Function at 0x10006bc70
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rax, qword [rsp + 0x2e8]
mov r15, qword [rsp + 0x2e0]
xor r14d, r14d
mov rbp, r9
mov r13d, r8d
mov rsi, rdx
mov qword [rsp + 0x50], rax
mov r12, rcx
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r14
cmp r9, r14
je 0x10006bccf
mov qword [r9], r14
lea rdx, [rsp + 0x48]
mov rcx, rsi
call fcn.1000b80c8
mov edi, eax
cmp eax, r14d
je 0x10006bcff
xor r9d, r9d
mov r8d, eax
mov edx, 0x39d0138
xor ecx, ecx
call fcn.1000b51b8
mov rbx, qword [rsp + 0x48]
jmp 0x10006be89
mov rbx, qword [rsp + 0x48]
mov r9d, dword [0x10011051c]
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rsi
xor r8d, r8d
repne scasw ax, word [rdi]
lea rax, [rsp + 0x40]
mov rdx, rbx
not rcx
mov qword [rsp + 0x20], rax
lea r14, [rcx - 1]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edi, edi
cmp eax, edi
je 0x10006bdcf
lea edx, [rdi + 0x5c]
mov rcx, rbx
mov qword [rsp + 0x40], rdi
call qword [sym.imp.msvcrt.dll_wcsrchr]
cmp rax, rdi
je 0x10006bdcf
mov r9d, dword [0x10011051c]
mov word [rax], di
sub rax, rbx
shr rax, 1
xor r8d, r8d
mov rdx, rbx
lea r14d, [rax + 1]
lea rax, [rsp + 0x40]
mov rcx, r12
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp eax, 2
jne 0x10006bdae
test r13d, r13d
je 0x10006bdb2
lea r8, [rsp + 0x40]
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov edi, eax
test eax, eax
je 0x10006bdcd
mov edx, 0x3bb0138
jmp 0x10006bdb7
test eax, eax
je 0x10006bdcd
mov edx, 0x3bd0138
mov r8d, eax
xor r9d, r9d
mov rcx, rbx
call fcn.1000b51b8
xor r14d, r14d
jmp 0x10006be89
xor edi, edi
mov rcx, qword [rsp + 0x40]
cmp rcx, rdi
je 0x10006be45
lea rsi, [rsi + r14*2]
xor r14d, r14d
cmp r14w, word [rsi]
je 0x10006be48
mov edi, r14d
mov r12d, reloc.certcli.dll_Ordinal_260
xor edx, edx
jmp 0x10006be0e
lea rcx, [rsp + 0x60]
mov rdx, rsi
call fcn.1000b5684
cmp eax, r14d
je 0x10006be3e
mov rcx, qword [rsp + 0x40]
inc edi
mov edx, edi
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x48], r12d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, r14d
je 0x10006bdf3
jmp 0x10006be48
lea rsi, [rsp + 0x60]
jmp 0x10006be48
xor r14d, r14d
mov rdx, qword [rsp + 0x50]
mov rcx, rsi
call fcn.1000b80c8
mov edi, eax
cmp eax, r14d
je 0x10006be70
xor r9d, r9d
mov r8d, eax
mov edx, 0x3dd0138
xor ecx, ecx
call fcn.1000b51b8
jmp 0x10006be89
cmp rbp, r14
je 0x10006be83
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x40], r14
mov qword [rbp], rax
mov qword [r15], rbx
mov rbx, r14
cmp rbx, r14
je 0x10006be97
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x40]
cmp rcx, r14
je 0x10006bea7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, edi
call fcn.1000b7bec
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1000ef870
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret