Function at 0x6ae610
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xb8
mov rbx, rcx
lea rdx, [0x007285d7]
lea rcx, [rsp + 0x88]
mov r8d, 0x2c
call fcn.006ae9f0
lea rdx, [0x00728603]
lea rcx, [rsp + 0x70]
mov r8d, 0x12
call fcn.006ae9f0
mov rsi, qword [rsp + 0x90]
mov qword [rsp + 0x58], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
mov rdx, rsi
xor r8d, r8d
mov r9d, 0x20019
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
je 0x6ae708
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.006d2530
test rax, rax
je 0x6ae6af
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
movabs rax, 0x8000000000000000
mov qword [rbx], rax
cmp qword [rsp + 0x70], 0
je 0x6ae6d7
mov r8, qword [rsp + 0x78]
mov rcx, qword [0x0076d128]
xor edx, edx
call fcn.006d3c74
cmp qword [rsp + 0x88], 0
je 0x6ae6f3
mov rcx, qword [0x0076d128]
xor edx, edx
mov r8, rsi
call fcn.006d3c74
nop
add rsp, 0xb8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x38], rsi
mov rdi, qword [rsp + 0x58]
mov dword [rsp + 0x34], 0x800
movzx eax, byte [0x0076d188]
mov edx, 0x800
xor ecx, ecx
call fcn.0069df80
test rax, rax
je 0x6ae939
mov r15, rax
mov qword [rsp + 0x40], 0x800
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0x78]
lea rsi, [rsp + 0x34]
lea r12, [rsp + 0x58]
lea r13, [rsp + 0x40]
jmp 0x6ae765
mov r15, qword [rsp + 0x48]
mov dword [rsp + 0x58], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r15
mov rcx, rdi
mov rdx, r14
xor r8d, r8d
mov r9, r12
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x6ae7db
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.006d2530
mov rbp, rax
cmp edx, 0x800700ea
jne 0x6ae844
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x50], rdx
mov r8d, dword [rsp + 0x34]
test r8, r8
je 0x6ae7ca
mov rcx, r13
call fcn.005b1de0
test rbp, rbp
je 0x6ae760
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x10]
jmp 0x6ae760
mov eax, dword [rsp + 0x34]
and eax, 0xfffffffe
add rax, r15
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], rax
mov word [rsp + 0x68], 0
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x58]
call fcn.006aa690
mov rax, qword [rsp + 0xb0]
test rax, rax
je 0x6ae8b8
mov rcx, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0x38]
nop word cs:[rax + rax]
cmp byte [rcx + rax - 1], 0
jne 0x6ae8bf
dec rax
jne 0x6ae830
xor eax, eax
jmp 0x6ae8bf
movabs rax, 0x8000000000000000
mov qword [rbx], rax
test rbp, rbp
je 0x6ae860
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 0x10]
cmp qword [rsp + 0x40], 0
je 0x6ae879
mov rcx, qword [0x0076d128]
xor edx, edx
mov r8, r15
call fcn.006d3c74
mov rcx, rdi
call sub.advapi32.dll_RegCloseKey
mov rsi, qword [rsp + 0x38]
test eax, eax
je 0x6ae6bc
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.006d2530
test rax, rax
je 0x6ae6bc
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
jmp 0x6ae6bc
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov qword [rsp + 0xb0], rax
mov qword [rbx + 0x10], rax
movups xmm0, xmmword [rsp + 0xa0]
movups xmmword [rbx], xmm0
cmp qword [rsp + 0x40], 0
je 0x6ae8ef
mov rcx, qword [0x0076d128]
xor edx, edx
mov r8, r15
call fcn.006d3c74
mov rcx, rdi
call sub.advapi32.dll_RegCloseKey
test eax, eax
je 0x6ae91c
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
call fcn.006d2530
test rax, rax
je 0x6ae91c
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x10]
cmp qword [rsp + 0x70], 0
je 0x6ae6d7
mov rcx, qword [0x0076d128]
xor edx, edx
mov r8, r14
jmp 0x6ae6d2
mov ecx, 1
mov edx, 0x800
call fcn.00522e90
ud2