Function at 0x10006de08
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x500
mov rax, qword [0x1000a1108]
xor rax, rsp
mov qword [rsp + 0x4f0], rax
mov rax, qword [0x1000a1180]
xor r12d, r12d
lea rcx, [rsp + 0x48]
mov rbp, r8
mov edi, edx
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
call fcn.100065ec4
cmp eax, r12d
mov ebx, eax
jge 0x10006de95
mov rdx, qword [rsp + 0x48]
lea rdi, [0x1000a1170]
add rdx, 0xfffffffffffffff4
cmp rdx, rdi
je 0x10006de8e
or ecx, 0xffffffff
lock xadd dword [rdx], ecx
dec ecx
cmp ecx, r12d
jg 0x10006de8e
mov rcx, rdx
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov eax, ebx
jmp 0x10006e0e9
mov rbx, qword [rsp + 0x48]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
lea rcx, [rsp + 0x68]
xor r9d, r9d
mov rdx, 0xffffffff80000001
mov r8, rbx
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], r12d
call fcn.10001474c
cmp eax, r12d
mov esi, eax
jge 0x10006df0c
lea rdi, [0x1000a1170]
add rbx, 0xfffffffffffffff4
cmp rbx, rdi
je 0x10006def5
or ecx, 0xffffffff
lock xadd dword [rbx], ecx
dec ecx
cmp ecx, r12d
jg 0x10006def5
mov rcx, rbx
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x68]
cmp rcx, r12
je 0x10006df05
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x10006e0e9
mov rax, qword [0x1000a1180]
lea rdx, [0x100006620]
lea rcx, [rsp + 0x58]
mov r8d, edi
mov qword [rsp + 0x58], rax
call fcn.10001646c
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
lea r11, [rsp + 0x40]
lea r9, [rsp + 0x60]
mov rdx, rbx
mov qword [rsp + 0x28], r11
xor r8d, r8d
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r12d
mov esi, eax
jge 0x10006dfa9
lea rcx, [rbx - 0xc]
lea rdi, [0x1000a1170]
cmp rcx, rdi
je 0x10006df80
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r12d
jg 0x10006df80
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x48]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x10006def5
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r12d
jg 0x10006def5
jmp 0x10006def0
mov rax, qword [0x1000a1180]
mov edx, dword [rsp + 0x40]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x50], rax
call fcn.100016600
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x68]
lea r9, [rsp + 0x60]
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rcx, [rsp + 0x50]
mov esi, eax
call fcn.1000166e4
mov rdi, qword [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov dword [rdi - 8], eax
mov word [rdi + rcx*2], r12w
cmp esi, r12d
jne 0x10006e072
mov eax, 0x5c
lea rcx, [rsp + 0x80]
mov rdx, rdi
mov qword [rsp + 0x4e0], r12
mov dword [rsp + 0x4e8], r12d
mov word [rsp + 0x4d8], ax
call fcn.100017cc4
cmp eax, r12d
je 0x10006e051
lea rdx, [rsp + 0x50]
mov rcx, rbp
call fcn.10001c054
mov rcx, qword [rsp + 0x4e0]
mov dword [rsp + 0x4e8], r12d
cmp rcx, r12
je 0x10006e072
cmp rcx, 0xffffffffffffffff
je 0x10006e072
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rdi - 0xc]
lea rdi, [0x1000a1170]
cmp rcx, rdi
je 0x10006e09a
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r12d
jg 0x10006e095
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov rbx, qword [rsp + 0x58]
lea rcx, [rbx - 0xc]
cmp rcx, rdi
je 0x10006e0b6
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r12d
jg 0x10006e0b6
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x48]
add rcx, 0xfffffffffffffff4
cmp rcx, rdi
je 0x10006e0d7
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r12d
jg 0x10006e0d7
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x68]
cmp rcx, r12
je 0x10006e0e7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x4f0]
xor rcx, rsp
call fcn.10007a3b0
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret