Function at 0x140060410
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xc8
xor r12d, r12d
mov qword [rbp - 0x19], r12
mov qword [rbp - 9], r12
mov qword [rbp - 1], r12
lea r8d, [r12 + 0x1c]
lea rdx, str.UW1kcnVfcGNaTkE_bm5Rcm1wYw
lea rcx, [rbp - 0x19]
call fcn.140030750
nop
mov qword [rbp - 0x39], r12
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x21], r12
lea r8d, [r12 + 8]
lea rdx, str.cXJfcnNx
lea rcx, [rbp - 0x39]
call fcn.140030750
nop
lea r15d, [r12 + 3]
mov dword [rbp + 0x67], r12d
mov dword [rbp + 0x6f], 4
mov qword [rbp - 0x79], r12
mov qword [rbp - 0x69], r12
mov qword [rbp - 0x61], r12
lea r14, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae r14, qword [rbp - 0x19]
movabs rbx, 0x7ffffffffffffffe
mov rsi, qword [rbp - 9]
cmp rsi, rbx
ja 0x140060709
lea r13d, [r12 + 0xa]
mov qword [rbp - 0x61], 7
cmp rsi, 8
jae 0x1400604db
mov qword [rbp - 0x69], rsi
lea r8d, [r12 + 0x10]
mov rdx, r14
lea rcx, [rbp - 0x79]
call fcn.140185440
jmp 0x14006051f
mov rdi, rsi
or rdi, 7
cmp rdi, rbx
jbe 0x1400604ec
mov rdi, rbx
jmp 0x1400604f3
cmp rdi, r13
cmovb rdi, r13
lea rdx, [rdi + 1]
lea rcx, [rbp - 0x79]
call fcn.140030fc0
mov qword [rbp - 0x79], rax
mov qword [rbp - 0x69], rsi
mov qword [rbp - 0x61], rdi
lea r8, [rsi*2 + 2]
mov rdx, r14
mov rcx, rax
call fcn.140185440
lea rdx, [rbp - 0x79]
lea rcx, [rbp + 0x7f]
call fcn.14004bc20
lea rcx, [rbp + 0x77]
mov qword [rsp + 0x20], rcx
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
mov rdx, qword [rbp + 0x7f]
add rdx, 0xffffffffffffffe8
mov r14d, 0xffffffff
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140060574
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test edi, edi
jne 0x140060673
mov qword [rbp - 0x59], r12
mov qword [rbp - 0x49], r12
mov qword [rbp - 0x41], r12
lea rsi, [rbp - 0x39]
cmp qword [rbp - 0x21], 8
cmovae rsi, qword [rbp - 0x39]
mov rdi, qword [rbp - 0x29]
cmp rdi, rbx
ja 0x14006070f
mov qword [rbp - 0x41], 7
cmp rdi, 8
jae 0x1400605c9
mov qword [rbp - 0x49], rdi
mov r8d, 0x10
mov rdx, rsi
lea rcx, [rbp - 0x59]
call fcn.140185440
jmp 0x14006060b
mov rax, rdi
or rax, 7
cmp rax, rbx
ja 0x1400605df
mov rbx, rax
cmp rax, r13
cmovb rbx, r13
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x59]
call fcn.140030fc0
mov qword [rbp - 0x59], rax
mov qword [rbp - 0x49], rdi
mov qword [rbp - 0x41], rbx
lea r8, [rdi*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.140185440
lea rdx, [rbp - 0x59]
lea rcx, [rbp + 7]
call fcn.14004bc20
lea rcx, [rbp + 0x6f]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x67]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rdx, qword [rbp + 7]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x14006065c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [rbp + 0x67]
test ebx, ebx
cmovne eax, r15d
mov r15d, eax
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x21]
cmp rdx, 8
jb 0x1400606b0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400606aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060715
call fcn.140183144
nop
mov rdx, qword [rbp - 1]
cmp rdx, 8
jb 0x1400606ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400606e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060703
call fcn.140183144
mov eax, r15d
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140189c24
nop
call fcn.140030df0
nop
call fcn.140030df0
nop
call fcn.140189c24
int3