Function at 0x140068fb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x370]
sub rsp, 0x470
mov rax, qword [0x1403c9cb8]
xor rax, rsp
mov qword [rbp + 0x360], rax
xor r13d, r13d
mov edi, 0x200
mov r15, r9
mov rsi, r8
mov r12, rdx
mov rbx, rcx
test rdi, rcx
je 0x1400691a3
mov rcx, qword [0x1403c1180]
lea r8, [rsp + 0x58]
lea edx, [r13 + 1]
mov qword [rsp + 0x58], r13
call fcn.140035348
test eax, eax
jne 0x1400691a3
mov dword [rsp + 0x40], edi
xor edx, edx
mov edi, r13d
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x44]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x44], 0x100
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x160]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x140069198
cmp dword [rsp + 0x50], 1
mov qword [rsp + 0x48], r13
jne 0x1400690cd
mov edx, dword [rsp + 0x44]
test edx, edx
je 0x1400690cd
cmp dword [rsi], edx
jbe 0x1400690cd
test edx, edx
js 0x140069264
mov r8, qword [r12]
lea rcx, [rbp + 0x160]
mov r9d, edx
call fcn.14002d46c
test eax, eax
jne 0x1400690cd
mov ecx, dword [rsi]
lea rdx, [rsp + 0x48]
mov r14d, dword [rsp + 0x40]
mov r8, r15
shr r14d, 1
dec r14d
add ecx, r14d
add rcx, rcx
call fcn.140033284
test eax, eax
jns 0x1400690de
inc edi
mov dword [rsp + 0x40], 0x200
mov edx, edi
jmp 0x140069028
mov r8d, dword [rsi]
lea rdi, [r14 + r14]
add r8d, r14d
add r8, r8
test rdi, rdi
je 0x140069132
mov rcx, qword [rsp + 0x48]
test rcx, rcx
jne 0x140069107
call fcn.14023aaf0
mov dword [rax], 0x16
jmp 0x14006912d
cmp r8, rdi
jb 0x14006911b
mov r8, rdi
lea rdx, [rsp + 0x60]
call fcn.14020fd80
jmp 0x140069132
xor edx, edx
call fcn.1402108c0
call fcn.14023aaf0
mov dword [rax], 0x22
call fcn.14023767c
mov rax, qword [rsp + 0x48]
movsxd rbx, dword [rsi]
mov r15, qword [r12]
lea rcx, [rdi + rax]
add rbx, rbx
je 0x14006917a
test rcx, rcx
je 0x14006916a
mov r8, rbx
test r15, r15
je 0x14006915e
mov rdx, r15
call fcn.14020fd80
jmp 0x14006917a
xor edx, edx
call fcn.1402108c0
test r15, r15
jne 0x14006917a
call fcn.14023aaf0
mov dword [rax], 0x16
call fcn.14023767c
mov rcx, qword [rsp + 0x48]
mov qword [r12], rcx
add dword [rsi], r14d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x14006923a
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
bt rbx, 0xa
jae 0x140069238
mov rcx, qword [0x1403c1178]
lea rdx, [rsp + 0x60]
mov r8d, 0x100
call fcn.14003bcf0
lea rax, [rsp + 0x60]
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], r13w
jne 0x1400691ce
mov qword [rsp + 0x48], r13
test edi, edi
je 0x140069238
mov ecx, dword [rsi]
lea rdx, [rsp + 0x48]
add ecx, edi
mov r8, r15
add rcx, rcx
call fcn.140033284
test eax, eax
js 0x140069238
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x60]
mov eax, edi
lea rbx, [rax + rax]
mov r8, rbx
call fcn.14020fd80
movsxd r8, dword [rsi]
mov rcx, qword [rsp + 0x48]
add r8, r8
mov rdx, qword [r12]
add rcx, rbx
call fcn.14020fd80
mov rax, qword [rsp + 0x48]
mov qword [r12], rax
add dword [rsi], edi
jmp 0x140069191
xor al, al
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.14020ed60
mov rbx, qword [rsp + 0x4b0]
add rsp, 0x470
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor edx, edx
mov ecx, 0x1402520
call fcn.1400235f8
int3