Function at 0x10006d468
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x2e8
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0x2d0], rax
mov rax, rcx
mov qword [rsp + 0x70], rcx
xor ecx, ecx
lea rbx, [rsp + 0xa8]
mov qword [rsp + 0x98], r9
mov dword [rsp + 0x54], r8d
mov qword [rsp + 0x90], rdx
mov rsi, rcx
mov rdi, rcx
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rcx
cmp r9, rcx
je 0x10006d524
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r9
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
mov qword [rsp + 0x80], rcx
lea rdx, [rcx + rcx + 2]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
xor ecx, ecx
mov rsi, rax
cmp rax, rcx
jne 0x10006d51f
mov r8d, 0x8007000e
xor r9d, r9d
mov edx, 0x88b0138
mov ebx, r8d
call fcn.1000b51b8
lea rdi, [rsp + 0xa8]
jmp 0x10006da91
mov rax, qword [rsp + 0x70]
mov ebp, ecx
mov dword [rsp + 0x50], ecx
mov ecx, reloc.certcli.dll_Ordinal_261
mov dword [rsp + 0x5c], ecx
mov r9d, ecx
lea r8, [rsp + 0xc0]
mov rcx, rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
xor ecx, ecx
cmp eax, ecx
jne 0x10006d7e8
xor ebx, ebx
cmp rsi, rbx
je 0x10006d58d
lea rdx, [rdi + 1]
lea r8, [rsp + 0xc0]
mov r9, rdi
mov rcx, rsi
call fcn.10006b5a0
mov rcx, qword [rsp + 0x98]
mov rdx, rsi
mov word [rsi + rdi*2], bx
call fcn.1000b5684
cmp eax, ebx
jne 0x10006d792
cmp ebp, ebx
jne 0x10006d5b1
lea rcx, [0x10000c564]
call fcn.1000b99b0
mov ecx, 0x2e3
call fcn.1000ba420
mov rcx, rax
call fcn.1000b99b0
jmp 0x10006d5c2
mov eax, 0xcccccccd
mul ebp
shr edx, 2
lea ecx, [rdx + rdx*4]
cmp ebp, ecx
jne 0x10006d5ce
lea rcx, [0x10000c564]
call fcn.1000b99b0
lea rdx, [rsp + 0xc0]
lea rcx, [0x100004a90]
call fcn.1000b99b0
mov eax, dword [0x10011bdc4]
inc ebp
cmp eax, ebx
je 0x10006d792
mov dword [rsp + 0x60], eax
cmp eax, 3
jae 0x10006d603
dec eax
mov dword [0x10011bdc4], eax
mov r9d, dword [0x10011051c]
mov rcx, qword [rsp + 0x70]
lea rax, [rsp + 0x68]
lea rdx, [rsp + 0xc0]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x68], rbx
mov dil, bl
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
xor eax, eax
cmp ebx, eax
je 0x10006d647
mov r8d, ebx
mov edx, 0x92a0138
jmp 0x10006d6fd
mov rbx, qword [rsp + 0x90]
or rcx, 0xffffffffffffffff
lea r8, [0x100014f4c]
mov rdi, rbx
repne scasw ax, word [rdi]
mov edi, dword [rsp + 0x54]
not rcx
mov rdx, rdi
dec rcx
mov qword [rsp + 0xa0], rcx
mov rcx, rbx
call fcn.100038a50
lea r8, [rsp + 0xc0]
mov rdx, rdi
mov rcx, rbx
call fcn.100038a50
lea rcx, [0x10000c564]
call fcn.1000b99b0
inc dword [0x10011be58]
mov ecx, 0x230
call fcn.1000ba420
mov edx, dword [0x10011be58]
mov rcx, rax
call fcn.1000b99b0
lea rcx, [0x10000c564]
call fcn.1000b99b0
lea rcx, [0x100010718]
mov rdx, rbx
mov dil, 1
call fcn.1000b99b0
mov r8d, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x68]
xor r9d, r9d
mov rdx, rbx
call fcn.10006d468
xor edx, edx
mov ebx, eax
cmp eax, edx
je 0x10006d70f
mov r8d, eax
mov edx, 0x9390138
lea rcx, [rsp + 0xc0]
xor r9d, r9d
call fcn.1000b51b8
jmp 0x10006d723
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x90]
mov word [rcx + rax*2], dx
mov rcx, qword [rsp + 0x68]
xor eax, eax
cmp rcx, rax
je 0x10006d737
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dil, al
je 0x10006d782
mov eax, dword [0x10011be58]
mov ecx, 0x231
mov edi, eax
dec eax
mov dword [0x10011be58], eax
call fcn.1000ba420
mov edx, edi
mov rcx, rax
call fcn.1000b99b0
lea rcx, [0x10000c564]
call fcn.1000b99b0
mov rdx, qword [rsp + 0x90]
lea rcx, [0x100010718]
call fcn.1000b99b0
xor eax, eax
cmp ebx, eax
jne 0x10006d7ce
mov eax, dword [rsp + 0x60]
xor ebx, ebx
mov dword [0x10011bdc4], eax
mov eax, dword [rsp + 0x50]
mov ecx, reloc.certcli.dll_Ordinal_261
lea r8, [rsp + 0xc0]
inc eax
mov dword [rsp + 0x5c], ecx
mov r9d, ecx
mov rcx, qword [rsp + 0x70]
mov edx, eax
mov dword [rsp + 0x50], eax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, ebx
jne 0x10006d7e0
mov rdi, qword [rsp + 0x80]
jmp 0x10006d555
xor r9d, r9d
mov r8d, ebx
mov edx, 0x8b80138
xor ecx, ecx
jmp 0x10006d50d
lea rbx, [rsp + 0xa8]
cmp eax, 0x103
je 0x10006d801
xor r9d, r9d
mov r8d, eax
mov edx, 0x8960138
xor ecx, ecx
call fcn.1000b51b8
xor eax, eax
mov ecx, 8
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x68], eax
mov edi, eax
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x58], ecx
lea rcx, [rsp + 0x58]
lea r9, [rsp + 0x5c]
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rcx
xor ecx, ecx
lea r8, [rsp + 0xc0]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x70]
mov edx, eax
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x5c], reloc.certcli.dll_Ordinal_261
mov rbp, rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
xor ecx, ecx
cmp eax, ecx
je 0x10006d916
cmp eax, 0xea
jne 0x10006da6e
mov edx, dword [rsp + 0x58]
add rdx, 6
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbp, rax
xor eax, eax
cmp rbp, rax
je 0x10006da54
lea rax, [rsp + 0xa8]
cmp rax, rbx
je 0x10006d8aa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [rsp + 0x58]
mov edx, dword [rsp + 0x54]
mov rcx, qword [rsp + 0x70]
mov dword [rsp + 0x60], eax
lea rax, [rsp + 0x58]
lea r9, [rsp + 0x5c]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rax
xor eax, eax
lea r8, [rsp + 0xc0]
mov rdi, rbp
mov qword [rsp + 0x88], rbp
mov dword [rsp + 0x5c], reloc.certcli.dll_Ordinal_261
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
xor eax, eax
cmp ebx, eax
jne 0x10006da40
mov edi, dword [rsp + 0x50]
mov rbx, rbp
jmp 0x10006d918
xor eax, eax
cmp rbp, rax
je 0x10006d92d
mov eax, dword [rsp + 0x58]
xor ecx, ecx
mov dword [rax + rbp], ecx
mov word [rax + rbp + 4], cx
xor eax, eax
cmp rsi, rax
je 0x10006d97b
mov rax, qword [rsp + 0x80]
lea r8, [rsp + 0xc0]
mov rcx, rsi
lea rdx, [rax + 1]
mov r9, rax
call fcn.10006b5a0
mov rax, qword [rsp + 0x80]
xor ecx, ecx
mov word [rsi + rax*2], cx
mov rcx, qword [rsp + 0x98]
mov rdx, rsi
call fcn.1000b5684
xor ecx, ecx
cmp eax, ecx
jne 0x10006da31
xor eax, eax
cmp edi, eax
jne 0x10006d99f
lea rcx, [0x10000c564]
call fcn.1000b99b0
mov ecx, 0x2e4
call fcn.1000ba420
mov rcx, rax
call fcn.1000b99b0
jmp 0x10006d9b6
cmp dword [rsp + 0x68], eax
jne 0x10006d9b6
mov eax, 0xcccccccd
mul edi
shr edx, 2
lea ecx, [rdx + rdx*4]
cmp edi, ecx
jne 0x10006d9c2
lea rcx, [0x10000c564]
call fcn.1000b99b0
mov r8d, dword [rsp + 0x78]
xor eax, eax
or rcx, 0xffffffffffffffff
lea edx, [rax + 0x19]
lea rdi, [rsp + 0xc0]
repne scasw ax, word [rdi]
not rcx
dec rcx
sub edx, ecx
cmp rcx, 0x19
lea rcx, [rsp + 0xc0]
cmova edx, eax
lea rax, [rsp + 0x68]
xor r9d, r9d
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x58]
mov qword [rsp + 0x40], rbp
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], edx
lea rdx, [rsp + 0xc0]
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], 1
call fcn.10006c474
mov edi, dword [rsp + 0x50]
inc edi
mov dword [rsp + 0x50], edi
mov eax, dword [rsp + 0x54]
mov ecx, dword [rsp + 0x60]
inc eax
jmp 0x10006d816
xor r9d, r9d
mov r8d, ebx
mov edx, 0x8e10138
xor ecx, ecx
call fcn.1000b51b8
jmp 0x10006da91
mov r8d, 0x8007000e
xor r9d, r9d
mov edx, 0x8d70138
xor ecx, ecx
mov ebx, r8d
call fcn.1000b51b8
jmp 0x10006da89
cmp eax, 0x103
je 0x10006da85
xor r9d, r9d
mov r8d, eax
mov edx, 0x8ce0138
call fcn.1000b51b8
xor edi, edi
mov ebx, edi
mov rdi, qword [rsp + 0x88]
xor ecx, ecx
cmp rdi, rcx
je 0x10006daae
lea rax, [rsp + 0xa8]
cmp rax, rdi
je 0x10006daae
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor edi, edi
cmp rsi, rdi
je 0x10006dabe
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, ebx
call fcn.1000b7bec
mov rcx, qword [rsp + 0x2d0]
xor rcx, rsp
call fcn.1000ef870
add rsp, 0x2e8
pop rdi
pop rsi
pop rbp
pop rbx
ret