Function at 0x140031b80
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xf8
mov qword [rbp - 0x49], 0xfffffffffffffffe
mov rax, qword [0x14023c048]
xor rax, rsp
mov qword [rbp + 7], rax
movzx edi, r9b
mov rbx, r8
mov rsi, rdx
mov r15, rcx
mov qword [rbp - 0x41], rcx
xor r12d, r12d
mov dword [rbp - 0x71], r12d
mov qword [rcx], r12
mov qword [rcx + 8], r12
xor r8d, r8d
xor edx, edx
call fcn.140032270
mov qword [r15], rax
mov dword [rbp - 0x71], 1
xor eax, eax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x31], r12
mov dword [rbp - 0x29], r12d
mov qword [rbp - 0x21], r12
cmp qword [rbx + 0x18], 8
jb 0x140031bfe
mov rbx, qword [rbx]
movzx r9d, dil
shl r9d, 9
add r9d, 0x20019
mov r8, rbx
mov rdx, rsi
lea rcx, [rbp - 0x31]
call fcn.140032cd0
mov r14, qword [rbp - 0x31]
test eax, eax
jne 0x140031e3e
mov esi, r12d
mov eax, r12d
mov dword [rbp - 0x39], eax
test r14, r14
je 0x140031c85
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea rax, [rbp - 0x39]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ecx, eax
cmp eax, 0xea
mov eax, dword [rbp - 0x39]
je 0x140031c85
test ecx, ecx
cmovne eax, r12d
lea r13d, [rax + 1]
mov eax, r13d
xor ecx, ecx
mov qword [rbp - 0x19], rcx
mov qword [rbp - 0x11], rcx
mov qword [rbp - 9], rcx
lea r8, [rbp - 0x79]
mov edx, eax
lea rcx, [rbp - 0x19]
call fcn.14002dc00
nop
mov rbx, qword [rbp - 0x11]
mov rdi, qword [rbp - 0x19]
sub rbx, rdi
mov rax, rbx
sar rax, 1
mov dword [rbp - 0x39], eax
mov edx, esi
inc esi
mov dword [rbp - 0x75], esi
lea rax, [rbp - 1]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x39]
mov r8, rdi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov r12d, eax
test eax, eax
jne 0x140031de4
cmp dword [rbp - 0x39], r13d
ja 0x140031de4
cmp rbx, 2
jb 0x140031de4
xor esi, esi
mov qword [rbp - 0x59], rsi
mov qword [rbp - 0x51], 7
mov word [rbp - 0x69], si
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], si
jne 0x140031d25
lea rcx, [rbp - 0x69]
cmp rdx, 7
ja 0x140031d52
mov qword [rbp - 0x59], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, rdi
call fcn.1401679c0
mov word [rbp + rbx - 0x69], si
jmp 0x140031d5e
mov r9, rdi
xor r8d, r8d
call fcn.14001f490
nop
mov rbx, qword [r15]
mov rsi, qword [rbx + 8]
lea r9, [rbp - 0x69]
mov r8, rsi
mov rdx, rbx
mov rcx, r15
call fcn.140032520
mov rdx, qword [r15 + 8]
movabs rcx, 0x555555555555554
sub rcx, rdx
cmp rcx, 1
jb 0x140031e7b
lea rcx, [rdx + 1]
mov qword [r15 + 8], rcx
mov qword [rbx + 8], rax
mov qword [rsi], rax
mov rdx, qword [rbp - 0x51]
cmp rdx, 8
jb 0x140031de1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031ddc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031e75
call fcn.140148ec0
mov esi, dword [rbp - 0x75]
test rdi, rdi
je 0x140031e20
mov rax, qword [rbp - 9]
sub rax, rdi
sar rax, 1
lea rdx, [rax + rax]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140031e18
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140031e6f
mov rcx, rdi
call fcn.140148ec0
test r12d, r12d
jne 0x140031e2d
xor r12d, r12d
jmp 0x140031c89
test r14, r14
je 0x140031e3e
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r14d, r14d
test r14, r14
je 0x140031e4c
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, r15
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.140149290
add rsp, 0xf8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14016ae5c
nop
call fcn.14016ae5c
nop
lea rcx, str.list_T__too_long
call fcn.140126d64
int3