Function at 0x14006ba90
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xd8
mov r13, rcx
xor ebx, ebx
mov dword [rbp - 0x79], ebx
mov edx, 0xa5
lea rcx, [rbp - 0x69]
call fcn.1400175a0
mov r15, rax
mov qword [rbp - 0x71], rax
cmp qword [rax + 0x18], 0x10
jb 0x14006bad8
mov r15, qword [rax]
mov qword [rbp - 0x71], r15
mov rdx, qword [rbp - 0x51]
cmp rdx, 0x10
jb 0x14006bb13
inc rdx
mov rcx, qword [rbp - 0x69]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006bb0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006c0e1
call fcn.140133e68
mov qword [rbp - 0x59], rbx
mov qword [rbp - 0x51], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x69], bl
call fcn.14000bfcc
mov rcx, rax
test rax, rax
je 0x14006c0e7
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [r13], rax
mov r14d, 1
mov dword [rbp - 0x79], r14d
mov dword [rbp + 0x77], r14d
call fcn.14000bfcc
mov rcx, rax
test rax, rax
je 0x14006c0f2
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rsi, [0x1404163d0]
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140006ea0
lea r12, [r14 - 2]
test al, al
jne 0x14006bcbf
mov rbx, r12
inc rbx
cmp byte [rsi + rbx], 0
jne 0x14006bb92
mov rdi, qword [rsp + 0x30]
test ebx, ebx
jne 0x14006bc01
lea rdx, [rdi - 0x18]
mov rbx, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14006bcc4
cmp dword [rdx + 0x10], 0
jge 0x14006bbd4
cmp dword [rdi - 0xc], 0
jl 0x14006c0fd
mov dword [rdi - 0x10], 0
mov byte [rdi], 0
jmp 0x14006bcc4
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006bbea
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + Ordinal_26]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x30], rdi
jmp 0x14006bcc4
mov r15d, dword [rdi - 0x10]
sub rsi, rdi
test ebx, ebx
js 0x14006c0fd
mov ecx, r14d
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, ebx
or eax, ecx
jge 0x14006bc30
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.140007db4
mov rdi, qword [rsp + 0x30]
movsxd r14, ebx
cmp rsi, r15
ja 0x14006bc64
lea rdx, [rsi + rdi]
test rdx, rdx
jne 0x14006bc4e
call fcn.140146434
mov dword [rax], reloc.WLDAP32.dll_Ordinal_22
jmp 0x14006bc96
movsxd rax, dword [rdi - 0xc]
cmp rax, r14
jb 0x14006bc8b
mov r8, r14
mov rcx, rdi
call fcn.1401378a0
jmp 0x14006bc9b
movsxd r8, dword [rdi - 0xc]
mov rcx, rdi
cmp r8, r14
jb 0x14006bc84
mov r8, r14
lea rsi, [0x1404163d0]
mov rdx, rsi
call fcn.1401378a0
jmp 0x14006bca2
xor edx, edx
call fcn.140137f50
call fcn.140146434
mov dword [rax], Ordinal_35
call fcn.140146288
lea rsi, [0x1404163d0]
cmp ebx, dword [rdi - 0xc]
jg 0x14006c0fd
mov dword [rdi - 0x10], ebx
mov byte [r14 + rdi], 0
mov r14d, 1
mov r15, qword [rbp - 0x71]
jmp 0x14006bcc4
mov rdi, qword [rsp + 0x30]
mov dword [rbp + 0x6f], 0x104
mov edx, 0xe1
lea rcx, [rbp - 0x49]
call fcn.1400175a0
mov rbx, rax
mov ecx, r14d
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, 0x104
or eax, ecx
jge 0x14006bd02
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.140007db4
mov rdi, qword [rsp + 0x30]
cmp qword [rbx + 0x18], 0x10
jb 0x14006bd0c
mov rbx, qword [rbx]
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x77]
mov r8, rbx
mov rdx, r15
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
nop
mov rdx, qword [rbp - 0x31]
cmp rdx, 0x10
jb 0x14006bd6d
inc rdx
mov rcx, qword [rbp - 0x49]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006bd68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006c108
call fcn.140133e68
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.1401738c0
test eax, eax
js 0x14006c0d6
cmp eax, dword [rdi - 0xc]
jg 0x14006c0d6
mov dword [rdi - 0x10], eax
cdqe
mov byte [rax + rdi], 0
call fcn.14000bfcc
mov rcx, rax
test rax, rax
je 0x14006c10e
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [rsp + 0x38], rax
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.140006ea0
test al, al
jne 0x14006bf01
mov rsi, r12
lea rdx, [0x1404163d0]
inc rsi
cmp byte [rdx + rsi], 0
jne 0x14006bdd2
mov rbx, qword [rsp + 0x38]
test esi, esi
jne 0x14006be46
lea rdx, [rbx - 0x18]
mov rsi, qword [rdx]
cmp dword [rdx + 8], 0
je 0x14006bf06
cmp dword [rdx + 0x10], 0
jge 0x14006be14
cmp dword [rbx - 0xc], 0
jl 0x14006c119
mov dword [rbx - 0x10], 0
mov byte [rbx], 0
jmp 0x14006bf06
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006be2a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
mov rdi, qword [rsp + 0x30]
jmp 0x14006bf06
mov r13d, dword [rbx - 0x10]
mov r15, rdx
sub r15, rbx
test esi, esi
js 0x14006c119
mov ecx, r14d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, ecx
jge 0x14006be7f
mov edx, esi
lea rcx, [rsp + 0x38]
call fcn.140007db4
mov rbx, qword [rsp + 0x38]
lea rdx, [0x1404163d0]
movsxd r14, esi
cmp r15, r13
ja 0x14006beb3
lea rdx, [r15 + rbx]
test rdx, rdx
jne 0x14006be9d
call fcn.140146434
mov dword [rax], reloc.WLDAP32.dll_Ordinal_22
jmp 0x14006bedb
movsxd rax, dword [rbx - 0xc]
cmp rax, r14
jb 0x14006bed0
mov r8, r14
mov rcx, rbx
call fcn.1401378a0
jmp 0x14006bee0
movsxd r8, dword [rbx - 0xc]
mov rcx, rbx
cmp r8, r14
jb 0x14006bec9
mov r8, r14
call fcn.1401378a0
jmp 0x14006bee0
xor edx, edx
call fcn.140137f50
call fcn.140146434
mov dword [rax], Ordinal_35
call fcn.140146288
cmp esi, dword [rbx - 0xc]
jg 0x14006c119
mov dword [rbx - 0x10], esi
mov byte [r14 + rbx], 0
mov r14d, 1
mov r15, qword [rbp - 0x71]
mov r13, qword [rbp + 0x67]
jmp 0x14006bf06
mov rbx, qword [rsp + 0x38]
mov edx, 0xe2
lea rcx, [rbp - 0x29]
call fcn.1400175a0
mov rsi, rax
sub r14d, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x104
or eax, r14d
jge 0x14006bf3c
mov edx, 0x104
lea rcx, [rsp + 0x38]
call fcn.140007db4
mov rbx, qword [rsp + 0x38]
cmp qword [rsi + 0x18], 0x10
jb 0x14006bf46
mov rsi, qword [rsi]
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x77]
mov r8, rsi
mov rdx, r15
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0x10
jb 0x14006bfa7
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006bfa2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006c124
call fcn.140133e68
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1401738c0
test eax, eax
js 0x14006c0cb
cmp eax, dword [rbx - 0xc]
jg 0x14006c0cb
mov dword [rbx - 0x10], eax
cdqe
mov byte [rax + rbx], 0
mov dword [rbp + 0x7f], 0
mov dword [rbp + 0x6f], 4
mov dword [rbp + 0x77], 4
mov edx, 0xe3
lea rcx, [rbp - 9]
call fcn.1400175a0
cmp qword [rax + 0x18], 0x10
jb 0x14006bffa
mov rax, qword [rax]
lea rdx, [rbp + 0x6f]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp + 0x7f]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x77]
mov r8, rax
mov rdx, r15
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov rdx, qword [rbp + 0xf]
cmp rdx, 0x10
jb 0x14006c05e
inc rdx
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006c059
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14006c12a
call fcn.140133e68
mov eax, dword [rbp + 0x7f]
mov dword [rsp + 0x20], eax
mov r9, rbx
mov r8, rdi
lea rdx, str._s__s__d
mov rcx, r13
call fcn.140008c60
nop
lea rdx, [rbx - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006c096
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
sub r12d, 1
jg 0x14006c0b4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, r13
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80070057
call fcn.14000c3ac
nop
mov ecx, 0x80070057
call fcn.14000c3ac
nop
call fcn.1401462a8
int3
mov ecx, 0x80004005
call fcn.14000c3ac
int3
mov ecx, 0x80004005
call fcn.14000c3ac
nop
mov ecx, 0x80070057
call fcn.14000c3ac
nop
call fcn.1401462a8
int3
mov ecx, 0x80004005
call fcn.14000c3ac
nop
mov ecx, 0x80070057
call fcn.14000c3ac
nop
call fcn.1401462a8
int3
call fcn.1401462a8
int3