Function at 0x1400655a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
test rcx, rcx
je 0x140065c81
mov rax, rsp
push rbp
push rdi
push r15
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov qword [rax - 0x28], rsi
mov r15, rdx
mov qword [rax - 0x30], r12
mov rdi, rcx
xor r12d, r12d
mov qword [rax - 0x38], r14
lea r14d, [rdx + rdx]
mov qword [rax - 0x20], rbx
mov dword [rbp + 0x90], r14d
lea rsi, [r12 - 1]
cmp r14d, 4
jb 0x1400657f8
xor eax, eax
mov qword [rbp + 0xa8], r12
mov dword [rcx], eax
lea rdx, str.SOFTWAREMetaQuotes_Software
lea rax, [rbp + 0xa8]
mov dword [rbp + 0xa0], r12d
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140065673
mov rcx, qword [rbp + 0xa8]
lea rax, [rbp + 0x90]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0xa0]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, [0x1401b6784]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0xa8]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete bl
test bl, bl
je 0x1400657f8
mov rcx, rdi
call fcn.14003e038
cmp rax, 0x2710
jl 0x1400657f8
xor eax, eax
mov dword [rbp + 0x90], 0xfe
mov dword [rsp + 0x50], eax
lea rdx, str.SOFTWAREMetaQuotes_Software
lea rax, [rbp + 0xa8]
mov qword [rbp + 0xa8], r12
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0xa0], r12d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006574c
mov rcx, qword [rbp + 0xa8]
lea rax, [rbp + 0x90]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0xa0]
lea rax, [rsp + 0x50]
xor r8d, r8d
lea rdx, [0x1401b6784]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0xa8]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14006574c
lea rax, [rsp + 0x50]
mov r8, rdi
sub r8, rax
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140065744
add rax, 2
test ecx, ecx
jne 0x140065730
test edx, edx
je 0x1400657ee
mov rcx, 0xffffffff80000001
call fcn.140003c10
test al, al
jne 0x14006576f
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000001
call fcn.140003b60
mov rax, rsi
cmp word [rdi + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x140065772
lea ebx, [rax*2 + 2]
test ebx, ebx
je 0x1400657ee
lea rax, [rbp + 0x90]
mov qword [rbp + 0x90], r12
mov r9d, 0x20106
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400657ee
mov rcx, qword [rbp + 0x90]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], ebx
lea rdx, [0x1401b6784]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [rdi], r12w
jne 0x140065952
mov dword [rbp + 0x90], r14d
cmp r14d, 4
jb 0x14006594e
xor eax, eax
mov qword [rbp + 0xa8], r12
mov dword [rdi], eax
lea rdx, str.SOFTWAREMetaQuotes_Software
lea rax, [rbp + 0xa8]
mov dword [rbp + 0xa0], r12d
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000001
xor bl, bl
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14006588d
mov rcx, qword [rbp + 0xa8]
lea rax, [rbp + 0x90]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0xa0]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, [0x1401b6784]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rbp + 0xa8]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
sete bl
test bl, bl
je 0x14006594e
mov rcx, rdi
call fcn.14003e038
cmp rax, 0x2710
jl 0x14006594e
mov rcx, 0xffffffff80000002
call fcn.140003c10
test al, al
jne 0x1400658cc
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000002
call fcn.140003b60
mov rax, rsi
nop
cmp word [rdi + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x1400658d0
lea ebx, [rax*2 + 2]
test ebx, ebx
je 0x140065952
lea rax, [rbp + 0x90]
mov qword [rbp + 0x90], r12
mov r9d, 0x20106
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140065952
mov rcx, qword [rbp + 0x90]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], ebx
lea rdx, [0x1401b6784]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140065952
mov word [rdi], r12w
mov r14, qword [rsp + 0x150]
mov rcx, rsi
nop dword [rax]
inc rcx
cmp word [rdi + rcx*2], r12w
jne 0x140065960
mov rdx, r12
test rcx, rcx
je 0x140065988
movzx eax, word [rdi + rdx*2]
sub ax, 0x30
cmp ax, 9
ja 0x140065992
inc rdx
cmp rdx, rcx
jb 0x140065972
cmp rcx, 9
jae 0x140065c5e
xor ecx, ecx
call fcn.140035ae0
mov edx, 8
lea rcx, [rbp + 0x90]
lea rbx, [rax - 0x54a48e00]
call fcn.140054ac0
mov rcx, qword [rbp + 0x90]
lea r9, [0x1401b70c0]
and ecx, 0x1ffffff
movabs rax, 0x4400000000000000
shl rcx, 0x20
mov r8, rsi
or rcx, rbx
mov rdx, r15
or rcx, rax
mov qword [rsp + 0x20], rcx
mov rcx, rdi
call fcn.140003a90
lea rax, [rbp + 0x90]
mov qword [rbp + 0x90], r12
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140065a95
lea rax, [rbp + 0x90]
mov qword [rbp + 0x90], r12
mov r9d, 0x20106
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140065a95
mov qword [rsp + 0x40], r12
lea rax, [rbp + 0x90]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREMetaQuotes_Software
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], 0x100
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140065aa2
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rsi
nop word [rax + rax]
cmp word [rdi + rax*2 + 2], r12w
lea rax, [rax + 1]
jne 0x140065ab0
lea ebx, [rax*2 + 2]
test ebx, ebx
je 0x140065b2c
lea rax, [rbp + 0x90]
mov qword [rbp + 0x90], r12
mov r9d, 0x20106
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140065b2c
mov rcx, qword [rbp + 0x90]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], ebx
lea rdx, [0x1401b6784]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp + 0x90]
mov qword [rbp + 0x90], r12
mov r9d, 0x20119
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140065bd5
lea rax, [rbp + 0x90]
mov qword [rbp + 0x90], r12
mov r9d, 0x20106
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140065bd5
mov qword [rsp + 0x40], r12
lea rax, [rbp + 0x90]
mov qword [rsp + 0x38], rax
lea rdx, str.SOFTWAREMetaQuotes_Software
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], 0x100
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x20], r12d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140065be2
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [rdi + rsi*2 + 2], r12w
lea rsi, [rsi + 1]
jne 0x140065be2
lea esi, [rsi*2 + 2]
test esi, esi
je 0x140065c5e
lea rax, [rbp + 0x90]
mov qword [rbp + 0x90], r12
mov r9d, 0x20106
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SOFTWAREMetaQuotes_Software
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140065c5e
mov rcx, qword [rbp + 0x90]
lea r9d, [rax + 1]
mov dword [rsp + 0x28], esi
lea rdx, [0x1401b6784]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x168]
mov rsi, qword [rsp + 0x160]
mov r12, qword [rsp + 0x158]
add rsp, 0x170
pop r15
pop rdi
pop rbp
ret