Function at 0x1400018c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x210]
sub rsp, 0x310
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [rsp + 0x360], rbx
mov rax, qword [0x14003b010]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov rbx, rdx
mov rsi, rcx
mov qword [rsp + 0x78], rcx
call fcn.140001230
mov rcx, rax
test rax, rax
je 0x140001d13
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rdx, str.SYSTEMCurrentControlSetControlMediaCategories_
mov rdi, 0xffffffffffffffff
cmp rdx, 0x10000
jae 0x14000194e
movzx edx, dx
lea rcx, [rsp + 0x30]
call fcn.140002e30
jmp 0x140001969
mov rax, rdi
inc rax
cmp word [rdx + rax*2], 0
jne 0x140001951
mov r8d, eax
lea rcx, [rsp + 0x30]
call fcn.1400030e0
nop
xor eax, eax
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x68], rax
call fcn.140001230
mov rcx, rax
test rax, rax
je 0x140001d1e
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea rdx, [0x140031900]
cmp rdx, 0x10000
jae 0x1400019b8
movzx edx, dx
lea rcx, [rsp + 0x38]
call fcn.140002e30
jmp 0x1400019d8
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400019c0
mov r8d, eax
lea rcx, [rsp + 0x38]
call fcn.1400030e0
nop
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp]
call fcn.1400134f0
mov r8d, 0x7f
lea rdx, [rbp]
lea rcx, [0x140031c70]
call qword [sym.imp.ole32.dll_StringFromGUID2]
mov r8d, 0x7f
lea rdx, [rbp + 0x100]
mov rcx, rbx
call qword [sym.imp.ole32.dll_StringFromGUID2]
lea rdx, [rbp + 0x100]
lea rcx, [rbp]
test eax, eax
cmovle rdx, rcx
lea rcx, [rsp + 0x50]
call fcn.140002cd0
nop
mov r13, qword [rsp + 0x50]
movsxd rcx, dword [r13 - 0x10]
mov rax, r13
mov rbx, qword [rsp + 0x30]
sub rax, rbx
sar rax, 1
mov qword [rsp + 0x48], rax
mov r12d, dword [rbx - 0x10]
test ecx, ecx
js 0x140001d29
mov rdx, rcx
mov rcx, r13
call fcn.1400156ec
mov r15, rax
mov eax, 0x7fffffff
sub eax, r15d
cmp eax, r12d
jl 0x140001d34
lea r14d, [r12 + r15]
test r14d, r14d
js 0x140001d3f
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r14d
or eax, ecx
jge 0x140001aaa
mov edx, r14d
lea rcx, [rsp + 0x30]
call fcn.140003370
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x48]
cmp rcx, r12
ja 0x140001ab8
lea r13, [rbx + rcx*2]
movsxd rdx, r15d
lea rcx, [rbx + r12*2]
mov r9d, r15d
mov r8, r13
call fcn.140003050
cmp r14d, dword [rbx - 0xc]
jg 0x140001d08
mov dword [rbx - 0x10], r14d
movsxd rax, r14d
xor r14d, r14d
mov word [rbx + rax*2], r14w
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140001b01
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r9d, 0x20019
mov r8, qword [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.1400015b0
test eax, eax
je 0x140001bc4
call fcn.140001230
mov rcx, rax
test rax, rax
je 0x140001d4a
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsi], rax
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.1400030e0
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140001b69
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140001b7a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140001b97
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rax, rsi
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.140011050
mov rbx, qword [rsp + 0x360]
add rsp, 0x310
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x40], 0x80
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, str.Name
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140001c27
mov eax, dword [rsp + 0x48]
dec eax
cmp eax, 1
ja 0x140001c27
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x140001ca8
test al, 1
jne 0x140001c27
shr rax, 1
cmp word [rsp + rax*2 + 0x7e], 0
je 0x140001cad
call fcn.140001230
mov rcx, rax
test rax, rax
je 0x140001cfd
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rsi], rax
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.1400030e0
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140001c72
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140001c83
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140001b97
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140001b97
mov word [rbp - 0x80], r14w
lea rcx, [rbp - 0x80]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x140001cb4
mov r8d, eax
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x38]
call fcn.1400030e0
mov rbx, qword [rsp + 0x38]
lea rcx, [rbx - 0x18]
call fcn.140002fc0
add rax, 0x18
mov qword [rsi], rax
mov eax, edi
lock xadd dword [rbx - 8], eax
sub eax, 1
jg 0x140001c72
mov rcx, qword [rbx - 0x18]
lea rdx, [rbx - 0x18]
jmp 0x140001c6b
mov ecx, 0x80004005
call fcn.1400014c0
nop
mov ecx, 0x80070057
call fcn.1400014c0
nop
mov ecx, 0x80004005
call fcn.1400014c0
nop
mov ecx, 0x80004005
call fcn.1400014c0
nop
mov ecx, 0x80070057
call fcn.1400014c0
int3
mov ecx, 0x80070057
call fcn.1400014c0
int3
mov ecx, 0x80070057
call fcn.1400014c0
nop
mov ecx, 0x80004005
call fcn.1400014c0
int3