Function at 0x140060e80
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rbp, r9
mov r12, r8
mov r8, rdx
xor r13d, r13d
mov qword [rax - 0x40], r13
mov dword [rax - 0x38], r13d
mov qword [rax - 0x30], r13
mov rdx, qword [rcx]
mov r9d, 0x20019
mov r8, qword [r8]
mov rdx, qword [rdx]
lea rcx, [rax - 0x40]
call fcn.14001c640
mov ecx, r13d
test eax, eax
sete cl
test ecx, ecx
jne 0x140060ef7
mov dword [rsp + 0x80], 0x80004005
lea rdx, [0x140176950]
lea rcx, [rsp + 0x80]
call fcn.1400de560
int3
mov dword [rsp + 0x80], r13d
mov edi, r13d
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x88]
xor r8d, r8d
mov rdx, qword [r12]
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, eax
test eax, eax
jne 0x140060f5d
mov eax, dword [rsp + 0x88]
cmp eax, 1
je 0x140060f51
cmp eax, 2
je 0x140060f51
mov r11d, reloc.WS2_32.dll_listen
jmp 0x140060f5d
mov edi, dword [rsp + 0x80]
shr edi, 1
mov r11d, r13d
mov eax, r13d
test r11d, r11d
sete al
test eax, eax
jne 0x140060f89
test rbx, rbx
je 0x140060f7d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x40], r13d
xor al, al
jmp 0x1400610cc
test edi, edi
jns 0x140060f98
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov rax, qword [rbp]
mov ecx, 1
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edi
or eax, ecx
jge 0x140060fb7
mov edx, edi
mov rcx, rbp
call fcn.1400020c0
mov rsi, qword [rbp]
cmp edi, dword [rsi - 0xc]
jg 0x1400610c1
mov dword [rsi - 0x10], edi
movsxd rcx, edi
mov rax, qword [rbp]
mov word [rax + rcx*2], r13w
lea eax, [rdi + rdi]
mov dword [rsp + 0x80], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x88]
xor r8d, r8d
mov rdx, qword [r12]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r11d, eax
test eax, eax
jne 0x140061055
mov eax, dword [rsp + 0x88]
cmp eax, 1
je 0x140061027
cmp eax, 2
je 0x140061027
mov r11d, reloc.WS2_32.dll_listen
jmp 0x140061055
test rsi, rsi
je 0x140061052
mov eax, dword [rsp + 0x80]
test eax, eax
je 0x14006104e
test al, 1
jne 0x140061046
shr rax, 1
cmp word [rsi + rax*2 - 2], 0
je 0x140061052
mov r11d, reloc.WS2_32.dll_listen
jmp 0x140061055
mov word [rsi], r13w
mov r11d, r13d
mov eax, r13d
test r11d, r11d
sete al
test eax, eax
jne 0x140061067
jmp 0x140060f6a
mov rcx, qword [rbp]
test rcx, rcx
jne 0x140061075
mov eax, r13d
jmp 0x140061082
movsxd rdx, dword [rcx - 0xc]
call fcn.1400d4f10
test eax, eax
js 0x1400610b6
mov rcx, qword [rbp]
cmp eax, dword [rcx - 0xc]
jg 0x1400610b6
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbp]
mov word [rax + rcx*2], r13w
test rbx, rbx
je 0x1400610ad
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x40], r13d
mov al, 1
jmp 0x1400610cc
mov ecx, 0x80070057
call fcn.1400022b0
int3
mov ecx, 0x80070057
call fcn.1400022b0
nop
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret