Function at 0x1400d9dc8
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xc8
mov qword [rbp + 7], 0xfffffffffffffffe
mov rdi, r8
mov rbx, rdx
mov r12, rcx
lea r14, [0x140148ea8]
mov rcx, qword [0x140148ea8]
cmp rcx, r14
je 0x1400d9e37
test byte [rcx + 0x1c], 1
je 0x1400d9e37
cmp byte [rcx + 0x19], 5
jb 0x1400d9e37
mov rax, qword [r8 + 0x10]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdx + 8]
mov rcx, qword [rcx + 0x10]
call fcn.1400d6914
xor r13d, r13d
mov qword [rsp + 0x30], r13
mov qword [rbp - 0x79], r13
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.1400d6d18
mov esi, eax
lea r15, [0x1400091f8]
mov r10, qword [0x140148ea8]
cmp r10, r14
je 0x1400d9e8e
test byte [r10 + 0x1c], 2
je 0x1400d9e8e
cmp byte [r10 + 0x19], 4
jb 0x1400d9e8e
mov edx, 0x9a
mov r9d, eax
mov r8, r15
mov rcx, qword [r10 + 0x10]
call fcn.14000fd64
mov r10, qword [0x140148ea8]
mov qword [rbp - 0x59], r13
mov qword [rbp - 0x51], r13
test esi, esi
jne 0x1400d9fbe
mov rax, qword [r12]
mov rbx, qword [rax + 0x58]
mov rcx, rbx
call qword [fcn.140015690]
mov rcx, r12
call rbx
test rax, rax
je 0x1400d9fad
mov rdi, r13
mov qword [rbp - 0x11], r13
mov qword [rbp - 9], r13
mov qword [rbp - 1], r13
mov rax, qword [r12]
mov rbx, qword [rax + 0x58]
mov rcx, rbx
call qword [fcn.140015690]
mov rcx, r12
call rbx
mov qword [rbp - 0x39], r13
lea rcx, [rbp - 0x39]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20119
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
jne 0x1400d9f19
mov esi, r13d
mov rdi, qword [rbp - 0x39]
mov qword [rbp - 0x11], rdi
mov r10, qword [0x140148ea8]
cmp r10, r14
je 0x1400d9f4e
test byte [r10 + 0x1c], 2
je 0x1400d9f4e
cmp byte [r10 + 0x19], 4
jb 0x1400d9f4e
mov edx, 0x9b
mov r9d, esi
mov r8, r15
mov rcx, qword [r10 + 0x10]
call fcn.14000fd64
mov r10, qword [0x140148ea8]
test esi, esi
jne 0x1400d9f96
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x11]
call fcn.1400d2210
mov esi, eax
mov r10, qword [0x140148ea8]
cmp r10, r14
je 0x1400d9f96
test byte [r10 + 0x1c], 2
je 0x1400d9f96
cmp byte [r10 + 0x19], 4
jb 0x1400d9f96
mov edx, 0x9c
mov r9d, eax
mov r8, r15
mov rcx, qword [r10 + 0x10]
call fcn.14000fd64
mov r10, qword [0x140148ea8]
test rdi, rdi
je 0x1400d9fb6
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r10, qword [0x140148ea8]
jmp 0x1400d9fb6
mov r10, qword [0x140148ea8]
jmp 0x1400d9fba
mov rdi, qword [rbp + 0x6f]
mov rbx, qword [rbp + 0x67]
mov r15d, r13d
cmp dword [rbp - 0x79], r13d
jle 0x1400da6e2
mov r14, r13
mov qword [rbp - 0x71], r13
mov dword [rbp + 0x77], r13d
test r15d, r15d
js 0x1400da6d2
cmp r15d, dword [rbp - 0x79]
jge 0x1400da6d2
mov rax, qword [rsp + 0x30]
lea r8, [rbp + 0x77]
mov rdx, qword [rax + r14*8]
mov rcx, r12
call fcn.1400d84b8
mov esi, eax
mov r10, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp r10, rax
je 0x1400da047
test byte [r10 + 0x1c], 2
je 0x1400da047
cmp byte [r10 + 0x19], 4
jb 0x1400da047
mov edx, LoadRegTypeLib
mov r9d, esi
lea r8, [0x1400091f8]
mov rcx, qword [r10 + 0x10]
call fcn.14000fd64
mov r10, qword [0x140148ea8]
lea rax, [0x140148ea8]
test esi, esi
jne 0x1400da09d
cmp dword [rbp + 0x77], 1
jne 0x1400da09d
cmp r10, rax
je 0x1400da5d4
test byte [r10 + 0x1c], 2
je 0x1400da5d4
cmp byte [r10 + 0x19], 4
jb 0x1400da5d4
cmp r15d, dword [rbp - 0x79]
jge 0x1400da5f5
mov edx, LoadRegTypeLib
mov rax, qword [rsp + 0x30]
mov r9, qword [rax + r14*8]
lea r8, [0x1400091f8]
mov rcx, qword [r10 + 0x10]
call fcn.14000fcd0
jmp 0x1400da5cd
mov dword [rbp - 0x61], r13d
cmp r15d, dword [rbp - 0x79]
jge 0x1400da6c2
mov rax, qword [rsp + 0x30]
lea r9, [rbp - 0x61]
lea r8, [0x1400091c8]
mov rdx, qword [rax + r14*8]
mov rcx, r12
call fcn.1400d874c
test eax, eax
jne 0x1400da112
cmp dword [rbp - 0x61], 1
jne 0x1400da112
mov r10, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp r10, rax
je 0x1400da5d4
test byte [r10 + 0x1c], 2
je 0x1400da5d4
cmp byte [r10 + 0x19], 4
jb 0x1400da5d4
cmp r15d, dword [rbp - 0x79]
jge 0x1400da605
mov edx, LoadRegTypeLib
jmp 0x1400da07f
cmp r15d, dword [rbp - 0x79]
jge 0x1400da6b2
mov r11, qword [rsp + 0x30]
mov ecx, r13d
cmp dword [rbx + 8], r13d
jle 0x1400da177
mov r9, qword [rbx]
mov r10d, r13d
cmp qword [r11 + r14*8], r13
setne r10b
test r10d, r10d
je 0x1400da615
mov rax, qword [r9]
mov r8, qword [r11 + r14*8]
sub r8, rax
movzx edx, word [rax]
cmp dx, word [rax + r8]
jne 0x1400da163
add rax, 2
test dx, dx
jne 0x1400da14b
mov eax, r13d
jmp 0x1400da168
sbb eax, eax
or eax, 1
test eax, eax
je 0x1400da17a
inc ecx
add r9, 8
cmp ecx, dword [rbx + 8]
jl 0x1400da138
or ecx, 0xffffffff
cmp ecx, 0xffffffff
je 0x1400da1ba
mov r10, qword [0x140148ea8]
lea rbx, [0x140148ea8]
cmp r10, rbx
je 0x1400da5d4
test byte [r10 + 0x1c], 2
je 0x1400da5d4
cmp byte [r10 + 0x19], 4
jb 0x1400da5d4
mov edx, LoadRegTypeLib
mov r9, qword [r11 + r14*8]
jmp 0x1400da088
cmp qword [rdi + 0x10], r13
je 0x1400da311
mov rax, qword [section..data]
mov rbx, qword [rax + 0x18]
mov rcx, rbx
call qword [fcn.140015690]
lea rcx, section..data
call rbx
add rax, 0x18
mov qword [rbp - 0x49], rax
cmp r15d, dword [rbp - 0x79]
jge 0x1400da633
mov rax, qword [rsp + 0x30]
lea r9, [rbp - 0x49]
lea r8, [0x1400da758]
mov rdx, qword [rax + r14*8]
mov rcx, r12
call fcn.1400d8938
mov rcx, qword [rbp - 0x49]
test eax, eax
jne 0x1400da2e6
cmp dword [rcx - 0x10], r13d
je 0x1400da2e6
mov rax, qword [rdi]
jmp 0x1400da253
mov rdx, qword [rax + 0x10]
mov r10, rcx
sub r10, rdx
movzx r8d, word [rdx]
movzx r9d, word [rdx + r10]
sub r8d, r9d
jne 0x1400da24b
add rdx, 2
test r9d, r9d
jne 0x1400da234
test r8d, r8d
je 0x1400da25b
mov rax, qword [rax]
test rax, rax
jne 0x1400da22a
mov rax, r13
test rax, rax
jne 0x1400da2e6
mov r10, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp r10, rax
je 0x1400da2b6
test byte [r10 + 0x1c], 2
je 0x1400da2b6
cmp byte [r10 + 0x19], 4
jb 0x1400da2b6
cmp r15d, dword [rbp - 0x79]
jge 0x1400da623
mov rax, qword [rsp + 0x30]
mov edx, reloc.OLEAUT32.dll_LoadRegTypeLib
mov qword [rsp + 0x20], rcx
