Function at 0x140061ab0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
test rdx, rdx
je 0x140061f7e
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push r12
lea rbp, [rax - 0x288]
sub rsp, 0x378
cmp word [rdx], 0
mov r12, rdx
je 0x140061f74
mov qword [rax - 0x18], rbx
lea rcx, [rbp + 0x50]
mov qword [rax - 0x20], rsi
mov edx, 0xff
mov qword [rax - 0x28], rdi
mov qword [rax - 0x30], r14
mov qword [rax - 0x38], r15
call fcn.1400655a0
xor ebx, ebx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rbx
lea r8, [rbp + 0x50]
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], 0xff
mov ecx, 0xfde9
lea r9d, [rbx - 1]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x140061b50
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rbx
lea r8, str._fz_uniq
mov rdx, r12
call fcn.140065f90
xor eax, eax
mov dword [rbp + 0x290], 0x1fe
mov dword [rbp + 0x50], eax
lea rdx, str.SOFTWAREMetaQuotes_SoftwareSettings
lea rax, [rbp + 0x2a0]
mov qword [rbp + 0x2a0], rbx
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x298], ebx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140061c37
mov rcx, qword [rbp + 0x2a0]
lea rax, [rbp + 0x290]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x298]
lea rax, [rbp + 0x50]
xor r8d, r8d
lea rdx, str.MQL5.Login
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x2a0]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x140061c37
cmp word [rbp + 0x50], bx
je 0x140061c37
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rbx
lea r9d, [rdi - 1]
mov dword [rsp + 0x28], 0xff
lea r8, [rbp + 0x50]
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x140061c37
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rbx
lea r8, str.mqlogin
mov rdx, r12
call fcn.140065f90
xor eax, eax
mov dword [rbp + 0x290], 0x1fe
mov dword [rbp + 0x50], eax
lea rdx, str.SOFTWAREMetaQuotes_Software
lea rax, [rbp + 0x2a0]
mov qword [rbp + 0x2a0], rbx
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x298], ebx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140061d2d
mov rcx, qword [rbp + 0x2a0]
lea rax, [rbp + 0x290]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x298]
lea rax, [rbp + 0x50]
xor r8d, r8d
lea rdx, str.Install.Time
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0x2a0]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x140061d2d
cmp word [rbp + 0x50], bx
je 0x140061d2d
lea rcx, [rbp + 0x50]
call fcn.14003e038
xor ecx, ecx
mov rdi, rax
call fcn.140035ae0
cmp rdi, rax
jge 0x140061de1
xor ecx, ecx
call fcn.140035ae0
sub rax, rdi
lea r8, [0x1401b9248]
mov r9, rax
lea rcx, [rsp + 0x50]
mov edx, 0xff
call fcn.140008c00
lea r9, [rsp + 0x50]
mov qword [rsp + 0x20], rbx
lea r8, [0x1401b9250]
mov rdx, r12
call fcn.140065f90
jmp 0x140061de1
xor ecx, ecx
call fcn.140035ae0
lea r9, str._I64d
mov qword [rsp + 0x20], rax
mov edx, 0xff
lea rcx, [rbp + 0x50]
mov r8, 0xffffffffffffffff
call fcn.140003a90
lea rcx, [rbp + 0x50]
mov rax, 0xffffffffffffffff
cmp word [rcx + rax*2 + 2], bx
lea rax, [rax + 1]
jne 0x140061d60
lea edi, [rax*2 + 2]
test edi, edi
je 0x140061de1
lea rax, [rbp + 0x290]
mov qword [rbp + 0x290], rbx
mov r9d, 0x20106
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140061de1
mov rcx, qword [rbp + 0x290]
lea rax, [rbp + 0x50]
mov dword [rsp + 0x28], edi
lea rdx, str.Install.Time
mov r9d, 1
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x290]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
lea rcx, [rsp + 0x40]
movups xmmword [rsp + 0x40], xmm0
call fcn.14000c1b0
mov r14d, reloc.WS2_32.dll_recv
lea rsi, [rsp + 0x40]
mov r15d, r14d
mov rdi, rbx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rsi]
lea rcx, [rsp + 0x50]
mov edx, 0xff
mov dword [rsp + 0x20], eax
sub rdx, rdi
lea r9, [0x1401b9254]
add rcx, rdi
mov r8, 0xffffffffffffffff
call fcn.1400053b0
add rdi, 2
lea rsi, [rsi + 1]
sub r15, 1
jne 0x140061e10
mov r15, qword [rsp + 0x350]
lea r9, [rsp + 0x50]
lea r8, [0x1401b925c]
mov qword [rsp + 0x20], rbx
mov rdx, r12
call fcn.140065f90
movzx eax, byte [rsp + 0x40]
lea rdi, [rsp + 0x40]
xor al, 0x41
mov byte [0x14021abd4], bl
mov byte [rsp + 0x40], al
lea rsi, [0x14021abd4]
sub al, 0x4a
xor al, byte [rsp + 0x41]
mov byte [rsp + 0x41], al
add al, 0x7f
xor al, byte [rsp + 0x42]
mov byte [rsp + 0x42], al
add al, 0x58
xor al, byte [rsp + 0x43]
mov byte [rsp + 0x43], al
add al, 0x38
xor al, byte [rsp + 0x44]
mov byte [rsp + 0x44], al
add al, 0xc
xor al, byte [rsp + 0x45]
mov byte [rsp + 0x45], al
sub al, r14b
xor al, byte [rsp + 0x46]
mov byte [rsp + 0x46], al
add al, 0x2d
xor al, byte [rsp + 0x47]
mov byte [rsp + 0x47], al
add al, 0x7b
xor al, byte [rsp + 0x48]
mov byte [rsp + 0x48], al
add al, 0x39
xor al, byte [rsp + 0x49]
mov byte [rsp + 0x49], al
add al, 8
xor al, byte [rsp + 0x4a]
mov byte [rsp + 0x4a], al
sub al, 2
xor al, byte [rsp + 0x4b]
mov byte [rsp + 0x4b], al
add al, 0x21
xor al, byte [rsp + 0x4c]
mov byte [rsp + 0x4c], al
sub al, 0x45
xor al, byte [rsp + 0x4d]
mov byte [rsp + 0x4d], al
add al, 0x41
xor al, byte [rsp + 0x4e]
mov byte [rsp + 0x4e], al
add al, 0x58
xor byte [rsp + 0x4f], al
nop dword [rax]
movzx eax, byte [rdi]
lea rcx, [rbx + rsi]
mov edx, 0x7f
mov dword [rsp + 0x20], eax
sub rdx, rbx
lea r9, [0x1401b9254]
mov r8, 0xffffffffffffffff
call fcn.1400053b0
add rbx, 2
lea rdi, [rdi + 1]
sub r14, 1
jne 0x140061f20
mov r14, qword [rsp + 0x358]
mov rdi, qword [rsp + 0x360]
mov rsi, qword [rsp + 0x368]
mov rbx, qword [rsp + 0x370]
add rsp, 0x378
pop r12
pop rbp
ret