Function at 0x180069b60
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, reloc.OLEAUT32.dll_VARIANT_UserUnmarshal
mov qword [rsp + 0xb8], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x18013e1e0]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov r14, rdx
mov qword [rsp + 0x80], rdx
mov rbx, rcx
mov qword [rsp + 0x88], rdx
mov eax, dword [0x1801470f0]
test al, 1
jne 0x180069d03
or eax, 1
mov dword [0x1801470f0], eax
mov qword [0x180147000], 0xffffffff80000001
mov qword [0x180147028], 7
xor esi, esi
mov qword [0x180147020], rsi
mov word [0x180147010], si
lea r8d, [rsi + 4]
lea rdx, str.HKCU
lea rcx, [0x180147008]
call fcn.180014810
nop
mov qword [0x180147030], 0xffffffff80000002
mov qword [0x180147058], 7
mov qword [0x180147050], rsi
mov word [0x180147040], si
lea r8d, [rsi + 4]
lea rdx, str.HKLM
lea rcx, [0x180147038]
call fcn.180014810
nop
mov qword [0x180147060], 0xffffffff80000000
mov qword [0x180147088], 7
mov qword [0x180147080], rsi
mov word [0x180147070], si
lea r8d, [rsi + 4]
lea rdx, str.HKCR
lea rcx, [0x180147068]
call fcn.180014810
nop
mov qword [0x180147090], 0xffffffff80000003
mov qword [0x1801470b8], 7
mov qword [0x1801470b0], rsi
mov word [0x1801470a0], si
lea r8d, [rsi + 0xa]
lea rdx, str.HKEY_USERS
lea rcx, [0x180147098]
call fcn.180014810
nop
mov qword [0x1801470c0], 0xffffffff80000005
mov qword [0x1801470e8], 7
mov qword [0x1801470e0], rsi
mov word [0x1801470d0], si
lea r8d, [rsi + 0x13]
lea rdx, str.HKEY_CURRENT_CONFIG
lea rcx, [0x1801470c8]
call fcn.180014810
nop
lea rcx, [0x1800f2490]
call fcn.1800c1d68
nop
jmp 0x180069d05
xor esi, esi
mov r15d, esi
mov r13, rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0xe0], 7
mov qword [rsp + 0xd8], rsi
mov word [rsp + 0xc8], si
mov qword [rsp + 0x108], 7
mov qword [rsp + 0x100], rsi
mov word [rsp + 0xf0], si
mov rcx, r14
call fcn.18006a6a0
or r14, 0xffffffffffffffff
mov r9, r14
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0xc0]
call fcn.180003570
cmp qword [rsp + 0xd8], 0
jne 0x180069d8b
mov dword [rsp + 0x64], r14d
lea rdx, [0x18013ad60]
lea rcx, [rsp + 0x64]
call fcn.1800c3e40
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x90]
call fcn.1800697d0
nop
mov r9, r14
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0xc0]
call fcn.180003570
nop
cmp qword [rsp + 0xb0], 8
jb 0x180069dd0
mov rcx, qword [rsp + 0x98]
call fcn.1800bf8b4
lea rcx, [rsp + 0xc0]
call fcn.180069280
mov ebx, esi
lea rcx, [0x180147000]
mov r11, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xd8]
mov r10, qword [rsp + 0xc8]
nop
cmp ebx, 5
jae 0x180069f64
mov eax, ebx
lea rdi, [rax + rax*2]
shl rdi, 4
add rdi, rcx
mov r14, qword [rdi + 0x20]
or r13, 0xffffffffffffffff
cmp r14, r13
cmovb r13, r14
cmp qword [rdi + 0x28], 8
jb 0x180069e32
mov rax, qword [rdi + 0x10]
jmp 0x180069e36
lea rax, [rdi + 0x10]
cmp r12, r14
cmovb r14, r12
lea rdx, [rsp + 0xc8]
cmp r11, 8
cmovae rdx, r10
mov rcx, r13
cmp r14, r13
cmovb rcx, r14
test rcx, rcx
je 0x180069e8c
movzx r8d, word [rdx]
movzx r9d, word [rax]
cmp r8w, r9w
je 0x180069e7f
mov eax, 1
cmp r8w, r9w
mov rdx, 0xffffffffffffffff
cmovb eax, edx
jmp 0x180069e92
add rdx, 2
add rax, 2
dec rcx
jmp 0x180069e57
mov eax, esi
or rdx, 0xffffffffffffffff
movsxd rcx, eax
test eax, eax
jne 0x180069eac
cmp r14, r13
jb 0x180069f53
mov eax, esi
cmp r14, r13
setne al
mov ecx, eax
test ecx, ecx
jne 0x180069f53
mov rbx, qword [rdi + 0x20]
lea rax, [rbx + 1]
cmp r12, rax
ja 0x180069ed6
mov dword [rsp + 0x70], edx
lea rdx, [0x18013ad60]
lea rcx, [rsp + 0x70]
call fcn.1800c3e40
cmp r12, rbx
ja 0x180069ef0
call fcn.1800bf820
mov r11, qword [rsp + 0xe0]
mov r10, qword [rsp + 0xc8]
lea rax, [rsp + 0xc8]
cmp r11, 8
cmovae rax, r10
cmp word [rax + rbx*2], 0x5c
je 0x180069f20
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x74], ecx
lea rdx, [0x18013ad60]
lea rcx, [rsp + 0x74]
call fcn.1800c3e40
mov r8, qword [rdi + 0x20]
inc r8
xor edx, edx
lea rcx, [rsp + 0xc0]
call fcn.180003200
mov r13, qword [rdi]
mov r11, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xd8]
mov r10, qword [rsp + 0xc8]
jmp 0x180069f64
inc ebx
mov r13, rsi
lea rcx, [0x180147000]
jmp 0x180069e00
test r13, r13
jne 0x180069f82
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x78], ecx
lea rdx, [0x18013ad60]
lea rcx, [rsp + 0x78]
call fcn.1800c3e40
lea rax, [rsp + 0xc8]
cmp r11, 8
cmovae rax, r10
lea rbx, [rax + r12*2]
test rbx, rbx
je 0x180069fc9
lea rax, [rsp + 0xc8]
cmp r11, 8
cmovae rax, r10
cmp rax, rbx
ja 0x180069fc9
lea rax, [rsp + 0xc8]
cmp r11, 8
cmovae rax, r10
lea rax, [rax + r12*2]
cmp rbx, rax
jbe 0x180069fe6
call fcn.1800c1088
mov r11, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xd8]
mov r10, qword [rsp + 0xc8]
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea rax, [rsp + 0xc0]
cmp rax, 0xfffffffffffffffc
je 0x18006a043
lea rax, [rsp + 0xc8]
cmp r11, 8
cmovae rax, r10
cmp rbx, rax
ja 0x18006a043
call fcn.1800c1088
mov r11, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xd8]
mov r10, qword [rsp + 0xc8]
lea rdi, [rbx - 2]
mov rbx, qword [rsp + 0x50]
cmp rbx, 0xfffffffffffffffc
je 0x18006a0af
test rbx, rbx
jne 0x18006a074
call fcn.1800c1088
mov r11, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xd8]
mov r10, qword [rsp + 0xc8]
cmp qword [rbx + 0x20], 8
jb 0x18006a081
mov rcx, qword [rbx + 8]
jmp 0x18006a085
lea rcx, [rbx + 8]
mov rax, qword [rbx + 0x18]
lea rcx, [rcx + rax*2]
cmp rdi, rcx
jb 0x18006a0af
call fcn.1800c1088
mov r11, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xd8]
mov r10, qword [rsp + 0xc8]
cmp word [rdi], 0x5c
jne 0x18006a2af
lea rax, [rsp + 0xc8]
cmp r11, 8
cmovae rax, r10
lea rbx, [rax + r12*2]
test rbx, rbx
je 0x18006a100
lea rax, [rsp + 0xc8]
cmp r11, 8
cmovae rax, r10
cmp rax, rbx
ja 0x18006a100
lea rax, [rsp + 0xc8]
cmp r11, 8
cmovae rax, r10
lea rax, [rax + r12*2]
cmp rbx, rax
jbe 0x18006a11d
call fcn.1800c1088
mov r11, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xd8]
mov r10, qword [rsp + 0xc8]
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea rax, [rsp + 0xc0]
cmp rax, 0xfffffffffffffffc
je 0x18006a197
lea rax, [rsp + 0xc8]
cmp r11, 8
cmovae rax, r10
lea rcx, [rbx - 2]
lea rax, [rax + r12*2]
cmp rcx, rax
ja 0x18006a17a
lea rax, [rsp + 0xc8]
cmp r11, 8
cmovae rax, r10
cmp rcx, rax
jae 0x18006a197
call fcn.1800c1088
mov r11, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xd8]
mov r10, qword [rsp + 0xc8]
add rbx, 0xfffffffffffffffe
cmp r11, 8
jb 0x18006a1ab
mov rdi, r10
test r10, r10
je 0x18006a1e1
jmp 0x18006a1b3
lea rdi, [rsp + 0xc8]
lea rax, [rsp + 0xc8]
cmp r11, 8
cmovae rax, r10
cmp rax, rdi
ja 0x18006a1e1
lea rax, [rsp + 0xc8]
cmp r11, 8
cmovae rax, r10
lea rax, [rax + r12*2]
cmp rdi, rax
jbe 0x18006a1e6
call fcn.1800c1088
test rbx, rbx
jne 0x18006a1f0
mov rbx, rsi
jmp 0x18006a218
mov rax, qword [rsp + 0x50]
cmp rax, 0xfffffffffffffffc
je 0x18006a212
test rax, rax
je 0x18006a20d
lea rcx, [rsp + 0xc0]
cmp rax, rcx
je 0x18006a212
call fcn.1800c1088
sub rbx, rdi
