Function at 0x14006b530
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x140
mov rax, qword [0x140162010]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rdi, r9
mov rsi, r8
mov qword [rsp + 0x38], rdx
mov r14, rcx
mov qword [rsp + 0x30], rcx
mov r12, qword [r8 + 0x10]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
sub rax, r12
cmp rax, 0x22
jb 0x14006b956
cmp qword [r8 + 0x18], 8
jb 0x14006b590
mov rsi, qword [r8]
xor eax, eax
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rax
lea r13, [r12 + 0x22]
mov ebx, 7
lea r15, [rsp + 0xf0]
cmp r13, rbx
jbe 0x14006b619
mov rbx, r13
or rbx, 7
cmp rbx, rcx
jbe 0x14006b5d2
mov rbx, rcx
jmp 0x14006b5de
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14006b95b
lfence
add rcx, rcx
call fcn.14000e8a0
mov r15, rax
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0x100], r13
mov qword [rsp + 0x108], rbx
movaps xmm0, xmmword [str.SOFTWARESophosManagementPolicy_]
movups xmmword [r15], xmm0
movaps xmm1, xmmword [0x140138680]
movups xmmword [r15 + 0x10], xmm1
movaps xmm0, xmmword [0x140138690]
movups xmmword [r15 + 0x20], xmm0
movaps xmm1, xmmword [0x1401386a0]
movups xmmword [r15 + 0x30], xmm1
mov eax, dword [0x1401386b0]
mov dword [r15 + 0x40], eax
lea rcx, [r15 + 0x44]
lea r8, [r12 + r12]
mov rdx, rsi
call fcn.1400d44b0
xor esi, esi
mov word [r15 + r13*2], si
xorps xmm0, xmm0
movups xmmword [rsp + 0xd8], xmm0
lea rdx, [rsp + 0xf0]
cmp qword [rsp + 0x108], 8
cmovae rdx, qword [rsp + 0xf0]
mov qword [rsp + 0xe0], rsi
lea r15, vtable.RegistryAccess.0
mov qword [rsp + 0xd8], r15
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x14006b961
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0xe8]
xor r8d, r8d
lea rdx, str.latest
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x14006b980
mov edx, dword [rsp + 0xc0]
mov ecx, dword [rsp + 0xe8]
call fcn.140077f80
mov r9d, dword [rsp + 0xc0]
lea r8, str.latest
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0xd8]
call fcn.1400792e0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0xc8], xmm0
lea rdx, [rsp + 0x110]
cmp qword [rsp + 0x128], 8
cmovae rdx, qword [rsp + 0x110]
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0xc8], r15
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x14006b99f
mov qword [rsp + 0xc8], r15
cmp qword [rdi + 0x18], 8
jb 0x14006b7c9
mov rdi, qword [rdi]
lea rax, [rsp + 0xc4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0xec]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x14006b9c4
mov edx, dword [rsp + 0xc4]
mov ecx, dword [rsp + 0xec]
call fcn.140077f80
mov r9d, dword [rsp + 0xc4]
mov r8, rdi
mov rdx, r14
lea rcx, [rsp + 0xc8]
call fcn.1400792e0
nop
lea rbx, vtable.RegistryHandle.0
mov qword [rsp + 0xc8], rbx
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
je 0x14006b85a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0xd0], rsi
mov rdx, qword [rsp + 0x128]
cmp rdx, 8
jb 0x14006b8a2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006b89d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006b9e9
call fcn.1400ada10
mov qword [rsp + 0x120], rsi
mov qword [rsp + 0x128], 7
mov word [rsp + 0x110], si
mov qword [rsp + 0xd8], rbx
mov rcx, qword [rsp + 0xe0]
test rcx, rcx
je 0x14006b8e1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0xe0], rsi
mov rdx, qword [rsp + 0x108]
cmp rdx, 8
jb 0x14006b929
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006b924
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006b9ef
call fcn.1400ada10
mov rax, r14
jmp 0x14006b933
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1400ad9f0
add rsp, 0x140
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.140006940
call fcn.1400067c0
nop
lea rdx, str.Failed_to_open_registry_key
lea rcx, [rsp + 0x40]
call fcn.14000a4a0
nop
lea rdx, [rsp + 0x40]
mov ecx, ebx
call fcn.140010730
nop
lea rdx, str.Failed_to_get_registry_value_length
lea rcx, [rsp + 0x60]
call fcn.14000a4a0
nop
lea rdx, [rsp + 0x60]
mov ecx, ebx
call fcn.140010730
nop
lea rdx, str.Failed_to_open_registry_key
lea rcx, [rsp + 0x80]
call fcn.14000a4a0
nop
lea rdx, [rsp + 0x80]
mov ecx, ebx
call fcn.140010730
nop
lea rdx, str.Failed_to_get_registry_value_length
lea rcx, [rsp + 0xa0]
call fcn.14000a4a0
nop
lea rdx, [rsp + 0xa0]
mov ecx, ebx
call fcn.140010730
nop
call fcn.1400e39e0
nop
call fcn.1400e39e0
int3