Function at 0x1400bb59c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xc0
mov qword [rbp + 0xf], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rsi, r8
mov r14, rdx
mov r13, rcx
lea r12, [0x140106190]
mov rcx, qword [0x140106190]
cmp rcx, r12
je 0x1400bb60a
test byte [rcx + 0x1c], 1
je 0x1400bb60a
cmp byte [rcx + 0x19], 5
jb 0x1400bb60a
mov rax, qword [r8 + 0x10]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdx + 8]
mov rcx, qword [rcx + 0x10]
call fcn.1400b8350
xor r15d, r15d
mov qword [rbp - 0x71], r15
mov qword [rbp - 0x69], r15
lea rdx, [rbp - 0x71]
mov rcx, r13
call fcn.1400b8740
mov ebx, eax
mov r10, qword [0x140106190]
cmp r10, r12
je 0x1400bb65c
test byte [r10 + 0x1c], 2
je 0x1400bb65c
cmp byte [r10 + 0x19], 4
jb 0x1400bb65c
mov edx, 0x99
mov r9d, eax
lea r8, [0x1400e7210]
mov rcx, qword [r10 + 0x10]
call fcn.1400035ec
mov r10, qword [0x140106190]
mov qword [rbp - 0x51], r15
mov qword [rbp - 0x49], r15
test ebx, ebx
jne 0x1400bb777
mov rax, qword [r13]
mov rcx, r13
mov rax, qword [rax + 0x58]
call qword [case.0x14006d218.0]
test rax, rax
je 0x1400bb770
mov rdi, r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov rax, qword [r13]
mov rcx, r13
mov rax, qword [rax + 0x58]
call qword [case.0x14006d218.0]
mov qword [rbp - 0x31], r15
lea rcx, [rbp - 0x31]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20119
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400bb6dd
mov ebx, r15d
mov rdi, qword [rbp - 0x31]
mov qword [rbp - 9], rdi
mov r10, qword [0x140106190]
cmp r10, r12
je 0x1400bb716
test byte [r10 + 0x1c], 2
je 0x1400bb716
cmp byte [r10 + 0x19], 4
jb 0x1400bb716
mov edx, 0x9a
mov r9d, ebx
lea r8, [0x1400e7210]
mov rcx, qword [r10 + 0x10]
call fcn.1400035ec
mov r10, qword [0x140106190]
test ebx, ebx
jne 0x1400bb762
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 9]
call fcn.1400b4124
mov ebx, eax
mov r10, qword [0x140106190]
cmp r10, r12
je 0x1400bb762
test byte [r10 + 0x1c], 2
je 0x1400bb762
cmp byte [r10 + 0x19], 4
jb 0x1400bb762
mov edx, 0x9b
mov r9d, eax
lea r8, [0x1400e7210]
mov rcx, qword [r10 + 0x10]
call fcn.1400035ec
mov r10, qword [0x140106190]
test rdi, rdi
je 0x1400bb777
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r10, qword [0x140106190]
mov edi, r15d
cmp dword [rbp - 0x69], r15d
jle 0x1400bbd5e
mov r12, r15
mov dword [rbp + 0x77], r15d
test edi, edi
js 0x1400bbe62
cmp edi, dword [rbp - 0x69]
jge 0x1400bbe62
mov rax, qword [rbp - 0x71]
lea r8, [rbp + 0x77]
mov rdx, qword [rax + r12*8]
mov rcx, r13
call fcn.1400b9dc0
mov ebx, eax
mov r10, qword [0x140106190]
lea rax, [0x140106190]
cmp r10, rax
je 0x1400bb7f9
test byte [r10 + 0x1c], 2
je 0x1400bb7f9
cmp byte [r10 + 0x19], 4
jb 0x1400bb7f9
mov edx, 0x9c
mov r9d, ebx
lea r8, [0x1400e7210]
mov rcx, qword [r10 + 0x10]
call fcn.1400035ec
mov r10, qword [0x140106190]
lea rax, [0x140106190]
test ebx, ebx
jne 0x1400bb84d
cmp dword [rbp + 0x77], 1
jne 0x1400bb84d
cmp r10, rax
je 0x1400bbcb0
test byte [r10 + 0x1c], 2
je 0x1400bbcb0
cmp byte [r10 + 0x19], 4
jb 0x1400bbcb0
cmp edi, dword [rbp - 0x69]
jge 0x1400bbdd3
mov edx, LoadRegTypeLib
mov rax, qword [rbp - 0x71]
mov r9, qword [rax + r12*8]
lea r8, [0x1400e7210]
mov rcx, qword [r10 + 0x10]
call fcn.140003558
jmp 0x1400bbca9
mov dword [rbp - 0x61], r15d
cmp edi, dword [rbp - 0x69]
jge 0x1400bbe57
mov rax, qword [rbp - 0x71]
lea r9, [rbp - 0x61]
lea r8, str.DefaultAuthorization
mov rdx, qword [rax + r12*8]
mov rcx, r13
call fcn.1400ba050
test eax, eax
jne 0x1400bb8bf
cmp dword [rbp - 0x61], 1
jne 0x1400bb8bf
mov r10, qword [0x140106190]
lea rax, [0x140106190]
cmp r10, rax
je 0x1400bbcb0
test byte [r10 + 0x1c], 2
je 0x1400bbcb0
cmp byte [r10 + 0x19], 4
jb 0x1400bbcb0
cmp edi, dword [rbp - 0x69]
jge 0x1400bbdde
mov edx, RegisterTypeLib
jmp 0x1400bb830
cmp edi, dword [rbp - 0x69]
jge 0x1400bbe4c
mov r11, qword [rbp - 0x71]
mov ecx, r15d
cmp dword [r14 + 8], r15d
jle 0x1400bb919
mov r9, qword [r14]
cmp qword [r11 + r12*8], r15
je 0x1400bbde9
mov rax, qword [r9]
mov r8, qword [r11 + r12*8]
sub r8, rax
movzx edx, word [rax]
cmp dx, word [rax + r8]
jne 0x1400bb904
add rax, 2
test dx, dx
jne 0x1400bb8ec
mov eax, r15d
jmp 0x1400bb909
sbb eax, eax
or eax, 1
test eax, eax
je 0x1400bb91c
inc ecx
add r9, 8
cmp ecx, dword [r14 + 8]
jl 0x1400bb8d8
or ecx, 0xffffffff
cmp ecx, 0xffffffff
je 0x1400bb95c
mov r10, qword [0x140106190]
lea rax, [0x140106190]
cmp r10, rax
je 0x1400bbcb0
test byte [r10 + 0x1c], 2
je 0x1400bbcb0
cmp byte [r10 + 0x19], 4
jb 0x1400bbcb0
mov edx, RegisterTypeLib
mov r9, qword [r11 + r12*8]
jmp 0x1400bb838
cmp qword [rsi + 0x10], r15
je 0x1400bba96
mov rax, qword [str.Xr_r_]
lea rcx, str.Xr_r_
mov rax, qword [rax + 0x18]
call qword [case.0x14006d218.0]
add rax, 0x18
mov qword [rbp - 0x39], rax
cmp edi, dword [rbp - 0x69]
jge 0x1400bbdff
mov rax, qword [rbp - 0x71]
lea r9, [rbp - 0x39]
lea r8, str.NetworkInterface
mov rdx, qword [rax + r12*8]
mov rcx, r13
call fcn.1400ba22c
mov rcx, qword [rbp - 0x39]
test eax, eax
jne 0x1400bba75
cmp dword [rcx - 0x10], r15d
je 0x1400bba75
mov rax, qword [rsi]
jmp 0x1400bb9ee
mov rdx, qword [rax + 0x10]
mov r10, rcx
sub r10, rdx
movzx r8d, word [rdx]
movzx r9d, word [rdx + r10]
sub r8d, r9d
jne 0x1400bb9e6
add rdx, 2
test r9d, r9d
jne 0x1400bb9cf
test r8d, r8d
je 0x1400bb9f6
mov rax, qword [rax]
test rax, rax
jne 0x1400bb9c5
mov rax, r15
test rax, rax
jne 0x1400bba75
mov r10, qword [0x140106190]
lea rax, [0x140106190]
cmp r10, rax
je 0x1400bba4b
test byte [r10 + 0x1c], 2
je 0x1400bba4b
cmp byte [r10 + 0x19], 4
jb 0x1400bba4b
cmp edi, dword [rbp - 0x69]
jge 0x1400bbdf4
mov rax, qword [rbp - 0x71]
mov edx, RegisterTypeLib
mov qword [rsp + 0x20], rcx
mov r9, qword [rax + r12*8]
lea r8, [0x1400e7210]
mov rcx, qword [r10 + 0x10]
call fcn.14000a2d8
mov rcx, qword [rbp - 0x39]
lea rdx, [rcx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400bbca9
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14006d218.0]
jmp 0x1400bbca9
lea rdx, [rcx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400bba96
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14006d218.0]
mov r14d, r15d
cmp dword [rbp - 0x49], 0
jle 0x1400bbc6c
xor esi, esi
mov qword [rbp - 0x21], rsi
and qword [rbp - 0x19], rsi
and qword [rbp - 0x11], rsi
mov rax, qword [r13]
mov rcx, r13
mov rax, qword [rax + 0x58]
call qword [case.0x14006d218.0]
mov rdx, rax
lea rcx, [rbp - 0x59]
call fcn.140004a80
nop
lea r8d, [rsi + 1]
lea rdx, [0x1400da7c0]
lea rcx, [rbp - 0x59]
call fcn.1400044f8
test r15, r15
js 0x1400bbe2b
cmp r14d, dword [rbp - 0x49]
jge 0x1400bbe2b
mov rax, qword [rbp - 0x51]
mov rdx, qword [rax + r15*8]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x59]
call fcn.1400044f8
and qword [rbp - 0x29], rsi
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rdx, qword [rbp - 0x59]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400bbb40
mov rsi, qword [rbp - 0x29]
mov qword [rbp - 0x21], rsi
mov rcx, qword [0x140106190]
lea rax, [0x140106190]
cmp rcx, rax
je 0x1400bbb77
test byte [rcx + 0x1c], 2
je 0x1400bbb77
cmp byte [rcx + 0x19], 4
jb 0x1400bbb77
mov edx, reloc.OLEAUT32.dll_LoadRegTypeLib
mov r9d, ebx
lea r8, [0x1400e7210]
mov rcx, qword [rcx + 0x10]
call fcn.1400035ec
test ebx, ebx
jne 0x1400bbc27
and dword [rbp - 0x5d], ebx
test r12, r12
js 0x1400bbe20
cmp edi, dword [rbp - 0x69]
jge 0x1400bbe20
mov rax, qword [rbp - 0x71]
mov dword [rbp - 0x41], 4
lea rcx, [rbp - 0x41]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x5d]
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x3d]
xor r8d, r8d
mov rdx, qword [rax + r12*8]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x1400bbbd8
mov eax, dword [rbp - 0x3d]
sub eax, 4
neg eax
sbb ebx, ebx
and ebx, 0xd
mov rcx, qword [0x140106190]
lea rax, [0x140106190]
cmp rcx, rax
je 0x1400bbc1d
test byte [rcx + 0x1c], 2
je 0x1400bbc1d
cmp byte [rcx + 0x19], 4
jb 0x1400bbc1d
mov edx, reloc.OLEAUT32.dll_RegisterTypeLib
mov r9d, ebx
lea r8, [0x1400e7210]
mov rcx, qword [rcx + 0x10]
call fcn.1400035ec
mov rcx, qword [0x140106190]
lea rax, [0x140106190]
cmp dword [rbp - 0x5d], 0
jne 0x1400bbcc7
