Function at 0x14006d6f4
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xe8
mov rax, r8
mov r15, rdx
mov rsi, rcx
lea rdi, [rsp + 0xa0]
mov r8d, 0xb
mov rcx, rdi
mov rdx, rax
call fcn.14006dc08
lea r9, [rsp + 0x3c]
and dword [r9], 0
lea r13, [rsp + 0x38]
and dword [r13], 0
mov rdi, qword [rdi]
mov qword [rsp + 0x28], r13
and qword [rsp + 0x20], 0
mov rcx, r15
mov rdx, rdi
xor r8d, r8d
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x14006d79d
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
and qword [rsi + 8], 0
mov dword [rsi + 0x10], ecx
mov dword [rsi], 6
mov rdx, qword [rsp + 0xa8]
mov rcx, rdi
call fcn.140072ed7
nop
add rsp, 0xe8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [rsp + 0x3c]
dec eax
cmp eax, 0xa
ja case.0x14006d7ba.5
lea rcx, [0x14008d930]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov r12d, dword [rsp + 0x38]
shr r12d, 1
mov rcx, r12
mov dl, 1
call fcn.140072a9a
mov r14, rax
mov rbx, rdx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
mov rcx, r15
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x14006d978
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
and qword [rsi + 8], 0
mov dword [rsi + 0x10], ecx
mov dword [rsi], 6
jmp 0x14006d9dd
mov r12d, dword [rsp + 0x38]
mov rcx, r12
mov dl, 1
call fcn.14000b1d8
mov r14, rax
mov rbx, rdx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
mov rcx, r15
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x14006d9e8
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
and qword [rsi + 8], 0
mov dword [rsi + 0x10], ecx
mov dword [rsi], 6
mov rcx, r14
mov rdx, rbx
call fcn.14000b1af
jmp 0x14006d778
cmp dword [rsp + 0x38], 4
jne case.0x14006d7ba.5
lea rax, [rsp + 0x40]
and dword [rax], 0
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
mov rcx, r15
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x14006d75c
mov eax, dword [rsp + 0x40]
and dword [rsi], 0
mov dword [rsi + 4], eax
jmp 0x14006d778
mov r12d, dword [rsp + 0x38]
shr r12d, 1
mov rcx, r12
mov dl, 1
call fcn.140072a9a
mov rbx, rax
mov r14, rdx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
mov rcx, r15
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
je 0x14006d9ff
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
and qword [rsi + 8], 0
mov dword [rsi + 0x10], ecx
mov dword [rsi], 6
mov rcx, rbx
jmp 0x14006dbc2
cmp dword [rsp + 0x38], 8
jne case.0x14006d7ba.5
lea rax, [rsp + 0x40]
and qword [rax], 0
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
mov rcx, r15
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
jne 0x14006d75c
mov rax, qword [rsp + 0x40]
mov dword [rsi], 1
mov qword [rsi + 8], rax
jmp 0x14006d778
and qword [rsi + 8], 0
mov dword [rsi + 0x10], 0x8007000d
jmp 0x14006d772
mov rcx, r14
mov rdx, r12
call fcn.140087493
lea rcx, [rax + rdx*2]
lea r15, [rsp + 0x40]
mov qword [r15], rax
mov qword [r15 + 8], rcx
and word [r15 + 0x10], 0
lea r12, [rsp + 0x88]
mov rcx, r12
mov rdx, r15
call fcn.14000b6c7
movups xmm0, xmmword [r12]
movups xmmword [r15 + 4], xmm0
mov rax, qword [r12 + 0x10]
mov qword [r15 + 0x14], rax
mov dword [rsi], 2
movups xmm0, xmmword [r15]
mov rax, qword [r15 + 0xc]
mov rcx, qword [r15 + 0x14]
movups xmmword [rsi + 4], xmm0
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rcx
mov rcx, r14
mov rdx, rbx
jmp 0x14006dbc5
mov dword [rsi], 3
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], r12
jmp 0x14006d778
mov rcx, rbx
mov rdx, r12
call fcn.140087493
lea r8, [rsp + 0xb8]
mov qword [r8], rax
mov qword [r8 + 8], rdx
mov byte [r8 + 0x10], 0
lea r15, [rsp + 0x40]
mov rcx, r15
mov rdx, r8
call fcn.14006c60f
cmp qword [r15], 0
mov qword [rsp + 0x68], rbx
je 0x14006dba0
mov qword [rsp + 0x60], r14
mov ecx, 8
mov edx, 0x60
call fcn.140036b27
test rax, rax
je 0x14006dbd8
mov r15, rax
lea rcx, [rsp + 0x40]
mov rax, qword [rcx + 0x10]
mov qword [r15 + 0x10], rax
movups xmm0, xmmword [rcx]
movups xmmword [r15], xmm0
mov rax, qword [rsp + 0xc8]
lea r12, [rsp + 0xd0]
mov qword [r12 + 0x10], rax
movups xmm0, xmmword [rsp + 0xb8]
movaps xmmword [r12], xmm0
mov ebx, 1
mov r13d, 4
mov r14d, 0x18
lea rdi, [rsp + 0x70]
mov rcx, rdi
mov rdx, r12
call fcn.14006c60f
cmp qword [rsp + 0x70], 0
je 0x14006db85
cmp rbx, r13
jne 0x14006db62
cmp byte [rsp + 0xe0], 1
mov ebp, 0
adc rbp, 1
add rbp, r13
jb 0x14006dbd8
lea rax, [r13*2]
cmp rax, rbp
cmova rbp, rax
cmp rbp, 5
jae 0x14006dafd
mov ebp, 4
xor edx, edx
movabs rax, 0x555555555555556
cmp rbp, rax
setb al
test r13, r13
je 0x14006db29
imul rcx, r13, 0x18
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x50], rcx
mov ecx, 8
jmp 0x14006db2b
xor ecx, ecx
imul r8, rbp, 0x18
mov dl, al
shl rdx, 3
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x88]
lea r9, [rsp + 0x40]
call fcn.14000afaf
cmp qword [rsp + 0x88], 0
jne 0x14006dbcf
mov r15, qword [rsp + 0x90]
mov r13, rbp
movups xmm0, xmmword [rsp + 0x70]
mov rax, qword [rsp + 0x80]
mov qword [r15 + r14 + 0x10], rax
movups xmmword [r15 + r14], xmm0
inc rbx
add r14, 0x18
jmp 0x14006daa9
mov rdx, qword [rsp + 0x78]
xor ecx, ecx
call fcn.140082850
mov rdi, qword [rsp + 0xa0]
mov r14, qword [rsp + 0x60]
jmp 0x14006dbab
mov r15d, 8
xor ebx, ebx
xor r13d, r13d
mov dword [rsi], 4
mov qword [rsi + 8], r15
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], rbx
mov rcx, qword [rsp + 0x68]
mov rdx, r14
call fcn.140072ed7
jmp 0x14006d778
cmp qword [rsp + 0x90], 0
ud2