Function at 0x14000e090
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x70
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov r12, rdx
mov r13, rcx
or rbp, 0xffffffffffffffff
mov r8, rbp
xor edx, edx
mov rcx, r12
call fcn.1400293c0
call fcn.1400280cc
mov rcx, rax
xor r14d, r14d
mov eax, r14d
test rcx, rcx
setne al
test eax, eax
jne 0x14000e0e6
mov ecx, 0x80004005
call fcn.140003280
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0xc8], rbx
call fcn.1400280cc
mov rdx, rax
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x14000e118
mov ecx, 0x80004005
call fcn.140003280
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
call fcn.1400280cc
mov rdx, rax
mov ecx, r14d
test rax, rax
setne cl
test ecx, ecx
jne 0x14000e14a
mov ecx, 0x80004005
call fcn.140003280
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x50], rdi
mov rsi, qword [r13]
call fcn.14000de80
mov r9d, r14d
mov ecx, 0x100
cmp eax, 1
cmove r9d, ecx
or r9d, 0x20019
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000e2e1
mov dword [rsp + 0xc0], 0x104
mov esi, r14d
nop
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov edx, dword [rsp + 0xc0]
sub eax, edx
or eax, ecx
jge 0x14000e1dd
lea rcx, [rsp + 0xc8]
call fcn.140003380
mov rbx, qword [rsp + 0xc8]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0xc0]
mov r8, rbx
mov edx, esi
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
add esi, 1
test eax, eax
jne 0x14000e2cf
test rbx, rbx
jne 0x14000e21e
mov ecx, r14d
jmp 0x14000e238
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x14000e2c4
cmp ecx, dword [rbx - 0xc]
jg 0x14000e2c4
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
cmp dword [rbx - 0x10], 0
je 0x14000e1b0
lea r8, [rsp + 0xc8]
mov rdx, r13
lea rcx, [rsp + 0x40]
call fcn.140002b10
nop
lea r8, [rsp + 0x40]
mov rdx, qword [r12 + 0x10]
mov rcx, r12
call fcn.14002972c
mov dword [rsp + 0xc0], 0x104
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jle 0x14000e2ae
mov rbx, qword [rsp + 0xc8]
jmp 0x14000e1b0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0xc8]
jmp 0x14000e1b0
mov ecx, 0x80070057
call fcn.140003280
int3
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [r12 + 0x10]
lea rdx, [rdi - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14000e302
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14000e323
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xc8]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x14000e347
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [r13]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x14000e364
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, ebx
add rsp, 0x70
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret