Function at 0x14006a460
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xd8
mov qword [rbp - 0x51], 0xfffffffffffffffe
mov r13, rcx
xor ebx, ebx
mov dword [rbp - 0x79], ebx
mov edx, 0xb2
lea rcx, [rbp - 0x71]
call fcn.1400160a0
mov r15, rax
cmp qword [rax + 0x18], 0x10
jb 0x14006a4a8
mov r15, qword [rax]
mov rax, qword [rbp - 0x59]
cmp rax, 0x10
jb 0x14006a4fe
inc rax
mov rcx, qword [rbp - 0x71]
cmp rax, 0x1000
jb 0x14006a4f9
test cl, 0x1f
je 0x14006a4cc
call fcn.140128ff4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14006a4db
call fcn.140128ff4
int3
sub rcx, rax
cmp rcx, 8
jae 0x14006a4ea
call fcn.140128ff4
int3
cmp rcx, 0x27
jbe 0x14006a4f6
call fcn.140128ff4
int3
mov rcx, rax
call fcn.1400eb7f4
mov qword [rbp - 0x59], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x61], rbx
mov byte [rbp - 0x71], bl
call fcn.14000b6b4
mov rcx, rax
test rax, rax
jne 0x14006a525
mov ecx, 0x80004005
call fcn.14000b9ec
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
add rax, 0x18
mov qword [r13], rax
mov r12d, 1
mov dword [rbp - 0x79], r12d
mov dword [rbp + 0x77], r12d
call fcn.14000b6b4
mov rcx, rax
test rax, rax
jne 0x14006a559
mov ecx, 0x80004005
call fcn.14000b9ec
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x30], rdi
lea rcx, [0x1403f4478]
mov rsi, rcx
shr rsi, 0x10
or r14, 0xffffffffffffffff
test rsi, rsi
jne 0x14006a5a2
movzx ebx, cx
xor edx, edx
mov ecx, ebx
call fcn.14000b0cc
test rax, rax
je 0x14006a5c3
mov r8d, ebx
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1400080f4
jmp 0x14006a5be
mov rax, r14
inc rax
cmp byte [rcx + rax], 0
jne 0x14006a5a5
mov r8d, eax
mov rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.140007a14
mov rdi, qword [rsp + 0x30]
mov dword [rbp + 0x6f], 0x104
mov edx, 0xfc
lea rcx, [rbp - 0x49]
call fcn.1400160a0
mov rbx, rax
mov edx, r12d
sub edx, dword [rdi - 8]
mov ecx, dword [rdi - 0xc]
sub ecx, 0x104
or ecx, edx
jge 0x14006a602
mov edx, 0x104
lea rcx, [rsp + 0x30]
call fcn.14000799c
mov rdi, qword [rsp + 0x30]
cmp qword [rbx + 0x18], 0x10
jb 0x14006a60c
mov rbx, qword [rbx]
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x77]
mov r8, rbx
mov rdx, r15
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
nop
mov rax, qword [rbp - 0x31]
cmp rax, 0x10
jb 0x14006a688
inc rax
mov rcx, qword [rbp - 0x49]
cmp rax, 0x1000
jb 0x14006a683
test cl, 0x1f
je 0x14006a656
call fcn.140128ff4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14006a665
call fcn.140128ff4
int3
sub rcx, rax
cmp rcx, 8
jae 0x14006a674
call fcn.140128ff4
int3
cmp rcx, 0x27
jbe 0x14006a680
call fcn.140128ff4
int3
mov rcx, rax
call fcn.1400eb7f4
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.140156670
test eax, eax
js 0x14006a917
cmp eax, dword [rdi - 0xc]
jg 0x14006a917
mov dword [rdi - 0x10], eax
cdqe
mov byte [rax + rdi], 0
call fcn.14000b6b4
mov rcx, rax
test rax, rax
jne 0x14006a6c6
mov ecx, 0x80004005
call fcn.14000b9ec
int3
mov rax, qword [rax]
call qword [rax + Ordinal_26]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x38], rbx
lea rdx, [0x1403f4478]
test rsi, rsi
jne 0x14006a704
movzx esi, dx
xor edx, edx
mov ecx, esi
call fcn.14000b0cc
test rax, rax
je 0x14006a722
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.1400080f4
jmp 0x14006a71d
mov rax, r14
inc rax
cmp byte [rdx + rax], 0
jne 0x14006a707
mov r8d, eax
lea rcx, [rsp + 0x38]
call fcn.140007a14
mov rbx, qword [rsp + 0x38]
mov edx, 0xfd
lea rcx, [rbp - 0x29]
call fcn.1400160a0
mov rsi, rax
sub r12d, dword [rbx - 8]
mov ecx, dword [rbx - 0xc]
sub ecx, 0x104
or ecx, r12d
jge 0x14006a759
mov edx, 0x104
lea rcx, [rsp + 0x38]
call fcn.14000799c
mov rbx, qword [rsp + 0x38]
cmp qword [rsi + 0x18], 0x10
jb 0x14006a763
mov rsi, qword [rsi]
lea rax, [rbp + 0x6f]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x77]
mov r8, rsi
mov rdx, r15
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
nop
mov rax, qword [rbp - 0x11]
cmp rax, 0x10
jb 0x14006a7df
inc rax
mov rcx, qword [rbp - 0x29]
cmp rax, 0x1000
jb 0x14006a7da
test cl, 0x1f
je 0x14006a7ad
call fcn.140128ff4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14006a7bc
call fcn.140128ff4
int3
sub rcx, rax
cmp rcx, 8
jae 0x14006a7cb
call fcn.140128ff4
int3
cmp rcx, 0x27
jbe 0x14006a7d7
call fcn.140128ff4
int3
mov rcx, rax
call fcn.1400eb7f4
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.140156670
test eax, eax
js 0x14006a90c
cmp eax, dword [rbx - 0xc]
jg 0x14006a90c
mov dword [rbx - 0x10], eax
cdqe
mov byte [rax + rbx], 0
mov dword [rbp + 0x7f], 0
mov dword [rbp + 0x6f], 4
mov dword [rbp + 0x77], 4
mov edx, VarUI2FromI4
lea rcx, [rbp - 9]
call fcn.1400160a0
cmp qword [rax + 0x18], 0x10
jb 0x14006a832
mov rax, qword [rax]
lea r8, [rbp + 0x6f]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x7f]
mov qword [rsp + 0x20], r8
lea r9, [rbp + 0x77]
mov r8, rax
mov rdx, r15
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov rax, qword [rbp + 0xf]
cmp rax, 0x10
jb 0x14006a8b1
inc rax
mov rcx, qword [rbp - 9]
cmp rax, 0x1000
jb 0x14006a8ac
test cl, 0x1f
je 0x14006a87f
call fcn.140128ff4
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x14006a88e
call fcn.140128ff4
int3
sub rcx, rax
cmp rcx, 8
jae 0x14006a89d
call fcn.140128ff4
int3
cmp rcx, 0x27
jbe 0x14006a8a9
call fcn.140128ff4
int3
mov rcx, rax
call fcn.1400eb7f4
mov eax, dword [rbp + 0x7f]
mov dword [rsp + 0x20], eax
mov r9, rbx
mov r8, rdi
lea rdx, str._s__s__d
mov rcx, r13
call fcn.140008754
nop
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006a8e9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x14006a907
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, r13
jmp 0x14006a922
mov ecx, 0x80070057
call fcn.14000b9ec
nop
mov ecx, 0x80070057
call fcn.14000b9ec
nop
add rsp, 0xd8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret