Function at 0x14006d910
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov byte [rsp + 0x18], r8b
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x268
mov qword [rsp + 0xe8], 0xfffffffffffffffe
mov rbx, rcx
xor esi, esi
mov dword [rsp + 0x2a8], esi
cmp byte [0x1400e3e01], sil
je 0x14006def6
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov edi, eax
test eax, eax
je 0x14006da30
lea rcx, [0x1400b59c8]
mov qword [rsp + 0x118], rcx
mov byte [rsp + 0x120], sil
mov byte [rsp + 0x220], sil
or rbx, 0xffffffffffffffff
mov r9d, ebx
lea r8, str.copyTo_query_
mov edx, 0x100
lea rcx, [rsp + 0x120]
call fcn.14001e6f0
lea r11, [0x1400b5a30]
mov qword [rsp + 0x118], r11
mov byte [rsp + 0x220], sil
mov r9d, ebx
lea r8, str.System
lea edx, [rsi + 0x20]
lea rcx, [rsp + 0x220]
call fcn.14001e6f0
mov edx, edi
lea rcx, [rsp + 0x118]
call fcn.140020200
lea rdx, [0x1400e07e8]
lea rcx, [rsp + 0x118]
call fcn.140073110
int3
mov eax, dword [rsp + 0x68]
add eax, 1
mov r8, 0xffffffffffffffff
je 0x14006da61
movsxd rcx, eax
mov eax, 2
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.1400725d0
mov rdi, rax
mov qword [rsp + 0x70], rax
jmp 0x14006da69
mov rdi, rsi
mov qword [rsp + 0x70], rsi
xor ecx, ecx
call fcn.140073030
mov qword [rsp + 0x110], rdi
movsxd rax, dword [rsp + 0x60]
test eax, eax
je 0x14006da93
mov rcx, rax
call fcn.1400725d0
mov rbp, rax
mov qword [rsp + 0x78], rax
jmp 0x14006da9b
mov rbp, rsi
mov qword [rsp + 0x78], rsi
xor ecx, ecx
call fcn.140073030
mov qword [rsp + 0xf0], rbp
mov eax, dword [rsp + 0x68]
add eax, 1
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x2a8], eax
lea rax, [rsp + 0x2a8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x64]
mov r8, rdi
xor edx, edx
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
cmp eax, 0x103
je 0x14006dcd0
test ebx, ebx
jne 0x14006dc3d
mov eax, dword [rsp + 0x2a8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbp
mov r9d, dword [rsp + 0x6c]
xor r8d, r8d
mov rdx, rdi
mov rax, qword [rsp + 0x298]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jne 0x14006dbaa
add esi, 1
mov eax, dword [rsp + 0x68]
add eax, 1
mov dword [rsp + 0x64], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x2a8], eax
lea rax, [rsp + 0x2a8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x64]
mov r8, rdi
mov edx, esi
mov rax, qword [rsp + 0x290]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov ebx, eax
cmp eax, 0x103
jne 0x14006db05
jmp 0x14006dcd0
lea rcx, [0x1400b59c8]
mov qword [rsp + 0x118], rcx
mov byte [rsp + 0x120], 0
mov byte [rsp + 0x220], 0
or r9d, 0xffffffff
lea r8, str.copyTo_set_
mov edx, 0x100
lea rcx, [rsp + 0x120]
call fcn.14001e6f0
lea r11, [0x1400b5a30]
mov qword [rsp + 0x118], r11
mov byte [rsp + 0x220], 0
or r9d, 0xffffffff
lea r8, str.System
lea edx, [r9 + 0x21]
lea rcx, [rsp + 0x220]
call fcn.14001e6f0
mov edx, ebx
lea rcx, [rsp + 0x118]
call fcn.140020200
lea rdx, [0x1400e07e8]
lea rcx, [rsp + 0x118]
call fcn.140073110
int3
lea rcx, [0x1400b59c8]
mov qword [rsp + 0x118], rcx
mov byte [rsp + 0x120], 0
mov byte [rsp + 0x220], 0
or r9d, 0xffffffff
lea r8, str.copyTo_enum_
mov edx, 0x100
lea rcx, [rsp + 0x120]
call fcn.14001e6f0
lea r11, [0x1400b5a30]
mov qword [rsp + 0x118], r11
mov byte [rsp + 0x220], 0
or r9d, 0xffffffff
lea r8, str.System
lea edx, [r9 + 0x21]
lea rcx, [rsp + 0x220]
call fcn.14001e6f0
mov edx, ebx
lea rcx, [rsp + 0x118]
call fcn.140020200
lea rdx, [0x1400e07e8]
lea rcx, [rsp + 0x118]
call fcn.140073110
int3
cmp byte [rsp + 0x2a0], 0
je 0x14006dee3
xor esi, esi
mov r8b, 1
xor edx, edx
mov rbx, qword [rsp + 0x290]
mov rcx, rbx
call fcn.14006ba90
test rax, rax
je 0x14006dee3
mov rdi, rax
mov rbp, qword [rsp + 0x298]
nop
nop
xor ecx, ecx
mov qword [rsp + 0x80], rcx
mov dword [rsp + 0x88], 0xf003f
mov qword [rsp + 0x90], rcx
movzx eax, byte [rbx + 0x18]
mov byte [rsp + 0x98], al
mov r9d, dword [rbx + 8]
and r9d, 0xfff2ffd9
or r9d, 0x20019
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov r8, rdi
mov rdx, qword [rbx]
lea rcx, [rsp + 0x80]
call fcn.14006c0d0
xor eax, eax
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0xa8], 0xf003f
mov qword [rsp + 0xb0], rax
mov byte [rsp + 0xb8], al
mov byte [rsp + 0x2a8], 1
lea rcx, [rsp + 0xc0]
call fcn.1400448e0
nop
mov dword [rsp + 0xf8], 0x18
xor ecx, ecx
mov dword [rsp + 0x108], ecx
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x100], rax
mov r9d, dword [rbp + 8]
or r9d, 0xf003f
lea rax, [rsp + 0x2a8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r8, rdi
mov rdx, qword [rbp]
lea rcx, [rsp + 0xa0]
call fcn.14006c0d0
nop
mov rcx, qword [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor edi, edi
mov qword [rsp + 0xe0], rdi
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rsp + 0xd8], rdi
mov rcx, qword [rsp + 0xd0]
call fcn.140073030
mov rcx, qword [rsp + 0xc8]
call fcn.140073030
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_LocalFree]
movzx r8d, byte [rsp + 0x2a0]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x80]
call fcn.14006d910
nop
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x14006de87
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0xa0], rdi
mov rcx, qword [rsp + 0xb0]
call fcn.140073030
nop
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x14006deb0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x80], rdi
mov rcx, qword [rsp + 0x90]
call fcn.140073030
add esi, 1
mov r8b, 1
mov edx, esi
mov rcx, rbx
call fcn.14006ba90
mov rdi, rax
test rax, rax
jne 0x14006dd10
mov rdi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rcx, rbp
call fcn.140073030
nop
mov rcx, rdi
call fcn.140073030
jmp 0x14006df20
mov r9d, 0x129
lea r8, str.....lib1oswinRegistry.cxx
lea rdx, str.writeAllowed
lea rcx, [rsp + 0x118]
call fcn.140022960
mov rcx, rax
call fcn.140022860
int3
add rsp, 0x268
pop rdi
pop rsi
pop rbp
pop rbx
ret