Function at 0x14002b020
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xf8
mov qword [rbp - 0x49], 0xfffffffffffffffe
mov rax, qword [0x14022b078]
xor rax, rsp
mov qword [rbp + 7], rax
movzx edi, r9b
mov rbx, r8
mov rsi, rdx
mov r15, rcx
mov qword [rbp - 0x41], rcx
xor r12d, r12d
mov dword [rbp - 0x71], r12d
mov qword [rcx], r12
mov qword [rcx + 8], r12
xor r8d, r8d
xor edx, edx
call fcn.14002da10
mov qword [r15], rax
mov dword [rbp - 0x71], 1
xor eax, eax
mov qword [rbp - 0x29], rax
mov qword [rbp - 0x31], r12
mov dword [rbp - 0x29], r12d
mov qword [rbp - 0x21], r12
cmp qword [rbx + 0x18], 8
jb 0x14002b09e
mov rbx, qword [rbx]
movzx r9d, dil
shl r9d, 9
add r9d, 0x20019
mov r8, rbx
mov rdx, rsi
lea rcx, [rbp - 0x31]
call fcn.14002f7c0
mov r14, qword [rbp - 0x31]
test eax, eax
jne 0x14002b2de
mov esi, r12d
mov eax, r12d
mov dword [rbp - 0x39], eax
test r14, r14
je 0x14002b125
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea rax, [rbp - 0x39]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ecx, eax
cmp eax, 0xea
mov eax, dword [rbp - 0x39]
je 0x14002b125
test ecx, ecx
cmovne eax, r12d
lea r13d, [rax + 1]
mov eax, r13d
xor ecx, ecx
mov qword [rbp - 0x19], rcx
mov qword [rbp - 0x11], rcx
mov qword [rbp - 9], rcx
lea r8, [rbp - 0x79]
mov edx, eax
lea rcx, [rbp - 0x19]
call fcn.140025f20
nop
mov rbx, qword [rbp - 0x11]
mov rdi, qword [rbp - 0x19]
sub rbx, rdi
mov rax, rbx
sar rax, 1
mov dword [rbp - 0x39], eax
lea rax, [rbp - 1]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x39]
mov r8, rdi
mov edx, esi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov r12d, eax
inc esi
mov dword [rbp - 0x75], esi
test eax, eax
jne 0x14002b284
cmp dword [rbp - 0x39], r13d
ja 0x14002b284
cmp rbx, 2
jb 0x14002b284
xor esi, esi
mov qword [rbp - 0x59], rsi
mov qword [rbp - 0x51], 7
mov word [rbp - 0x69], si
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rdi + rdx*2], si
jne 0x14002b1c5
lea rcx, [rbp - 0x69]
cmp rdx, 7
ja 0x14002b1f2
mov qword [rbp - 0x59], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, rdi
call fcn.14015dc80
mov word [rbp + rbx - 0x69], si
jmp 0x14002b1fe
mov r9, rdi
xor r8d, r8d
call fcn.140016ea0
nop
mov rbx, qword [r15]
mov rsi, qword [rbx + 8]
lea r9, [rbp - 0x69]
mov r8, rsi
mov rdx, rbx
mov rcx, r15
call fcn.14002ec10
mov rdx, qword [r15 + 8]
movabs rcx, 0x555555555555554
sub rcx, rdx
cmp rcx, 1
jb 0x14002b31b
lea rcx, [rdx + 1]
mov qword [r15 + 8], rcx
mov qword [rbx + 8], rax
mov qword [rsi], rax
mov rdx, qword [rbp - 0x51]
cmp rdx, 8
jb 0x14002b281
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002b27c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b315
call fcn.14013f180
mov esi, dword [rbp - 0x75]
test rdi, rdi
je 0x14002b2c0
mov rax, qword [rbp - 9]
sub rax, rdi
sar rax, 1
lea rdx, [rax + rax]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14002b2b8
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002b30f
mov rcx, rdi
call fcn.14013f180
test r12d, r12d
jne 0x14002b2cd
xor r12d, r12d
jmp 0x14002b129
test r14, r14
je 0x14002b2de
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r14d, r14d
test r14, r14
je 0x14002b2ec
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, r15
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.14013f550
add rsp, 0xf8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14016111c
nop
call fcn.14016111c
nop
lea rcx, str.list_T__too_long
call fcn.14011d024
int3