sar rbx, 1
mov r8d, 1
mov rdx, rbx
lea rcx, [rsp + 0xc0]
call fcn.180003200
lea rax, [rsp + 0xc8]
mov r8, qword [rsp + 0xc8]
mov r9, qword [rsp + 0xe0]
cmp r9, 8
cmovae rax, r8
lea rdx, [rax + rbx*2]
test rdx, rdx
je 0x18006a291
lea rax, [rsp + 0xc8]
cmp r9, 8
cmovae rax, r8
cmp rax, rdx
ja 0x18006a291
lea rcx, [rsp + 0xc8]
cmp r9, 8
cmovae rcx, r8
mov rax, qword [rsp + 0xd8]
lea rcx, [rcx + rax*2]
cmp rdx, rcx
jbe 0x18006a37b
call fcn.1800c1088
mov r9, qword [rsp + 0xe0]
mov r8, qword [rsp + 0xc8]
or r14, 0xffffffffffffffff
jmp 0x18006a37f
mov edx, 0x5c
or r14, 0xffffffffffffffff
mov r8, r14
lea rcx, [rsp + 0xc0]
call fcn.18006a5c0
mov rbx, rax
cmp rax, r14
jne 0x18006a30a
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0xe8]
call fcn.180003570
lea rcx, [rsp + 0xc0]
call fcn.180066660
mov r9, qword [rsp + 0xe0]
mov r8, qword [rsp + 0xc8]
jmp 0x18006a37f
lea r8, [rax + 1]
mov r9, r14
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0xc0]
call fcn.180008fc0
nop
mov r9, r14
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0xe8]
call fcn.180003570
nop
cmp qword [rsp + 0xb0], 8
jb 0x18006a356
mov rcx, qword [rsp + 0x98]
call fcn.1800bf8b4
mov r8, r14
mov rdx, rbx
lea rcx, [rsp + 0xc0]
call fcn.180003200
mov r9, qword [rsp + 0xe0]
mov r8, qword [rsp + 0xc8]
jmp 0x18006a37f
or r14, 0xffffffffffffffff
lea rdx, [rsp + 0xc8]
cmp r9, 8
cmovae rdx, r8
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18006a51e
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18006a51e
mov dword [rsp + 0x38], esi
lea rdx, [rsp + 0xf0]
cmp qword [rsp + 0x108], 8
cmovae rdx, qword [rsp + 0xf0]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x18006a44f
cmp eax, 2
jne 0x18006a439
cmp dword [rsp + 0x38], 0
jne 0x18006a439
cmp qword [rsp + 0x100], 0
jne 0x18006a439
mov byte [rsp + 0x30], 0
lea r8, [rsp + 0x30]
mov edx, eax
mov rcx, qword [rsp + 0x80]
call fcn.18006a750
mov r15d, 1
jmp 0x18006a51e
mov dword [rsp + 0x6c], r14d
lea rdx, [0x18013ad60]
lea rcx, [rsp + 0x6c]
call fcn.1800c3e40
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x18006a51e
mov dword [rsp + 0x34], esi
mov byte [rsp + 0x30], 0
mov rdx, rax
lea r8, [rsp + 0x30]
mov r14, qword [rsp + 0x80]
mov rcx, r14
call fcn.18006a750
mov rax, qword [r14 + 0x20]
cmp rax, qword [r14 + 0x18]
jne 0x18006a48b
call fcn.1800c1088
mov rax, qword [r14 + 0x18]
lea rdx, [rsp + 0xf0]
cmp qword [rsp + 0x108], 8
cmovae rdx, qword [rsp + 0xf0]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x18006a4e8
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x60], ecx
lea rdx, [0x18013ad60]
lea rcx, [rsp + 0x60]
call fcn.1800c3e40
mov r15d, dword [rsp + 0x34]
test r15d, r15d
je 0x18006a504
cmp r15d, 5
jbe 0x18006a51e
cmp r15d, 7
je 0x18006a51e
cmp r15d, 0xb
je 0x18006a51e
or rcx, 0xffffffffffffffff
mov dword [rsp + 0x68], ecx
lea rdx, [0x18013ad60]
lea rcx, [rsp + 0x68]
call fcn.1800c3e40
nop
jmp 0x18006a525
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18006a53a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rsi
cmp qword [rsp + 0x108], 8
jb 0x18006a552
mov rcx, qword [rsp + 0xf0]
call fcn.1800bf8b4
mov qword [rsp + 0x108], 7
mov qword [rsp + 0x100], rsi
mov word [rsp + 0xf0], si
cmp qword [rsp + 0xe0], 8
jb 0x18006a586
mov rcx, qword [rsp + 0xc8]
call fcn.1800bf8b4
mov eax, r15d
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.1800bf8d0
lea r11, [rsp + reloc.OLEAUT32.dll_VARIANT_UserUnmarshal]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret