Function at 0x1400293e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x1400922d0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, rdx
mov rbx, rcx
mov r12d, 1
mov dword [rbp - 0x18], r12d
call fcn.140002950
mov rcx, rax
xor r15d, r15d
test rax, rax
je 0x140029917
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x50], rax
mov dword [rbp - 0x30], 0x104
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x20], r15
call fcn.140002950
mov rcx, rax
test rax, rax
je 0x140029931
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x40], rax
lea rdx, [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.ole32.dll_StringFromCLSID]
mov esi, eax
test eax, eax
js 0x14002987e
lea r8, str.CLSID_
lea rdx, [0x140093358]
lea rcx, [rbp - 0x38]
call fcn.14001ba30
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.1400068a0
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, r12d
jg 0x1400294c3
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rbp - 0x20]
test rdx, rdx
jne 0x1400294d1
mov eax, r15d
jmp 0x1400294df
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], r15w
jne 0x1400294d5
mov r8d, eax
lea rcx, [rbp - 0x40]
call fcn.140008ba0
mov esi, 0x80004005
mov edi, esi
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp - 0x40]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r13d, eax
test eax, eax
jne 0x1400295fe
mov edx, dword [rbp - 0x30]
test edx, edx
js 0x14002993f
mov rbx, qword [rbp - 0x50]
mov ecx, r12d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x140029551
lfence
mov edx, dword [rbp - 0x30]
lea rcx, [rbp - 0x50]
call fcn.140002d40
mov rbx, qword [rbp - 0x50]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x18]
xor r8d, r8d
lea rdx, str.ThreadingModel
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r15d, eax
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcsnlen
xor ecx, ecx
test eax, eax
js 0x14002993f
cmp eax, dword [rbx - 0xc]
jg 0x14002993f
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], cx
test r15d, r15d
jne 0x1400295c6
xor edx, edx
lea rcx, [rbp - 0x50]
call fcn.140008e40
mov rbx, qword [rbp - 0x50]
mov eax, dword [rbx - 0x10]
neg eax
sbb edi, edi
not edi
and edi, esi
xor r15d, r15d
jmp 0x1400295ee
or rax, 0xffffffffffffffff
xor r15d, r15d
lea rdx, [0x140067c00]
inc rax
cmp word [rdx + rax*2], r15w
jne 0x1400295d4
mov r8d, eax
lea rcx, [rbp - 0x50]
call fcn.140002c00
mov rbx, qword [rbp - 0x50]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x28], r15
jmp 0x140029602
mov rbx, qword [rbp - 0x50]
lea rcx, [rbp - 0x40]
call fcn.140002fb0
test edi, edi
jns 0x14002979a
call fcn.140002950
mov rcx, rax
test rax, rax
je 0x14002994a
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x48], rax
lea rdx, [0x14006ac60]
or rdi, 0xffffffffffffffff
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140029640
mov r8d, eax
lea rcx, [rbp - 0x48]
call fcn.140002c00
mov rdx, qword [rbp - 0x20]
test rdx, rdx
jne 0x140029664
mov eax, r15d
jmp 0x140029671
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140029667
mov r8d, eax
lea rcx, [rbp - 0x48]
call fcn.140008ba0
lea rdx, [0x14006d440]
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r15w
jne 0x140029687
mov r8d, eax
lea rcx, [rbp - 0x48]
call fcn.140008ba0
lea rdx, str.InProcServer32
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r15w
jne 0x1400296a7
mov r8d, eax
lea rcx, [rbp - 0x48]
call fcn.140008ba0
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdi, qword [rbp - 0x48]
mov rdx, rdi
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400297ee
mov edx, 0x104
mov dword [rbp - 0x30], edx
sub r12d, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, r12d
jge 0x140029715
lfence
lea rcx, [rbp - 0x50]
call fcn.140002d40
mov rbx, qword [rbp - 0x50]
mov rdi, qword [rbp - 0x48]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x18]
xor r8d, r8d
lea rdx, str.ThreadingModel
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r15d, eax
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcsnlen
xor ecx, ecx
test eax, eax
js 0x140029909
cmp eax, dword [rbx - 0xc]
jg 0x140029909
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], cx
test r15d, r15d
jne 0x1400297c5
xor edx, edx
lea rcx, [rbp - 0x50]
call fcn.140008e40
xor r15d, r15d
lea rdx, [rdi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140029796
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp - 0x50]
movups xmm0, xmmword [0x140067c30]
movdqu xmmword [r14], xmm0
lea rdx, str.Apartment
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x140029812
movups xmm0, xmmword [0x140072e30]
jmp 0x140029857
or rax, 0xffffffffffffffff
xor r15d, r15d
lea rcx, [0x140067c00]
inc rax
cmp word [rcx + rax*2], r15w
jne 0x1400297d3
mov r8d, eax
mov rdx, rcx
lea rcx, [rbp - 0x50]
call fcn.140002c00
jmp 0x140029779
test r13d, r13d
je 0x140029779
lea rdx, [rdi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002987e
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14002987e
lea rdx, str.Both
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x14002982e
movups xmm0, xmmword [0x140072e20]
jmp 0x140029857
lea rdx, str.Free
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x14002984a
movups xmm0, xmmword [0x140072e10]
jmp 0x140029857
cmp dword [rbx - 0x10], r15d
jne 0x14002985c
movups xmm0, xmmword [str.a0_r]
movdqu xmmword [r14], xmm0
mov rcx, qword [r14]
sub rcx, qword [0x140067c30]
jne 0x140029873
mov rcx, qword [r14 + 8]
sub rcx, qword [0x140067c38]
mov eax, r15d
test rcx, rcx
cmove eax, esi
mov esi, eax
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x14002988d
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14002989d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400298bf
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400298e0
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, esi
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140001020
mov rbx, qword [rsp + 0xd0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.1400327c0
nop
jmp 0x140029916
nop
mov ecx, 0x80004005
call fcn.1400327c0
nop
jmp 0x140029930
nop
mov ecx, 0x80004005
call fcn.1400327c0
nop
jmp 0x14002993e
nop
mov ecx, 0x80070057
call fcn.1400327c0
int3
mov ecx, esi
call fcn.1400327c0
int3