Function at 0x14006ac70
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
xor r13d, r13d
mov r14, rdx
mov r15, rcx
and dword [rax + 0x20], r13d
mov rcx, qword [str.P5_n_]
lea rdi, str.P5_n_
lea rsi, [0x140008e88]
cmp rcx, rdi
je 0x14006accd
test byte [rcx + 0x1c], 4
je 0x14006accd
cmp byte [rcx + 0x19], 5
jb 0x14006accd
mov rcx, qword [rcx + 0x10]
lea edx, [r13 + 0xa]
mov r8, rsi
call fcn.14000ffa8
lea rax, [rsp + 0x98]
lea r9, [rsp + 0x30]
lea rdx, [0x14000c8a0]
mov qword [rsp + 0x28], rax
and qword [rsp + 0x20], r13
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x14006ad2e
mov rcx, qword [str.P5_n_]
cmp rcx, rdi
je 0x14006aed1
test byte [rcx + 0x1c], 4
je 0x14006aed1
cmp byte [rcx + 0x19], 2
jb 0x14006aed1
mov edx, 0xb
mov r8, rsi
jmp 0x14006af53
cmp dword [rsp + 0x30], 3
je 0x14006ad68
mov rcx, qword [str.P5_n_]
cmp rcx, rdi
je 0x14006ad5e
test byte [rcx + 0x1c], 4
je 0x14006ad5e
cmp byte [rcx + 0x19], 2
jb 0x14006ad5e
mov rcx, qword [rcx + 0x10]
mov edx, 0xc
mov r8, rsi
call fcn.14000ffa8
mov ebx, 0x3f1
jmp 0x14006aed1
mov eax, dword [rsp + 0x98]
test eax, eax
je 0x14006aed1
mov rcx, rax
call fcn.140076a54
mov r13, rax
test rax, rax
jne 0x14006adc2
lea ebx, [rax + 8]
mov rcx, qword [str.P5_n_]
cmp rcx, rdi
je 0x14006aed1
test byte [rcx + 0x1c], 4
je 0x14006aed1
cmp byte [rcx + 0x19], 2
jb 0x14006aed1
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0xd]
mov r8, rsi
call fcn.14000ffa8
jmp 0x14006aed1
lea rax, [rsp + 0x98]
lea r9, [rsp + 0x30]
lea rdx, [0x14000c8a0]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rcx, r14
mov qword [rsp + 0x20], r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x14006ae20
mov rcx, qword [str.P5_n_]
cmp rcx, rdi
je 0x14006aed1
test byte [rcx + 0x1c], 4
je 0x14006aed1
cmp byte [rcx + 0x19], 2
jb 0x14006aed1
mov edx, 0xe
jmp 0x14006ad26
mov edi, dword [rsp + 0x98]
xor ebp, ebp
shr edi, 2
lea r12d, [rbp + 1]
test edi, edi
je 0x14006aed1
mov rsi, r13
lea r8, [0x1400a4068]
mov rax, qword [0x1400a4068]
mov edx, dword [rsi]
test rax, rax
jne 0x14006aefe
xor r12d, r12d
inc ebp
add rsi, 4
cmp ebp, edi
jb 0x14006ae42
test r12d, r12d
jne 0x14006aed1
mov rdx, r14
mov rcx, r15
call fcn.14006afe0
test eax, eax
je 0x14006aeac
mov rcx, qword [str.P5_n_]
lea rdx, str.P5_n_
cmp rcx, rdx
je 0x14006aeac
test byte [rcx + 0x1c], 4
je 0x14006aeac
cmp byte [rcx + 0x19], 2
jb 0x14006aeac
mov rcx, qword [rcx + 0x10]
lea edx, [r12 + 0x10]
lea r8, [0x140008e88]
mov r9d, eax
call fcn.1400100e0
mov rax, qword [rsp + 0x90]
mov r9d, 0x80007d42
mov qword [rsp + 0x20], rax
mov eax, 1
lea edx, [rax + 1]
mov r8d, eax
mov ecx, eax
call fcn.140077054
mov rcx, r13
call fcn.140076afc
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, rax
mov rax, qword [rax]
cmp dword [rcx + 0x18], edx
je 0x14006af05
cmp rax, r8
jne 0x14006aef3
xor ecx, ecx
test rcx, rcx
je 0x14006ae54
mov rcx, r15
call fcn.14006b348
mov ebx, eax
test eax, eax
jne 0x14006af28
lea r8, [0x1400a4068]
jmp 0x14006ae57
mov rcx, qword [str.P5_n_]
lea rdx, str.P5_n_
cmp rcx, rdx
je 0x14006aed1
test byte [rcx + 0x1c], 4
je 0x14006aed1
cmp byte [rcx + 0x19], 2
jb 0x14006aed1
mov edx, 0xf
lea r8, [0x140008e88]
mov rcx, qword [rcx + 0x10]
mov r9d, eax
call fcn.1400100e0
jmp 0x14006aed1