Function at 0x1400b6970
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r13
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140169c00]
xor bl, bl
xor r15d, r15d
mov r12d, dword [rax + 0x110]
mov rdi, r9
mov r13, r8
mov dword [rax + 0x110], 0x200
mov r10, rdx
mov rsi, rcx
mov qword [rbp - 0x30], r15
mov byte [rbp + 0x38], bl
test rdx, rdx
je 0x1400b6ce7
test r8, r8
je 0x1400b6ce7
lea r9, [rbp + 0x38]
lea edx, [r15 + 2]
xor r8d, r8d
mov rcx, r10
mov qword [rsp + 0xa0], r14
call fcn.140023b60
mov r14, rax
test rax, rax
je 0x1400b6ca5
mov rax, qword [0x140169c00]
xor r8d, r8d
mov rdx, r13
mov r9d, dword [rax + 0x110]
lea rax, [rbp - 0x30]
mov rcx, r14
or r9d, 0x20019
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400b6ca5
mov rcx, qword [rbp - 0x30]
lea r9, [rbp - 0x3c]
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b6ca5
mov eax, dword [rbp - 0x3c]
test eax, eax
je 0x1400b6ca3
cmp eax, 2
jbe 0x1400b6a78
cmp eax, 3
je 0x1400b6b87
cmp eax, 4
je 0x1400b6b3a
cmp eax, 7
jne 0x1400b6ca3
mov rcx, qword [rbp - 0x30]
lea rax, [rbp - 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], r15
mov dword [rbp - 0x40], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b6ca3
mov eax, dword [rbp - 0x40]
test eax, eax
je 0x1400b6ca3
shr eax, 1
mov rcx, rsi
lea edx, [rax + 2]
call fcn.14001ad10
test rax, rax
je 0x1400b6ca5
mov rbx, qword [rsi + 8]
mov rcx, qword [rbp - 0x30]
lea rax, [rbp - 0x40]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b6c9f
mov edx, dword [rbp - 0x40]
test edx, edx
je 0x1400b6c9f
shr edx, 1
lea eax, [rdx + 1]
mov word [rbx + rdx*2], r15w
mov word [rbx + rax*2], r15w
cmp dword [rbp - 0x3c], 7
mov eax, edx
jne 0x1400b6ca3
mov eax, 0xa
nop
cmp word [rbx], r15w
jne 0x1400b6b34
mov word [rbx], ax
cmp word [rbx + 2], r15w
je 0x1400b6ca3
add rbx, 2
jmp 0x1400b6b20
mov rcx, qword [rbp - 0x30]
lea rax, [rbp - 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x38]
xor r8d, r8d
mov rdx, rdi
mov dword [rbp - 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b6ca3
mov edx, dword [rbp - 0x38]
mov rcx, rsi
call fcn.14001b010
test rax, rax
je 0x1400b6ca5
jmp 0x1400b6ca3
mov rcx, qword [rbp - 0x30]
lea rax, [rbp - 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], r15
mov dword [rbp - 0x40], r15d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b6ca3
mov eax, dword [rbp - 0x40]
test eax, eax
je 0x1400b6ca3
lea edx, [rax + rax]
mov rcx, rsi
call fcn.14001ad10
test rax, rax
je 0x1400b6ca5
mov rsi, qword [rsi + 8]
lea rax, [rbp - 0x40]
xor r9d, r9d
mov word [rsi], r15w
mov ecx, dword [rbp - 0x40]
mov qword [rsp + 0x28], rax
lea ebx, [rcx + rcx]
xor r8d, r8d
mov rdx, rdi
add rbx, rbx
sub rbx, rcx
mov rcx, qword [rbp - 0x30]
add rbx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400b6ca3
mov rax, qword [0x140150440]
mov r9d, r15d
mov r8d, r15d
mov qword [rbp - 0x28], rax
mov rax, qword [0x140150448]
mov qword [rbp - 0x20], rax
mov rax, qword [0x140150450]
mov qword [rbp - 0x18], rax
mov rax, qword [0x140150458]
mov qword [rbp - 0x10], rax
movzx eax, word [0x140150460]
mov word [rbp - 8], ax
cmp dword [rbp - 0x40], r15d
jbe 0x1400b6c95
mov rdx, rsi
nop dword [rax]
movzx eax, byte [rbx]
inc r8d
add rdx, 4
mov ecx, eax
and eax, 0xf
add r9d, 2
movzx eax, word [rbp + rax*2 - 0x28]
shr rcx, 4
inc rbx
mov word [rdx - 2], ax
and ecx, 0xf
movzx eax, word [rbp + rcx*2 - 0x28]
mov word [rdx - 4], ax
cmp r8d, dword [rbp - 0x40]
jb 0x1400b6c60
movsxd rax, r9d
mov word [rsi + rax*2], r15w
jmp 0x1400b6ca3
mov word [rbx], r15w
mov bl, 1
cmp byte [rbp + 0x38], r15b
je 0x1400b6cb9
test r14, r14
je 0x1400b6cb9
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 0x30]
mov r14, qword [rsp + 0xa0]
test rcx, rcx
je 0x1400b6ce0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11, qword [0x140169c00]
mov dword [r11 + 0x110], r12d
jmp 0x1400b6cee
mov rax, qword [0x140169c00]
mov dword [rax + 0x110], r12d
lea r11, [rsp + 0x70]
movzx eax, bl
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rbp
ret