Function at 0x140056b50
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x178], rbx
mov rax, qword [0x1403d88e8]
xor rax, rsp
mov qword [rbp + 0x18], rax
mov r13, r8
mov r15, rdx
mov rdi, rcx
mov qword [rsp + 0x70], rcx
test rdx, rdx
jne 0x140056bb9
lea r8, str.DefLevelSetter.cpp
mov edx, pe_nt_image_headers64
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
xor eax, eax
jmp 0x140056fe2
test r13, r13
jne 0x140056bdd
lea r8, str.DefLevelSetter.cpp
mov edx, 0x111
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
xor eax, eax
jmp 0x140056fe2
call fcn.1400f9930
mov rcx, rax
test rax, rax
je 0x140057009
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea rbx, [0x140345b70]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140015a40
or r14, 0xffffffffffffffff
test al, al
jne 0x140056c3b
mov rax, r14
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140056c20
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1400105e0
nop
call fcn.1400f9930
mov rcx, rax
test rax, rax
je 0x140057014
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
xor r12d, r12d
mov qword [rsp + 0x50], r12
mov dword [rsp + 0x58], r12d
mov qword [rsp + 0x60], r12
xor edx, edx
mov r8d, 0x80
lea rcx, [rbp - 0x70]
call fcn.14029ff20
mov qword [r13], r12
mov rcx, qword [r15 + 0x10]
movzx eax, word [rcx]
cmp ax, word [0x140345b70]
je 0x140056e00
movups xmm0, xmmword [0x1403466f8]
movups xmmword [rbp - 0x80], xmm0
cmp dword [rcx - 8], 1
jle 0x140056cb7
mov edx, dword [rcx - 0x10]
lea rcx, [r15 + 0x10]
call fcn.14000dc90
mov rcx, qword [r15 + 0x10]
lea rdx, [rbp - 0x80]
call qword [sym.imp.ole32.dll_CLSIDFromString]
mov rcx, qword [r15 + 0x10]
test rcx, rcx
jne 0x140056ccf
mov eax, r12d
jmp 0x140056ce0
movsxd rdx, dword [rcx - 0xc]
call fcn.1402a58a8
test eax, eax
js 0x14005701f
mov rcx, qword [r15 + 0x10]
cmp eax, dword [rcx - 0xc]
jg 0x14005701f
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [r15 + 0x10]
mov word [rax + rcx*2], r12w
mov rax, qword [rbp - 0x80]
cmp rax, qword [0x1403466f8]
jne 0x140056d1a
mov rax, qword [rbp - 0x78]
cmp rax, qword [0x140346700]
je 0x140056e00
cmp dword [r15 + 0x18], 0
jne 0x140056e00
lea rdx, str.SYSTEMCurrentControlSetControlMediaCategories_
mov rax, r14
nop
inc rax
cmp word [rdx + rax*2], 0
jne 0x140056d30
mov r8d, eax
lea rcx, [rsp + 0x40]
call fcn.1400105e0
mov rdx, qword [r15 + 0x10]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x40]
call fcn.14001cfc0
mov r9d, 0x20019
mov r8, qword [rsp + 0x40]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x50]
call fcn.140015610
mov rbx, qword [rsp + 0x50]
test eax, eax
je 0x140056d85
mov edx, 0x12b
jmp 0x140056de3
mov dword [rsp + 0x38], 0x80
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, str.Name
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140056dde
mov eax, dword [rsp + 0x48]
dec eax
cmp eax, 1
ja 0x140056dde
mov eax, dword [rsp + 0x38]
test eax, eax
je 0x140056dfb
test al, 1
jne 0x140056dde
shr rax, 1
cmp word [rbp + rax*2 - 0x72], 0
je 0x140056e00
mov edx, 0x12e
lea r8, str.DefLevelSetter.cpp
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
jmp 0x140056f91
mov word [rbp - 0x70], r12w
mov rax, qword [rdi + 8]
mov rdi, qword [rax + 0x1bd8]
nop dword [rax + rax]
test rdi, rdi
je 0x140056f77
mov rsi, qword [rdi + 0x10]
mov rdi, qword [rdi]
test rsi, rsi
je 0x140056e10
mov rax, qword [rsi]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [rax + 0x78]
test eax, eax
je 0x140056e10
mov edx, 0x5c
mov rcx, qword [rsp + 0x30]
call fcn.14029f968
test rax, rax
je 0x140056e10
sub rax, qword [rsp + 0x30]
sar rax, 1
test eax, eax
js 0x140056e10
lea rcx, [rsp + 0x30]
call fcn.14001c920
mov edx, 0x5c
mov rcx, qword [rsp + 0x30]
call fcn.14029f968
mov rcx, qword [rsp + 0x30]
test rax, rax
jne 0x140056e7f
mov eax, r14d
jmp 0x140056e85
sub rax, rcx
sar rax, 1
lea r8d, [rax + 1]
mov r9d, dword [rcx - 0x10]
sub r9d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x30]
call fcn.14001cee0
mov r8, qword [r15 + 8]
test r8, r8
je 0x14005702a
mov rax, qword [rsp + 0x68]
mov rcx, rax
sub r8, rax
nop word [rax + rax]
movzx ebx, word [rcx]
movzx edx, word [rcx + r8]
sub ebx, edx
jne 0x140056ed4
add rcx, 2
test edx, edx
jne 0x140056ec0
lea rdx, [rax - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140056eee
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test ebx, ebx
jne 0x140056e10
cmp qword [rsi + 0x1f8], 0
je 0x140056f8c
mov rdi, qword [rsi + 0x1e8]
cmp dword [r15 + 0x18], ebx
je 0x140056f1b
mov rax, qword [rdi + 0x10]
mov qword [r13], rax
jmp 0x140056f83
test rdi, rdi
je 0x140056f83
mov rsi, rdi
mov rdi, qword [rdi]
mov rsi, qword [rsi + 0x10]
test rsi, rsi
je 0x140056f1b
mov rcx, qword [rsi + 0x48]
sub rcx, 0x18
call fcn.140015740
lea rbx, [rax + 0x18]
lea rdx, [rbp - 0x70]
mov rcx, rbx
call fcn.1402a70ac
test eax, eax
sete r15b
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140056f6c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r15b, r15b
je 0x140056f1b
mov qword [r13], rsi
jmp 0x140056f83
mov rax, qword [rsp + 0x70]
mov dword [rax + 0x14], 1
cmp qword [r13], 0
setne r12b
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x140056fa0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140056fc0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r14d
sub r14d, 1
jg 0x140056fdf
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, r12d
mov rcx, qword [rbp + 0x18]
xor rcx, rsp
call fcn.14029d880
mov rbx, qword [rsp + 0x178]
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000de90
nop
mov ecx, 0x80004005
call fcn.14000de90
nop
mov ecx, 0x80070057
call fcn.14000de90
int3
mov ecx, 0x80004005
call fcn.14000de90
int3