Function at 0x140036310
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov qword [rbp - 0x69], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1402f2080]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, rcx
mov qword [rbp - 0x71], rcx
mov qword [rbp - 0x61], rcx
xor r12d, r12d
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x20], r12
mov dword [rcx + 0x18], r12d
mov qword [rcx + 0x28], r12
mov dword [rcx + 0x30], r12d
mov word [rcx + 0x34], r12w
lea rax, vtable.CAutoInstallAPO.1.0
mov qword [rcx], rax
lea rax, vtable.CAutoInstallAPO.0
mov qword [rcx + 8], rax
mov qword [rcx + 0x38], r12
mov qword [rcx + 0x40], r12
mov qword [rcx + 0x48], r12
lea rax, vtable.CAudioProperties.0
mov qword [rcx + 0x50], rax
mov qword [rcx + 0x90], r12
xor eax, eax
mov qword [rcx + 0x5c], rax
mov qword [rcx + 0x64], rax
mov qword [rcx + 0x6c], rax
mov qword [rcx + 0x74], rax
mov qword [rcx + 0x7c], rax
mov qword [rcx + 0x88], r12
mov dword [rcx + 0x58], r12d
mov word [rcx + 0x98], r12w
mov qword [rcx + 0x2a0], r12
mov dword [rcx + 0x2a8], r12d
add rcx, 0x2b0
lea edx, [rax + 2]
call fcn.140126b60
nop
mov qword [rdi + 0x300], r12
mov dword [rdi + 0x308], r12d
lea rsi, [rdi + 0x310]
mov qword [rsp + 0x48], rsi
mov qword [rsi], r12
mov qword [rsi + 8], r12
call fcn.140031c70
mov qword [rsi], rax
lea rbx, [rdi + 0x320]
mov qword [rbp - 0x79], rbx
mov qword [rbx], r12
mov qword [rbx + 8], r12
call fcn.140031c70
mov qword [rbx], rax
lea rbx, [rdi + 0x330]
mov qword [rbp - 9], rbx
mov qword [rbx], r12
mov qword [rbx + 8], r12
call fcn.140031c70
mov qword [rbx], rax
mov qword [rdi + 0x340], r12
mov qword [rdi + 0x348], r12
mov qword [rdi + 0x350], r12
lea rax, str.CAutoInstallAPO::CAutoInstallAPO
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9d, [r12 + 3]
lea r8, [0x140303c50]
mov edx, 0xe5
lea rcx, str.d:jenkinsworkspacemainrel4_dell_12818consumermainrel4_dell_12818consumerplatform_vista_shared_autoinstallapo.cpp
call fcn.1400189f0
mov dword [rbp - 0x11], r12d
mov qword [rbp - 0x39], r12
lea rax, [rbp - 0x39]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREWaves_AudioMaxxAudioGeneral
mov rcx, 0xffffffff80000002
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x1400364f8
mov dword [rbp - 1], 4
lea rax, [rbp - 1]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x11]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x1f]
xor r8d, r8d
lea rdx, str.DDPause
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov eax, dword [rbp - 0x11]
mov dword [rdi + 0x308], eax
mov dword [rsp + 0x30], eax
lea rax, str.CAutoInstallAPO::CAutoInstallAPO__dwPause___d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov r9d, 3
lea r8, [0x140303c50]
mov edx, 0xe9
lea rcx, str.d:jenkinsworkspacemainrel4_dell_12818consumermainrel4_dell_12818consumerplatform_vista_shared_autoinstallapo.cpp
call fcn.1400189f0
xor eax, eax
mov qword [rbp - 0x19], rax
mov qword [rbp - 0x31], r12
mov qword [rbp - 0x29], r12
mov qword [rbp - 0x21], r12
mov dword [rbp - 0x19], r12d
mov qword [rbp + 0xf], r12
lea rax, [0x14022a4b0]
mov qword [rsp + 0x20], rax
lea r9, str.DDEnDiInclude
lea r8, str.SOFTWAREWaves_AudioMaxxAudioGeneral
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0xf]
call fcn.14001fbd0
nop
mov rdi, qword [rbp + 0xf]
mov qword [rbp - 0x29], r12
mov rbx, r12
mov qword [rbp - 0x21], rbx
mov r15, 0xffffffffffffffff
cmp r12w, word [rdi]
je 0x140036668
mov rsi, r12
mov r14, r12
nop
call fcn.140015450
test rax, rax
je 0x140036a1a
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp + 7], rax
mov rdx, rdi
lea rcx, [rbp + 7]
call fcn.1400165c0
test al, al
jne 0x1400365ee
mov rax, r15
inc rax
cmp word [rdi + rax*2], 0
jne 0x1400365d2
mov r8d, eax
mov rdx, rdi
lea rcx, [rbp + 7]
call fcn.140016ed0
mov rsi, r14
cmp rsi, rbx
jb 0x140036608
lea rdx, [rsi + 1]
lea rcx, [rbp - 0x31]
call fcn.140021a80
test al, al
je 0x140036a0f
mov rax, qword [rbp - 0x31]
lea rcx, [rax + rsi*8]
mov rbx, qword [rbp + 7]
mov rdx, rbx
call fcn.140016290
mov rsi, qword [rbp - 0x29]
inc rsi
mov qword [rbp - 0x29], rsi
movsxd rax, dword [rbx - 0x10]
lea rdi, [rdi + rax*2]
add rdi, 2
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003664d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov r14, rsi
cmp r12w, word [rdi]
je 0x14003665f
mov rbx, qword [rbp - 0x21]
jmp 0x1400365a0
mov rdi, qword [rbp + 0xf]
mov rsi, qword [rsp + 0x48]
lea rdx, [rdi - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140036682
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov r13d, r12d
mov r14, qword [rbp - 0x31]
mov r12, qword [rbp - 0x29]
test r12, r12
je 0x140036722
xor eax, eax
movzx ebx, byte [rsp + 0x40]
cmp rax, r12
jae 0x140036a3b
lea rsi, [r14 + rax*8]
mov r8, qword [rsi]
movsxd rdi, dword [r8 - 0x10]
test edi, edi
js 0x140036a30
mov ecx, 1
sub ecx, dword [r8 - 8]
mov eax, dword [r8 - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400366d9
mov edx, edi
mov rcx, rsi
call fcn.140017100
mov r8, qword [rsi]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, r8
call fcn.1401730e8
mov rax, qword [rsi]
cmp edi, dword [rax - 0xc]
jg 0x140036a25
mov dword [rax - 0x10], edi
mov rax, qword [rsi]
xor edx, edx
mov word [rax + rdi*2], dx
mov byte [rsp + 0x20], bl
mov r9, rsi
lea rdx, [rbp - 0x59]
mov rsi, qword [rsp + 0x48]
mov rcx, rsi
call fcn.140039b10
inc r13d
mov eax, r13d
cmp rax, r12
jb 0x1400366a6
mov rax, qword [rsi + 8]
mov qword [rsp + 0x30], rax
lea rax, str.CAutoInstallAPO::CAutoInstallAPO__number_of_entries_in_DDEnDiInclude___d
mov qword [rsp + 0x28], rax
xor r13d, r13d
mov qword [rsp + 0x20], r13
lea r9d, [r13 + 3]
lea r8, [0x140303c50]
mov edx, 0xf4
lea rcx, str.d:jenkinsworkspacemainrel4_dell_12818consumermainrel4_dell_12818consumerplatform_vista_shared_autoinstallapo.cpp
call fcn.1400189f0
test r14, r14
je 0x14003677a
mov rdx, r12
mov rcx, r14
call fcn.140021b70
mov rcx, r14
call fcn.14016e4d0
mov r14d, r13d
mov qword [rbp - 0x31], r13
mov qword [rbp - 0x29], r13
mov qword [rbp - 0x21], r13
mov qword [rbp - 9], r13
lea rax, [0x14022a4b0]
mov qword [rsp + 0x20], rax
lea r9, str.DDEnDiExclude
lea r8, str.SOFTWAREWaves_AudioMaxxAudioGeneral
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 9]
call fcn.14001fbd0
nop
mov rdi, qword [rbp - 9]
test r14, r14
je 0x1400367d3
xor edx, edx
mov rcx, r14
call fcn.140021b70
mov rcx, r14
call fcn.14016e4d0
mov r14, r13
mov qword [rbp - 0x31], r13
mov qword [rbp - 0x29], r13
mov rbx, r13
mov qword [rbp - 0x21], rbx
cmp r13w, word [rdi]
je 0x1400368b3
mov rsi, r13
mov r12, r13
nop
call fcn.140015450
test rax, rax
je 0x140036a51
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rbp + 0x17], rax
mov rdx, rdi
lea rcx, [rbp + 0x17]
call fcn.1400165c0
test al, al
jne 0x14003683e
mov rax, r15
inc rax
cmp word [rdi + rax*2], 0
jne 0x140036822
mov r8d, eax
mov rdx, rdi
lea rcx, [rbp + 0x17]
call fcn.140016ed0
mov rsi, r12
cmp rsi, rbx
jb 0x14003685c
lea rdx, [rsi + 1]
lea rcx, [rbp - 0x31]
call fcn.140021a80
test al, al
je 0x140036a46
mov r14, qword [rbp - 0x31]
lea rcx, [r14 + rsi*8]
mov rbx, qword [rbp + 0x17]
mov rdx, rbx
call fcn.140016290
mov rsi, qword [rbp - 0x29]
inc rsi
mov qword [rbp - 0x29], rsi
movsxd rax, dword [rbx - 0x10]
lea rdi, [rdi + rax*2]
add rdi, 2
lea rdx, [rbx - 0x18]
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14003689d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov r12, rsi
cmp r13w, word [rdi]
je 0x1400368b3
mov rbx, qword [rbp - 0x21]
mov r14, qword [rbp - 0x31]
jmp 0x1400367f0
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg 0x1400368d0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov r14d, r13d
mov r12, qword [rbp - 0x31]
mov r15, qword [rbp - 0x29]
test r15, r15
je 0x140036972
mov rax, r13
movzx ebx, byte [rsp + 0x40]
mov r13, qword [rbp - 0x79]
cmp rax, r15
jae 0x140036a04
lea rsi, [r12 + rax*8]
mov r8, qword [rsi]
movsxd rdi, dword [r8 - 0x10]
test edi, edi
js 0x140036a67
mov ecx, 1
sub ecx, dword [r8 - 8]
mov eax, dword [r8 - 0xc]
sub eax, edi
or eax, ecx
jge 0x14003692c
mov edx, edi
mov rcx, rsi
call fcn.140017100
mov r8, qword [rsi]
lea eax, [rdi + 1]
movsxd rdx, eax
mov rcx, r8
call fcn.1401730e8
mov rax, qword [rsi]
cmp edi, dword [rax - 0xc]
jg 0x140036a5c
mov dword [rax - 0x10], edi
mov rax, qword [rsi]
xor edx, edx
mov word [rax + rdi*2], dx
mov byte [rsp + 0x20], bl
mov r9, rsi
lea rdx, [rbp - 0x49]
mov rcx, r13
call fcn.140039b10
inc r14d
mov eax, r14d
cmp rax, r15
jb 0x1400368f9
jmp 0x140036976
mov r13, qword [rbp - 0x79]
mov rax, qword [r13 + 8]
mov qword [rsp + 0x30], rax
lea rax, str.CAutoInstallAPO::CAutoInstallAPO__number_of_entries_in_DDEnDiExclude___d
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x20], rax
lea r9d, [rax + 3]
lea r8, [0x140303c50]
mov edx, 0xff
lea rcx, str.d:jenkinsworkspacemainrel4_dell_12818consumermainrel4_dell_12818consumerplatform_vista_shared_autoinstallapo.cpp
call fcn.1400189f0
mov rbx, qword [rbp - 0x71]
mov rcx, rbx
call fcn.1400385c0
nop
test r12, r12
je 0x1400369d4
mov rdx, r15
mov rcx, r12
call fcn.140021b70
mov rcx, r12
call fcn.14016e4d0
nop
mov rax, rbx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140146480
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x80070057
call fcn.1400151f0
nop
mov ecx, 0x8007000e
call fcn.1400151f0
nop
mov ecx, 0x80004005
call fcn.1400151f0
nop
mov ecx, 0x80070057
call fcn.1400151f0
int3
mov ecx, 0x80070057
call fcn.1400151f0
int3
mov ecx, 0x80070057
call fcn.1400151f0
nop
mov ecx, 0x8007000e
call fcn.1400151f0
nop
mov ecx, 0x80004005
call fcn.1400151f0
nop
mov ecx, 0x80070057
call fcn.1400151f0
int3
mov ecx, 0x80070057
call fcn.1400151f0
int3