Function at 0x1400299e0
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xf8
mov qword [rbp - 0x49], 0xfffffffffffffffe
mov rax, qword [0x140228058]
xor rax, rsp
mov qword [rbp + 7], rax
movzx edi, r9b
mov rbx, r8
mov rsi, rdx
mov r15, rcx
mov qword [rbp - 0x41], rcx
xor r12d, r12d
mov dword [rbp - 0x71], r12d
mov qword [rcx], r12
mov qword [rcx + 8], r12
xor r8d, r8d
xor edx, edx
call fcn.14002c3d0
mov qword [r15], rax
mov dword [rbp - 0x71], 1
xor eax, eax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x31], r12
mov dword [rbp - 0x29], r12d
mov qword [rbp - 0x21], r12
cmp qword [rbx + 0x18], 8
jb 0x140029a5e
mov rbx, qword [rbx]
movzx r9d, dil
shl r9d, 9
add r9d, 0x20019
mov r8, rbx
mov rdx, rsi
lea rcx, [rbp - 0x31]
call fcn.14002e180
mov r14, qword [rbp - 0x31]
test eax, eax
jne 0x140029c9e
mov esi, r12d
mov eax, r12d
mov dword [rbp - 0x39], eax
test r14, r14
je 0x140029ae5
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea rax, [rbp - 0x39]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ecx, eax
cmp eax, 0xea
mov eax, dword [rbp - 0x39]
je 0x140029ae5
test ecx, ecx
cmovne eax, r12d
lea r13d, [rax + 1]
mov eax, r13d
xor ecx, ecx
mov qword [rbp - 0x19], rcx
mov qword [rbp - 0x11], rcx
mov qword [rbp - 9], rcx
lea r8, [rbp - 0x79]
mov edx, eax
lea rcx, [rbp - 0x19]
call fcn.1400248e0
nop
mov rbx, qword [rbp - 0x11]
mov rdi, qword [rbp - 0x19]
sub rbx, rdi
mov rax, rbx
sar rax, 1
mov dword [rbp - 0x39], eax
lea rax, [rbp - 1]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x39]
mov r8, rdi
mov edx, esi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov r12d, eax
inc esi
mov dword [rbp - 0x75], esi
test eax, eax
jne 0x140029c44
cmp dword [rbp - 0x39], r13d
ja 0x140029c44
cmp rbx, 2
jb 0x140029c44
xor esi, esi
mov qword [rbp - 0x59], rsi
mov qword [rbp - 0x51], 7
mov word [rbp - 0x69], si
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], si
jne 0x140029b85
lea rcx, [rbp - 0x69]
cmp rdx, 7
ja 0x140029bb2
mov qword [rbp - 0x59], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, rdi
call fcn.14015c680
mov word [rbp + rbx - 0x69], si
jmp 0x140029bbe
mov r9, rdi
xor r8d, r8d
call fcn.140015860
nop
mov rbx, qword [r15]
mov rsi, qword [rbx + 8]
lea r9, [rbp - 0x69]
mov r8, rsi
mov rdx, rbx
mov rcx, r15
call fcn.14002d5d0
mov rdx, qword [r15 + 8]
movabs rcx, 0x555555555555554
sub rcx, rdx
cmp rcx, 1
jb 0x140029cdb
lea rcx, [rdx + 1]
mov qword [r15 + 8], rcx
mov qword [rbx + 8], rax
mov qword [rsi], rax
mov rdx, qword [rbp - 0x51]
cmp rdx, 8
jb 0x140029c41
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140029c3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029cd5
call fcn.14013db80
mov esi, dword [rbp - 0x75]
test rdi, rdi
je 0x140029c80
mov rax, qword [rbp - 9]
sub rax, rdi
sar rax, 1
lea rdx, [rax + rax]
mov rax, rdi
cmp rdx, 0x1000
jb 0x140029c78
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140029ccf
mov rcx, rdi
call fcn.14013db80
test r12d, r12d
jne 0x140029c8d
xor r12d, r12d
jmp 0x140029ae9
test r14, r14
je 0x140029c9e
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r14d, r14d
test r14, r14
je 0x140029cac
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, r15
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.14013df50
add rsp, 0xf8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14015fb1c
nop
call fcn.14015fb1c
nop
lea rcx, str.list_T__too_long
call fcn.14011ba24
int3