Function at 0x1400610e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rbp, r9
mov r12, r8
mov r8, rdx
xor r13d, r13d
mov qword [rax - 0x40], r13
mov dword [rax - 0x38], r13d
mov qword [rax - 0x30], r13
mov rdx, qword [rcx]
mov r9d, 0x20019
mov r8, qword [r8]
mov rdx, qword [rdx]
lea rcx, [rax - 0x40]
call fcn.14001c640
mov ecx, r13d
test eax, eax
sete cl
test ecx, ecx
jne 0x140061157
mov dword [rsp + 0x80], 0x80004005
lea rdx, [0x140176950]
lea rcx, [rsp + 0x80]
call fcn.1400de560
int3
mov dword [rsp + 0x80], r13d
mov ebx, r13d
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x88]
xor r8d, r8d
mov rdx, qword [r12]
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, eax
test eax, eax
jne 0x1400611b4
cmp dword [rsp + 0x88], 7
je 0x1400611a8
lea r11d, [rax + 0xd]
jmp 0x1400611b4
mov ebx, dword [rsp + 0x80]
shr ebx, 1
mov r11d, r13d
mov eax, r13d
test r11d, r11d
sete al
test eax, eax
jne 0x1400611e0
test rdi, rdi
je 0x1400611d4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x40], r13d
xor al, al
jmp 0x140061339
test ebx, ebx
jns 0x1400611ef
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov rax, qword [rbp]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, ebx
or eax, ecx
jge 0x14006120e
mov edx, ebx
mov rcx, rbp
call fcn.1400020c0
mov rsi, qword [rbp]
cmp ebx, dword [rsi - 0xc]
jg 0x14006132e
mov dword [rsi - 0x10], ebx
movsxd rcx, ebx
mov rax, qword [rbp]
mov word [rax + rcx*2], r13w
test rsi, rsi
je 0x14006123e
cmp ebx, 2
jae 0x14006123e
mov ecx, 0x7a
jmp 0x1400612c3
lea eax, [rbx + rbx]
mov dword [rsp + 0x80], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x88]
xor r8d, r8d
mov rdx, qword [r12]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
test eax, eax
jne 0x1400612c3
cmp dword [rsp + 0x88], 7
je 0x140061287
lea ecx, [rax + 0xd]
jmp 0x1400612c3
test rsi, rsi
je 0x1400612c0
mov ecx, dword [rsp + 0x80]
test cl, 1
jne 0x1400612b9
mov eax, ecx
shr eax, 1
cmp eax, 1
jb 0x1400612b9
shr rcx, 1
cmp word [rsi + rcx*2 - 2], 0
jne 0x1400612b9
cmp eax, 1
jbe 0x1400612c0
cmp word [rsi + rcx*2 - 4], 0
je 0x1400612c0
mov ecx, reloc.WS2_32.dll_listen
jmp 0x1400612c3
mov ecx, r13d
mov eax, r13d
test ecx, ecx
sete al
test eax, eax
jne 0x1400612d4
jmp 0x1400611c1
mov rcx, qword [rbp]
test rcx, rcx
jne 0x1400612e2
mov eax, r13d
jmp 0x1400612ef
movsxd rdx, dword [rcx - 0xc]
call fcn.1400d4f10
test eax, eax
js 0x140061323
mov rcx, qword [rbp]
cmp eax, dword [rcx - 0xc]
jg 0x140061323
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbp]
mov word [rax + rcx*2], r13w
test rdi, rdi
je 0x14006131a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x40], r13d
mov al, 1
jmp 0x140061339
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 0x80070057
call fcn.1400022b0
nop
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret