Function at 0x14006af0e
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xf8
add byte [rax], al
add byte [rcx + rcx*4 - 0x40], cl
mov rbx, rdx
mov rsi, rcx
mov esi, ecx
invalid
lea rdi, [rsp + 0xa8]
add byte [rax], al
add byte [rcx - 0x48], al
or eax, dword [rax]
add byte [rax], al
add byte [rax - 0x77], cl
stc
mov rdx, rax
call fcn.14006b3f1
lea r9, [rsp + 0x3c]
and dword [r9], 0
lea r13, [rsp + 0x38]
and dword [r13], 0
mov rdi, qword [rdi + 8]
mov qword [rsp + 0x28], r13
and qword [rsp + 0x20], 0
and byte [rax], al
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
xor eax, eax
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
je 0x14006afb9
movzx ecx, ax
or ecx, 0x80070000
add byte [rbp - 0x37b1f040], 0x48
and dword [rsi + 8], 0
invalid
mov dword [rsi + 0x10], ecx
mov dword [rsi], 6
mov rcx, qword [rsp + 0xa8]
mov rdx, rdi
call fcn.14007c366
nop
add rsp, 0xf8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop rbp
pop r14
pop r15
ret
mov eax, dword [rsp + 0x3c]
dec eax
cmp eax, 0xa
ja case.0x14006afd6.5
lea rcx, [0x1400f1924]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov edx, dword [rsp + 0x38]
shr edx, 1
lea r14, [rsp + 0x60]
mov rcx, r14
call fcn.140091678
mov r14, qword [r14 + 8]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
and al, 0x20
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
je 0x14006b1bd
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
enter 0xffffffffffff8348, 0x66
or byte [rax], al
mov dword [rsi + 0x10], ecx
mov dword [rsi], 6
jmp 0x14006b21f
mov r14d, dword [rsp + 0x38]
mov qword [rsp + 0x20], 1
add byte [rbp + rcx*4 + 0x7c], cl
lea edi, [rsp + 0x40]
mov r9d, 1
mov rcx, r15
mov rdx, r14
mov r8b, 1
mov r8b, 1
call fcn.140008050
cmc
iretd
stc
inc dword [rcx - 0x7d]
invalid
add dword [rdi], ecx
test byte [rdi + 3], bl
pop rdi
add eax, dword [rax]
invalid
mov r12, qword [rsp + 0x48]
mov r15, qword [rsp + 0x50]
mov qword [rsp + 0x28], r13
and al, 0x28
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
je 0x14006b272
movzx ecx, ax
or ecx, 0x80070000
add byte [rdi], al
add byte [rbp - 0x37b1f040], 0x48
enter 0xffffffffffff8348, 0x66
or byte [rax], al
mov dword [rsi + 0x10], ecx
mov dword [rsi], 6
invalid
invalid
add byte [rax], al
add byte [rcx + rcx*4 - 0x1f], cl
mov rcx, r12
mov rdx, r15
mov edx, edi
call fcn.140007f19
jmp 0x14006af94
cmp dword [rsp + 0x38], 8
jne case.0x14006afd6.5
lea rax, [rsp + 0x40]
and qword [rax], 0
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov rdx, rdi
mov edx, edi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
pop rcx
lahf
add al, byte [rax]
test eax, eax
jne 0x14006af78
invalid
invalid
invalid
invalid
invalid
mov rax, qword [rsp + 0x40]
mov dword [rsi], 1
mov qword [rsi + 8], rax
jmp 0x14006af94
cmp dword [rsp + 0x38], 4
jne case.0x14006afd6.5
lea rax, [rsp + 0x40]
and dword [rax], 0
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
jne 0x14006af78
invalid
mov eax, dword [rsp + 0x40]
and dword [rsi], 0
mov dword [rsi + 4], eax
jmp 0x14006af94
and qword [rsi + 8], 0
mov dword [rsi + 0x10], 0x8007000d
jmp 0x14006af8e
mov edx, dword [rsp + 0x38]
shr edx, 1
lea r14, [rsp + 0x90]
mov rcx, r14
call fcn.140091678
mov r14, qword [r14 + 8]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r14
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.advapi32.dll_RegQueryValueExW]
test eax, eax
je 0x14006b229
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
and qword [rsi + 8], 0
mov dword [rsi + 0x10], ecx
mov dword [rsi], 6
jmp 0x14006b3af
mov rdx, qword [rsp + 0x70]
mov rcx, r14
call fcn.1400916bf
lea rcx, [rax + rdx*2]
lea rbx, [rsp + 0x40]
mov qword [rbx], rax
mov qword [rbx + 8], rcx
and word [rbx + 0x10], 0
lea r15, [rsp + 0xc0]
mov rcx, r15
mov rdx, rbx
call fcn.140008936
movups xmm0, xmmword [r15]
movups xmmword [rbx + 4], xmm0
mov rax, qword [r15 + 0x10]
mov qword [rbx + 0x14], rax
mov dword [rsi], 2
movups xmm0, xmmword [rbx]
mov rax, qword [rbx + 0xc]
mov qword [rsi + 0x10], rax
mov rax, qword [rbx + 0x14]
mov qword [rsi + 0x18], rax
movups xmmword [rsi + 4], xmm0
mov rcx, qword [rsp + 0x60]
jmp 0x14006b3b7
mov rdx, qword [rsp + 0xa0]
mov rcx, r14
call fcn.1400916bf
lea r8, [rsp + 0xe0]
mov qword [r8], rax
mov qword [r8 + 8], rdx
mov byte [r8 + 0x10], 0
lea rbx, [rsp + 0x60]
mov rcx, rbx
mov rdx, r8
call fcn.14006979e
xor eax, eax
cmp rax, qword [rbx]
jno 0x14006b289
mov eax, 8
xor ebx, ebx
xor ecx, ecx
jmp 0x14006b39d
mov dword [rsi], 3
mov qword [rsi + 8], r12
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], r14
jmp 0x14006af94
movabs rdi, 0x8000000000000000
mov ebp, 0x18
mov ecx, 4
mov edx, 8
mov r8d, 0x18
call fcn.140001560
mov r13, rdx
mov rcx, qword [rsp + 0x70]
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], rcx
lea r14, [rsp + 0x78]
mov qword [r14], rax
mov qword [r14 + 8], rdx
mov qword [r14 + 0x10], 1
mov rax, qword [rsp + 0xf0]
lea r15, [rsp + 0xc0]
mov qword [r15 + 0x10], rax
movups xmm0, xmmword [rsp + 0xe0]
movaps xmmword [r15], xmm0
mov ebx, 1
lea r12, [rsp + 0x40]
mov rcx, r12
mov rdx, r15
call fcn.14006979e
cmp qword [rsp + 0x40], rdi
je 0x14006b373
cmp rbx, qword [rsp + 0x78]
je 0x14006b33e
movups xmm0, xmmword [rsp + 0x40]
mov rax, qword [rsp + 0x50]
mov qword [r13 + rbp + 0x10], rax
movups xmmword [r13 + rbp], xmm0
inc rbx
mov qword [rsp + 0x88], rbx
add rbp, 0x18
jmp 0x14006b2ff
movzx eax, byte [rsp + 0xd0]
mov r8d, 2
sub r8, rax
mov qword [rsp + 0x20], 0x18
mov r9d, 8
mov rcx, r14
mov rdx, rbx
call fcn.1400929b6
mov r13, qword [rsp + 0x80]
jmp 0x14006b318
mov rdx, qword [rsp + 0x48]
mov rcx, rdi
call fcn.140072de6
mov rcx, qword [rsp + 0x78]
mov rax, qword [rsp + 0x80]
mov r14, qword [rsp + 0x98]
mov rdi, qword [rsp + 0xb0]
mov dword [rsi], 4
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rbx
mov rcx, qword [rsp + 0x90]
mov rdx, r14
call fcn.14007c366
jmp 0x14006af94
ud2