Function at 0x140069b70
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov r12, rcx
mov edx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rcx, [rbp - 0x40]
call fcn.1400160a0
mov rbx, rax
cmp qword [rax + 0x18], 0x10
jb 0x140069bab
mov rbx, qword [rax]
call fcn.14000b6b4
mov rcx, rax
test rax, rax
jne 0x140069bc3
mov ecx, 0x80004005
call fcn.14000b9ec
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rbp - 0x50], rax
or r14, 0xffffffffffffffff
xor esi, esi
test rbx, rbx
je 0x140069c1b
test rbx, 0xffffffffffff0000
jne 0x140069c07
movzx ebx, bx
xor edx, edx
mov ecx, ebx
call fcn.14000b0cc
test rax, rax
je 0x140069c2d
mov r8d, ebx
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.1400080f4
jmp 0x140069c2d
mov rax, r14
nop word [rax + rax]
inc rax
cmp byte [rbx + rax], sil
jne 0x140069c10
jmp 0x140069c1d
mov eax, esi
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x50]
call fcn.140007a14
nop
mov rax, qword [rbp - 0x28]
cmp rax, 0x10
jb 0x140069c83
inc rax
mov rcx, qword [rbp - 0x40]
cmp rax, 0x1000
jb 0x140069c7e
test cl, 0x1f
je 0x140069c51
call fcn.140128ff4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140069c60
call fcn.140128ff4
int3
sub rcx, rax
cmp rcx, 8
jae 0x140069c6f
call fcn.140128ff4
int3
cmp rcx, 0x27
jbe 0x140069c7b
call fcn.140128ff4
int3
mov rcx, rax
call fcn.1400eb7f4
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x30], rsi
mov byte [rbp - 0x40], 0
mov r15d, 1
mov dword [rbp + 0x50], r15d
mov dword [rbp + 0x48], 0x800
lea edx, [r15 + 0x15]
lea rcx, [rbp - 0x20]
call fcn.1400160a0
mov rdi, rax
cmp qword [rax + 0x18], 0x10
jb 0x140069cbe
mov rdi, qword [rax]
call fcn.14000b6b4
mov rcx, rax
test rax, rax
jne 0x140069cd6
mov ecx, 0x80004005
call fcn.14000b9ec
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rbp + 0x58], rbx
test rdi, rdi
je 0x140069d22
test rdi, 0xffffffffffff0000
jne 0x140069d14
movzx edi, di
xor edx, edx
mov ecx, edi
call fcn.14000b0cc
test rax, rax
je 0x140069d37
mov r8d, edi
mov rdx, rax
lea rcx, [rbp + 0x58]
call fcn.1400080f4
jmp 0x140069d33
mov rax, r14
inc rax
cmp byte [rdi + rax], 0
jne 0x140069d17
jmp 0x140069d24
mov eax, esi
mov r8d, eax
mov rdx, rdi
lea rcx, [rbp + 0x58]
call fcn.140007a14
mov rbx, qword [rbp + 0x58]
mov edx, dword [rbp + 0x48]
test edx, edx
jns 0x140069d49
mov ecx, 0x80070057
call fcn.14000b9ec
int3
mov rax, qword [r12]
sub r15d, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edx
or eax, r15d
jge 0x140069d63
mov rcx, r12
call fcn.14000799c
mov rax, qword [r12]
lea rcx, [rbp + 0x48]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x50]
mov r8, rbx
mov rdx, qword [rbp - 0x50]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov edi, eax
lea rdx, [rbx - 0x18]
mov ecx, r14d
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140069dab
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
nop
mov rax, qword [rbp - 8]
cmp rax, 0x10
jb 0x140069e01
inc rax
mov rcx, qword [rbp - 0x20]
cmp rax, 0x1000
jb 0x140069dfc
test cl, 0x1f
je 0x140069dcf
call fcn.140128ff4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x140069dde
call fcn.140128ff4
int3
sub rcx, rax
cmp rcx, 8
jae 0x140069ded
call fcn.140128ff4
int3
cmp rcx, 0x27
jbe 0x140069df9
call fcn.140128ff4
int3
mov rcx, rax
call fcn.1400eb7f4
mov rcx, qword [r12]
test rcx, rcx
je 0x140069e19
movsxd rdx, dword [rcx - 0xc]
call fcn.140156670
mov esi, eax
test eax, eax
js 0x140069e58
mov rax, qword [r12]
cmp esi, dword [rax - 0xc]
jg 0x140069e58
mov dword [rax - 0x10], esi
movsxd rcx, esi
mov rax, qword [r12]
mov byte [rcx + rax], 0
test edi, edi
sete bl
mov rax, qword [rbp - 0x50]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x140069e53
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.WS2_32.dll_htonl + 8]
movzx eax, bl
jmp 0x140069e63
mov ecx, 0x80070057
call fcn.14000b9ec
nop
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret