Function at 0x1400666c0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
test rcx, rcx
je 0x140066da1
mov rax, rsp
push rbp
push rdi
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov qword [rax - 0x28], rsi
mov r15, rdx
mov qword [rax - 0x30], r12
mov rdi, rcx
xor r12d, r12d
mov qword [rax - 0x38], r14
lea r14d, [rdx + rdx]
mov qword [rax - 0x20], rbx
mov dword [rbp + 0x90], r14d
lea rsi, [r12 - 1]
cmp r14d, 4
jb 0x140066918
xor eax, eax
mov qword [rbp + 0xa8], r12
mov dword [rcx], eax
lea rdx, str.SOFTWAREMetaQuotes_Software
lea rax, [rbp + 0xa8]
mov dword [rbp + 0xa0], r12d
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140066793
mov rcx, qword [rbp + 0xa8]
lea rax, [rbp + 0x90]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0xa0]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, [0x1401b7784]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0xa8]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete bl
test bl, bl
je 0x140066918
mov rcx, rdi
call fcn.14003e3e8
cmp rax, 0x2710
jl 0x140066918
xor eax, eax
mov dword [rbp + 0x90], 0xfe
mov dword [rsp + 0x50], eax
lea rdx, str.SOFTWAREMetaQuotes_Software
lea rax, [rbp + 0xa8]
mov qword [rbp + 0xa8], r12
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0xa0], r12d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006686c
mov rcx, qword [rbp + 0xa8]
lea rax, [rbp + 0x90]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0xa0]
lea rax, [rsp + 0x50]
xor r8d, r8d
lea rdx, [0x1401b7784]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0xa8]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14006686c
lea rax, [rsp + 0x50]
mov r8, rdi
sub r8, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140066864
add rax, 2
test ecx, ecx
jne 0x140066850
test edx, edx
je 0x14006690e
mov rcx, 0xffffffff80000001
call fcn.140003f50
test al, al
jne 0x14006688f
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000001
call fcn.140003ea0
mov rax, rsi
cmp word [rdi + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x140066892
lea ebx, [rax*2 + 2]
test ebx, ebx
je 0x14006690e
lea rax, [rbp + 0x90]
mov qword [rbp + 0x90], r12
mov r9d, 0x20106
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006690e
mov rcx, qword [rbp + 0x90]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], ebx
lea rdx, [0x1401b7784]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [rdi], r12w
jne 0x140066a72
mov dword [rbp + 0x90], r14d
cmp r14d, 4
jb 0x140066a6e
xor eax, eax
mov qword [rbp + 0xa8], r12
mov dword [rdi], eax
lea rdx, str.SOFTWAREMetaQuotes_Software
lea rax, [rbp + 0xa8]
mov dword [rbp + 0xa0], r12d
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000001
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400669ad
mov rcx, qword [rbp + 0xa8]
lea rax, [rbp + 0x90]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0xa0]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, [0x1401b7784]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0xa8]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete bl
test bl, bl
je 0x140066a6e
mov rcx, rdi
call fcn.14003e3e8
cmp rax, 0x2710
jl 0x140066a6e
mov rcx, 0xffffffff80000002
call fcn.140003f50
test al, al
jne 0x1400669ec
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000002
call fcn.140003ea0
mov rax, rsi
nop
cmp word [rdi + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x1400669f0
lea ebx, [rax*2 + 2]
test ebx, ebx
je 0x140066a72
lea rax, [rbp + 0x90]
mov qword [rbp + 0x90], r12
mov r9d, 0x20106
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140066a72
mov rcx, qword [rbp + 0x90]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], ebx
lea rdx, [0x1401b7784]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140066a72
mov word [rdi], r12w
mov r14, qword [rsp + 0x150]
mov rcx, rsi
nop dword [rax]
inc rcx
cmp word [rdi + rcx*2], r12w
jne 0x140066a80
mov rdx, r12
test rcx, rcx
je 0x140066aa8
movzx eax, word [rdi + rdx*2]
sub ax, 0x30
cmp ax, 9
ja 0x140066ab2
inc rdx
cmp rdx, rcx
jb 0x140066a92
cmp rcx, 9
jae 0x140066d7e
xor ecx, ecx
call fcn.140035e90
mov edx, 8
lea rcx, [rbp + 0x90]
lea rbx, [rax - 0x54a48e00]
call fcn.140054e70
mov rcx, qword [rbp + 0x90]
lea r9, [0x1401b80d0]
and ecx, 0x1ffffff
movabs rax, 0x4400000000000000
shl rcx, 0x20
mov r8, rsi
or rcx, rbx
mov rdx, r15
or rcx, rax
mov qword [rsp + 0x20], rcx
mov rcx, rdi
call fcn.140003dd0
lea rax, [rbp + 0x90]
mov qword [rbp + 0x90], r12
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140066bb5
lea rax, [rbp + 0x90]
mov qword [rbp + 0x90], r12
mov r9d, 0x20106
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140066bb5
mov qword [rsp + 0x40], r12
lea rax, [rbp + 0x90]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREMetaQuotes_Software
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], 0x100
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140066bc2
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rsi
nop word [rax + rax]
cmp word [rdi + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x140066bd0
lea ebx, [rax*2 + 2]
test ebx, ebx
je 0x140066c4c
lea rax, [rbp + 0x90]
mov qword [rbp + 0x90], r12
mov r9d, 0x20106
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140066c4c
mov rcx, qword [rbp + 0x90]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], ebx
lea rdx, [0x1401b7784]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x90]
mov qword [rbp + 0x90], r12
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140066cf5
lea rax, [rbp + 0x90]
mov qword [rbp + 0x90], r12
mov r9d, 0x20106
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140066cf5
mov qword [rsp + 0x40], r12
lea rax, [rbp + 0x90]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREMetaQuotes_Software
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], 0x100
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140066d02
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [rdi + rsi*2 + 2], r12w
lea rsi, [rsi + 1]
jne 0x140066d02
lea esi, [rsi*2 + 2]
test esi, esi
je 0x140066d7e
lea rax, [rbp + 0x90]
mov qword [rbp + 0x90], r12
mov r9d, 0x20106
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140066d7e
mov rcx, qword [rbp + 0x90]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], esi
lea rdx, [0x1401b7784]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x168]
mov rsi, qword [rsp + 0x160]
mov r12, qword [rsp + 0x158]
add rsp, 0x170
pop r15
pop rdi
pop rbp
ret