Function at 0x140002870
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x140048360]
xor rax, rsp
mov qword [rbp + 0x190], rax
xor r12d, r12d
mov r15, rcx
mov rsi, rdx
lea rcx, [rbp - 0x7e]
xor edx, edx
mov r8d, 0x206
mov r14d, r12d
mov word [rbp - 0x80], r12w
call fcn.1400198d0
lea r13, [0x14004c720]
mov qword [rsp + 0x2f0], rdi
nop dword [rax]
mov rcx, qword [0x14004ba80]
lea rax, [rsp + 0x4c]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x40]
lea r8, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x48]
mov edx, r14d
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x44], 0x104
mov dword [rsp + 0x4c], 4
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x140002b02
cmp dword [rsp + 0x48], 4
jne 0x1400028d0
mov ebx, r12d
inc r14d
or edi, 0xffffffff
cmp dword [0x14004ba94], ebx
jbe 0x140002967
nop dword [rax]
mov eax, ebx
lea rdx, [rbp - 0x80]
imul rcx, rax, 0x210
add rcx, r13
call fcn.1400184b0
test eax, eax
je 0x140002965
inc ebx
cmp ebx, dword [0x14004ba94]
jb 0x140002940
jmp 0x140002967
mov edi, ebx
test edi, edi
js 0x1400028d0
xor eax, eax
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
movsxd rax, edi
lea rdi, [0x14004ba90]
imul rcx, rax, 0x210
lea rax, [rdi + 0xc90]
lea rbx, [rcx + rdi]
add rax, rcx
mov rcx, qword [rbx + 0xc88]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x40]
cmp rcx, rax
jae 0x140002a5a
mov qword [rbx + 0xc88], rax
mov rbx, qword [rsi]
lea r9, [rsp + 0x50]
mov r8, qword [rbx + 8]
mov rcx, rsi
mov rdx, rbx
mov dword [rsp + 0x58], 0x1d37
call fcn.140001460
mov rdx, qword [rsi + 8]
movabs rcx, 0x3fffffffffffffe
sub rcx, rdx
cmp rcx, 1
jb 0x140002b5d
lea rcx, [rdx + 1]
mov qword [rsi + 8], rcx
mov qword [rbx + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
lea rcx, [rbp - 0x80]
or rax, 0xffffffffffffffff
cmp word [rcx + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x140002a23
lea rcx, [rsp + rax*2 + 0x78]
lea rdx, str..exe
call fcn.1400184b0
test eax, eax
je 0x1400028d0
mov ecx, dword [rsp + 0x40]
lea rdx, [rbp - 0x80]
call fcn.140002dd0
jmp 0x1400028d0
jbe 0x1400028d0
lea rcx, [rbp - 0x80]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [rcx + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x140002a70
lea rcx, [rsp + rax*2 + 0x78]
lea rdx, str..exe
call fcn.1400184b0
test eax, eax
je 0x140002aa5
mov ecx, dword [rbx + 0xc88]
call fcn.140002fe0
mov qword [rbx + 0xc88], r12
jmp 0x140002ab0
mov eax, dword [rsp + 0x40]
mov qword [rbx + 0xc88], rax
mov rbx, qword [rsi]
lea r9, [rsp + 0x50]
mov rcx, rsi
mov r8, qword [rbx + 8]
mov rdx, rbx
mov dword [rsp + 0x58], 0x1d38
call fcn.140001460
mov rdx, qword [rsi + 8]
movabs rcx, 0x3fffffffffffffe
sub rcx, rdx
cmp rcx, 1
jb 0x140002b6a
lea rcx, [rdx + 1]
mov qword [rsi + 8], rcx
mov qword [rbx + 8], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rax
jmp 0x1400028d0
cmp eax, 0x103
jne 0x1400028d0
mov r9, qword [r15]
test r9, r9
je 0x140002b33
mov rcx, qword [0x14004ba80]
mov edx, 1
mov dword [rsp + 0x20], 1
lea r8d, [rdx + 3]
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov rdi, qword [rsp + 0x2f0]
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1400198a0
add rsp, 0x2a0
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbx
pop rbp
ret
lea rcx, str.list_T__too_long
call fcn.140016ebc
int3
lea rcx, str.list_T__too_long
call fcn.140016ebc
int3