Function at 0x140020ba0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x4c0]
sub rsp, 0x5c0
mov rax, qword [0x140062148]
xor rax, rsp
mov qword [rbp + 0x4b0], rax
mov r14, rdx
mov rdi, rcx
lea rdx, str.B9AA1F11_F480_4054_A84E_B5D9277E40A8
lea rcx, [rbp + 0x70]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_wchar_t_const____ptr64____ptr64]
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor r15d, r15d
mov qword [rsp + 0x60], r15
mov dword [rsp + 0x68], r15d
mov qword [rsp + 0x70], r15
lea rdx, [0x140046190]
lea rcx, [rbp - 8]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_wchar_t_const____ptr64____ptr64]
nop
lea rcx, [rbp - 0x30]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_void____ptr64]
nop
lea rdx, str.SoftwareClassesTypeLib_
lea rcx, [rbp - 0x80]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_wchar_t_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x80]
call qword [reloc.Cmmlib.dll___Y__CStringT__W_Cmm__QEAAAEAV01_AEBV01__Z]
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x58]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_class_Cmm::CStringT_wchar_t_____ptr64____ptr64]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 8]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_class_Cmm::CStringT_wchar_t_____ptr64____ptr64]
lea rcx, [rbp - 0x58]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
mov rbx, 0xffffffff80000002
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
lea r8, [rbp - 8]
mov rdx, rbx
mov rcx, rdi
call fcn.140022330
test eax, eax
jne 0x140020d5f
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
lea r8, [rbp - 8]
mov rdx, rbx
mov rcx, rdi
call fcn.140022330
test eax, eax
jne 0x140020d5f
lea rdx, str.TypeLib_
lea rcx, [rbp - 0x80]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_wchar_t_const____ptr64____ptr64]
nop
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x80]
call qword [reloc.Cmmlib.dll___Y__CStringT__W_Cmm__QEAAAEAV01_AEBV01__Z]
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x58]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_class_Cmm::CStringT_wchar_t_____ptr64____ptr64]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 8]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_class_Cmm::CStringT_wchar_t_____ptr64____ptr64]
lea rcx, [rbp - 0x58]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
mov rbx, 0xffffffff80000000
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20219
lea r8, [rbp - 8]
mov rdx, rbx
mov rcx, rdi
call fcn.140022330
test eax, eax
jne 0x140020d5f
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
lea r8, [rbp - 8]
mov rdx, rbx
mov rcx, rdi
call fcn.140022330
cmp eax, 1
jne 0x140021016
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x58]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_class_Cmm::CStringT_wchar_t__const____ptr64____ptr64]
nop
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_class_Cmm::CStringT_wchar_t__const____ptr64____ptr64]
nop
lea rdx, [0x140046190]
lea rcx, [rbp - 0x80]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_wchar_t_const____ptr64____ptr64]
nop
lea rdx, [0x140046190]
lea rcx, [rbp + 0x20]
call qword [sym.imp.Cmmlib.dll_public:_void___cdecl_Cmm::CStringT_wchar_t_::constructor_wchar_t_const____ptr64____ptr64]
nop
lea rdx, str.win32
lea rcx, [rbp - 0x58]
call qword [reloc.Cmmlib.dll___Y__CStringT__W_Cmm__QEAAAEAV01_PEB_W_Z]
lea rdx, str.Win64
lea rcx, [rbp + 0x48]
call qword [reloc.Cmmlib.dll___Y__CStringT__W_Cmm__QEAAAEAV01_PEB_W_Z]
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x40], r15
lea rcx, [rbp + 0x48]
call qword [sym.imp.Cmmlib.dll_public:_wchar_t_const____ptr64___cdecl_Cmm::CStringT_wchar_t_::c_str_void_const___ptr64]
mov r8, rax
mov r9d, 0x20019
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1400166c0
mov rsi, qword [rsp + 0x30]
test eax, eax
jne 0x140020e9e
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0xa0]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x78], 0x410
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x7c]
xor r8d, r8d
lea rdx, [0x140046190]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140020e9e
mov eax, dword [rsp + 0x7c]
dec eax
cmp eax, 1
ja 0x140020e9e
mov eax, dword [rsp + 0x78]
test eax, eax
je 0x140020e85
test al, 1
jne 0x140020e9e
shr rax, 1
cmp word [rbp + rax*2 + 0x9e], 0
je 0x140020e8d
jmp 0x140020e9e
mov word [rbp + 0xa0], r15w
lea rdx, [rbp + 0xa0]
lea rcx, [rbp - 0x80]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x58], r15
lea rcx, [rbp - 0x58]
call qword [sym.imp.Cmmlib.dll_public:_wchar_t_const____ptr64___cdecl_Cmm::CStringT_wchar_t_::c_str_void_const___ptr64]
mov r8, rax
mov r9d, 0x20019
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.1400166c0
mov rdi, qword [rsp + 0x48]
test eax, eax
jne 0x140020f70
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp + 0xa0]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x78], 0x410
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x7c]
xor r8d, r8d
lea rdx, [0x140046190]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140020f70
mov eax, dword [rsp + 0x7c]
dec eax
cmp eax, 1
ja 0x140020f70
mov eax, dword [rsp + 0x78]
test eax, eax
je 0x140020f57
test al, 1
jne 0x140020f70
shr rax, 1
cmp word [rbp + rax*2 + 0x9e], 0
je 0x140020f5f
jmp 0x140020f70
mov word [rbp + 0xa0], r15w
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x20]
call qword [sym.imp.Cmmlib.dll_public:_class_Cmm::CStringT_wchar_t_____ptr64___cdecl_Cmm::CStringT_wchar_t_::operator_wchar_t_const____ptr64____ptr64]
lea rcx, [rbp - 0x80]
call qword [sym.imp.Cmmlib.dll_public:_int___cdecl_Cmm::CStringT_wchar_t_::IsEmpty_void_const___ptr64]
mov ebx, 1
test eax, eax
jne 0x140020f9b
lea rcx, [rbp + 0x20]
call qword [sym.imp.Cmmlib.dll_public:_int___cdecl_Cmm::CStringT_wchar_t_::IsEmpty_void_const___ptr64]
test eax, eax
jne 0x140020f9b
mov eax, 3
mov dword [r14], eax
jmp 0x140020fcb
lea rcx, [rbp - 0x80]
call qword [sym.imp.Cmmlib.dll_public:_int___cdecl_Cmm::CStringT_wchar_t_::IsEmpty_void_const___ptr64]
test eax, eax
jne 0x140020fb3
mov eax, 2
mov dword [r14], eax
jmp 0x140020fcb
lea rcx, [rbp + 0x20]
call qword [sym.imp.Cmmlib.dll_public:_int___cdecl_Cmm::CStringT_wchar_t_::IsEmpty_void_const___ptr64]
test eax, eax
jne 0x140020fc8
mov eax, ebx
mov dword [r14], ebx
jmp 0x140020fcb
mov ebx, r15d
test rdi, rdi
je 0x140020fda
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
test rsi, rsi
je 0x140020fe9
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp + 0x20]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x80]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x48]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
nop
lea rcx, [rbp - 0x58]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
jmp 0x140021019
mov ebx, r15d
lea rcx, [rbp - 0x30]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
nop
lea rcx, [rbp - 8]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x70]
call qword [sym.imp.Cmmlib.dll_public_virtual:_void___cdecl_Cmm::CStringT_wchar_t_::destructor_void____ptr64]
mov eax, ebx
mov rcx, qword [rbp + 0x4b0]
xor rcx, rsp
call fcn.140032650
lea r11, [rsp + 0x5c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret