Function at 0x140028720
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4a0]
sub rsp, 0x5a0
mov rax, qword [0x14005a018]
xor rax, rsp
mov qword [rbp + 0x490], rax
xor r14d, r14d
mov qword [rsp + 0x50], rdx
mov rdi, rdx
mov qword [rsp + 0x48], rcx
mov rdx, qword [rcx]
mov r15, 0xffffffffffffffff
mov qword [rsp + 0x58], r14
mov r13, r8
mov r12d, r15d
test rdx, rdx
jne 0x140028a34
movaps xmm0, xmmword [0x140051c00]
lea rcx, [rbp - 0x4f]
movaps xmm1, xmmword [0x140051c10]
mov r8d, 0xc3
movzx eax, byte [0x140051c40]
mov esi, r14d
movaps xmmword [rsp + 0x70], xmm0
movaps xmm0, xmmword [0x140051c20]
movaps xmmword [rbp - 0x80], xmm1
movaps xmm1, xmmword [0x140051c30]
movaps xmmword [rbp - 0x70], xmm0
movaps xmmword [rbp - 0x60], xmm1
mov byte [rbp - 0x50], al
call fcn.14002ec20
movaps xmm0, xmmword [0x140051c50]
lea rcx, [rbp + 0xb5]
movaps xmm1, xmmword [0x140051c60]
xor edx, edx
movzx eax, byte [0x140051c90]
mov r8d, 0xc3
movups xmmword [rbp + 0x74], xmm0
mov byte [rbp + 0xb4], al
movaps xmm0, xmmword [0x140051c70]
movups xmmword [rbp + 0x84], xmm1
movaps xmm1, xmmword [0x140051c80]
movups xmmword [rbp + 0x94], xmm0
movups xmmword [rbp + 0xa4], xmm1
call fcn.14002ec20
movaps xmm0, xmmword [0x140051ca0]
lea rcx, [rbp + 0x1b9]
movaps xmm1, xmmword [0x140051cb0]
xor edx, edx
movzx eax, byte [0x140051ce0]
mov r8d, 0xc3
movups xmmword [rbp + 0x178], xmm0
mov byte [rbp + 0x1b8], al
movaps xmm0, xmmword [0x140051cc0]
movups xmmword [rbp + 0x188], xmm1
movaps xmm1, xmmword [0x140051cd0]
movups xmmword [rbp + 0x198], xmm0
movups xmmword [rbp + 0x1a8], xmm1
call fcn.14002ec20
movaps xmm0, xmmword [0x140051cf0]
lea rcx, [rbp + 0x2bd]
movaps xmm1, xmmword [0x140051d00]
xor edx, edx
movzx eax, byte [0x140051d30]
mov r8d, 0xc3
movups xmmword [rbp + 0x27c], xmm0
mov byte [rbp + 0x2bc], al
movaps xmm0, xmmword [0x140051d10]
movups xmmword [rbp + 0x28c], xmm1
movaps xmm1, xmmword [0x140051d20]
movups xmmword [rbp + 0x29c], xmm0
movups xmmword [rbp + 0x2ac], xmm1
call fcn.14002ec20
movaps xmm0, xmmword [0x140051d40]
lea rcx, [rbp + 0x3c1]
movaps xmm1, xmmword [0x140051d50]
xor edx, edx
movzx eax, byte [0x140051d80]
mov r8d, 0xc3
movaps xmmword [rbp + 0x380], xmm0
movaps xmm0, xmmword [0x140051d60]
movaps xmmword [rbp + 0x390], xmm1
movaps xmm1, xmmword [0x140051d70]
movaps xmmword [rbp + 0x3a0], xmm0
movaps xmmword [rbp + 0x3b0], xmm1
mov byte [rbp + 0x3c0], al
call fcn.14002ec20
mov r15d, r14d
nop dword [rax + rax]
cmp r15d, 5
jge 0x1400289c4
movsxd rax, r15d
lea rdx, [rsp + 0x40]
imul rcx, rax, 0x104
lea rax, [rsp + 0x70]
add rcx, rax
call fcn.140025790
mov rdi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
mov rdx, rdi
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov r12d, eax
test eax, eax
jne 0x1400289b6
mov rbx, 0xffffffffffffffff
nop dword [rax]
cmp byte [rdi + rbx + 1], r14b
lea rbx, [rbx + 1]
jne 0x140028990
lea rcx, [rbx + 1]
call fcn.14002fc3c
mov r8, rdi
lea rdx, [rbx + 1]
mov rcx, rax
mov rsi, rax
call fcn.14002fbc8
inc r15d
test r12d, r12d
jne 0x140028930
jmp 0x1400289cd
test r12d, r12d
jne 0x140028ba3
mov r15, 0xffffffffffffffff
test rsi, rsi
je 0x140028baa
cmp qword [rsp + 0x58], r14
je 0x140028baa
mov rcx, r15
nop dword [rax + rax]
inc rcx
cmp byte [rsi + rcx], r14b
jne 0x1400289f0
add rcx, 1
mov edx, 1
cmovb rcx, r15
call fcn.14002f9e8
mov rcx, qword [rsp + 0x48]
mov rdx, r15
mov qword [rcx], rax
inc rdx
cmp byte [rsi + rdx], r14b
jne 0x140028a16
inc rdx
mov r8, rsi
mov rcx, rax
call fcn.14002fbc8
mov rdi, qword [rsp + 0x50]
jmp 0x140028a67
lea rax, [rsp + 0x58]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140028baa
cmp qword [rsp + 0x58], r14
je 0x140028baa
mov edx, 1
mov dword [rsp + 0x60], 0x2000
mov ecx, 0x2000
call fcn.14002f9e8
lea rcx, [rsp + 0x60]
mov qword [r13], rax
mov qword [rsp + 0x30], rcx
lea rdx, [0x140051905]
mov rcx, qword [rsp + 0x58]
mov r9d, 0xffff
mov qword [rsp + 0x28], rax
mov r8, rdi
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
mov rbx, qword [r13]
test rbx, rbx
je 0x140028b9f
mov rax, r15
inc rax
cmp byte [rbx + rax], r14b
jne 0x140028ac1
cmp rax, 1
jbe 0x140028b9f
mov edi, r14d
mov rcx, r15
nop word [rax + rax]
inc rcx
cmp byte [rbx + rcx], dil
jne 0x140028ae0
add rcx, 1
mov edx, 2
cmovb rcx, r15
call fcn.14002f9e8
mov rsi, rax
mov rdx, rax
movzx ecx, byte [rbx]
test cl, cl
je 0x140028b19
movsx ecx, cl
inc edi
inc rbx
mov word [rdx], cx
add rdx, 2
jmp 0x140028b01
movsxd rax, edi
mov word [rsi + rax*2], r14w
mov rcx, qword [r13]
call fcn.14002fc28
mov rcx, rsi
mov qword [r13], r14
call fcn.140025b60
mov qword [r13], r14
mov rbx, rax
test rax, rax
je 0x140028b8f
mov rcx, r15
inc rcx
cmp word [rax + rcx*2], r14w
jne 0x140028b45
add rcx, 1
mov edx, 1
cmovb rcx, r15
call fcn.14002f9e8
mov qword [r13], rax
mov rax, r14
nop dword [rax + rax]
movzx ecx, word [rbx + rax*2]
mov rdx, qword [r13]
test cx, cx
je 0x140028b88
inc r14d
mov byte [rdx + rax], cl
inc rax
jmp 0x140028b70
movsxd rax, r14d
mov byte [rax + rdx], 0
mov rcx, rsi
call fcn.14002fc28
mov rcx, rbx
call fcn.14002fc28
xor eax, eax
jmp 0x140028bad
mov r15, 0xffffffffffffffff
mov eax, r15d
mov rcx, qword [rbp + 0x490]
xor rcx, rsp
call fcn.14002d5c0
mov rbx, qword [rsp + 0x5f8]
add rsp, 0x5a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret