Function at 0x14005fff0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c8]
and al, 0x38
invalid
invalid
dec dword [rax - 0x7f]
in al, dx
enter 2, 0
mov dword [rbp + 0x210], 0x200
call fcn.14005fbc0
lea r12, [0x140223f40]
lea rdx, str.03000200_0400_0500_0006_000700080009
mov r14, 0xffffffffffffffff
mov rcx, r14
movzx eax, word [r12 + rcx*2 + 2]
cmp ax, word [rdx + rcx*2 + 2]
jne 0x140060059
add rcx, 2
cmp rcx, 0x25
je 0x1400600fa
movzx eax, word [r12 + rcx*2]
cmp ax, word [rdx + rcx*2]
je 0x140060033
lea rdx, str.12345678_1234_5678_90AB_CDDEEFAABBCC
mov rcx, r14
movzx eax, word [r12 + rcx*2 + 2]
cmp ax, word [rdx + rcx*2 + 2]
jne 0x140060089
add rcx, 2
cmp rcx, 0x25
je 0x1400600fa
movzx eax, word [r12 + rcx*2]
cmp ax, word [rdx + rcx*2]
je 0x140060063
lea rdx, str.00000000_0000_0000_0000_000000000000
mov rcx, r14
movzx eax, word [r12 + rcx*2 + 2]
cmp ax, word [rdx + rcx*2 + 2]
jne 0x1400600b5
add rcx, 2
cmp rcx, 0x25
je 0x1400600fa
movzx eax, word [r12 + rcx*2]
cmp ax, word [rdx + rcx*2]
je 0x140060093
lea rdx, str.FFFFFFFF_FFFF_FFFF_FFFF_FFFFFFFFFFFF
mov rcx, r14
nop
movzx eax, word [r12 + rcx*2 + 2]
cmp ax, word [rdx + rcx*2 + 2]
jne 0x1400600e2
add rcx, 2
cmp rcx, 0x25
je 0x1400600fa
movzx eax, word [r12 + rcx*2]
cmp ax, word [rdx + rcx*2]
je 0x1400600c0
mov rax, r14
inc rax
cmp word [r12 + rax*2], 0
jne 0x1400600e5
cmp rax, 0x24
je 0x1400603de
xor r13d, r13d
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], r13
lea r8d, [r13 + 0x2c]
lea rdx, str.UU1EUlU_UENaS2dhcG1xbWRyWkFwd25ybWVwX25mdw
lea rcx, [rbp - 0x70]
call fcn.140030750
nop
mov qword [rsp + 0x70], r13
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], r13
lea r8d, [r13 + 0x10]
lea rdx, str.S19hZmdsY0VzZ2I
lea rcx, [rsp + 0x70]
call fcn.140030750
nop
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], r13
lea r15, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae r15, qword [rbp - 0x70]
movabs rbx, 0x7ffffffffffffffe
mov rsi, qword [rbp - 0x60]
cmp rsi, rbx
ja 0x1400603f8
lea eax, [r13 + 0xa]
mov qword [rsp + 0x48], 7
cmp rsi, 8
jae 0x1400601a0
mov qword [rsp + 0x40], rsi
lea r8d, [r13 + 0x10]
mov rdx, r15
lea rcx, [rsp + 0x30]
call fcn.140185440
jmp 0x1400601e8
mov rdi, rsi
or rdi, 7
cmp rdi, rbx
jbe 0x1400601b1
mov rdi, rbx
jmp 0x1400601b8
cmp rdi, rax
cmovb rdi, rax
lea rdx, [rdi + 1]
lea rcx, [rsp + 0x30]
call fcn.140030fc0
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
lea r8, [rsi*2 + 2]
mov rdx, r15
mov rcx, rax
call fcn.140185440
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x228]
call fcn.14004bc20
lea rcx, [rbp + 0x220]
mov qword [rsp + 0x20], rcx
mov r9d, 0x101
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rdx, qword [rbp + 0x228]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006023f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], r13
lea rsi, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rsi, qword [rsp + 0x70]
mov rdi, qword [rbp - 0x80]
cmp rdi, rbx
ja 0x1400603fe
mov qword [rsp + 0x68], 7
cmp rdi, 8
jae 0x140060294
mov qword [rsp + 0x60], rdi
mov r8d, 0x10
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140185440
jmp 0x1400602e0
mov rax, rdi
or rax, 7
cmp rax, rbx
ja 0x1400602b0
mov rbx, rax
cmp rax, 0xa
mov eax, 0xa
cmovb rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rsp + 0x50]
call fcn.140030fc0
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rbx
lea r8, [rdi*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.140185440
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x50]
call fcn.14004bc20
lea rcx, [rbp + 0x210]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x40]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x218]
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [rbp + 0x220]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x14006033a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp + 0x220]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rbp - 0x40]
call fcn.140198498
mov r8, rax
lea rdx, str._wsX
mov rcx, r12
call qword [sym.imp.USER32.dll_wsprintfW]
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x1400603a2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006039c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140060404
call fcn.140183144
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x1400603de
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400603d9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400603f2
call fcn.140183144
add rsp, 0x2c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140189c24
nop
call fcn.140030df0
nop
call fcn.140030df0
nop
call fcn.140189c24
int3