Function at 0x2d9e3c0dc0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push r12
push r14
push r15
lea rbp, [rsp - 0x3f8]
sub rsp, 0x4f8
mov rax, qword [0x2d9e415008]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
xor r12d, r12d
lea rdx, [rsp + 0x70]
lea rcx, [0x2d9e408e34]
mov r15d, r12d
call fcn.2d9e3c9800
lea r8, [rsp + 0x70]
lea rdx, [0x2d9e407f00]
lea rcx, [rbp + 0x1d0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rax, [rsp + 0x50]
mov r9d, 0x20119
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x1d0]
mov rcx, 0xffffffff80000002
mov r14d, r12d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x2d9e3c10e7
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x38], r12
lea r8, [rbp - 0x40]
mov qword [rsp + 0x30], r12
xor edx, edx
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x44], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x2d9e3c10dc
mov qword [rsp + 0x4f0], r13
lea r13d, [r12 + 1]
mov qword [rsp + 0x520], rbx
mov qword [rsp + 0x528], rsi
mov qword [rsp + 0x530], rdi
nop dword [rax]
inc r14d
cmp dword [rsp + 0x44], 0x10
jne 0x2d9e3c1081
mov rcx, qword [rsp + 0x50]
lea rdx, [rbp - 0x40]
xor eax, eax
mov dword [rsp + 0x58], 4
mov dword [rsp + 0x48], eax
mov r9d, 0x20119
lea rax, [rsp + 0x60]
mov qword [rsp + 0x60], r12
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov ebx, r12d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x2d9e3c0f48
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x5c]
lea rax, [rsp + 0x48]
xor r8d, r8d
lea rdx, [0x2d9e407fc8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x2d9e3c0f35
cmp dword [rsp + 0x5c], 4
cmove ebx, r13d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [rsp + 0x48]
test ebx, ebx
jne 0x2d9e3c0f4b
mov esi, r13d
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x68]
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp - 0x40]
mov edi, r12d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x2d9e3c1081
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x4c]
xor r8d, r8d
mov qword [rsp + 0x20], r12
lea rdx, [0x2d9e407f34]
mov dword [rsp + 0x40], r12d
mov rbx, r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x2d9e3c100f
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x2d9e3c100f
mov ecx, eax
call fcn.2d9e3da838
mov rbx, rax
test rax, rax
je 0x2d9e3c100f
mov rcx, qword [rsp + 0x68]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x4c]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
lea rdx, [0x2d9e407f34]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x2d9e3c1004
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x2d9e3c1004
cmp dword [rsp + 0x4c], 3
jne 0x2d9e3c1004
mov edi, eax
jmp 0x2d9e3c100f
mov rcx, rbx
call fcn.2d9e3da7f4
mov rbx, r12
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x2d9e3c1081
cmp edi, r13d
jbe 0x2d9e3c1062
movzx eax, byte [rbx]
lea r10d, [rdi - 1]
xor byte [r10 + rbx], al
add r10d, 0xffffffff
je 0x2d9e3c1056
mov ecx, r10d
lea r8d, [r10 + 1]
add rcx, rbx
add r8, rbx
movzx eax, byte [r8]
lea r8, [r8 - 1]
xor byte [rcx], al
lea rcx, [rcx - 1]
add r10d, 0xffffffff
jne 0x2d9e3c1042
lea eax, [r10 + 1]
movzx eax, byte [rax + rbx]
xor byte [r10 + rbx], al
mov r9d, esi
mov r8d, r13d
mov edx, edi
mov rcx, rbx
call fcn.2d9e3c16f0
test eax, eax
je 0x2d9e3c1079
inc r15d
mov rcx, rbx
call fcn.2d9e3da7f4
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x38], r12
lea r8, [rbp - 0x40]
mov qword [rsp + 0x30], r12
mov edx, r14d
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x44], 0x104
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x2d9e3c0eb0
mov r13, qword [rsp + 0x4f0]
mov rdi, qword [rsp + 0x530]
mov rsi, qword [rsp + 0x528]
mov rbx, qword [rsp + 0x520]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, r15d
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.2d9e3da7d0
add rsp, 0x4f8
pop r15
pop r14
pop r12
pop rbp
ret