Function at 0x140033ac0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x150], rbx
mov rax, qword [0x1403d88e8]
xor rax, rsp
mov qword [rbp], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x70], rcx
call fcn.1400f9930
mov rcx, rax
test rax, rax
je 0x140033e51
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x30], rax
lea r14, str.SYSTEMCurrentControlSetControlMediaCategories_
mov rdx, r14
lea rcx, [rsp + 0x30]
call fcn.140015a40
or rbx, 0xffffffffffffffff
test al, al
jne 0x140033b5c
mov rax, rbx
nop dword [rax]
inc rax
cmp word [r14 + rax*2], 0
jne 0x140033b40
mov r8d, eax
mov rdx, r14
lea rcx, [rsp + 0x30]
call fcn.1400105e0
nop
xor r15d, r15d
mov qword [rsp + 0x48], r15
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x58], r15
call fcn.1400f9930
mov rcx, rax
test rax, rax
je 0x140033e5c
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x38], rax
lea r14, [0x140345b70]
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.140015a40
test al, al
jne 0x140033bcc
mov rax, rbx
nop dword [rax]
inc rax
cmp word [r14 + rax*2], 0
jne 0x140033bb0
mov r8d, eax
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.1400105e0
nop
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.140033090
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x30]
call fcn.14001cfc0
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140033c0a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r9d, 0x20019
mov r8, qword [rsp + 0x30]
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x48]
call fcn.140015610
test eax, eax
je 0x140033cd6
lea r8, str.Common.cpp
mov edx, 0x735
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
call fcn.1400f9930
mov rcx, rax
test rax, rax
je 0x140033e67
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
xor edx, edx
mov rcx, rdi
call fcn.140015a40
test al, al
jne 0x140033c80
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.1400105e0
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140033c9f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140033cb0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x140033e2b
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
jmp 0x140033e2b
mov dword [rsp + 0x40], 0x80
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, str.Name
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140033d31
mov eax, dword [rsp + 0x44]
dec eax
cmp eax, 1
ja 0x140033d31
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x140033d5c
test al, 1
jne 0x140033d31
shr rax, 1
cmp word [rsp + rax*2 + 0x7e], 0
je 0x140033d61
lea r8, str.Common.cpp
mov edx, 0x738
lea rcx, str._VCpl__RETURN_FALSE_ON_FALSE:_Line___d__File___s_n
call fcn.140055180
call fcn.1400f9930
mov rcx, rax
test rax, rax
je 0x140033e72
jmp 0x140033db6
mov word [rbp - 0x80], r15w
lea rcx, [rbp - 0x80]
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x140033d70
mov r8d, eax
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x38]
call fcn.1400105e0
mov rsi, qword [rsp + 0x38]
lea rcx, [rsi - 0x18]
call fcn.140015740
add rax, 0x18
mov qword [rdi], rax
mov eax, ebx
lock xadd dword [rsi - 8], eax
sub eax, 1
jg 0x140033dfe
mov rcx, qword [rsi - 0x18]
lea rdx, [rsi - 0x18]
jmp 0x140033df7
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rdi], rax
xor edx, edx
mov rcx, rdi
call fcn.140015a40
test al, al
jne 0x140033ddf
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.1400105e0
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140033dfe
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140033e0f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
sub ebx, 1
jg 0x140033e2b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rdi
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.14029d880
mov rbx, qword [rsp + 0x150]
add rsp, 0x110
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.14000de90
nop
mov ecx, 0x80004005
call fcn.14000de90
nop
mov ecx, 0x80004005
call fcn.14000de90
int3
mov ecx, 0x80004005
call fcn.14000de90
int3