Function at 0x140069f60
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xc0
mov qword [rsp + 0xb8], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov r15, rdx
mov r12, rcx
xor edi, edi
mov qword [rax + 0x20], rdi
lea rdx, [rax - 0x70]
mov rcx, qword [rcx + 0x10]
call fcn.14000f700
nop
lea rax, [rsp + 0x118]
mov qword [rsp + 0x30], rax
mov rbx, qword [rsp + 0x88]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 0xffffffff80000002
lea r9, str.hKey_x__lpszSubKey_s__phSubKey_x
lea r8, str.OpenSubKey
lea rdx, str.CRegistryIF
mov rcx, qword [r12]
call fcn.140081070
mov esi, edi
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006a021
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x118], rax
mov esi, 1
mov dword [rsp + 0x20], esi
lea r9, [0x1400fb428]
lea r8, str.OpenSubKey
lea rdx, str.CRegistryIF
mov rcx, qword [r12]
call fcn.140081270
or r14, 0xffffffffffffffff
test esi, esi
je 0x14006a3b5
lea r8, str.InstallDefaultLang
mov rdx, qword [rsp + 0x118]
mov rcx, r12
call fcn.1400678e0
test rax, rax
je 0x14006a088
or dword [r15], 1
mov ecx, dword [rax]
mov dword [r15 + 4], ecx
mov rcx, qword [r12 + 8]
mov r8, rax
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea r8, str.InstalledRegion
mov rdx, qword [rsp + 0x118]
mov rcx, r12
call fcn.1400678e0
test rax, rax
je 0x14006a0c3
or dword [r15], 2
movzx ecx, word [rax]
mov word [r15 + 8], cx
mov rcx, qword [r12 + 8]
mov r8, rax
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [r12 + 0x10]
movabs rcx, 0x40000000000
test qword [rax], rcx
je 0x14006a3a6
lea rcx, [rsp + 0x58]
call fcn.1400aa430
nop
lea rax, method.CPtrArray.virtual_0
mov qword [rsp + 0x58], rax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [rsp + 0x80], rax
lea rax, str.ERDPrintCapability
mov qword [rsp + 0x98], rax
lea rax, [0x1401050b8]
mov qword [rsp + 0xa0], rax
lea rax, str.Mail
mov qword [rsp + 0xa8], rax
mov rbp, rdi
nop
nop
nop
mov dword [rsp + 0x110], edi
mov dword [rsp + 0x100], edi
mov r13, qword [rsp + rbp*8 + 0x98]
lea rax, [rsp + 0x100]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x110]
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14006a2c2
mov eax, dword [rsp + 0x100]
test eax, eax
je 0x14006a2c2
cmp dword [rsp + 0x110], 1
jne 0x14006a1af
add eax, 2
mov dword [rsp + 0x100], eax
mov r8d, eax
mov rcx, qword [r12 + 8]
test eax, eax
je 0x14006a2c2
mov edx, 8
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x14006a2c2
lea rax, [rsp + 0x100]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x110]
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14006a2af
mov qword [rsp + 0x40], rdi
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov rdx, r13
mov rcx, qword [r12 + 8]
call fcn.140013c20
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x100]
mov dword [rsp + 0x4c], eax
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x48], eax
mov qword [rsp + 0x50], rsi
mov edx, 8
lea r8d, [rdx + 0x10]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
test rax, rax
je 0x14006a2c2
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetElement
lea r8, [rsp + 0x40]
mov rdx, r9
mov rcx, rax
call fcn.1400cd500
test eax, eax
jne 0x14006a29a
mov r8, rsi
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x58]
call fcn.1400aa678
jmp 0x14006a2c2
mov r8, rsi
xor edx, edx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14006a2c2
mov rcx, qword [r12 + 8]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rbp, 1
cmp rbp, 3
jl 0x14006a140
mov ecx, 0x30
call fcn.140091360
mov rsi, rax
mov qword [rsp + 0xb0], rax
test rax, rax
je 0x14006a31e
mov rcx, rax
call fcn.1400aa430
nop
lea rbp, method.CPtrArray.virtual_0
mov qword [rsi], rbp
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapCreate]
mov qword [rsi + 0x28], rax
lea rdx, [rsp + 0x58]
mov rcx, rsi
call fcn.14005cbd0
nop
jmp 0x14006a328
mov rsi, rdi
lea rbp, method.CPtrArray.virtual_0
mov qword [r15 + 0x10], rsi
mov qword [rsp + 0x58], rbp
mov rcx, qword [rsp + 0x68]
test rcx, rcx
jle 0x14006a38d
nop
nop
test rdi, rdi
js 0x14006a387
cmp rdi, rcx
jge 0x14006a387
mov rax, qword [rsp + 0x60]
mov r8, qword [rax + rdi*8]
test r8, r8
je 0x14006a36d
xor edx, edx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x68]
add rdi, 1
cmp rdi, rcx
jl 0x14006a340
mov r8, r14
xor edx, edx
lea rcx, [rsp + 0x58]
call fcn.1400aa464
jmp 0x14006a38d
call fcn.1400a0610
int3
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_HeapDestroy]
nop
lea rcx, [rsp + 0x58]
call fcn.1400aa450
mov rcx, qword [rsp + 0x118]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], r14d
add r14d, 0xffffffff
test r14d, r14d
jg 0x14006a3d1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x108]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret