Function at 0x1400602e8
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r14, rdx
mov rbx, rcx
mov r15d, 1
mov dword [rbp + 0x58], r15d
call fcn.140002dfc
mov rcx, rax
xor r12d, r12d
test rax, rax
je 0x1400607dc
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x30], rax
mov dword [rbp + 0x50], 0x104
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x10], r12
call fcn.140002dfc
mov rcx, rax
test rax, rax
je 0x1400607e7
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.ole32.dll_StringFromCLSID]
mov esi, eax
test eax, eax
js 0x14006075b
lea r8, str.CLSID_
lea rdx, [0x140091640]
lea rcx, [rbp - 8]
call fcn.1400315dc
nop
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.140009900
nop
mov rdx, qword [rbp - 8]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, r15d
jg 0x1400603b9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rbp - 0x10]
test rdx, rdx
jne 0x1400603c7
mov eax, r12d
jmp 0x1400603d5
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], r12w
jne 0x1400603cb
mov r8d, eax
lea rcx, [rbp - 0x18]
call fcn.1400097e8
mov esi, 0x80004005
mov edi, esi
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp - 0x18]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r13d, eax
test eax, eax
jne 0x1400604ee
mov edx, dword [rbp + 0x50]
test edx, edx
js 0x1400607f2
mov rbx, qword [rbp - 0x30]
mov ecx, r15d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x140060441
lea rcx, [rbp - 0x30]
call fcn.1400028a0
mov rbx, qword [rbp - 0x30]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x58]
xor r8d, r8d
lea rdx, str.ThreadingModel
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r12d, eax
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcsnlen
xor ecx, ecx
test eax, eax
js 0x1400607f2
cmp eax, dword [rbx - 0xc]
jg 0x1400607f2
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], cx
test r12d, r12d
jne 0x1400604b6
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.14001b014
mov rbx, qword [rbp - 0x30]
mov eax, dword [rbx - 0x10]
neg eax
sbb edi, edi
not edi
and edi, esi
xor r12d, r12d
jmp 0x1400604de
or rax, 0xffffffffffffffff
xor r12d, r12d
lea rdx, [0x1400706b8]
inc rax
cmp word [rdx + rax*2], r12w
jne 0x1400604c4
mov r8d, eax
lea rcx, [rbp - 0x30]
call fcn.14000a350
mov rbx, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x28], r12
jmp 0x1400604f2
mov rbx, qword [rbp - 0x30]
lea rcx, [rbp - 0x18]
call fcn.14000a484
test edi, edi
jns 0x14006067d
call fcn.140002dfc
mov rcx, rax
test rax, rax
je 0x1400607fd
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x20], rax
lea rdx, [0x14006a3f0]
or rdi, 0xffffffffffffffff
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r12w
jne 0x140060530
mov r8d, eax
lea rcx, [rbp - 0x20]
call fcn.14000a350
mov rdx, qword [rbp - 0x10]
test rdx, rdx
jne 0x140060554
mov eax, r12d
jmp 0x140060561
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r12w
jne 0x140060557
mov r8d, eax
lea rcx, [rbp - 0x20]
call fcn.1400097e8
lea rdx, [0x140073508]
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r12w
jne 0x140060577
mov r8d, eax
lea rcx, [rbp - 0x20]
call fcn.1400097e8
lea rdx, str.InProcServer32
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r12w
jne 0x140060597
mov r8d, eax
lea rcx, [rbp - 0x20]
call fcn.1400097e8
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdi, qword [rbp - 0x20]
mov rdx, rdi
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400606ce
mov edx, 0x104
mov dword [rbp + 0x50], edx
sub r15d, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, r15d
jge 0x1400605fe
lea rcx, [rbp - 0x30]
call fcn.1400028a0
mov rbx, qword [rbp - 0x30]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x58]
xor r8d, r8d
lea rdx, str.ThreadingModel
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r15d, eax
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcsnlen
test eax, eax
js 0x1400607d1
cmp eax, dword [rbx - 0xc]
jg 0x1400607d1
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r12w
test r15d, r15d
jne 0x1400606a8
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.14001b014
nop
lea rdx, [rdi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140060679
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp - 0x30]
movups xmm0, xmmword [0x140069fb8]
movdqu xmmword [r14], xmm0
lea rdx, str.Apartment
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x1400606ef
movups xmm0, xmmword [0x14006a780]
jmp 0x140060734
or rax, 0xffffffffffffffff
lea rcx, [0x1400706b8]
inc rax
cmp word [rcx + rax*2], r12w
jne 0x1400606b3
mov r8d, eax
mov rdx, rcx
lea rcx, [rbp - 0x30]
call fcn.14000a350
jmp 0x14006065f
test r13d, r13d
je 0x14006065f
lea rdx, [rdi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006075b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14006075b
lea rdx, str.Both
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x14006070b
movups xmm0, xmmword [0x14006a770]
jmp 0x140060734
lea rdx, str.Free
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x140060727
movups xmm0, xmmword [0x14006a760]
jmp 0x140060734
cmp dword [rbx - 0x10], r12d
jne 0x140060739
movups xmm0, xmmword [str.a0_r]
movdqu xmmword [r14], xmm0
mov rcx, qword [r14]
sub rcx, qword [0x140069fb8]
jne 0x140060750
mov rcx, qword [r14 + 8]
sub rcx, qword [0x140069fc0]
mov eax, r12d
test rcx, rcx
cmove eax, esi
mov esi, eax
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14006076a
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14006077a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140060799
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400607b7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, esi
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.140002fa4
nop
mov ecx, 0x80004005
call fcn.140002fa4
nop
mov ecx, 0x80004005
call fcn.140002fa4
nop
mov ecx, 0x80070057
call fcn.140002fa4
int3
mov ecx, esi
call fcn.140002fa4
int3