Function at 0x14002dcf0
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
movaps xmmword [rsp + 0x70], xmm6
mov r15, r9
mov rbp, r8
mov rsi, rdx
mov r14, rcx
mov rax, qword [0x140145040]
xor rax, rsp
mov qword [rsp + 0x68], rax
cmp byte [0x140157aac], 0
jne 0x14002dd39
call fcn.14002d810
test al, al
je 0x14002df02
xorps xmm6, xmm6
lea rdi, [rsp + 0x50]
movaps xmmword [rdi], xmm6
mov rcx, rdi
mov rdx, rsi
call sub.ntdll.dll_RtlInitUnicodeString
mov esi, 0x18
lea r12, [rsp + 0x4c]
mov dword [r12], esi
mov ecx, 0x18
call fcn.1400b4d4c
mov rbx, rax
movups xmmword [rax], xmm6
mov qword [rax + 0x10], 0
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], esi
mov rcx, r14
mov rdx, rdi
mov r8d, 1
mov r9, rax
call sub.ntdll.dll_NtQueryValueKey
cmp eax, 0xc0000023
mov qword [rsp + 0x40], rbp
je 0x14002dda9
cmp eax, 0x80000005
jne 0x14002df18
mov qword [rsp + 0x30], r15
mov r13d, dword [rsp + 0x4c]
cmp r13, 0x18
ja 0x14002ddcd
lea r15, [rbx + 0x18]
mov r12, r13
add r12, rbx
cmp r13d, 0x18
cmove r12, r15
jmp 0x14002de24
lea rdi, [r13 - 0x18]
cmp r13, 0x31
mov r15d, 0x30
cmovae r15, r13
mov rcx, r15
call fcn.1400b4d4c
mov rsi, rax
lea rcx, [rax + 0x18]
add r15, rax
mov r12, r13
add r12, rax
xor edx, edx
mov r8, rdi
call fcn.1400eb280
movups xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
mov rax, qword [rbx + 0x10]
mov qword [rsi + 0x10], rax
test rbx, rbx
je 0x14002de21
mov rcx, rbx
call fcn.1400b4d44
mov r13d, dword [rsp + 0x4c]
mov rbx, rsi
lea rdi, [rsp + 0x4c]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], r13d
lea rdx, [rsp + 0x50]
mov rcx, r14
mov r8d, 1
mov r9, rbx
call sub.ntdll.dll_NtQueryValueKey
cmp eax, 0xc0000023
je 0x14002de5b
cmp eax, 0x80000005
jne 0x14002df13
mov r13d, dword [rsp + 0x4c]
mov rbp, r12
sub rbp, rbx
mov rsi, r13
sub rsi, rbp
jbe 0x14002df8c
mov rax, r15
sub rax, r12
cmp rax, rsi
jae 0x14002df79
sub r15, rbx
lea rax, [r15 + r15]
cmp rax, r13
cmovbe rax, r13
movabs rcx, 0x3fffffffffffffff
cmp r15, rcx
movabs r15, 0x7fffffffffffffff
cmovb r15, rax
mov rcx, r15
call fcn.1400b4d4c
mov rdi, rax
lea rcx, [rax + rbp]
mov qword [rsp + 0x38], rcx
xor edx, edx
mov r8, rsi
call fcn.1400eb280
cmp r12, rbx
je 0x14002dee0
mov rcx, rdi
mov rdx, rbx
mov r8, rbp
call fcn.1400eabe0
mov qword [rsp + 0x38], rdi
add r15, rdi
add r13, rdi
test rbx, rbx
je 0x14002def3
mov rcx, rbx
call fcn.1400b4d44
mov rbx, qword [rsp + 0x38]
lea rdi, [rsp + 0x4c]
jmp 0x14002df9a
xor ebp, ebp
jmp 0x14002df51
mov rax, qword [r15]
mov qword [r15 + 8], rax
jmp 0x14002df41
xor ebp, ebp
jmp 0x14002df44
mov r15, qword [rsp + 0x30]
test eax, eax
js 0x14002df0f
mov eax, dword [rbx + 4]
mov rcx, qword [rsp + 0x40]
mov dword [rcx], eax
mov r9d, dword [rbx + 0xc]
test r9, r9
je 0x14002df06
mov edx, dword [rbx + 8]
add rdx, rbx
lea r8, [rdx + r9]
mov rcx, r15
call fcn.1400570b0
mov bpl, 1
test rbx, rbx
je 0x14002df51
mov rcx, rbx
call fcn.1400b4d44
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400b7310
mov eax, ebp
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea r13, [r12 + rsi]
mov rcx, r12
xor edx, edx
mov r8, rsi
call fcn.1400eb280
jmp 0x14002df9a
lea rax, [rbx + r13]
cmp r13, rbp
cmovb r12, rax
mov r13, r12
mov eax, dword [rsp + 0x4c]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x50]
mov rcx, r14
mov r8d, 1
mov r9, rbx
call sub.ntdll.dll_NtQueryValueKey
cmp eax, 0xc0000023
je 0x14002dfcf
cmp eax, 0x80000005
jne 0x14002df13
mov r12d, dword [rsp + 0x4c]
mov rbp, r13
sub rbp, rbx
mov rsi, r12
sub rsi, rbp
ja 0x14002e09c
lea rax, [rbx + r12]
cmp r12, rbp
cmovb r13, rax
mov r12, r13
mov eax, dword [rsp + 0x4c]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x50]
mov rcx, r14
mov r8d, 1
mov r9, rbx
call sub.ntdll.dll_NtQueryValueKey
cmp eax, 0xc0000023
je 0x14002e029
cmp eax, 0x80000005
jne 0x14002df13
mov eax, dword [rsp + 0x4c]
mov r13, r12
sub r13, rbx
mov rsi, rax
sub rsi, r13
jbe 0x14002e057
mov rcx, r15
sub rcx, r12
cmp rcx, rsi
jb 0x14002e146
mov rcx, r12
xor edx, edx
mov r8, rsi
call fcn.1400eb280
mov r15, qword [rsp + 0x30]
mov eax, dword [rsp + 0x4c]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
lea rdx, [rsp + 0x50]
mov rcx, r14
mov r8d, 1
mov r9, rbx
call sub.ntdll.dll_NtQueryValueKey
xor ebp, ebp
cmp eax, 0x80000005
je 0x14002df44
cmp eax, 0xc0000023
je 0x14002df44
jmp 0x14002df18
mov rax, r15
sub rax, r13
cmp rax, rsi
jb 0x14002e0bd
lea r12, [rsi + r13]
mov rcx, r13
xor edx, edx
mov r8, rsi
call fcn.1400eb280
jmp 0x14002dff4
sub r15, rbx
lea rax, [r15 + r15]
cmp rax, r12
cmovbe rax, r12
movabs rcx, 0x3fffffffffffffff
cmp r15, rcx
movabs r15, 0x7fffffffffffffff
cmovb r15, rax
mov rcx, r15
call fcn.1400b4d4c
mov rdi, rax
add rbp, rax
mov rcx, rbp
xor edx, edx
mov r8, rsi
call fcn.1400eb280
cmp r13, rbx
je 0x14002e126
mov rax, rbx
not rax
add rax, r13
add rax, rdi
mov cl, byte [r13 - 1]
dec r13
mov byte [rax], cl
dec rax
cmp r13, rbx
jne 0x14002e112
mov rbp, rdi
add r15, rdi
add r12, rdi
test rbx, rbx
je 0x14002e139
mov rcx, rbx
call fcn.1400b4d44
mov rbx, rbp
lea rdi, [rsp + 0x4c]
jmp 0x14002dff4
sub r15, rbx
lea rcx, [r15 + r15]
cmp rcx, rax
cmova rax, rcx
movabs rcx, 0x3fffffffffffffff
cmp r15, rcx
movabs rcx, 0x7fffffffffffffff
cmovb rcx, rax
call fcn.1400b4d4c
mov rdi, rax
add r13, rax
mov rcx, r13
xor edx, edx
mov r8, rsi
call fcn.1400eb280
cmp r12, rbx
je 0x14002e1ad
mov rax, rbx
not rax
add rax, r12
add rax, rdi
mov cl, byte [r12 - 1]
dec r12
mov byte [rax], cl
dec rax
cmp r12, rbx
jne 0x14002e198
mov r13, rdi
test rbx, rbx
mov r15, qword [rsp + 0x30]
lea rdi, [rsp + 0x4c]
je 0x14002e1c4
mov rcx, rbx
call fcn.1400b4d44
mov rbx, r13
jmp 0x14002e05c