Function at 0x140002e60
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x1c0
lea rbp, [rsp + 0x60]
mov qword [rbp + 0x1a0], rbx
mov rax, qword [0x14007a8d0]
xor rax, rbp
mov qword [rbp + 0x150], rax
xor esi, esi
mov rdi, rcx
mov r14d, r8d
mov ecx, esi
mov rbx, rdx
mov qword [rbp + 8], rcx
test rdx, rdx
je 0x14000330e
mov eax, dword [0x1400636e0]
cmp dword [rdi], eax
jne 0x140002ed5
mov eax, dword [0x1400636e4]
cmp dword [rdi + 4], eax
jne 0x140002ed5
mov eax, dword [0x1400636e8]
cmp dword [rdi + 8], eax
jne 0x140002ed5
mov eax, dword [0x1400636ec]
cmp dword [rdi + 0xc], eax
je 0x14000330e
xor edx, edx
lea rax, [rbp + 8]
lea r9, [0x140056130]
lea r8d, [rdx + 1]
lea rcx, [0x140063740]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x14000330a
cmp dword [rbx], esi
je 0x140002f59
mov rax, qword [rbx + 8]
mov rcx, qword [rbp + 8]
lea r9, [rbp + 0x40]
mov r8d, 1
mov rdx, rdi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
mov rax, qword [rcx]
test r14d, r14d
je 0x140002f42
cmp dword [rbx], r8d
jne 0x140002f32
call qword [rax + 0x28]
jmp 0x140002f35
call qword [rax + 0x38]
test eax, eax
jns 0x140002f53
mov rcx, qword [rbp + 8]
jmp 0x140003310
cmp dword [rbx], 1
jne 0x140002f50
call qword [rax + 0x30]
add rbx, 0x10
jmp 0x140002f00
call qword [rax + 0x40]
add rbx, 0x10
jmp 0x140002f00
test r14d, r14d
jne 0x140003304
lea r8d, [r14 + 0x40]
lea rdx, [rbp + 0xd0]
mov rcx, rdi
call qword [sym.imp.ole32.dll_StringFromGUID2]
or r14, 0xffffffffffffffff
mov rbx, rsi
mov rax, r14
lea rcx, [rbp + 0xd0]
inc rax
cmp word [rcx + rax*2], bx
jne 0x140002f87
inc eax
mov ecx, 0xffffffff
movsxd rdi, eax
mov eax, 0x80000000
add rdi, rdi
add rax, rdi
cmp rax, rcx
ja 0x140003304
cmp edi, 0x400
jg 0x140002feb
movsxd r15, edi
mov rcx, r15
call fcn.1400080c0
test al, al
je 0x140002feb
lea rax, [r15 + 0xf]
cmp rax, r15
ja 0x140002fd8
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.14003ee70
sub rsp, rax
lea rcx, [rsp + 0x60]
jmp 0x140003018
movsxd rcx, edi
sub r14, rcx
cmp r14, 0x10
jb 0x14000340a
add rcx, 0x10
call fcn.14003d1c4
test rax, rax
jne 0x14000300e
mov rcx, rsi
jmp 0x140003018
mov qword [rax], rsi
mov rbx, rax
lea rcx, [rax + 0x10]
lea rdx, [rbp + 0xd0]
mov r9d, 3
mov r8d, edi
call fcn.140003720
mov r15, rax
test rax, rax
je 0x1400032ef
lea r8, [0x140056140]
lea rcx, [rbp + 0x50]
mov edx, 0x80
call fcn.14003d4e8
test eax, eax
je 0x140003076
cmp eax, 0xc
je 0x14000335a
cmp eax, 0x16
je 0x14000334f
cmp eax, 0x22
je 0x14000334f
cmp eax, 0x50
jne 0x140003344
lea rcx, [rbp + 0x50]
mov r8, r15
mov edx, 0x80
call fcn.14003d54c
test eax, eax
je 0x1400030af
cmp eax, 0xc
je 0x14000337b
cmp eax, 0x16
je 0x140003370
cmp eax, 0x22
je 0x140003370
cmp eax, 0x50
jne 0x140003365
lea r8, str.Required_Categories
lea rcx, [rbp + 0x50]
mov edx, 0x80
call fcn.14003d54c
test eax, eax
je 0x1400030ec
cmp eax, 0xc
je 0x14000339c
cmp eax, 0x16
je 0x140003391
cmp eax, 0x22
je 0x140003391
cmp eax, 0x50
jne 0x140003386
lea r8, [rbp + 0x50]
lea rcx, [rbp + 0x10]
mov r9d, 0x20019
mov rdx, 0xffffffff80000000
mov qword [rbp + 0x28], 0xffffffff80000000
mov dword [rbp + 0x30], esi
mov qword [rbp + 0x38], rsi
mov qword [rbp + 0x10], rsi
mov dword [rbp + 0x18], esi
mov qword [rbp + 0x20], rsi
mov dword [rbp], esi
call fcn.140005000
test eax, eax
jne 0x140003197
mov rdi, qword [rbp + 0x10]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
lea rax, [rbp]
mov qword [rsp + 0x30], rsi
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
movsxd r14, eax
test rdi, rdi
je 0x14000317d
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x10], rsi
mov dword [rbp + 0x18], esi
test r14, r14
jne 0x140003197
cmp dword [rbp], esi
jne 0x140003197
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x28]
call fcn.140003e30
lea r8, [0x140056140]
lea rcx, [rbp + 0x50]
mov edx, 0x80
call fcn.14003d4e8
test eax, eax
je 0x1400031d4
cmp eax, 0xc
je 0x1400033bd
cmp eax, 0x16
je 0x1400033b2
cmp eax, 0x22
je 0x1400033b2
cmp eax, 0x50
jne 0x1400033a7
lea rcx, [rbp + 0x50]
mov r8, r15
mov edx, 0x80
call fcn.14003d54c
test eax, eax
je 0x14000320d
cmp eax, 0xc
je 0x1400033de
cmp eax, 0x16
je 0x1400033d3
cmp eax, 0x22
je 0x1400033d3
cmp eax, 0x50
jne 0x1400033c8
lea r8, str.Implemented_Categories
lea rcx, [rbp + 0x50]
mov edx, 0x80
call fcn.14003d54c
test eax, eax
je 0x14000324a
cmp eax, 0xc
je 0x1400033ff
cmp eax, 0x16
je 0x1400033f4
cmp eax, 0x22
je 0x1400033f4
cmp eax, 0x50
jne 0x1400033e9
lea r8, [rbp + 0x50]
lea rcx, [rbp + 0x10]
mov r9d, 0x20019
mov rdx, 0xffffffff80000000
call fcn.140005000
mov rdi, qword [rbp + 0x10]
test eax, eax
jne 0x1400032d4
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
lea rax, [rbp]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
movsxd r14, eax
test rdi, rdi
je 0x1400032bd
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, rsi
test r14, r14
jne 0x1400032d4
cmp dword [rbp], esi
jne 0x1400032d4
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x28]
call fcn.140003e30
test rdi, rdi
je 0x1400032e2
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x140003304
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.14003d184
test rbx, rbx
jne 0x1400032f4
mov rcx, qword [rbp + 8]
jmp 0x140003312
mov rcx, qword [rbp + 8]
mov eax, esi
mov esi, eax
test rcx, rcx
je 0x14000331d
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov eax, esi
mov rcx, qword [rbp + 0x150]
xor rcx, rbp
call fcn.14003eed0
mov rbx, qword [rbp + 0x1a0]
lea rsp, [rbp + 0x160]
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140003630
int3
mov ecx, 0x80070057
call fcn.140003630
int3
mov ecx, 0x8007000e
call fcn.140003630
int3
mov ecx, 0x80004005
call fcn.140003630
int3
mov ecx, 0x80070057
call fcn.140003630
int3
mov ecx, 0x8007000e
call fcn.140003630
int3
mov ecx, 0x80004005
call fcn.140003630
int3
mov ecx, 0x80070057
call fcn.140003630
int3
mov ecx, 0x8007000e
call fcn.140003630
int3
mov ecx, 0x80004005
call fcn.140003630
int3
mov ecx, 0x80070057
call fcn.140003630
int3
mov ecx, 0x8007000e
call fcn.140003630
int3
mov ecx, 0x80004005
call fcn.140003630
int3
mov ecx, 0x80070057
call fcn.140003630
int3
mov ecx, 0x8007000e
call fcn.140003630
int3
mov ecx, 0x80004005
call fcn.140003630
int3
mov ecx, 0x80070057
call fcn.140003630
int3
mov ecx, 0x8007000e
call fcn.140003630
int3
mov ecx, 0x80070216
call fcn.140003630
int3