Function at 0x1400bac54
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xc0
mov qword [rbp + 0xf], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov rsi, r8
mov r14, rdx
mov r13, rcx
lea r12, [0x140106190]
mov rcx, qword [0x140106190]
cmp rcx, r12
je 0x1400bacc2
test byte [rcx + 0x1c], 1
je 0x1400bacc2
cmp byte [rcx + 0x19], 5
jb 0x1400bacc2
mov rax, qword [r8 + 0x10]
mov dword [rsp + 0x20], eax
mov r9d, dword [rdx + 8]
mov rcx, qword [rcx + 0x10]
call fcn.1400b79cc
xor r15d, r15d
mov qword [rbp - 0x71], r15
mov qword [rbp - 0x69], r15
lea rdx, [rbp - 0x71]
mov rcx, r13
call fcn.1400b7dc8
mov ebx, eax
mov r10, qword [0x140106190]
cmp r10, r12
je 0x1400bad14
test byte [r10 + 0x1c], 2
je 0x1400bad14
cmp byte [r10 + 0x19], 4
jb 0x1400bad14
mov edx, 0x99
mov r9d, eax
lea r8, [0x1400e7b20]
mov rcx, qword [r10 + 0x10]
call fcn.140003634
mov r10, qword [0x140106190]
mov qword [rbp - 0x51], r15
mov qword [rbp - 0x49], r15
test ebx, ebx
jne 0x1400bae2f
mov rax, qword [r13]
mov rcx, r13
mov rax, qword [rax + 0x58]
call qword [case.0x14006e230.0]
test rax, rax
je 0x1400bae28
mov rdi, r15
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov qword [rbp + 7], r15
mov rax, qword [r13]
mov rcx, r13
mov rax, qword [rax + 0x58]
call qword [case.0x14006e230.0]
mov qword [rbp - 0x31], r15
lea rcx, [rbp - 0x31]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20119
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400bad95
mov ebx, r15d
mov rdi, qword [rbp - 0x31]
mov qword [rbp - 9], rdi
mov r10, qword [0x140106190]
cmp r10, r12
je 0x1400badce
test byte [r10 + 0x1c], 2
je 0x1400badce
cmp byte [r10 + 0x19], 4
jb 0x1400badce
mov edx, 0x9a
mov r9d, ebx
lea r8, [0x1400e7b20]
mov rcx, qword [r10 + 0x10]
call fcn.140003634
mov r10, qword [0x140106190]
test ebx, ebx
jne 0x1400bae1a
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 9]
call fcn.1400b3638
mov ebx, eax
mov r10, qword [0x140106190]
cmp r10, r12
je 0x1400bae1a
test byte [r10 + 0x1c], 2
je 0x1400bae1a
cmp byte [r10 + 0x19], 4
jb 0x1400bae1a
mov edx, 0x9b
mov r9d, eax
lea r8, [0x1400e7b20]
mov rcx, qword [r10 + 0x10]
call fcn.140003634
mov r10, qword [0x140106190]
test rdi, rdi
je 0x1400bae2f
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r10, qword [0x140106190]
mov edi, r15d
cmp dword [rbp - 0x69], r15d
jle 0x1400bb4bf
mov r12, r15
mov dword [rbp + 0x77], r15d
test edi, edi
js 0x1400bb4b4
cmp edi, dword [rbp - 0x69]
jge 0x1400bb4b4
mov rax, qword [rbp - 0x71]
lea r8, [rbp + 0x77]
mov rdx, qword [rax + r12*8]
mov rcx, r13
call fcn.1400b9468
mov ebx, eax
mov r10, qword [0x140106190]
lea rax, [0x140106190]
cmp r10, rax
je 0x1400baeb1
test byte [r10 + 0x1c], 2
je 0x1400baeb1
cmp byte [r10 + 0x19], 4
jb 0x1400baeb1
mov edx, 0x9c
mov r9d, ebx
lea r8, [0x1400e7b20]
mov rcx, qword [r10 + 0x10]
call fcn.140003634
mov r10, qword [0x140106190]
lea rax, [0x140106190]
test ebx, ebx
jne 0x1400baf05
cmp dword [rbp + 0x77], 1
jne 0x1400baf05
cmp r10, rax
je 0x1400bb409
test byte [r10 + 0x1c], 2
je 0x1400bb409
cmp byte [r10 + 0x19], 4
jb 0x1400bb409
cmp edi, dword [rbp - 0x69]
jge 0x1400bb41c
mov edx, LoadRegTypeLib
mov rax, qword [rbp - 0x71]
mov r9, qword [rax + r12*8]
lea r8, [0x1400e7b20]
mov rcx, qword [r10 + 0x10]
call fcn.140003598
jmp 0x1400bb402
mov dword [rbp - 0x61], r15d
cmp edi, dword [rbp - 0x69]
jge 0x1400bb4a9
mov rax, qword [rbp - 0x71]
lea r9, [rbp - 0x61]
lea r8, str.DefaultAuthorization
mov rdx, qword [rax + r12*8]
mov rcx, r13
call fcn.1400b9700
test eax, eax
jne 0x1400baf77
cmp dword [rbp - 0x61], 1
jne 0x1400baf77
mov r10, qword [0x140106190]
lea rax, [0x140106190]
cmp r10, rax
je 0x1400bb409
test byte [r10 + 0x1c], 2
je 0x1400bb409
cmp byte [r10 + 0x19], 4
jb 0x1400bb409
cmp edi, dword [rbp - 0x69]
jge 0x1400bb427
mov edx, RegisterTypeLib
jmp 0x1400baee8
cmp edi, dword [rbp - 0x69]
jge 0x1400bb49e
mov r11, qword [rbp - 0x71]
mov ecx, r15d
cmp dword [r14 + 8], r15d
jle 0x1400bafe3
mov r9, qword [r14]
mov r10d, r15d
cmp qword [r11 + r12*8], r15
setne r10b
test r10d, r10d
je 0x1400bb432
mov rax, qword [r9]
mov r8, qword [r11 + r12*8]
sub r8, rax
movzx edx, word [rax]
cmp dx, word [rax + r8]
jne 0x1400bafc6
add rax, 2
test dx, dx
jne 0x1400bafae
mov eax, r15d
jmp 0x1400bafcb
sbb eax, eax
or eax, 1
test eax, eax
je 0x1400bafdd
inc ecx
add r9, 8
cmp ecx, dword [r14 + 8]
jl 0x1400baf9b
jmp 0x1400bafe3
or r14d, 0xffffffff
jmp 0x1400bafea
or r14d, 0xffffffff
mov ecx, r14d
cmp ecx, r14d
je 0x1400bb02a
mov r10, qword [0x140106190]
lea rax, [0x140106190]
cmp r10, rax
je 0x1400bb409
test byte [r10 + 0x1c], 2
je 0x1400bb409
cmp byte [r10 + 0x19], 4
jb 0x1400bb409
mov edx, QueryPathOfRegTypeLib
mov r9, qword [r11 + r12*8]
jmp 0x1400baef0
cmp qword [rsi + 0x10], r15
je 0x1400bb168
mov rax, qword [0x140108fd0]
lea rcx, [0x140108fd0]
mov rax, qword [rax + 0x18]
call qword [case.0x14006e230.0]
add rax, 0x18
mov qword [rbp - 0x39], rax
cmp edi, dword [rbp - 0x69]
jge 0x1400bb448
mov rax, qword [rbp - 0x71]
lea r9, [rbp - 0x39]
lea r8, str.NetworkInterface
mov rdx, qword [rax + r12*8]
mov rcx, r13
call fcn.1400b98e0
mov rcx, qword [rbp - 0x39]
test eax, eax
jne 0x1400bb145
cmp dword [rcx - 0x10], r15d
je 0x1400bb145
mov rax, qword [rsi]
jmp 0x1400bb0bc
mov rdx, qword [rax + 0x10]
mov r10, rcx
sub r10, rdx
movzx r8d, word [rdx]
movzx r9d, word [rdx + r10]
sub r8d, r9d
jne 0x1400bb0b4
add rdx, 2
test r9d, r9d
jne 0x1400bb09d
test r8d, r8d
je 0x1400bb0c4
mov rax, qword [rax]
test rax, rax
jne 0x1400bb093
mov rax, r15
test rax, rax
jne 0x1400bb145
mov r10, qword [0x140106190]
lea rax, [0x140106190]
cmp r10, rax
je 0x1400bb119
test byte [r10 + 0x1c], 2
je 0x1400bb119
cmp byte [r10 + 0x19], 4
jb 0x1400bb119
cmp edi, dword [rbp - 0x69]
jge 0x1400bb43d
mov rax, qword [rbp - 0x71]
mov edx, QueryPathOfRegTypeLib
mov qword [rsp + 0x20], rcx
mov r9, qword [rax + r12*8]
lea r8, [0x1400e7b20]
mov rcx, qword [r10 + 0x10]
call fcn.14000a5c4
mov rcx, qword [rbp - 0x39]
lea rdx, [rcx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x1400bb402
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14006e230.0]
jmp 0x1400bb402
lea rdx, [rcx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
add eax, r14d
test eax, eax
jg 0x1400bb168
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14006e230.0]
mov esi, r15d
cmp dword [rbp - 0x49], 0
jle 0x1400bb3c5
xor r14d, r14d
mov qword [rbp - 0x21], r14
and qword [rbp - 0x19], r14
and qword [rbp - 0x11], r14
mov rax, qword [r13]
mov rcx, r13
mov rax, qword [rax + 0x58]
call qword [case.0x14006e230.0]
mov rdx, rax
lea rcx, [rbp - 0x59]
call fcn.140004b74
nop
lea r8d, [r14 + 1]
lea rdx, str._DB
lea rcx, [rbp - 0x59]
call fcn.140004588
test r15, r15
js 0x1400bb474
cmp esi, dword [rbp - 0x49]
jge 0x1400bb474
mov rax, qword [rbp - 0x51]
mov rdx, qword [rax + r15*8]
mov r8d, dword [rdx - 0x10]
lea rcx, [rbp - 0x59]
call fcn.140004588
and qword [rbp - 0x29], r14
lea rax, [rbp - 0x29]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rdx, qword [rbp - 0x59]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
jne 0x1400bb212
mov r14, qword [rbp - 0x29]
mov qword [rbp - 0x21], r14
mov rcx, qword [0x140106190]
lea rax, [0x140106190]
cmp rcx, rax
je 0x1400bb249
test byte [rcx + 0x1c], 2
je 0x1400bb249
cmp byte [rcx + 0x19], 4
jb 0x1400bb249
mov edx, reloc.OLEAUT32.dll_LoadRegTypeLib
mov r9d, ebx
lea r8, [0x1400e7b20]
mov rcx, qword [rcx + 0x10]
call fcn.140003634
test ebx, ebx
jne 0x1400bb2f5
and dword [rbp - 0x5d], ebx
test r12, r12
js 0x1400bb469
cmp edi, dword [rbp - 0x69]
jge 0x1400bb469
mov rax, qword [rbp - 0x71]
mov dword [rbp - 0x41], 4
lea rcx, [rbp - 0x41]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x5d]
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x3d]
xor r8d, r8d
mov rdx, qword [rax + r12*8]
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x1400bb2aa
mov eax, dword [rbp - 0x3d]
sub eax, 4
neg eax
sbb ebx, ebx
and ebx, 0xd
mov rcx, qword [0x140106190]
lea rax, [0x140106190]
cmp rcx, rax
je 0x1400bb2ef
test byte [rcx + 0x1c], 2
je 0x1400bb2ef
cmp byte [rcx + 0x19], 4
jb 0x1400bb2ef
mov edx, reloc.OLEAUT32.dll_RegisterTypeLib
mov r9d, ebx
lea r8, [0x1400e7b20]
mov rcx, qword [rcx + 0x10]
call fcn.140003634
mov rcx, qword [0x140106190]
lea rax, [0x140106190]
cmp dword [rbp - 0x5d], 0
jne 0x1400bb33d
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400bb31b
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14006e230.0]
nop
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x1400bb32a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
inc r15
cmp esi, dword [rbp - 0x49]
jge 0x1400bb3c5
jmp 0x1400bb175
cmp rcx, rax
je 0x1400bb38b
test byte [rcx + 0x1c], 2
je 0x1400bb38b
cmp byte [rcx + 0x19], 4
jb 0x1400bb38b
cmp esi, dword [rbp - 0x49]
jge 0x1400bb45e
mov rax, qword [rbp - 0x51]
mov r8, qword [rax + r15*8]
cmp edi, dword [rbp - 0x69]
jge 0x1400bb453
mov rax, qword [rbp - 0x71]
mov edx, reloc.OLEAUT32.dll_QueryPathOfRegTypeLib
mov qword [rsp + 0x20], r8
mov r9, qword [rax + r12*8]
lea r8, [0x1400e7b20]
mov rcx, qword [rcx + 0x10]
call fcn.14000a5c4
nop
mov rdx, qword [rbp - 0x59]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
xor r15d, r15d
sub eax, 1
jg 0x1400bb3b4
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14006e230.0]
nop
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x1400bb3fe
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400bb3fe
cmp edi, dword [rbp - 0x69]
jge 0x1400bb493
mov rdx, qword [rbp - 0x71]
mov rdx, qword [rdx + r12*8]
mov rcx, r13
call fcn.1400b81cc
cmp edi, dword [rbp - 0x69]
jge 0x1400bb488
movsxd rcx, edi
mov rax, qword [rbp - 0x71]
lea rdx, [rax + rcx*8]
mov rcx, qword [rbp + 0x7f]
call fcn.140018668
xor r15d, r15d
mov rsi, qword [rbp + 0x6f]
mov r10, qword [0x140106190]
inc edi
inc r12
cmp edi, dword [rbp - 0x69]
jge 0x1400bb47f
mov r14, qword [rbp + 0x67]
jmp 0x1400bae3f
mov ecx, 0xc000008c
call fcn.140005064
int3
mov ecx, 0xc000008c
call fcn.140005064
int3
mov ecx, 0x80004005
call fcn.14000507c
nop
mov ecx, 0xc000008c
call fcn.140005064
int3
mov ecx, 0xc000008c
call fcn.140005064
nop
mov ecx, 0xc000008c
call fcn.140005064
int3
mov ecx, 0xc000008c
call fcn.140005064
int3
mov ecx, 0xc000008c
call fcn.140005064
int3
mov ecx, 0xc000008c
call fcn.140005064
nop
lea r12, [0x140106190]
jmp 0x1400bb4bf
mov ecx, 0xc000008c
call fcn.140005064
int3
mov ecx, 0xc000008c
call fcn.140005064
int3
mov ecx, 0xc000008c
call fcn.140005064
int3
mov ecx, 0xc000008c
call fcn.140005064
int3
mov ecx, 0xc000008c
call fcn.140005064
int3
cmp r10, r12
je 0x1400bb504
test byte [r10 + 0x1c], 1
je 0x1400bb504
movzx edx, byte [r10 + 0x19]
mov eax, ebx
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jl 0x1400bb504
mov rax, qword [rbp + 0x7f]
mov eax, dword [rax + 8]
mov edx, ConnectToConnectionPoint
mov dword [rsp + 0x20], eax
mov r9d, ebx
lea r8, [0x1400e7b20]
mov rcx, qword [r10 + 0x10]
call fcn.1400054b8
nop
lea rcx, [rbp - 0x51]
call fcn.1400185e8
nop
lea rcx, [rbp - 0x71]
call fcn.1400185e8
mov eax, ebx
mov rbx, qword [rsp + 0x100]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret