4], 0
je 0x140028a26
mov esi, SafeArrayDestroy
jmp 0x140028b58
mov esi, r13d
mov r14d, r13d
mov qword [rbp - 0x11], r13
mov ecx, 7
mov qword [rbp - 9], rcx
mov word [rbp - 0x21], r13w
mov rax, qword [rbp - 0x49]
mov rbx, qword [rbp - 0x51]
sub rax, rbx
test eax, eax
je 0x140028b1c
mov eax, r14d
lea r9, [rbx + rax*2]
cmp word [r9], 0
je 0x140028b1c
mov rdx, 0xffffffffffffffff
nop word [rax + rax]
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x140028a70
cmp rdx, rcx
ja 0x140028aaa
lea rdi, [rbp - 0x21]
cmp rcx, 8
cmovae rdi, qword [rbp - 0x21]
mov qword [rbp - 0x11], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call fcn.14015c680
mov word [rdi + rbx], r13w
jmp 0x140028ab6
xor r8d, r8d
lea rcx, [rbp - 0x21]
call fcn.140015860
mov rbx, qword [r12]
mov rdi, qword [rbx + 8]
lea r9, [rbp - 0x21]
mov r8, rdi
mov rdx, rbx
mov rcx, r12
call fcn.14002d4f0
mov rdx, qword [r12 + 8]
movabs rcx, 0x555555555555554
sub rcx, rdx
cmp rcx, 1
jb 0x140028be8
lea rcx, [rdx + 1]
mov qword [r12 + 8], rcx
mov qword [rbx + 8], rax
mov qword [rdi], rax
mov eax, dword [rbp - 0x11]
inc eax
add r14d, eax
mov rax, qword [rbp - 0x49]
mov rbx, qword [rbp - 0x51]
sub rax, rbx
mov rcx, qword [rbp - 9]
cmp r14d, eax
jb 0x140028a51
cmp rcx, 8
jb 0x140028b5c
lea rdx, [rcx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028b53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140028be2
call fcn.14013db80
mov rbx, qword [rbp - 0x51]
test r15, r15
je 0x140028b71
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15, r13
mov rbx, qword [rbp - 0x51]
test rbx, rbx
je 0x140028bac
mov rdx, qword [rbp - 0x41]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x140028b9e
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140028bdc
mov rcx, rbx
call fcn.14013db80
jmp 0x140028bac
mov r15, qword [rbp - 0x39]
test r15, r15
je 0x140028bba
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.14013df50
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14015fb1c
nop
call fcn.14015fb1c
nop
lea rcx, str.list_T__too_long
call fcn.14011ba24
int3