Function at 0x14006b9c0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
xor esi, esi
lea rax, [rbp - 8]
mov qword [r11 - 0x48], rsi
mov r13, r8
mov qword [r11 - 0x50], rax
mov r12, rdx
mov qword [r11 - 0x58], rsi
lea rdx, [0x1400aded8]
mov r15, rcx
mov dword [rsp + 0x28], 0x2001f
xor r9d, r9d
mov dword [rsp + 0x20], esi
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14006ba2c
lea eax, [rsi + 2]
jmp 0x14006bc30
mov ecx, 0xc8
mov edi, 1
mov edx, edi
mov dword [rbp + 0x48], ecx
call fcn.14000fd10
mov rcx, qword [rbp - 8]
lea r14, str.Recent_sessions
mov rbx, rax
lea r9, [rbp - 0x10]
lea rax, [rbp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov rdx, r14
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0xea
jne 0x14006baaa
mov rcx, rbx
call fcn.14000fcfc
mov ecx, dword [rbp + 0x48]
mov edx, edi
call fcn.14000fd10
mov rcx, qword [rbp - 8]
lea r9, [rbp - 0x10]
mov rbx, rax
xor r8d, r8d
lea rax, [rbp + 0x48]
mov rdx, r14
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 2
je 0x14006bae6
test eax, eax
je 0x14006bacf
mov rcx, rbx
call fcn.14000fcfc
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 3
jmp 0x14006bc30
cmp dword [rbp - 0x10], 7
je 0x14006bae9
mov rcx, qword [rbp - 8]
mov rdx, r14
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x14006bab3
mov word [rbx], si
mov edx, dword [rbp + 0x48]
mov rcx, rbx
dec edx
test rdx, rdx
jle 0x14006bb10
mov rax, rsi
cmp byte [rcx], sil
jne 0x14006bb05
cmp byte [rax + rbx + 1], sil
je 0x14006bb10
add rcx, rdi
add rax, rdi
cmp rax, rdx
jl 0x14006baf9
sub rcx, rbx
cmp rcx, rdx
jl 0x14006bb1b
mov word [rbx], si
test r15, r15
jne 0x14006bb31
test r12, r12
jne 0x14006bb2c
mov edi, esi
jmp 0x14006bc08
mov rax, rsi
jmp 0x14006bb3c
mov rcx, r15
call fcn.140071b40
add rax, rdi
mov ecx, dword [rbp + 0x48]
mov rdx, rdi
add rcx, rax
call fcn.14000fd10
mov r14, rax
mov rsi, rax
mov rdi, rbx
test r15, r15
je 0x14006bb72
mov rdx, r15
mov rcx, rax
call fcn.14007ae90
mov rcx, rsi
call fcn.140071b40
lea rsi, [rsi + 1]
add rsi, rax
xor r15d, r15d
cmp byte [rbx], r15b
je 0x14006bbd0
test r12, r12
je 0x14006bb8e
mov rdx, r12
mov rcx, rdi
call fcn.140072d70
test eax, eax
je 0x14006bbbd
mov rcx, rdi
call fcn.14006b384
test rax, rax
je 0x14006bbbd
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, rdi
mov rcx, rsi
call fcn.14007ae90
mov rcx, rsi
call fcn.140071b40
inc rsi
add rsi, rax
mov rcx, rdi
call fcn.140071b40
inc rdi
add rdi, rax
cmp byte [rdi], r15b
jne 0x14006bb7a
mov byte [rsi], r15b
lea rdx, str.Recent_sessions
mov rcx, qword [rbp - 8]
sub esi, r14d
inc esi
mov r9d, 7
mov dword [rsp + 0x28], esi
xor r8d, r8d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, rbx
mov edi, eax
call fcn.14000fcfc
mov rbx, r14
test r13, r13
je 0x14006bc17
test edi, edi
jne 0x14006bc17
mov qword [r13], rbx
jmp 0x14006bc1f
mov rcx, rbx
call fcn.14000fcfc
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
neg edi
sbb eax, eax
and eax, 4
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret