Function at 0x140008534
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rdi
push r12
push r13
push r14
sub rsp, 0x1c0
lea rbp, [rsp + 0x60]
mov qword [rbp + 0x1a0], rbx
mov qword [rbp + 0x1a8], rsi
mov rax, qword [0x140059d90]
xor rax, rbp
mov qword [rbp + 0x150], rax
xor r13d, r13d
mov r12d, r8d
mov rbx, rdx
mov rdi, rcx
mov qword [rbp + 8], r13
test rdx, rdx
je 0x140008a86
mov eax, dword [0x140048ea0]
cmp dword [rcx], eax
jne 0x1400085b0
mov eax, dword [0x140048ea4]
cmp dword [rcx + 4], eax
jne 0x1400085b0
mov eax, dword [0x140048ea8]
cmp dword [rcx + 8], eax
jne 0x1400085b0
mov eax, dword [0x140048eac]
cmp dword [rcx + 0xc], eax
je 0x140008a86
lea rax, [rbp + 8]
mov r14d, 1
lea r9, [0x1400467d0]
lea rcx, [0x14004a600]
xor edx, edx
mov r8d, r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x140008a77
cmp dword [rbx], r13d
je 0x140008643
mov rax, qword [rbx + 8]
mov rcx, qword [rbp + 8]
lea r9, [rbp + 0x40]
mov r8d, r14d
mov rdx, rdi
movups xmm0, xmmword [rax]
movdqu xmmword [rbp + 0x40], xmm0
mov rax, qword [rcx]
test r12d, r12d
je 0x140008630
cmp dword [rbx], r14d
jne 0x140008611
call qword [rax + SafeArrayCreateVectorEx]
jmp 0x140008614
call qword [rax + 0x38]
mov esi, eax
test eax, eax
jns 0x14000863d
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x140008629
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov eax, esi
jmp 0x140008a88
cmp dword [rbx], r14d
jne 0x14000863a
call qword [rax + 0x30]
jmp 0x14000863d
call qword [rax + 0x40]
add rbx, 0x10
jmp 0x1400085e0
test r12d, r12d
jne 0x140008a77
lea r8d, [r12 + 0x40]
lea rdx, [rbp + 0xd0]
mov rcx, rdi
call qword [sym.imp.ole32.dll_StringFromGUID2]
lea rcx, [rbp + 0xd0]
mov rbx, r13
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, 0xffffffff
add eax, r14d
movsxd rsi, eax
mov eax, 0x80000000
add rsi, rsi
add rax, rsi
cmp rax, rcx
ja 0x140008736
or r12, 0xffffffffffffffff
cmp esi, 0x400
jg 0x1400086d1
movsxd rdi, esi
mov rcx, rdi
call fcn.140006e70
test al, al
je 0x1400086d1
lea rax, [rdi + 0xf]
cmp rax, rdi
ja 0x1400086be
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.140022fa0
sub rsp, rax
lea rdi, [rsp + 0x60]
jmp 0x1400086fc
movsxd rcx, esi
mov rax, r12
sub rax, rcx
cmp rax, 0x10
jb 0x140008ab5
add rcx, 0x10
call fcn.140022c58
test rax, rax
je 0x140008736
mov qword [rax], r13
mov rbx, rax
lea rdi, [rax + 0x10]
test rdi, rdi
je 0x140008736
mov qword [rsp + 0x38], r13
xor edx, edx
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0xd0]
lea ecx, [rdx + 3]
mov r9d, r12d
mov dword [rsp + 0x28], esi
mov byte [rdi], r13b
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
neg eax
sbb rsi, rsi
and rsi, rdi
jmp 0x140008739
mov rsi, r13
test rsi, rsi
je 0x140008a72
mov edi, 0x80
lea r8, str.CLSID_
lea rcx, [rbp + 0x50]
mov edx, edi
call fcn.140022dd8
lea r14d, [rdi - 0x74]
test eax, eax
je 0x140008796
cmp eax, r14d
je 0x14000878b
cmp eax, 0x16
je 0x140008780
cmp eax, 0x22
je 0x140008780
cmp eax, 0x50
je 0x140008796
mov ecx, 0x80004005
call fcn.1400055f8
int3
mov ecx, 0x80070057
call fcn.1400055f8
int3
mov ecx, 0x8007000e
call fcn.1400055f8
int3
lea rcx, [rbp + 0x50]
mov r8, rsi
mov rdx, rdi
call fcn.140022f0c
test eax, eax
je 0x1400087de
cmp eax, r14d
je 0x1400087d3
cmp eax, 0x16
je 0x1400087c8
cmp eax, 0x22
je 0x1400087c8
cmp eax, 0x50
je 0x1400087de
mov ecx, 0x80004005
call fcn.1400055f8
int3
mov ecx, 0x80070057
call fcn.1400055f8
int3
mov ecx, 0x8007000e
call fcn.1400055f8
int3
lea r8, str.Required_Categories
lea rcx, [rbp + 0x50]
mov rdx, rdi
call fcn.140022f0c
test eax, eax
je 0x14000882a
cmp eax, r14d
je 0x14000881f
cmp eax, 0x16
je 0x140008814
cmp eax, 0x22
je 0x140008814
cmp eax, 0x50
je 0x14000882a
mov ecx, 0x80004005
call fcn.1400055f8
int3
mov ecx, 0x80070057
call fcn.1400055f8
int3
mov ecx, 0x8007000e
call fcn.1400055f8
int3
lea r8, [rbp + 0x50]
lea rcx, [rbp + 0x10]
mov r9d, 0x20019
mov rdx, 0xffffffff80000000
mov qword [rbp + 0x28], 0xffffffff80000000
mov dword [rbp + 0x30], r13d
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x10], r13
mov dword [rbp + 0x18], r13d
mov qword [rbp + 0x20], r13
mov dword [rbp], r13d
call fcn.140005e78
test eax, eax
jne 0x1400088df
mov rdi, qword [rbp + 0x10]
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
lea rax, [rbp]
mov qword [rsp + 0x30], r13
mov rcx, rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
movsxd r12, eax
test rdi, rdi
je 0x1400088be
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp + 0x10], r13
mov dword [rbp + 0x18], r13d
test r12, r12
jne 0x1400088da
cmp dword [rbp], r13d
jne 0x1400088da
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x28]
call fcn.140005cb8
mov edi, 0x80
lea r8, str.CLSID_
lea rcx, [rbp + 0x50]
mov rdx, rdi
call fcn.140022dd8
test eax, eax
je 0x14000892b
cmp eax, r14d
je 0x140008920
cmp eax, 0x16
je 0x140008915
cmp eax, 0x22
je 0x140008915
cmp eax, 0x50
je 0x14000892b
mov ecx, 0x80004005
call fcn.1400055f8
int3
mov ecx, 0x80070057
call fcn.1400055f8
int3
mov ecx, 0x8007000e
call fcn.1400055f8
int3
lea rcx, [rbp + 0x50]
mov r8, rsi
mov rdx, rdi
call fcn.140022f0c
test eax, eax
je 0x140008973
cmp eax, r14d
je 0x140008968
cmp eax, 0x16
je 0x14000895d
cmp eax, 0x22
je 0x14000895d
cmp eax, 0x50
je 0x140008973
mov ecx, 0x80004005
call fcn.1400055f8
int3
mov ecx, 0x80070057
call fcn.1400055f8
int3
mov ecx, 0x8007000e
call fcn.1400055f8
int3
lea r8, str.Implemented_Categories
lea rcx, [rbp + 0x50]
mov rdx, rdi
call fcn.140022f0c
test eax, eax
je 0x1400089bf
cmp eax, r14d
je 0x1400089b4
cmp eax, 0x16
je 0x1400089a9
cmp eax, 0x22
je 0x1400089a9
cmp eax, 0x50
je 0x1400089bf
mov ecx, 0x80004005
call fcn.1400055f8
int3
mov ecx, 0x80070057
call fcn.1400055f8
int3
mov ecx, 0x8007000e
call fcn.1400055f8
int3
lea r8, [rbp + 0x50]
lea rcx, [rbp + 0x10]
mov r9d, 0x20019
mov rdx, 0xffffffff80000000
call fcn.140005e78
mov rdi, qword [rbp + 0x10]
test eax, eax
jne 0x140008a4a
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x38], r13
lea rax, [rbp]
mov qword [rsp + 0x30], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
movsxd rsi, eax
test rdi, rdi
je 0x140008a32
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, r13
test rsi, rsi
jne 0x140008a4a
cmp dword [rbp], r13d
jne 0x140008a4a
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x28]
call fcn.140005cb8
test rdi, rdi
je 0x140008a58
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140008a72
mov rcx, rbx
mov rbx, qword [rbx]
call fcn.140022d10
test rbx, rbx
jne 0x140008a67
mov rcx, qword [rbp + 8]
test rcx, rcx
je 0x140008a86
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
xor eax, eax
mov rcx, qword [rbp + 0x150]
xor rcx, rbp
call fcn.140021570
mov rbx, qword [rbp + 0x1a0]
mov rsi, qword [rbp + 0x1a8]
lea rsp, [rbp + 0x160]
pop r14
pop r13
pop r12
pop rdi
pop rbp
ret
mov ecx, 0x80070216
call fcn.1400055f8
int3