Function at 0x140020820
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x4c0]
sub rsp, 0x5c0
mov rax, qword [0x140061148]
xor rax, rsp
mov qword [rbp + 0x4b0], rax
mov r14, rdx
mov rdi, rcx
lea rdx, str.B9AA1F11_F480_4054_A84E_B5D9277E40A8
lea rcx, [rbp + 0x70]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_wchar_t_const____ptr64____ptr64]
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor r15d, r15d
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], r15d
mov qword [rsp + 0x70], r15
lea rdx, [0x140045170]
lea rcx, [rbp - 8]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_wchar_t_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_void____ptr64]
nop
lea rdx, str.SoftwareClassesTypeLib_
lea rcx, [rbp - 0x80]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_wchar_t_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x80]
call qword [reloc.Cmmlib.dll___Y__CStringT__W_Cmm__QEAAAEAV01_AEBV01__Z]
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x58]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_class_Cmm::CStringT_wchar_t_____ptr64____ptr64]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 8]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_class_Cmm::CStringT_wchar_t_____ptr64____ptr64]
lea rcx, [rbp - 0x58]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
mov rbx, 0xffffffff80000002
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
lea r8, [rbp - 8]
mov rdx, rbx
mov rcx, rdi
call fcn.140021fb0
test eax, eax
jne 0x1400209df
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
lea r8, [rbp - 8]
mov rdx, rbx
mov rcx, rdi
call fcn.140021fb0
test eax, eax
jne 0x1400209df
lea rdx, str.TypeLib_
lea rcx, [rbp - 0x80]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_wchar_t_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x80]
call qword [reloc.Cmmlib.dll___Y__CStringT__W_Cmm__QEAAAEAV01_AEBV01__Z]
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x58]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_class_Cmm::CStringT_wchar_t_____ptr64____ptr64]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 8]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_class_Cmm::CStringT_wchar_t_____ptr64____ptr64]
lea rcx, [rbp - 0x58]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
mov rbx, 0xffffffff80000000
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
lea r8, [rbp - 8]
mov rdx, rbx
mov rcx, rdi
call fcn.140021fb0
test eax, eax
jne 0x1400209df
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
lea r8, [rbp - 8]
mov rdx, rbx
mov rcx, rdi
call fcn.140021fb0
cmp eax, 1
jne 0x140020c96
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x58]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_class_Cmm::CStringT_wchar_t__const____ptr64____ptr64]
nop
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_class_Cmm::CStringT_wchar_t__const____ptr64____ptr64]
nop
lea rdx, [0x140045170]
lea rcx, [rbp - 0x80]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_wchar_t_const____ptr64____ptr64]
nop
lea rdx, [0x140045170]
lea rcx, [rbp + 0x20]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_wchar_t_const____ptr64____ptr64]
nop
lea rdx, str.win32
lea rcx, [rbp - 0x58]
call qword [reloc.Cmmlib.dll___Y__CStringT__W_Cmm__QEAAAEAV01_PEB_W_Z]
lea rdx, str.Win64
lea rcx, [rbp + 0x48]
call qword [reloc.Cmmlib.dll___Y__CStringT__W_Cmm__QEAAAEAV01_PEB_W_Z]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x40], r15
lea rcx, [rbp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_wchar_t_const____ptr64___cdecl_Cmm::CStringT_wchar_t_::c_str_void_const___ptr64]
mov r8, rax
mov r9d, 0x20019
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140016340
mov rsi, qword [rsp + 0x30]
test eax, eax
jne 0x140020b1e
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0xa0]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x78], 0x410
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x7c]
xor r8d, r8d
lea rdx, [0x140045170]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140020b1e
mov eax, dword [rsp + 0x7c]
dec eax
cmp eax, 1
ja 0x140020b1e
mov eax, dword [rsp + 0x78]
test eax, eax
je 0x140020b05
test al, 1
jne 0x140020b1e
shr rax, 1
cmp word [rbp + rax*2 + 0x9e], 0
je 0x140020b0d
jmp 0x140020b1e
mov word [rbp + 0xa0], r15w
lea rdx, [rbp + 0xa0]
lea rcx, [rbp - 0x80]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x58], r15
lea rcx, [rbp - 0x58]
call qword [sym.imp.Cmmlib.dll_public:_wchar_t_const____ptr64___cdecl_Cmm::CStringT_wchar_t_::c_str_void_const___ptr64]
mov r8, rax
mov r9d, 0x20019
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140016340
mov rdi, qword [rsp + 0x48]
test eax, eax
jne 0x140020bf0
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0xa0]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x78], 0x410
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x7c]
xor r8d, r8d
lea rdx, [0x140045170]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140020bf0
mov eax, dword [rsp + 0x7c]
dec eax
cmp eax, 1
ja 0x140020bf0
mov eax, dword [rsp + 0x78]
test eax, eax
je 0x140020bd7
test al, 1
jne 0x140020bf0
shr rax, 1
cmp word [rbp + rax*2 + 0x9e], 0
je 0x140020bdf
jmp 0x140020bf0
mov word [rbp + 0xa0], r15w
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x20]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64____ptr64]
lea rcx, [rbp - 0x80]
call qword [sym.imp.Cmmlib.dll_public:_int___cdecl_Cmm::CStringT_wchar_t_::IsEmpty_void_const___ptr64]
mov ebx, 1
test eax, eax
jne 0x140020c1b
lea rcx, [rbp + 0x20]
call qword [sym.imp.Cmmlib.dll_public:_int___cdecl_Cmm::CStringT_wchar_t_::IsEmpty_void_const___ptr64]
test eax, eax
jne 0x140020c1b
mov eax, 3
mov dword [r14], eax
jmp 0x140020c4b
lea rcx, [rbp - 0x80]
call qword [sym.imp.Cmmlib.dll_public:_int___cdecl_Cmm::CStringT_wchar_t_::IsEmpty_void_const___ptr64]
test eax, eax
jne 0x140020c33
mov eax, 2
mov dword [r14], eax
jmp 0x140020c4b
lea rcx, [rbp + 0x20]
call qword [sym.imp.Cmmlib.dll_public:_int___cdecl_Cmm::CStringT_wchar_t_::IsEmpty_void_const___ptr64]
test eax, eax
jne 0x140020c48
mov eax, ebx
mov dword [r14], ebx
jmp 0x140020c4b
mov ebx, r15d
test rdi, rdi
je 0x140020c5a
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
test rsi, rsi
je 0x140020c69
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp + 0x20]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x48]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
jmp 0x140020c99
mov ebx, r15d
lea rcx, [rbp - 0x30]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
nop
lea rcx, [rbp - 8]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x70]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
mov eax, ebx
mov rcx, qword [rbp + 0x4b0]
xor rcx, rsp
call fcn.1400322d0
lea r11, [rsp + 0x5c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret