Function at 0x180001b60
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x1c0
lea rbp, [rsp + 0x60]
mov qword [rbp + 0x1a0], rbx
mov rax, qword [0x18003d928]
xor rax, rbp
mov qword [rbp + 0x150], rax
xor r13d, r13d
mov r12d, r8d
mov rbx, rdx
mov rdi, rcx
mov qword [rbp + 8], r13
test rdx, rdx
je 0x18000209f
mov eax, dword [0x18002f810]
cmp dword [rcx], eax
jne 0x180001bd4
mov eax, dword [0x18002f814]
cmp dword [rcx + 4], eax
jne 0x180001bd4
mov eax, dword [0x18002f818]
cmp dword [rcx + 8], eax
jne 0x180001bd4
mov eax, dword [0x18002f81c]
cmp dword [rcx + 0xc], eax
je 0x18000209f
xor edx, edx
lea rax, [rbp + 8]
lea r9, [0x18002c8a0]
lea r8d, [rdx + 1]
lea rcx, [0x18002f7e0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x180002090
cmp dword [rbx], r13d
je 0x180001c78
mov rcx, qword [rbx + 8]
lea r9, [rbp + 0x40]
mov r8d, 1
mov eax, dword [rcx]
mov rdx, rdi
mov dword [rbp + 0x40], eax
mov eax, dword [rcx + 4]
mov dword [rbp + 0x44], eax
mov eax, dword [rcx + 8]
mov dword [rbp + 0x48], eax
mov eax, dword [rcx + 0xc]
mov rcx, qword [rbp + 8]
mov dword [rbp + 0x4c], eax
mov rax, qword [rcx]
test r12d, r12d
je 0x180001c61
cmp dword [rbx], r8d
jne 0x180001c42
call qword [rax + 0x28]
jmp 0x180001c45
call qword [rax + 0x38]
mov esi, eax
test eax, eax
jns 0x180001c72
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x180001c5a
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, esi
jmp 0x1800020a1
cmp dword [rbx], 1
jne 0x180001c6f
call qword [rax + 0x30]
add rbx, 0x10
jmp 0x180001bff
call qword [rax + 0x40]
add rbx, 0x10
jmp 0x180001bff
test r12d, r12d
jne 0x180002090
lea r8d, [r12 + 0x40]
lea rdx, [rbp + 0xd0]
mov rcx, rdi
call qword [sym.imp.ole32.dll_StringFromGUID2]
lea rcx, [rbp + 0xd0]
mov rbx, r13
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 0xffffffff
inc eax
movsxd rdi, eax
mov eax, 0x80000000
add rdi, rdi
add rax, rdi
cmp rax, rcx
ja 0x180002090
cmp edi, 0x400
jg 0x180001d01
movsxd rsi, edi
mov rcx, rsi
call fcn.180001410
test al, al
je 0x180001d01
lea rax, [rsi + 0xf]
cmp rax, rsi
ja 0x180001cee
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1800193e0
sub rsp, rax
lea rcx, [rsp + 0x60]
jmp 0x180001d32
or rax, 0xffffffffffffffff
movsxd rcx, edi
sub rax, rcx
cmp rax, 0x10
jb 0x1800020c6
add rcx, 0x10
call fcn.180018ae4
test rax, rax
jne 0x180001d28
mov rcx, r13
jmp 0x180001d32
mov qword [rax], r13
mov rbx, rax
lea rcx, [rax + 0x10]
lea rdx, [rbp + 0xd0]
mov r9d, 3
mov r8d, edi
call fcn.180001060
mov r12, rax
test rax, rax
je 0x180002075
lea r8, str.CLSID_
lea rcx, [rbp + 0x50]
mov edx, 0x80
call fcn.180018ccc
test eax, eax
je 0x180001da1
cmp eax, 0xc
je 0x180001d96
cmp eax, 0x16
je 0x180001d8b
cmp eax, 0x22
je 0x180001d8b
cmp eax, 0x50
je 0x180001da1
mov ecx, 0x80004005
call fcn.1800010d0
int3
mov ecx, 0x80070057
call fcn.1800010d0
int3
mov ecx, 0x8007000e
call fcn.1800010d0
int3
lea rcx, [rbp + 0x50]
mov r8, r12
mov edx, 0x80
call fcn.180018e00
test eax, eax
je 0x180001deb
cmp eax, 0xc
je 0x180001de0
cmp eax, 0x16
je 0x180001dd5
cmp eax, 0x22
je 0x180001dd5
cmp eax, 0x50
je 0x180001deb
mov ecx, 0x80004005
call fcn.1800010d0
int3
mov ecx, 0x80070057
call fcn.1800010d0
int3
mov ecx, 0x8007000e
call fcn.1800010d0
int3
lea r8, str.Required_Categories
lea rcx, [rbp + 0x50]
mov edx, 0x80
call fcn.180018e00
test eax, eax
je 0x180001e39
cmp eax, 0xc
je 0x180001e2e
cmp eax, 0x16
je 0x180001e23
cmp eax, 0x22
je 0x180001e23
cmp eax, 0x50
je 0x180001e39
mov ecx, 0x80004005
call fcn.1800010d0
int3
mov ecx, 0x80070057
call fcn.1800010d0
int3
mov ecx, 0x8007000e
call fcn.1800010d0
int3
lea r8, [rbp + 0x50]
lea rcx, [rbp + 0x10]
mov r9d, 0x20019
mov rdx, 0xffffffff80000000
mov qword [rbp + 0x28], 0xffffffff80000000
mov dword [rbp + 0x30], r13d
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x10], r13
mov dword [rbp + 0x18], r13d
mov qword [rbp + 0x20], r13
mov dword [rbp], r13d
call fcn.1800012d0
test eax, eax
jne 0x180001ee9
mov rdi, qword [rbp + 0x10]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
lea rax, [rbp]
mov qword [rsp + 0x30], r13
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
movsxd rsi, eax
test rdi, rdi
je 0x180001ecd
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x10], r13
mov dword [rbp + 0x18], r13d
test rsi, rsi
jne 0x180001ee9
cmp dword [rbp], r13d
jne 0x180001ee9
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x28]
call fcn.180001220
lea r8, str.CLSID_
lea rcx, [rbp + 0x50]
mov edx, 0x80
call fcn.180018ccc
test eax, eax
je 0x180001f37
cmp eax, 0xc
je 0x180001f2c
cmp eax, 0x16
je 0x180001f21
cmp eax, 0x22
je 0x180001f21
cmp eax, 0x50
je 0x180001f37
mov ecx, 0x80004005
call fcn.1800010d0
int3
mov ecx, 0x80070057
call fcn.1800010d0
int3
mov ecx, 0x8007000e
call fcn.1800010d0
int3
lea rcx, [rbp + 0x50]
mov r8, r12
mov edx, 0x80
call fcn.180018e00
test eax, eax
je 0x180001f81
cmp eax, 0xc
je 0x180001f76
cmp eax, 0x16
je 0x180001f6b
cmp eax, 0x22
je 0x180001f6b
cmp eax, 0x50
je 0x180001f81
mov ecx, 0x80004005
call fcn.1800010d0
int3
mov ecx, 0x80070057
call fcn.1800010d0
int3
mov ecx, 0x8007000e
call fcn.1800010d0
int3
lea r8, str.Implemented_Categories
lea rcx, [rbp + 0x50]
mov edx, 0x80
call fcn.180018e00
test eax, eax
je 0x180001fcf
cmp eax, 0xc
je 0x180001fc4
cmp eax, 0x16
je 0x180001fb9
cmp eax, 0x22
je 0x180001fb9
cmp eax, 0x50
je 0x180001fcf
mov ecx, 0x80004005
call fcn.1800010d0
int3
mov ecx, 0x80070057
call fcn.1800010d0
int3
mov ecx, 0x8007000e
call fcn.1800010d0
int3
lea r8, [rbp + 0x50]
lea rcx, [rbp + 0x10]
mov r9d, 0x20019
mov rdx, 0xffffffff80000000
call fcn.1800012d0
mov rdi, qword [rbp + 0x10]
test eax, eax
jne 0x18000205a
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
lea rax, [rbp]
mov qword [rsp + 0x30], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
movsxd rsi, eax
test rdi, rdi
je 0x180002042
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r13
test rsi, rsi
jne 0x18000205a
cmp dword [rbp], r13d
jne 0x18000205a
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x28]
call fcn.180001220
test rdi, rdi
je 0x180002068
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x180002090
nop word [rax + rax]
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.180018b9c
test rbx, rbx
jne 0x180002080
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x18000209f
mov rax, qword [rcx]
call qword [rax + 0x10]
xor eax, eax
mov rcx, qword [rbp + 0x150]
xor rcx, rbp
call fcn.1800193b0
mov rbx, qword [rbp + 0x1a0]
lea rsp, [rbp + 0x160]
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070216
call fcn.1800010d0
int3