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400bbc4d
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14006d218.0]
nop
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x1400bbc5c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r14d
inc r15
cmp r14d, dword [rbp - 0x49]
jl 0x1400bbaa3
cmp edi, dword [rbp - 0x69]
jge 0x1400bbe41
mov rdx, qword [rbp - 0x71]
mov rdx, qword [rdx + r12*8]
mov rcx, r13
call fcn.1400b8b34
cmp edi, dword [rbp - 0x69]
jge 0x1400bbe36
movsxd rcx, edi
mov rax, qword [rbp - 0x71]
lea rdx, [rax + rcx*8]
mov rcx, qword [rbp + 0x7f]
call fcn.1400181f8
xor r15d, r15d
mov r14, qword [rbp + 0x67]
mov r10, qword [0x140106190]
inc edi
inc r12
cmp edi, dword [rbp - 0x69]
jge 0x1400bbd57
mov rsi, qword [rbp + 0x6f]
jmp 0x1400bb787
cmp rcx, rax
je 0x1400bbd16
test byte [rcx + 0x1c], 2
je 0x1400bbd16
cmp byte [rcx + 0x19], 4
jb 0x1400bbd16
cmp r14d, dword [rbp - 0x49]
jge 0x1400bbe15
mov rax, qword [rbp - 0x51]
mov r8, qword [rax + r15*8]
cmp edi, dword [rbp - 0x69]
jge 0x1400bbe0a
mov rax, qword [rbp - 0x71]
mov edx, reloc.OLEAUT32.dll_QueryPathOfRegTypeLib
mov qword [rsp + 0x20], r8
mov r9, qword [rax + r12*8]
lea r8, [0x1400e7210]
mov rcx, qword [rcx + 0x10]
call fcn.14000a2d8
nop
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
xor r15d, r15d
sub eax, 1
jg 0x1400bbd3f
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14006d218.0]
nop
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x1400bbca5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400bbca5
lea r12, [0x140106190]
cmp r10, r12
je 0x1400bbda3
test byte [r10 + 0x1c], 1
je 0x1400bbda3
movzx edx, byte [r10 + 0x19]
mov eax, ebx
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jb 0x1400bbda3
mov rax, qword [rbp + 0x7f]
mov eax, dword [rax + 8]
mov edx, ConnectToConnectionPoint
mov dword [rsp + 0x20], eax
mov r9d, ebx
lea r8, [0x1400e7210]
mov rcx, qword [r10 + 0x10]
call fcn.1400053dc
nop
lea rcx, [rbp - 0x51]
call fcn.14001817c
nop
lea rcx, [rbp - 0x71]
call fcn.14001817c
mov eax, ebx
mov rbx, qword [rsp + 0x100]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0xc000008c
call fcn.140004f50
int3
mov ecx, 0xc000008c
call fcn.140004f50
int3
mov ecx, 0x80004005
call fcn.140004f64
nop
mov ecx, 0xc000008c
call fcn.140004f50
int3
mov ecx, 0xc000008c
call fcn.140004f50
nop
mov ecx, 0xc000008c
call fcn.140004f50
int3
mov ecx, 0xc000008c
call fcn.140004f50
int3
mov ecx, 0xc000008c
call fcn.140004f50
int3
mov ecx, 0xc000008c
call fcn.140004f50
nop
mov ecx, 0xc000008c
call fcn.140004f50
int3
mov ecx, 0xc000008c
call fcn.140004f50
int3
mov ecx, 0xc000008c
call fcn.140004f50
int3
mov ecx, 0xc000008c
call fcn.140004f50
int3
mov ecx, 0xc000008c
call fcn.140004f50
int3