mov r9, qword [rax + r14*8]
lea r8, [0x1400091f8]
mov rcx, qword [r10 + 0x10]
call fcn.140017150
mov rcx, qword [rbp - 0x49]
lea r14, [rcx - 0x18]
lock add dword [r14 + 0x10], 0xffffffff
jg 0x1400da2dd
mov rdi, qword [r14]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.140015690]
mov rdx, r14
mov rcx, rdi
call rbx
mov r14, qword [rbp - 0x71]
jmp 0x1400da5cd
lea r14, [rcx - 0x18]
lock add dword [r14 + 0x10], 0xffffffff
jg 0x1400da30d
mov rdi, qword [r14]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.140015690]
mov rdx, r14
mov rcx, rdi
call rbx
mov r14, qword [rbp - 0x71]
mov r12d, r13d
cmp dword [rbp - 0x51], 0
jle 0x1400da588
xor edi, edi
mov qword [rbp - 0x29], rdi
and qword [rbp - 0x21], rdi
and qword [rbp - 0x19], rdi
mov rsi, qword [rbp + 0x5f]
mov rax, qword [rsi]
mov rbx, qword [rax + 0x58]
mov rcx, rbx
call qword [fcn.140015690]
mov rcx, rsi
call rbx
mov rdx, rax
lea rcx, [rbp - 0x69]
call fcn.140011450
nop
lea r8d, [rdi + 1]
lea rdx, [0x140001cb8]
lea rcx, [rbp - 0x69]
call fcn.140010e38
test r13, r13
js 0x1400da676
cmp r12d, dword [rbp - 0x51]
jge 0x1400da676
mov rax, qword [rbp - 0x59]
mov rdx, qword [rax + r13*8]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x69]
call fcn.140010e38
and qword [rbp - 0x31], rdi
lea rax, [rbp - 0x31]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rdx, qword [rbp - 0x69]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test eax, eax
jne 0x1400da3c3
mov rdi, qword [rbp - 0x31]
mov qword [rbp - 0x29], rdi
mov rcx, qword [0x140148ea8]
lea rbx, [0x140148ea8]
cmp rcx, rbx
je 0x1400da3fa
test byte [rcx + 0x1c], 2
je 0x1400da3fa
cmp byte [rcx + 0x19], 4
jb 0x1400da3fa
mov edx, reloc.OLEAUT32.dll_RegisterTypeLib
mov r9d, esi
lea r8, [0x1400091f8]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
test esi, esi
jne 0x1400da49a
and dword [rbp - 0x5d], esi
test r14, r14
js 0x1400da666
cmp r15d, dword [rbp - 0x79]
jge 0x1400da666
mov rax, qword [rsp + 0x30]
mov dword [rbp - 0x3d], 4
lea rcx, [rbp - 0x3d]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x5d]
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x41]
xor r8d, r8d
mov rdx, qword [rax + r14*8]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
jne 0x1400da45d
mov eax, dword [rbp - 0x41]
sub eax, 4
neg eax
sbb esi, esi
and esi, 0xd
mov rcx, qword [0x140148ea8]
cmp rcx, rbx
je 0x1400da494
test byte [rcx + 0x1c], 2
je 0x1400da494
cmp byte [rcx + 0x19], 4
jb 0x1400da494
mov edx, reloc.OLEAUT32.dll_QueryPathOfRegTypeLib
mov r9d, esi
lea r8, [0x1400091f8]
mov rcx, qword [rcx + 0x10]
call fcn.14000fd64
mov rcx, qword [0x140148ea8]
cmp dword [rbp - 0x5d], 0
jne 0x1400da4ec
mov r14, qword [rbp - 0x69]
lock add dword [r14 - 8], 0xffffffff
jg 0x1400da4c4
mov rdi, qword [r14 - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.140015690]
lea rdx, [r14 - 0x18]
mov rcx, rdi
call rbx
nop
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x1400da4d3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc r12d
inc r13
cmp r12d, dword [rbp - 0x51]
jge 0x1400da588
mov r14, qword [rbp - 0x71]
jmp 0x1400da31e
cmp rcx, rbx
je 0x1400da53d
test byte [rcx + 0x1c], 2
je 0x1400da53d
cmp byte [rcx + 0x19], 4
jb 0x1400da53d
cmp r12d, dword [rbp - 0x51]
jge 0x1400da656
mov rax, qword [rbp - 0x59]
mov r8, qword [rax + r13*8]
cmp r15d, dword [rbp - 0x79]
jge 0x1400da646
mov rax, qword [rsp + 0x30]
mov edx, ConnectToConnectionPoint
mov qword [rsp + 0x20], r8
mov r9, qword [rax + r14*8]
lea r8, [0x1400091f8]
mov rcx, qword [rcx + 0x10]
call fcn.140017150
nop
mov r14, qword [rbp - 0x69]
or eax, 0xffffffff
lock xadd dword [r14 - 8], eax
xor r13d, r13d
dec eax
jg 0x1400da56f
mov rdi, qword [r14 - 0x18]
mov rax, qword [rdi]
mov rbx, qword [rax + 8]
mov rcx, rbx
call qword [fcn.140015690]
lea rdx, [r14 - 0x18]
mov rcx, rdi
call rbx
nop
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x1400da57e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14, qword [rbp - 0x71]
mov r12, qword [rbp + 0x5f]
jmp 0x1400da5cd
cmp r15d, dword [rbp - 0x79]
jge 0x1400da6a2
mov rdx, qword [rsp + 0x30]
mov r14, qword [rbp - 0x71]
mov rdx, qword [rdx + r14*8]
mov r12, qword [rbp + 0x5f]
mov rcx, r12
call fcn.1400d7124
cmp r15d, dword [rbp - 0x79]
jge 0x1400da692
movsxd rcx, r15d
mov rax, qword [rsp + 0x30]
lea rdx, [rax + rcx*8]
mov rcx, qword [rbp + 0x7f]
call fcn.140026e40
xor r13d, r13d
mov r10, qword [0x140148ea8]
inc r15d
inc r14
mov qword [rbp - 0x71], r14
cmp r15d, dword [rbp - 0x79]
jge 0x1400da689
mov rdi, qword [rbp + 0x6f]
mov rbx, qword [rbp + 0x67]
jmp 0x1400d9fd2
mov edx, 1
mov ecx, 0xc000008c
call fcn.1400119d8
int3
mov edx, 1
mov ecx, 0xc000008c
call fcn.1400119d8
int3
mov ecx, 0x80004005
call fcn.1400119f0
nop
jmp 0x1400da622
nop
mov edx, 1
mov ecx, 0xc000008c
call fcn.1400119d8
int3
mov edx, 1
mov ecx, 0xc000008c
call fcn.1400119d8
nop
jmp 0x1400da645
nop
mov edx, 1
mov ecx, 0xc000008c
call fcn.1400119d8
int3
mov edx, 1
mov ecx, 0xc000008c
call fcn.1400119d8
int3
mov edx, 1
mov ecx, 0xc000008c
call fcn.1400119d8
int3
mov edx, 1
mov ecx, 0xc000008c
call fcn.1400119d8
nop
jmp 0x1400da688
nop
lea r14, [0x140148ea8]
jmp 0x1400da6e2
mov edx, 1
mov ecx, 0xc000008c
call fcn.1400119d8
int3
mov edx, 1
mov ecx, 0xc000008c
call fcn.1400119d8
int3
mov edx, 1
mov ecx, 0xc000008c
call fcn.1400119d8
int3
mov edx, 1
mov ecx, 0xc000008c
call fcn.1400119d8
int3
mov edx, 1
mov ecx, 0xc000008c
call fcn.1400119d8
int3
cmp r10, r14
je 0x1400da727
test byte [r10 + 0x1c], 1
je 0x1400da727
movzx edx, byte [r10 + 0x19]
mov eax, esi
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jl 0x1400da727
mov rax, qword [rbp + 0x7f]
mov eax, dword [rax + 8]
mov edx, ConnectToConnectionPoint
mov dword [rsp + 0x20], eax
mov r9d, esi
lea r8, [0x1400091f8]
mov rcx, qword [r10 + 0x10]
call fcn.140011e38
nop
lea rcx, [rbp - 0x59]
call fcn.140026ee0
nop
lea rcx, [rsp + 0x30]
call fcn.140026ee0
mov eax, esi
add rsp, 0xc8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret