Function at 0x100038124
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x188
mov rax, qword [0x10007f110]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbp, r8
mov rsi, rcx
mov ebx, edx
mov r13d, 0x5e
lea r8, [0x100005e28]
lea rcx, [rsp + 0x58]
mov edx, r13d
mov rdi, r9
call sub.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::constructor_unsigned_long_int__char_const____ptr64____ptr64
xor r12d, r12d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x70]
mov edx, ebx
mov rcx, rsi
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x44], 0x40
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x40], 0x80
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegEnumKeyExW]
mov ebx, eax
cmp eax, r12d
je 0x1000381dc
cmp eax, 0x103
je 0x10003830d
lea r8, [0x100005e50]
mov r9d, eax
xor edx, edx
mov ecx, r13d
call sub.vdsutil.dll_void___cdecl_VdsTraceEx_unsigned_long_int__unsigned_long_int__char____ptr64_
jmp 0x10003830d
lea rcx, [rsp + 0x70]
mov rdx, rdi
call qword [sym.imp.ole32.dll_CLSIDFromString]
cmp eax, r12d
mov ebx, eax
jge 0x100038236
lea r8, [0x100005e80]
mov r9d, eax
xor edx, edx
mov ecx, r13d
call sub.vdsutil.dll_void___cdecl_VdsTraceEx_unsigned_long_int__unsigned_long_int__char____ptr64_
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rax
mov r9d, ebx
xor r8d, r8d
xor edx, edx
mov ecx, 0xc200000c
mov dword [rsp + 0x20], 0x2000007
call fcn.1000320a8
movzx ebx, bx
jmp 0x10003830d
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0x70]
mov r9d, 0x2000000
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
mov ebx, eax
cmp eax, r12d
je 0x10003826a
lea r8, [0x100005eb0]
jmp 0x1000381ca
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x40]
lea rdx, str.Clsid
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xf0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
mov ebx, eax
cmp eax, r12d
je 0x1000382ac
lea r8, [0x100005ee0]
jmp 0x1000381ca
lea rcx, [rsp + 0xf0]
mov rdx, rbp
mov word [rsp + 0x16e], r12w
call qword [sym.imp.ole32.dll_CLSIDFromString]
cmp eax, r12d
mov edi, eax
jge 0x100038343
lea r8, [0x100005f10]
mov r9d, eax
xor edx, edx
mov ecx, r13d
call sub.vdsutil.dll_void___cdecl_VdsTraceEx_unsigned_long_int__unsigned_long_int__char____ptr64_
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], rax
mov r9d, edi
xor r8d, r8d
xor edx, edx
mov ecx, 0xc200000d
mov dword [rsp + 0x20], 0x2000008
call fcn.1000320a8
movzx ebx, di
cmp ebx, r12d
je 0x100038343
cmp ebx, 0x103
je 0x100038343
lea rax, [rsp + 0x70]
mov qword [rsp + 0x30], r12
mov r9d, ebx
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov ecx, 0xc200000e
mov dword [rsp + 0x20], 0x2000009
call fcn.1000320a8
mov rcx, qword [rsp + 0x48]
cmp rcx, r12
je 0x100038359
cmp rcx, 0xffffffffffffffff
je 0x100038359
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
lea rcx, [rsp + 0x58]
call sub.vdsutil.dll_public:_void___cdecl_CVdsCallTracer::destructor_void____ptr64
mov eax, ebx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.100075490
add rsp, 0x188
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret