Function at 0x14001c420
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rdi
push r12
push r13
push r14
sub rsp, 0x1b0
lea rbp, [rsp + 0x60]
mov qword [rbp + 0x190], rbx
mov qword [rbp + 0x198], rsi
mov rax, qword [0x1400389f0]
xor rax, rbp
mov qword [rbp + 0x140], rax
xor r13d, r13d
mov r12d, r8d
mov rbx, rdx
mov rdi, rcx
mov qword [rbp + 8], r13
cmp rdx, r13
je 0x14001c99e
mov eax, dword [0x1400312a8]
cmp dword [rcx], eax
jne 0x14001c49c
mov eax, dword [0x1400312ac]
cmp dword [rcx + 4], eax
jne 0x14001c49c
mov eax, dword [0x1400312b0]
cmp dword [rcx + 8], eax
jne 0x14001c49c
mov eax, dword [0x1400312b4]
cmp dword [rcx + 0xc], eax
je 0x14001c99e
lea rax, [rbp + 8]
mov r14d, 1
lea r9, [0x140030da0]
lea rcx, [0x1400312c8]
xor edx, edx
mov r8d, r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, r13d
jl 0x14001c98f
cmp dword [rbx], r13d
je 0x14001c532
mov rax, qword [rbx + 8]
mov rcx, qword [rbp + 8]
lea r9, [rbp + 0x30]
mov r8d, r14d
mov rdx, rdi
movdqu xmm0, xmmword [rax]
movdqu xmmword [rbp + 0x30], xmm0
mov rax, qword [rcx]
cmp r12d, r13d
je 0x14001c51f
cmp dword [rbx], r14d
jne 0x14001c4ff
call qword [rax + 0x28]
jmp 0x14001c502
call qword [rax + 0x38]
cmp eax, r13d
mov esi, eax
jge 0x14001c52c
mov rcx, qword [rbp + 8]
cmp rcx, r13
je 0x14001c518
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, esi
jmp 0x14001c9a0
cmp dword [rbx], r14d
jne 0x14001c529
call qword [rax + 0x30]
jmp 0x14001c52c
call qword [rax + 0x40]
add rbx, 0x10
jmp 0x14001c4cd
cmp r12d, r13d
jne 0x14001c98f
lea rdx, [rbp + 0xc0]
mov r8d, 0x40
mov rcx, rdi
call qword [sym.imp.ole32.dll_StringFromGUID2]
lea rcx, [rbp + 0xc0]
mov rbx, r13
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 0xffffffff
add eax, r14d
movsxd rsi, eax
mov eax, 0x80000000
add rsi, rsi
add rax, rsi
cmp rax, rcx
ja 0x14001c627
or r12, 0xffffffffffffffff
cmp esi, 0x400
jg 0x14001c5c2
movsxd rdi, esi
mov rcx, rdi
call fcn.14001b11c
cmp al, r13b
je 0x14001c5c2
lea rax, [rdi + 0xf]
cmp rax, rdi
ja 0x14001c5af
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.14002d580
sub rsp, rax
lea rdi, [rsp + 0x60]
jmp 0x14001c5ed
movsxd rcx, esi
mov rax, r12
sub rax, rcx
cmp rax, 0x10
jb 0x14001c9cd
add rcx, 0x10
call fcn.140020f74
cmp rax, r13
je 0x14001c627
mov qword [rax], r13
mov rbx, rax
lea rdi, [rax + 0x10]
cmp rdi, r13
je 0x14001c627
mov qword [rsp + 0x38], r13
xor edx, edx
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0xc0]
lea ecx, [rdx + 3]
mov r9d, r12d
mov dword [rsp + 0x28], esi
mov byte [rdi], r13b
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb rsi, rsi
and rsi, rdi
jmp 0x14001c62a
mov rsi, r13
cmp rsi, r13
je 0x14001c98a
mov edi, 0x80
lea r8, str.CLSID_
lea rcx, [rbp + 0x40]
mov rdx, rdi
call fcn.140021b18
lea r14d, [rdi - 0x74]
cmp eax, r13d
je 0x14001c689
cmp eax, r14d
je 0x14001c67e
cmp eax, 0x16
je 0x14001c673
cmp eax, 0x22
je 0x14001c673
cmp eax, 0x50
je 0x14001c689
mov ecx, 0x80004005
call fcn.14001a60c
int3
mov ecx, 0x80070057
call fcn.14001a60c
int3
mov ecx, 0x8007000e
call fcn.14001a60c
int3
lea rcx, [rbp + 0x40]
mov r8, rsi
mov rdx, rdi
call fcn.1400222e0
cmp eax, r13d
je 0x14001c6d2
cmp eax, r14d
je 0x14001c6c7
cmp eax, 0x16
je 0x14001c6bc
cmp eax, 0x22
je 0x14001c6bc
cmp eax, 0x50
je 0x14001c6d2
mov ecx, 0x80004005
call fcn.14001a60c
int3
mov ecx, 0x80070057
call fcn.14001a60c
int3
mov ecx, 0x8007000e
call fcn.14001a60c
int3
lea r8, str.Required_Categories
lea rcx, [rbp + 0x40]
mov rdx, rdi
call fcn.1400222e0
cmp eax, r13d
je 0x14001c71f
cmp eax, r14d
je 0x14001c714
cmp eax, 0x16
je 0x14001c709
cmp eax, 0x22
je 0x14001c709
cmp eax, 0x50
je 0x14001c71f
mov ecx, 0x80004005
call fcn.14001a60c
int3
mov ecx, 0x80070057
call fcn.14001a60c
int3
mov ecx, 0x8007000e
call fcn.14001a60c
int3
lea rax, [rbp + 0x18]
mov rcx, 0xffffffff80000000
lea rdx, [rbp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov dword [rbp + 0x28], r13d
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x20], rcx
mov rdi, r13
mov dword [rbp], r13d
mov qword [rbp + 0x18], r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, r13d
jne 0x14001c7c7
mov rdi, qword [rbp + 0x18]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
lea rax, [rbp]
mov qword [rsp + 0x30], r13
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
movsxd r12, eax
cmp rdi, r13
je 0x14001c7af
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r13
cmp r12, r13
jne 0x14001c7c7
cmp dword [rbp], r13d
jne 0x14001c7c7
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x20]
call fcn.14001a718
mov r12d, 0x80
lea r8, str.CLSID_
lea rcx, [rbp + 0x40]
mov rdx, r12
call fcn.140021b18
cmp eax, r13d
je 0x14001c81a
cmp eax, r14d
je 0x14001c80f
cmp eax, 0x16
je 0x14001c804
cmp eax, 0x22
je 0x14001c804
cmp eax, 0x50
je 0x14001c81a
mov ecx, 0x80004005
call fcn.14001a60c
int3
mov ecx, 0x80070057
call fcn.14001a60c
int3
mov ecx, 0x8007000e
call fcn.14001a60c
int3
lea rcx, [rbp + 0x40]
mov r8, rsi
mov rdx, r12
call fcn.1400222e0
cmp eax, r13d
je 0x14001c863
cmp eax, r14d
je 0x14001c858
cmp eax, 0x16
je 0x14001c84d
cmp eax, 0x22
je 0x14001c84d
cmp eax, 0x50
je 0x14001c863
mov ecx, 0x80004005
call fcn.14001a60c
int3
mov ecx, 0x80070057
call fcn.14001a60c
int3
mov ecx, 0x8007000e
call fcn.14001a60c
int3
lea r8, str.Implemented_Categories
lea rcx, [rbp + 0x40]
mov rdx, r12
call fcn.1400222e0
cmp eax, r13d
je 0x14001c8b0
cmp eax, r14d
je 0x14001c8a5
cmp eax, 0x16
je 0x14001c89a
cmp eax, 0x22
je 0x14001c89a
cmp eax, 0x50
je 0x14001c8b0
mov ecx, 0x80004005
call fcn.14001a60c
int3
mov ecx, 0x80070057
call fcn.14001a60c
int3
mov ecx, 0x8007000e
call fcn.14001a60c
int3
lea rax, [rbp + 0x10]
mov r12, 0xffffffff80000000
lea rdx, [rbp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x20], rax
mov qword [rbp + 0x10], r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, r13d
jne 0x14001c966
mov eax, r13d
cmp rdi, r13
je 0x14001c8f4
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rbp + 0x10]
cmp eax, r13d
jne 0x14001c966
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
lea rax, [rbp]
mov qword [rsp + 0x30], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
movsxd rsi, eax
cmp rdi, r13
je 0x14001c94e
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r13
cmp rsi, r13
jne 0x14001c966
cmp dword [rbp], r13d
jne 0x14001c966
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x20]
call fcn.14001a718
cmp rdi, r13
je 0x14001c974
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r12
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001c98a
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.140020f34
cmp rbx, r13
jne 0x14001c97f
mov rcx, qword [rbp + 8]
cmp rcx, r13
je 0x14001c99e
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
mov rcx, qword [rbp + 0x140]
xor rcx, rbp
call fcn.140020bd0
mov rbx, qword [rbp + 0x190]
mov rsi, qword [rbp + 0x198]
lea rsp, [rbp + 0x150]
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
mov ecx, 0x80070057
call fcn.14001a60c
int3