Function at 0x10006aae0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x2b0
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
xor ebx, ebx
mov qword [rsp + 0x20], rcx
lea r9, [0x100030c70]
lea rcx, [rsp + 0x170]
lea r8, [0x10002ee00]
mov edx, 0x95
mov esi, ebx
mov ebp, ebx
mov dword [rsp + 0x30], 1
mov qword [rsp + 0x38], rbx
call fcn.10003a080
cmp eax, ebx
jge 0x10006ab4a
xor eax, eax
jmp 0x10006ae45
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0x170]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x10006ae40
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x170]
lea rdx, [0x10002ee20]
xor r8d, r8d
mov dword [rsp + 0x34], 0x12c
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r14d, 0x20
cmp eax, ebx
jne 0x10006ac5d
cmp dword [rsp + 0x30], 1
jne 0x10006ac5d
lea rdi, [rsp + 0x170]
lea rax, [rsp + 0x40]
mov r8, rdi
mov edx, 0x95
sub r8, rax
lea rcx, [rsp + 0x40]
lea rax, [rdx + 0x7fffff69]
cmp rax, rbx
je 0x10006ac0c
movzx eax, word [r8 + rcx]
cmp ax, bx
je 0x10006ac0c
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x10006abe9
cmp rdx, rbx
jne 0x10006ac15
sub rcx, 2
mov word [rcx], bx
lea rcx, [rsp + 0x40]
mov edx, r14d
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, rbx
je 0x10006ac2e
mov word [rax], bx
lea rcx, [rsp + 0x40]
inc ebp
call fcn.1000732f4
cmp eax, ebx
je 0x10006ac40
inc esi
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcschr]
mov rdi, rax
cmp rax, rbx
je 0x10006ac5d
add rdi, 2
jmp 0x10006abd4
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x170]
lea rdx, [0x10002ee38]
xor r8d, r8d
mov dword [rsp + 0x34], 0x12c
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10006ad44
cmp dword [rsp + 0x30], 1
jne 0x10006ad44
lea rdi, [rsp + 0x170]
lea rax, [rsp + 0x40]
mov r8, rdi
mov edx, 0x95
sub r8, rax
lea rcx, [rsp + 0x40]
lea rax, [rdx + 0x7fffff69]
cmp rax, rbx
je 0x10006ace9
movzx eax, word [r8 + rcx]
cmp ax, bx
je 0x10006ace9
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x10006acc6
cmp rdx, rbx
jne 0x10006acf2
sub rcx, 2
mov word [rcx], bx
lea rcx, [rsp + 0x40]
mov edx, r14d
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, rbx
je 0x10006ad0b
mov word [rax], bx
lea rax, [rsp + 0x40]
inc ebp
cmp rax, rbx
je 0x10006ad27
lea rcx, [rsp + 0x40]
call fcn.100073aa4
cmp eax, ebx
je 0x10006ad27
inc esi
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcschr]
mov rdi, rax
cmp rax, rbx
je 0x10006ad44
add rdi, 2
jmp 0x10006acb1
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x170]
lea rdx, [0x10002ee48]
xor r8d, r8d
mov dword [rsp + 0x34], 0x12c
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10006ae28
cmp dword [rsp + 0x30], 1
jne 0x10006ae28
lea rdi, [rsp + 0x170]
lea rax, [rsp + 0x40]
mov r8, rdi
mov edx, 0x95
sub r8, rax
lea rcx, [rsp + 0x40]
lea rax, [rdx + 0x7fffff69]
cmp rax, rbx
je 0x10006add0
movzx eax, word [r8 + rcx]
cmp ax, bx
je 0x10006add0
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x10006adad
cmp rdx, rbx
jne 0x10006add9
sub rcx, 2
mov word [rcx], bx
lea rcx, [rsp + 0x40]
mov edx, r14d
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, rbx
je 0x10006adf2
mov word [rax], bx
lea rdx, [0x100030e00]
lea rcx, [rsp + 0x40]
inc ebp
call fcn.10007393c
cmp eax, ebx
je 0x10006ae0b
inc esi
mov edx, r14d
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcschr]
mov rdi, rax
cmp rax, rbx
je 0x10006ae28
add rdi, 2
jmp 0x10006ad98
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebp
je 0x10006ae40
cmp esi, ebx
seta bl
mov eax, ebx
jmp 0x10006ae45
mov eax, 2
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret