Function at 0x1400690a8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x10], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov rdi, r8
mov r14, rdx
mov rbx, rcx
xor r15d, r15d
mov esi, r15d
lea rcx, [rbp - 0x20]
call fcn.140011450
nop
lea r12d, [r15 + 1]
mov r8d, r12d
lea rdx, [0x140001cb8]
lea rcx, [rbp - 0x20]
call fcn.140010e38
lea r8d, [r15 + 0x2e]
lea rdx, [0x1400695c0]
lea rcx, [rbp - 0x20]
call fcn.140010e38
mov r8d, r12d
lea rdx, [0x140001cb8]
lea rcx, [rbp - 0x20]
call fcn.140010e38
test rdi, rdi
jne 0x14006912b
mov eax, r15d
jmp 0x140069139
or rax, 0xffffffffffffffff
inc rax
cmp word [rdi + rax*2], r15w
jne 0x14006912f
mov r8d, eax
mov rdx, rdi
lea rcx, [rbp - 0x20]
call fcn.140010e38
mov qword [rbp - 0x18], r15
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rdx, qword [rbp - 0x20]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r12d, 0x80070000
test eax, eax
je 0x14006923c
movzx esi, ax
or esi, r12d
test eax, eax
cmovle esi, eax
test esi, esi
jns 0x14006923c
test r14, r14
jne 0x14006919a
mov eax, r15d
jmp 0x1400691a8
or rax, 0xffffffffffffffff
inc rax
cmp word [r14 + rax*2], r15w
jne 0x14006919e
mov r8d, eax
mov rdx, r14
lea rcx, [rbp - 0x20]
call fcn.1400118b4
mov edi, 1
mov r8d, edi
lea rdx, [0x140001cb8]
lea rcx, [rbp - 0x20]
call fcn.140010e38
lea r8d, [rdi + 0x2d]
lea rdx, [0x1400695c0]
lea rcx, [rbp - 0x20]
call fcn.140010e38
lea r8d, [rdi + 7]
lea rdx, [0x140069620]
lea rcx, [rbp - 0x20]
call fcn.140010e38
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rdx, qword [rbp - 0x20]
mov rcx, 0xffffffff80000003
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x14006922b
movzx esi, ax
or esi, r12d
test eax, eax
cmovle esi, eax
jmp 0x14006922e
mov esi, r15d
test esi, esi
jns 0x14006923c
mov esi, r15d
mov dword [rbx], edi
jmp 0x1400694a4
mov dword [rbx], r15d
mov dword [rbp + 0x48], 4
lea rax, [rbp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov edi, reloc.OLEAUT32.dll_SafeArrayGetDim
mov r9d, edi
lea r8, [0x1400694f8]
xor edx, edx
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140069287
movzx esi, ax
or esi, r12d
test eax, eax
cmovle esi, eax
test esi, esi
js 0x140069410
mov eax, r15d
cmp dword [rbp + 0x40], r15d
setne al
mov dword [rbx + 4], eax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9d, edi
lea r8, [0x140069528]
xor edx, edx
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x1400692d8
movzx esi, ax
or esi, r12d
test eax, eax
cmovle esi, eax
test esi, esi
js 0x140069410
mov eax, r15d
cmp dword [rbp + 0x40], r15d
setne al
mov dword [rbx + 0x10], eax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9d, edi
lea r8, [0x140069540]
xor edx, edx
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140069329
movzx esi, ax
or esi, r12d
test eax, eax
cmovle esi, eax
test esi, esi
js 0x140069410
mov eax, dword [rbp + 0x40]
mov dword [rbx + 0xc], eax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9d, edi
lea r8, [0x140069558]
xor edx, edx
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140069373
movzx esi, ax
or esi, r12d
test eax, eax
cmovle esi, eax
test esi, esi
js 0x140069410
mov eax, r15d
cmp dword [rbp + 0x40], r15d
setne al
mov dword [rbx + 8], eax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9d, edi
lea r8, [0x140069570]
xor edx, edx
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x1400693c4
movzx esi, ax
or esi, r12d
test eax, eax
cmovle esi, eax
test esi, esi
js 0x140069410
mov eax, r15d
cmp dword [rbp + 0x40], r15d
setne al
mov dword [rbx + 0x14], eax
lea rax, [rbp + 0x48]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [0x140069598]
xor edx, edx
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
je 0x140069410
movzx esi, ax
or esi, r12d
test eax, eax
cmovle esi, eax
cmp dword [rbx + 0x14], r15d
jne 0x1400694a4
test esi, esi
js 0x1400694a4
mov ecx, dword [rbp + 0x48]
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov qword [rbx + 0x20], rax
mov ecx, 0x8007000e
test rax, rax
cmove esi, ecx
test esi, esi
js 0x1400694a4
lea rcx, [rbp + 0x48]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9d, 8
lea r8, [0x140069598]
xor edx, edx
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov edi, eax
test eax, eax
je 0x140069489
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov qword [rbx + 0x20], r15
movzx esi, di
or esi, r12d
test edi, edi
cmovle esi, edi
test esi, esi
js 0x1400694a4
mov ecx, dword [rbp + 0x48]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 3
mov dword [rbx + 0x18], edx
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400694b4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov r14, qword [rbp - 0x20]
lock add dword [r14 - 8], 0xffffffff
jg 0x1400694dd
mov rdi, qword [r14 - 0x18]
mov r8, qword [rdi]
mov rbx, qword [r8 + 8]
mov rcx, rbx
call qword [fcn.140015690]
lea rdx, [r14 - 0x18]
mov rcx, rdi
call rbx
mov eax, esi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret