Function at 0x140004a70
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x1b0
lea rbp, [rsp + 0x60]
mov qword [rbp + 0x48], 0xfffffffffffffffe
mov qword [rbp + 0x180], rbx
mov r14d, r8d
mov rbx, rdx
mov rsi, rcx
xor edi, edi
mov qword [rbp + 0x198], rdi
test rdx, rdx
je 0x140004f87
mov eax, dword [0x140018ce8]
cmp dword [rcx], eax
jne 0x140004add
mov eax, dword [0x140018cec]
cmp dword [rcx + 4], eax
jne 0x140004add
mov eax, dword [0x140018cf0]
cmp dword [rcx + 8], eax
jne 0x140004add
mov eax, dword [0x140018cf4]
cmp dword [rcx + 0xc], eax
je 0x140004f87
lea rax, [rbp + 0x198]
mov qword [rsp + 0x20], rax
lea r9, [0x1400188b0]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140018d08]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140004f87
mov ecx, dword [rbx]
test ecx, ecx
je 0x140004b70
mov rax, qword [rbx + 8]
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
lea r9, [rbp + 0x20]
mov r8d, 1
mov rdx, rsi
test r14d, r14d
je 0x140004b4f
cmp ecx, r8d
mov rcx, qword [rbp + 0x198]
mov rax, qword [rcx]
jne 0x140004b42
call qword [rax + 0x28]
jmp 0x140004b45
call qword [rax + 0x38]
test eax, eax
js 0x140004f89
jmp 0x140004b66
cmp ecx, 1
mov rcx, qword [rbp + 0x198]
mov rax, qword [rcx]
jne 0x140004b63
call qword [rax + 0x30]
jmp 0x140004b66
call qword [rax + 0x40]
add rbx, 0x10
mov ecx, dword [rbx]
test ecx, ecx
jne 0x140004b11
test r14d, r14d
jne 0x140004f8b
lea r8d, [r14 + 0x40]
lea rdx, [rbp + 0xd0]
mov rcx, rsi
call qword [sym.imp.ole32.dll_StringFromGUID2]
test eax, eax
jne 0x140004b9a
lea eax, [r14 + 0xd]
jmp 0x140004f89
mov rbx, rdi
mov qword [rbp + 0x18], rbx
lea rcx, [rbp + 0xd0]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140004bb0
inc eax
cdqe
lea r14, [rax + rax]
mov eax, 0x80000000
add rax, r14
mov ecx, 0xffffffff
cmp rax, rcx
ja 0x140004f6a
movsxd rsi, r14d
cmp r14d, 0x400
jg 0x140004c16
mov rcx, rsi
call fcn.14000b030
test al, al
je 0x140004c16
lea rax, [rsi + 0xf]
cmp rax, rsi
ja 0x140004c03
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1400112c0
sub rsp, rax
lea rcx, [rsp + 0x60]
jmp 0x140004c66
mov rax, rsi
not rax
cmp rax, 0x10
jb 0x140004c28
add rsi, 0x10
jmp 0x140004c2f
mov rsi, qword [rbp + 0x188]
cmp rax, 0x10
sbb ecx, ecx
and ecx, 0x80070216
cmp rax, 0x10
jb 0x140004fb5
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
jne 0x140004c58
mov rcx, rdi
jmp 0x140004c66
mov qword [rax], rdi
mov rbx, rax
mov qword [rbp + 0x18], rax
lea rcx, [rax + 0x10]
mov r9d, 3
mov r8d, r14d
lea rdx, [rbp + 0xd0]
call fcn.140005390
mov r15, rax
test rax, rax
je 0x140004f6a
lea r8, [0x1400188c0]
mov edx, 0x80
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
test eax, eax
je 0x140004cc5
cmp eax, 0xc
je 0x140004fd1
cmp eax, 0x16
je 0x140004fc6
cmp eax, 0x22
je 0x140004fc6
cmp eax, 0x50
jne 0x140004fbb
mov r8, r15
mov edx, 0x80
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
test eax, eax
je 0x140004cff
cmp eax, 0xc
je 0x140004ff2
cmp eax, 0x16
je 0x140004fe7
cmp eax, 0x22
je 0x140004fe7
cmp eax, 0x50
jne 0x140004fdc
lea r8, str.Required_Categories
mov edx, 0x80
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
test eax, eax
je 0x140004d3d
cmp eax, 0xc
je 0x140005013
cmp eax, 0x16
je 0x140005008
cmp eax, 0x22
je 0x140005008
cmp eax, 0x50
jne 0x140004ffd
mov qword [rbp + 0x30], 0xffffffff80000000
mov dword [rbp + 0x38], edi
mov qword [rbp + 0x40], rdi
mov qword [rbp], rdi
mov dword [rbp + 8], edi
mov qword [rbp + 0x10], rdi
mov dword [rbp + 0x188], edi
mov r9d, 0x20019
lea r8, [rbp + 0x50]
mov rdx, 0xffffffff80000000
lea rcx, [rbp]
call fcn.140006f30
test eax, eax
jne 0x140004df2
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
lea rax, [rbp + 0x188]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rsi, qword [rbp]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
movsxd r14, eax
test rsi, rsi
je 0x140004dd4
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp], rdi
mov dword [rbp + 8], edi
test r14, r14
jne 0x140004df2
cmp dword [rbp + 0x188], r14d
jne 0x140004df2
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x30]
call fcn.140005730
lea r8, [0x1400188c0]
mov edx, 0x80
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
test eax, eax
je 0x140004e30
cmp eax, 0xc
je 0x140005034
cmp eax, 0x16
je 0x140005029
cmp eax, 0x22
je 0x140005029
cmp eax, 0x50
jne 0x14000501e
mov r8, r15
mov edx, 0x80
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
test eax, eax
je 0x140004e6a
cmp eax, 0xc
je 0x140005055
cmp eax, 0x16
je 0x14000504a
cmp eax, 0x22
je 0x14000504a
cmp eax, 0x50
jne 0x14000503f
lea r8, str.Implemented_Categories
mov edx, 0x80
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcat_s]
test eax, eax
je 0x140004ea8
cmp eax, 0xc
je 0x140005076
cmp eax, 0x16
je 0x14000506b
cmp eax, 0x22
je 0x14000506b
cmp eax, 0x50
jne 0x140005060
mov r9d, 0x20019
lea r8, [rbp + 0x50]
mov rdx, 0xffffffff80000000
lea rcx, [rbp]
call fcn.140006f30
mov rsi, qword [rbp]
test eax, eax
jne 0x140004f41
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
lea rax, [rbp + 0x188]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
movsxd r14, eax
test rsi, rsi
je 0x140004f22
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, rdi
mov qword [rbp], rdi
mov dword [rbp + 8], edi
test r14, r14
jne 0x140004f41
cmp dword [rbp + 0x188], r14d
jne 0x140004f41
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x30]
call fcn.140005730
nop
test rsi, rsi
je 0x140004f53
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp], rdi
mov dword [rbp + 8], edi
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x30], rdi
mov dword [rbp + 0x38], edi
test rbx, rbx
je 0x140004f8b
nop
mov rcx, rbx
mov rbx, qword [rbx]
mov qword [rbp + 0x18], rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
test rbx, rbx
jne 0x140004f70
jmp 0x140004f8b
mov eax, edi
mov edi, eax
mov rcx, qword [rbp + 0x198]
test rcx, rcx
je 0x140004f9d
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov eax, edi
mov rbx, qword [rbp + 0x180]
lea rsp, [rbp + 0x150]
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140005280
nop
mov ecx, 0x80004005
call fcn.140005280
int3
mov ecx, 0x80070057
call fcn.140005280
int3
mov ecx, 0x8007000e
call fcn.140005280
int3
mov ecx, 0x80004005
call fcn.140005280
int3
mov ecx, 0x80070057
call fcn.140005280
int3
mov ecx, 0x8007000e
call fcn.140005280
int3
mov ecx, 0x80004005
call fcn.140005280
int3
mov ecx, 0x80070057
call fcn.140005280
int3
mov ecx, 0x8007000e
call fcn.140005280
nop
mov ecx, 0x80004005
call fcn.140005280
int3
mov ecx, 0x80070057
call fcn.140005280
int3
mov ecx, 0x8007000e
call fcn.140005280
int3
mov ecx, 0x80004005
call fcn.140005280
int3
mov ecx, 0x80070057
call fcn.140005280
int3
mov ecx, 0x8007000e
call fcn.140005280
int3
mov ecx, 0x80004005
call fcn.140005280
int3
mov ecx, 0x80070057
call fcn.140005280
int3
mov ecx, 0x8007000e
call fcn.140005280
int3