Function at 0x1400261b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rsi, rcx
xor r12d, r12d
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x48], r12d
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x30], r12
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_Explorer
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002641d
mov rdi, qword [rsp + 0x30]
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x48], r12d
call fcn.14000923c
mov rcx, rax
test rax, rax
je 0x140026462
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x14002625f
mov edx, 0x104
lea rcx, [rsp + 0x38]
call fcn.140018168
mov rbx, qword [rsp + 0x38]
mov dword [rsp + 0xb0], 0x208
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0xb8]
xor r8d, r8d
lea rdx, str.version
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400262bc
mov eax, dword [rsp + 0xb8]
dec eax
cmp eax, 1
ja 0x1400262bc
test rbx, rbx
je 0x1400262bc
cmp dword [rsp + 0xb0], 0
jne 0x1400262bc
mov word [rbx], r12w
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.140067808
test eax, eax
js 0x140026442
cmp eax, dword [rbx - 0xc]
jg 0x140026442
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r12w
mov qword [rsi], r12
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], 7
mov word [rsi], r12w
mov r14, 0xffffffffffffffff
mov rdi, r14
inc rdi
cmp word [rbx + rdi*2], 0
jne 0x140026300
cmp rdi, 7
ja 0x14002632f
mov qword [rsi + 0x10], rdi
add rdi, rdi
mov r8, rdi
mov rdx, rbx
mov rcx, rsi
call fcn.140061930
mov word [rdi + rsi], r12w
jmp 0x1400263f1
movabs r15, 0x7ffffffffffffffe
cmp rdi, r15
ja 0x14002646d
mov rax, rdi
or rax, 7
cmp rax, r15
jbe 0x140026357
mov rcx, 0xfffffffffffffffe
jmp 0x140026389
mov r15, rax
mov ecx, 0xa
cmp rax, rcx
cmovb r15, rcx
lea rcx, [r15 + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140026488
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400263b5
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140026488
mov rcx, rax
call fcn.1400679f4
test rax, rax
je 0x140026473
lea rbp, [rax + 0x27]
and rbp, 0xffffffffffffffe0
mov qword [rbp - 8], rax
jmp 0x1400263d0
test rcx, rcx
je 0x1400263cd
call fcn.1400679f4
mov rbp, rax
test rax, rax
je 0x14002644d
jmp 0x1400263d0
mov rbp, r12
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x18], r15
add rdi, rdi
mov r8, rdi
mov rdx, rbx
mov rcx, rbp
call fcn.140061930
mov word [rdi + rbp], r12w
mov qword [rsi], rbp
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x14002640b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x140026430
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140026430
mov qword [rsi], r12
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], r12
mov word [rsi], r12w
mov rax, rsi
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x80070057
call fcn.14000d0c0
int3
lea rdx, [0x1400beb80]
lea rcx, [rsp + 0xb0]
call fcn.140062228
nop
mov ecx, 0x80004005
call fcn.14000d0c0
nop
call fcn.140005da8
int3
lea rdx, [0x1400beb80]
lea rcx, [rsp + 0xa8]
call fcn.140062228
int3
call fcn.140005fc4
int3