Function at 0x140028aa0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov r14, rdx
mov rbx, rcx
mov r15d, 1
mov dword [rbp + 0x58], r15d
call fcn.1400027c4
mov rcx, rax
xor r12d, r12d
test rax, rax
je 0x140028f95
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x30], rax
mov dword [rbp + 0x50], 0x104
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x10], r12
call fcn.1400027c4
mov rcx, rax
test rax, rax
je 0x140028fa3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x10]
mov rcx, rbx
call qword [sym.imp.ole32.dll_StringFromCLSID]
mov esi, eax
test eax, eax
js 0x140028f11
lea r8, str.CLSID_
lea rdx, [0x14008e398]
lea rcx, [rbp - 8]
call fcn.14001aca0
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.140006324
mov rdx, qword [rbp - 8]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, r15d
jg 0x140028b6f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rbp - 0x10]
test rdx, rdx
jne 0x140028b7d
mov eax, r12d
jmp 0x140028b8b
or rax, 0xffffffffffffffff
inc rax
cmp word [rdx + rax*2], r12w
jne 0x140028b81
mov r8d, eax
lea rcx, [rbp - 0x18]
call fcn.140008448
mov esi, 0x80004005
mov edi, esi
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp - 0x18]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r13d, eax
test eax, eax
jne 0x140028ca4
mov edx, dword [rbp + 0x50]
test edx, edx
js 0x140028fb1
mov rbx, qword [rbp - 0x30]
mov ecx, r15d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x140028bf7
lea rcx, [rbp - 0x30]
call fcn.140002b54
mov rbx, qword [rbp - 0x30]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x58]
xor r8d, r8d
lea rdx, str.ThreadingModel
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r12d, eax
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcsnlen
xor ecx, ecx
test eax, eax
js 0x140028fb1
cmp eax, dword [rbx - 0xc]
jg 0x140028fb1
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], cx
test r12d, r12d
jne 0x140028c6c
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.1400086e0
mov rbx, qword [rbp - 0x30]
mov eax, dword [rbx - 0x10]
neg eax
sbb edi, edi
not edi
and edi, esi
xor r12d, r12d
jmp 0x140028c94
or rax, 0xffffffffffffffff
xor r12d, r12d
lea rdx, [0x1400631a8]
inc rax
cmp word [rdx + rax*2], r12w
jne 0x140028c7a
mov r8d, eax
lea rcx, [rbp - 0x30]
call fcn.140002a20
mov rbx, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x28], r12
jmp 0x140028ca8
mov rbx, qword [rbp - 0x30]
lea rcx, [rbp - 0x18]
call fcn.140003970
test edi, edi
jns 0x140028e33
call fcn.1400027c4
mov rcx, rax
test rax, rax
je 0x140028fbc
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x20], rax
lea rdx, [0x1400669f0]
or rdi, 0xffffffffffffffff
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r12w
jne 0x140028ce6
mov r8d, eax
lea rcx, [rbp - 0x20]
call fcn.140002a20
mov rdx, qword [rbp - 0x10]
test rdx, rdx
jne 0x140028d0a
mov eax, r12d
jmp 0x140028d17
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r12w
jne 0x140028d0d
mov r8d, eax
lea rcx, [rbp - 0x20]
call fcn.140008448
lea rdx, [0x140068fb0]
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r12w
jne 0x140028d2d
mov r8d, eax
lea rcx, [rbp - 0x20]
call fcn.140008448
lea rdx, str.InProcServer32
mov rax, rdi
inc rax
cmp word [rdx + rax*2], r12w
jne 0x140028d4d
mov r8d, eax
lea rcx, [rbp - 0x20]
call fcn.140008448
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdi, qword [rbp - 0x20]
mov rdx, rdi
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140028e84
mov edx, 0x104
mov dword [rbp + 0x50], edx
sub r15d, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, r15d
jge 0x140028db4
lea rcx, [rbp - 0x30]
call fcn.140002b54
mov rbx, qword [rbp - 0x30]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x58]
xor r8d, r8d
lea rdx, str.ThreadingModel
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r15d, eax
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcsnlen
test eax, eax
js 0x140028f87
cmp eax, dword [rbx - 0xc]
jg 0x140028f87
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r12w
test r15d, r15d
jne 0x140028e5e
xor edx, edx
lea rcx, [rbp - 0x30]
call fcn.1400086e0
nop
lea rdx, [rdi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140028e2f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp - 0x30]
movups xmm0, xmmword [0x140064340]
movdqu xmmword [r14], xmm0
lea rdx, str.Apartment
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x140028ea5
movups xmm0, xmmword [0x14006ffa0]
jmp 0x140028eea
or rax, 0xffffffffffffffff
lea rcx, [0x1400631a8]
inc rax
cmp word [rcx + rax*2], r12w
jne 0x140028e69
mov r8d, eax
mov rdx, rcx
lea rcx, [rbp - 0x30]
call fcn.140002a20
jmp 0x140028e15
test r13d, r13d
je 0x140028e15
lea rdx, [rdi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140028f11
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140028f11
lea rdx, str.Both
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x140028ec1
movups xmm0, xmmword [0x14006ff90]
jmp 0x140028eea
lea rdx, str.Free
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_wcscmp
test eax, eax
jne 0x140028edd
movups xmm0, xmmword [0x14006ff80]
jmp 0x140028eea
cmp dword [rbx - 0x10], r12d
jne 0x140028eef
movups xmm0, xmmword [str.a0_r]
movdqu xmmword [r14], xmm0
mov rcx, qword [r14]
sub rcx, qword [0x140064340]
jne 0x140028f06
mov rcx, qword [r14 + 8]
sub rcx, qword [0x140064348]
mov eax, r12d
test rcx, rcx
cmove eax, esi
mov esi, eax
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140028f20
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x140028f30
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140028f4f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140028f6d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, esi
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80070057
call fcn.1400312f0
nop
jmp 0x140028f94
nop
mov ecx, 0x80004005
call fcn.1400312f0
nop
jmp 0x140028fa2
nop
mov ecx, 0x80004005
call fcn.1400312f0
nop
jmp 0x140028fb0
nop
mov ecx, 0x80070057
call fcn.1400312f0
int3
mov ecx, esi
call fcn.1400312f0
int3