Function at 0x140004a40
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x290]
sub rsp, 0x390
mov rax, qword [0x1400a2318]
xor rax, rsp
mov qword [rbp + 0x280], rax
mov r13, r8
mov qword [rsp + 0x78], rdx
movsxd r12, ecx
xor edi, edi
mov qword [rbp - 0x80], rdi
lea r15d, [rdi + 1]
mov ebx, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x48], edi
lea r8, str.CVdsService::LoadAndInitializeProviders__
lea edx, [rdi + 0x5e]
lea rcx, [rbp - 0x78]
call qword [sym.imp.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::constructor_unsigned_long_int__char_const____ptr64____ptr64]
nop dword [rax + rax]
nop
imul rcx, r12, 0xc8
lea rax, str.Uknown
add rcx, rax
mov qword [rsp + 0x20], rcx
lea r9, str.SystemCurrentControlSetServices_vds
lea r8, str._s_s
lea edx, [rdi + 0x64]
lea rcx, [rbp + 0x1b0]
call fcn.140005bb0
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x2000000
xor r8d, r8d
lea rdx, [rbp + 0x1b0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x140004b5f
jg 0x140004b1e
mov ebx, eax
jmp 0x140004b2c
movzx ebx, ax
or ebx, 0x80070000
cmp eax, 2
je 0x140004b48
mov r9d, eax
lea r8, str.CVdsService::LoadAndInitializeProviders__1__error_ld
xor edx, edx
lea ecx, [rdx + 0x5e]
call qword [sym.imp.vdsutil.dll_VdsTraceEx]
nop dword [rax + rax]
nop
lea rcx, [rbp - 0x78]
call qword [sym.imp.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::destructor_void____ptr64]
nop dword [rax + rax]
mov eax, ebx
jmp 0x140005421
mov rax, qword [0x1400a34b0]
mov qword [rbp - 0x60], rax
xor r14d, r14d
mov dword [rsp + 0x4c], edi
mov rsi, qword [rbp - 0x80]
lea r8, str.CVdsService::GetNextProviderClsid__
mov edx, 0x5e
lea rcx, [rbp - 0x40]
call qword [sym.imp.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::constructor_unsigned_long_int__char_const____ptr64____ptr64]
nop dword [rax + rax]
nop
mov dword [rsp + 0x68], 0x40
mov qword [rsp + 0x70], r14
mov dword [rsp + 0x50], 0x80
lea rax, [rbp - 0x48]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x68]
lea r8, [rbp + 0xb0]
mov edx, edi
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
je 0x140004c0d
cmp eax, 0x103
je 0x140004d7e
mov r9d, eax
lea r8, str.CVdsService::GetNextProviderClsid:_1___ld
xor edx, edx
lea ecx, [rdx + 0x5e]
call qword [sym.imp.vdsutil.dll_VdsTraceEx]
nop dword [rax + rax]
jmp 0x140004d86
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CLSIDFromString]
nop dword [rax + rax]
mov r14d, eax
test eax, eax
jns 0x140004c57
mov r9d, eax
lea r8, str.CVdsService::GetNextProviderClsid:_2___lX
xor edx, edx
lea ecx, [rdx + 0x5e]
call qword [sym.imp.vdsutil.dll_VdsTraceEx]
nop dword [rax + rax]
mov ecx, 0xc200000c
xor esi, esi
mov eax, 0x2000007
jmp 0x140004d4d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x2000000
xor r8d, r8d
lea rdx, [rbp + 0xb0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
je 0x140004ca6
mov r9d, eax
lea r8, str.CVdsService::GetNextProviderClsid:_3___ld
xor edx, edx
lea ecx, [rdx + 0x5e]
call qword [sym.imp.vdsutil.dll_VdsTraceEx]
nop dword [rax + rax]
jmp 0x140004d7b
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x130]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Clsid
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
je 0x140004cfd
mov r9d, eax
lea r8, str.CVdsService::GetNextProviderClsid:_4___ld
xor edx, edx
lea ecx, [rdx + 0x5e]
call qword [sym.imp.vdsutil.dll_VdsTraceEx]
nop dword [rax + rax]
jmp 0x140004d7b
xor esi, esi
mov word [rbp + 0x1ae], si
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x130]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CLSIDFromString]
nop dword [rax + rax]
mov r14d, eax
test eax, eax
jns 0x140004db1
mov r9d, eax
lea r8, str.CVdsService::GetNextProviderClsid:_5___ld
xor edx, edx
lea ecx, [rsi + 0x5e]
call qword [sym.imp.vdsutil.dll_VdsTraceEx]
nop dword [rax + rax]
mov ecx, 0xc200000d
mov eax, 0x2000008
mov r11, rsi
lea r10, [rbp + 0xb0]
mov r9d, r14d
mov r8, rsi
mov rdx, rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], r10
mov dword [rsp + 0x20], eax
call fcn.140013198
movzx edi, r14w
test edi, edi
je 0x140004db1
xor r14d, r14d
cmp edi, 0x103
je 0x140004db1
mov qword [rsp + 0x30], r14
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2000009
mov r9d, edi
xor r8d, r8d
xor edx, edx
mov ecx, 0xc200000e
call fcn.140013198
mov rcx, qword [rsp + 0x70]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140004dcd
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
lea rcx, [rbp - 0x40]
call qword [sym.imp.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::destructor_void____ptr64]
nop dword [rax + rax]
test edi, edi
jne 0x14000538e
lea r8d, [rdi + 0x32]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x20]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_StringFromGUID2]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140004e28
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x140063988]
xor r14d, r14d
mov qword [rsp + 0x40], r14
jmp 0x140004e2b
xor r14d, r14d
lea r8, str.CVdsService::IsBuiltinProvider__
mov edx, 0x5e
lea rcx, [rbp - 0x58]
call qword [sym.imp.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::constructor_unsigned_long_int__char_const____ptr64____ptr64]
nop dword [rax + rax]
nop
mov ecx, r14d
movsxd rax, ecx
cmp rax, 0xc
jae 0x140004eeb
shl rax, 4
lea rdx, [0x1400a2340]
add rax, rdx
mov rdx, qword [rbp + 0x20]
sub rdx, qword [rax]
jne 0x140004e77
mov rdx, qword [rbp + 0x28]
sub rdx, qword [rax + 8]
test rdx, rdx
je 0x140004e80
inc ecx
jmp 0x140004e4b
lea rcx, [rbp - 0x58]
call qword [sym.imp.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::destructor_void____ptr64]
nop dword [rax + rax]
mov r14d, 1
mov dword [rsp + 0x48], r14d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [0x140064d58]
xor edx, edx
mov r8d, r14d
lea rcx, [rbp + 0x30]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x140004fa9
mov r9d, eax
lea r8, str.CVdsService::LoadAndInitializeProviders__2b__hr_lX
xor edx, edx
lea ecx, [rdx + 0x5e]
call qword [sym.imp.vdsutil.dll_VdsTraceEx]
nop dword [rax + rax]
xor r14d, r14d
jmp 0x140004f43
lea rcx, [rbp - 0x58]
call qword [sym.imp.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::destructor_void____ptr64]
nop dword [rax + rax]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [0x140064d58]
xor edx, edx
lea r8d, [rdx + 4]
lea rcx, [rbp + 0x30]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x140004fa4
mov r9d, eax
lea r8, str.CVdsService::LoadAndInitializeProviders__2c__hr_lX
xor edx, edx
lea ecx, [rdx + 0x5e]
call qword [sym.imp.vdsutil.dll_VdsTraceEx]
nop dword [rax + rax]
mov r9d, ebx
lea r8, str.CVdsService::LoadAndInitializeProviders__3__hr_lX
xor edx, edx
lea ecx, [rdx + 0x5e]
call qword [sym.imp.vdsutil.dll_VdsTraceEx]
nop dword [rax + rax]
mov qword [rsp + 0x30], r14
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x200000a
mov r9d, ebx
xor r8d, r8d
xor edx, edx
mov ecx, 0xc200000f
call fcn.140013198
lea rcx, [rbp + 0x20]
call fcn.140013554
test eax, eax
jne 0x1400053c5
mov r15d, r14d
mov ebx, 1
jmp 0x140005364
mov r14d, dword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
movabs r10, 0xdee01e7974d59970
lea r8, [rsp + 0x58]
lea rdx, [0x140064d40]
mov rax, qword [rax]
call qword [0x140063988]
mov ebx, eax
test eax, eax
jns 0x14000500f
mov r9d, eax
lea r8, str.CVdsService::LoadAndInitializeProviders__4__hr_lX
xor edx, edx
lea ecx, [rdx + 0x5e]
call qword [sym.imp.vdsutil.dll_VdsTraceEx]
nop dword [rax + rax]
xor r14d, r14d
mov qword [rsp + 0x30], r14
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x200000b
jmp 0x140004f74
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
movabs r10, 0x87c51e3358536270
mov r8, qword [rbp - 0x60]
lea rdx, [0x140064d50]
mov rax, qword [rax + 0x20]
call qword [0x140063988]
mov ebx, eax
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140005062
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x140063988]
xor esi, esi
mov qword [rsp + 0x58], rsi
jmp 0x140005064
xor esi, esi
test ebx, ebx
jns 0x1400050a1
mov r9d, ebx
lea r8, str.CVdsService::LoadAndInitializeProviders__5__hr_lX
xor edx, edx
lea ecx, [rdx + 0x5e]
call qword [sym.imp.vdsutil.dll_VdsTraceEx]
nop dword [rax + rax]
xor r14d, r14d
mov qword [rsp + 0x30], r14
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x200000c
jmp 0x140004f74
cmp r12d, 1
jne 0x14000523a
mov rcx, qword [rsp + 0x40]
mov rax, qword [rcx]
movabs r10, 0xdee01e7974d59970
lea r8, [rsp + 0x60]
lea rdx, [0x140065400]
mov rax, qword [rax]
call qword [0x140063988]
test eax, eax
jns 0x140005106
xor r14d, r14d
mov qword [rsp + 0x30], r14
lea rcx, [rbp + 0x40]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x200000d
mov r9d, eax
xor r8d, r8d
xor edx, edx
mov ecx, 0xc2000010
call fcn.140013198
jmp 0x140004f97
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
movabs r10, 0xc08d8e531853e870
lea rdx, [rbp - 0x20]
mov rax, qword [rax + 0x18]
call qword [0x140063988]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000514e
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x140063988]
mov qword [rsp + 0x60], rsi
test ebx, ebx
jns 0x14000518e
mov r9d, ebx
lea r8, str.CVdsService::LoadAndInitializeProviders__6__hr_lX
xor edx, edx
lea ecx, [rdx + 0x5e]
call qword [sym.imp.vdsutil.dll_VdsTraceEx]
nop dword [rax + rax]
xor r14d, r14d
mov qword [rsp + 0x30], r14
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x200000e
mov r9d, ebx
jmp 0x1400050f2
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400051a7
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov qword [rbp - 0x10], rsi
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x1400051c0
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoTaskMemFree]
nop dword [rax + rax]
mov qword [rbp + 8], rsi
mov eax, dword [rbp + 0x14]
mov ecx, dword [0x1400a34ac]
test eax, eax
jns 0x1400051d6
or ecx, 1
mov dword [0x1400a34ac], ecx
bt eax, 0x1e
jae 0x1400051e5
or ecx, 2
mov dword [0x1400a34ac], ecx
test al, 0x20
je 0x1400051f3
bts ecx, 8
mov dword [0x1400a34ac], ecx
test al, 0x40
je 0x140005201
bts ecx, 9
mov dword [0x1400a34ac], ecx
bt eax, 0x1d
jae 0x140005210
or ecx, 8
mov dword [0x1400a34ac], ecx
call qword [sym.imp.vdsutil.dll_IsRunningOnAMD64]
nop dword [rax + rax]
test eax, eax
jne 0x140005230
call qword [sym.imp.vdsutil.dll_IsClientSKU]
nop dword [rax + rax]
test eax, eax
jne 0x14000523a
or dword [0x1400a34ac], 0x400
test r13, r13
je 0x1400052b5
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
xor edx, edx
lea r8d, [rdx + 0x20]
call qword [sym.imp.vdsutil.dll_VdsHeapAlloc]
nop dword [rax + rax]
mov qword [r13], rax
test rax, rax
je 0x14000536f
xorps xmm0, xmm0
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
mov rcx, qword [r13]
mov rax, qword [rsp + 0x40]
mov qword [rcx], rax
mov rax, qword [r13]
mov rcx, qword [rax]
mov rax, qword [rcx]
movabs r10, 0xfd41b67356dad870
mov rax, qword [rax + 8]
call qword [0x140063988]
mov rax, qword [r13]
movaps xmm0, xmmword [rbp + 0x20]
movups xmmword [rax + 8], xmm0
mov r13, qword [r13]
add r13, 0x18
cmp r12d, 1
jne 0x1400052d5
mov rax, qword [rbp + 0x20]
sub rax, qword [0x1400a2420]
jne 0x140005311
mov rax, qword [rbp + 0x28]
sub rax, qword [0x1400a2428]
jmp 0x140005311
cmp r12d, 2
jne 0x14000532e
mov rax, qword [rbp + 0x20]
mov rcx, rax
mov rdx, qword [rbp + 0x28]
sub rcx, qword [0x1400a2410]
jne 0x1400052f9
mov rcx, rdx
sub rcx, qword [0x1400a2418]
test rcx, rcx
je 0x140005316
sub rax, qword [0x1400a2400]
jne 0x140005311
mov rax, rdx
sub rax, qword [0x1400a2408]
test rax, rax
jne 0x14000532e
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.vdsutil.dll_public:_int___cdecl_CRtlList::InsertTailPointer_void____ptr64____ptr64]
nop dword [rax + rax]
jmp 0x140005344
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.vdsutil.dll_public:_int___cdecl_CRtlList::InsertHeadPointer_void____ptr64____ptr64]
nop dword [rax + rax]
mov qword [rsp + 0x40], rsi
movaps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp - 0x30], xmm0
mov r8d, r14d
mov edx, r12d
lea rcx, [rbp - 0x30]
call fcn.14001219c
xor r14d, r14d
mov edi, dword [rsp + 0x4c]
inc edi
jmp 0x140004b6d
lea r8, str.CVdsService::InitializeThread:_ppVdsProviderNext_Alloc:_Out_of_memory.
xor edx, edx
lea ecx, [rdx + 0x5e]
call qword [sym.imp.vdsutil.dll_VdsTraceEx]
nop dword [rax + rax]
mov ebx, 0x8007000e
jmp 0x1400053c2
cmp edi, 0x103
je 0x1400053c2
test edi, edi
jg 0x14000539e
mov ebx, edi
jmp 0x1400053a7
movzx ebx, di
or ebx, 0x80070000
mov r9d, edi
lea r8, str.CVdsService::LoadAndInitializeProviders__2__error_ld
xor edx, edx
lea ecx, [rdx + 0x5e]
call qword [sym.imp.vdsutil.dll_VdsTraceEx]
nop dword [rax + rax]
xor r14d, r14d
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400053eb
mov rax, qword [rcx]
movabs r10, 0xbaac1f10365eb170
mov rax, qword [rax + 0x10]
call qword [0x140063988]
mov qword [rsp + 0x40], r14
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
test ebx, ebx
js 0x140004b48
lea rcx, [rbp - 0x78]
call qword [sym.imp.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::destructor_void____ptr64]
nop dword [rax + rax]
test r15d, r15d
je 0x14000541c
xor eax, eax
jmp 0x140005421
mov eax, 1
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.1400149c0
mov rbx, qword [rsp + 0x3e8]
add rsp, 0x390
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret