Function at 0x140030a30
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xa8
mov qword [rbp - 0x61], 0xfffffffffffffffe
mov rax, qword [0x14023c048]
xor rax, rsp
mov qword [rbp - 1], rax
mov r12, r9
mov rdi, r8
xor eax, eax
mov qword [rbp - 0x31], rax
xor r13d, r13d
mov qword [rbp - 0x39], r13
mov dword [rbp - 0x31], r13d
mov qword [rbp - 0x29], r13
cmp qword [rdx + 0x18], 8
jb 0x140030a84
mov rdx, qword [rdx]
movzx r9d, byte [rbp + 0x7f]
shl r9d, 9
add r9d, 0x20019
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x39]
call fcn.140032cd0
mov esi, eax
test eax, eax
jne 0x140030d38
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x51], xmm0
mov qword [rbp - 0x41], r13
mov eax, r13d
mov dword [rbp - 0x59], eax
mov r15, qword [rbp - 0x39]
test r15, r15
je 0x140030b08
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140030ad5
mov rdx, qword [rdi]
lea rax, [rbp - 0x59]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x55]
xor r8d, r8d
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
cmp eax, 0xea
mov eax, dword [rbp - 0x59]
je 0x140030b08
test ecx, ecx
cmovne eax, r13d
mov dword [rbp - 0x59], eax
mov edx, eax
lea r8, [rbp - 0x51]
lea rcx, [rbp - 0x51]
call fcn.14002bef0
mov rax, qword [rbp - 0x49]
mov rbx, qword [rbp - 0x51]
sub rax, rbx
cmp qword [rdi + 0x18], 8
jb 0x140030b2c
mov rdi, qword [rdi]
test rbx, rbx
je 0x140030b40
cmp eax, 2
jae 0x140030b40
mov esi, 0x7a
jmp 0x140030cec
add eax, eax
mov dword [rbp - 0x59], eax
lea rax, [rbp - 0x59]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x55]
xor r8d, r8d
mov rdx, rdi
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x140030ce8
cmp dword [rbp - 0x55], 7
je 0x140030b7e
lea esi, [rax + 0xd]
jmp 0x140030ce8
test rbx, rbx
je 0x140030bb6
mov ecx, dword [rbp - 0x59]
test cl, 1
jne 0x140030bac
mov eax, ecx
shr eax, 1
cmp eax, 1
jb 0x140030bac
shr rcx, 1
cmp word [rbx + rcx*2 - 2], 0
jne 0x140030bac
cmp eax, 1
jbe 0x140030bb6
cmp word [rbx + rcx*2 - 4], 0
je 0x140030bb6
mov esi, SafeArrayDestroy
jmp 0x140030ce8
mov esi, r13d
mov r14d, r13d
mov qword [rbp - 0x11], r13
mov ecx, 7
mov qword [rbp - 9], rcx
mov word [rbp - 0x21], r13w
mov rax, qword [rbp - 0x49]
mov rbx, qword [rbp - 0x51]
sub rax, rbx
test eax, eax
je 0x140030cac
mov eax, r14d
lea r9, [rbx + rax*2]
cmp word [r9], 0
je 0x140030cac
mov rdx, 0xffffffffffffffff
nop word [rax + rax]
inc rdx
cmp word [r9 + rdx*2], 0
jne 0x140030c00
cmp rdx, rcx
ja 0x140030c3a
lea rdi, [rbp - 0x21]
cmp rcx, 8
cmovae rdi, qword [rbp - 0x21]
mov qword [rbp - 0x11], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call fcn.1401679c0
mov word [rdi + rbx], r13w
jmp 0x140030c46
xor r8d, r8d
lea rcx, [rbp - 0x21]
call fcn.14001f490
mov rbx, qword [r12]
mov rdi, qword [rbx + 8]
lea r9, [rbp - 0x21]
mov r8, rdi
mov rdx, rbx
mov rcx, r12
call fcn.140032440
mov rdx, qword [r12 + 8]
movabs rcx, 0x555555555555554
sub rcx, rdx
cmp rcx, 1
jb 0x140030d78
lea rcx, [rdx + 1]
mov qword [r12 + 8], rcx
mov qword [rbx + 8], rax
mov qword [rdi], rax
mov eax, dword [rbp - 0x11]
inc eax
add r14d, eax
mov rax, qword [rbp - 0x49]
mov rbx, qword [rbp - 0x51]
sub rax, rbx
mov rcx, qword [rbp - 9]
cmp r14d, eax
jb 0x140030be1
cmp rcx, 8
jb 0x140030cec
lea rdx, [rcx*2 + 2]
mov rcx, qword [rbp - 0x21]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030ce3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140030d72
call fcn.140148ec0
mov rbx, qword [rbp - 0x51]
test r15, r15
je 0x140030d01
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15, r13
mov rbx, qword [rbp - 0x51]
test rbx, rbx
je 0x140030d3c
mov rdx, qword [rbp - 0x41]
sub rdx, rbx
mov rax, rbx
cmp rdx, 0x1000
jb 0x140030d2e
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140030d6c
mov rcx, rbx
call fcn.140148ec0
jmp 0x140030d3c
mov r15, qword [rbp - 0x39]
test r15, r15
je 0x140030d4a
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rbp - 1]
xor rcx, rsp
call fcn.140149290
add rsp, 0xa8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14016ae5c
nop
call fcn.14016ae5c
nop
lea rcx, str.list_T__too_long
call fcn.140126d64
int3