Function at 0x1400069e8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0xc0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rsi, r8
mov rdi, rdx
mov rbp, rcx
xor r12d, r12d
mov dword [rsp + 0x108], r12d
lea rcx, [rsp + 0x30]
call fcn.1400011b0
nop
lea r13d, [r12 + 1]
mov rdx, r13
lea rcx, [rsp + 0x38]
call fcn.140003900
mov rdx, rax
lea ecx, [r12 + 8]
call fcn.1400010b0
cmp rax, r12
je 0x140006a5c
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.140001190
jmp 0x140006a5f
mov rax, r12
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.140006e90
mov r11, qword [rsp + 0x48]
cmp r11, r12
jne 0x140006a91
mov rdx, r12
jmp 0x140006a99
mov rdx, qword [rsp + 0x58]
sub rdx, r11
lea rcx, [rsp + 0x30]
call fcn.140006fb0
mov r11, qword [rsp + 0x50]
mov eax, r11d
mov rcx, qword [rsp + 0x48]
sub eax, ecx
mov dword [rsp + 0x108], eax
cmp rsi, r12
je 0x140006b22
lea rdx, str._Default_
mov rcx, rsi
call fcn.14000ce74
cmp eax, r12d
jne 0x140006b18
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
cmp rax, rcx
jne 0x140006aeb
call fcn.14000c828
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x108]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x100]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
jmp 0x140006b5d
mov r11, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
cmp r11, rcx
jne 0x140006b31
call fcn.14000c828
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x108]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x100]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
cmp ebx, 0xea
je 0x140006b95
mov rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
cmp rcx, r8
jne 0x140006b83
call fcn.14000c828
mov rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
cmp r8, r12
jne 0x140006c0e
cmp ebx, r12d
jne 0x140006c89
mov edx, dword [rsp + 0x108]
lea rcx, [rsp + 0x30]
call fcn.140006fb0
mov rcx, qword [rsp + 0x50]
mov rdx, rcx
mov r8, qword [rsp + 0x48]
sub rdx, r8
mov eax, dword [rsp + 0x108]
cmp rdx, rax
jne 0x140006c09
cmp rdx, r12
ja 0x140006bd1
call fcn.14000c828
mov r8, qword [rsp + 0x48]
lea rax, [rsp + 0x108]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
lea r9, [rsp + 0x100]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
jmp 0x140006c0e
mov ebx, 8
cmp ebx, r12d
jne 0x140006c89
cmp rcx, r8
jne 0x140006c22
call fcn.14000c828
mov r8, qword [rsp + 0x48]
mov r9d, dword [rsp + 0x108]
mov edx, dword [rsp + 0x100]
mov rcx, rdi
call fcn.140006888
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, r12
je 0x140006c56
mov r8, qword [rsp + 0x58]
sub r8, rdx
lea rcx, [rsp + 0x40]
call fcn.140004d30
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov r8, r13
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140004d30
lea rcx, [rsp + 0x30]
call fcn.140004ae0
mov rax, rdi
jmp 0x140006d8c
cmp ebx, 5
jne 0x140006cfa
cmp rcx, r8
jne 0x140006c9d
call fcn.14000c828
mov r8, qword [rsp + 0x48]
xor r9d, r9d
xor edx, edx
mov rcx, rdi
call fcn.140006888
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, r12
je 0x140006cc7
mov r8, qword [rsp + 0x58]
sub r8, rdx
lea rcx, [rsp + 0x40]
call fcn.140004d30
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov r8, r13
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140004d30
lea rcx, [rsp + 0x30]
call fcn.140004ae0
mov rax, rdi
jmp 0x140006d8c
cmp byte [rsp + 0x110], r12b
je 0x140006d25
xor r8d, r8d
mov edx, ebx
lea rcx, [rsp + 0x68]
call fcn.140007b18
lea rdx, [0x140027c10]
lea rcx, [rsp + 0x68]
call fcn.14000d0b8
int3
cmp rcx, r8
jne 0x140006d34
call fcn.14000c828
mov r8, qword [rsp + 0x48]
xor r9d, r9d
xor edx, edx
mov rcx, rdi
call fcn.140006888
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, r12
je 0x140006d5e
mov r8, qword [rsp + 0x58]
sub r8, rdx
lea rcx, [rsp + 0x40]
call fcn.140004d30
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], r12
mov r8, r13
mov rdx, qword [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140004d30
lea rcx, [rsp + 0x30]
call fcn.140004ae0
mov rax, rdi
mov rbx, qword [rsp + 0xf0]
add rsp, 0xc0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret