Function at 0x14006f2b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r13, r9
mov r14, r8
xor sil, sil
xor ebp, ebp
mov r15d, ebp
mov dword [rax - 0x40], ebp
mov qword [rax - 0x38], rbp
mov qword [rax + 0x10], rbp
lea rax, [rax + 0x10]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rdx]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006f4e9
mov r15, qword [rsp + 0x98]
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x48], ebp
mov edi, 0x3e8
mov ecx, 0x7d0
call fcn.140220bc0
mov qword [rsp + 0x38], rax
mov rbx, rax
lea eax, [rdi + rdi]
mov dword [rsp + 0x98], eax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [r14]
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14006f384
cmp eax, 0xea
jne 0x14006f38f
mov edi, 0x3e8
mov edx, 0x7d0
mov rcx, rbx
call fcn.14021db6c
test rax, rax
je 0x14006f330
jmp 0x14006f328
mov eax, dword [rsp + 0x30]
dec eax
cmp eax, 1
jbe 0x14006f397
xor sil, sil
jmp 0x14006f4e0
mov ecx, dword [rsp + 0x98]
test rbx, rbx
je 0x14006f3c4
test ecx, ecx
je 0x14006f3c1
test cl, 1
jne 0x14006f38f
mov eax, ecx
shr rax, 1
cmp word [rbx + rax*2 - 2], 0
je 0x14006f3c4
xor sil, sil
jmp 0x14006f4e0
mov word [rbx], bp
shr ecx, 1
mov sil, 1
mov word [rbx + rcx*2], bp
test rbx, rbx
je 0x14006f4d7
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rbx + rdi*2], 0
jne 0x14006f3e0
test edi, edi
je 0x14006f4d7
mov rax, qword [r13]
mov r12d, dword [rax - 0x10]
mov rbp, rbx
sub rbp, rax
sar rbp, 1
test edi, edi
js 0x14006f519
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edi
or eax, ecx
jge 0x14006f426
mov edx, edi
mov rcx, r13
call fcn.140002a48
mov rcx, qword [r13]
movsxd r14, edi
add r14, r14
movsxd r8, dword [rcx - 0xc]
cmp rbp, r12
ja 0x14006f47b
lea rdx, [rcx + rbp*2]
test r14, r14
je 0x14006f4be
test rcx, rcx
jne 0x14006f454
call fcn.14021a52c
mov dword [rax], 0x16
jmp 0x14006f4b9
test rdx, rdx
jne 0x14006f466
call fcn.14021a52c
mov dword [rax], 0x16
jmp 0x14006f4b9
mov rax, r8
add rax, rax
cmp rax, r14
jb 0x14006f4ae
mov r8, r14
call fcn.140215b40
jmp 0x14006f4be
add r8, r8
test r14, r14
je 0x14006f4be
test rcx, rcx
jne 0x14006f495
call fcn.14021a52c
mov dword [rax], 0x16
jmp 0x14006f4b9
cmp r8, r14
jb 0x14006f4a7
mov r8, r14
mov rdx, rbx
call fcn.140215b40
jmp 0x14006f4be
xor edx, edx
call fcn.1402161f0
call fcn.14021a52c
mov dword [rax], 0x22
call fcn.14021a3dc
mov rax, qword [r13]
cmp edi, dword [rax - 0xc]
jg 0x14006f519
mov dword [rax - 0x10], edi
mov rax, qword [r13]
xor ecx, ecx
mov word [r14 + rax], cx
jmp 0x14006f4e0
mov rcx, r13
call fcn.1400028b4
nop
mov rcx, rbx
call fcn.14021dab0
nop
test r15, r15
je 0x14006f4f7
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, sil
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x80070057
call fcn.140002d2c
int3