Function at 0x140035ab0
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xa0
mov qword [rbp - 0x11], 0xfffffffffffffffe
mov qword [rsp + 0xf8], rbx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r12, qword [rbp + 0x7f]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rsp + 0x28], r9d
lea rax, [rbp - 0x41]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x39]
call fcn.140033c30
mov rdi, rax
shr rax, 0x27
not eax
or r14, 0xffffffffffffffff
test al, 1
jne 0x140035cae
cmp byte [rbp - 0x41], 0
jne 0x140035b33
movabs rdi, 0x8000000000
jmp 0x140035cae
mov edx, 0x104
lea rcx, [rbp - 0x29]
call fcn.14000c730
nop
xor ecx, ecx
mov edi, ecx
mov r15, qword [rbp - 0x21]
mov rax, r15
mov rbx, qword [rbp - 0x29]
sub rax, rbx
sar rax, 1
mov dword [rbp - 0x3d], eax
mov r13, qword [rbp - 0x39]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x3d]
mov r8, rbx
xor edx, edx
mov rcx, qword [r13 + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
cmp eax, 0x103
je 0x140035c86
cmp esi, 0xea
jne 0x140035bb2
mov edx, dword [rbp - 0x3d]
lea rcx, [rbp - 0x29]
call fcn.1400075f0
mov r15, qword [rbp - 0x21]
mov rbx, qword [rbp - 0x29]
xor esi, esi
jmp 0x140035c28
test esi, esi
jne 0x140035c6a
xor esi, esi
mov qword [rbp + 7], rsi
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], rsi
mov word [rbp - 9], si
cmp word [rbx], si
jne 0x140035bde
mov r8d, esi
jmp 0x140035beb
mov r8, r14
inc r8
cmp word [rbx + r8*2], si
jne 0x140035be1
mov rdx, rbx
lea rcx, [rbp - 9]
call fcn.140007c60
nop
lea rdx, [rbp - 9]
mov rcx, r12
call fcn.140028940
nop
cmp qword [rbp + 0xf], 8
jb 0x140035c16
mov rcx, qword [rbp - 9]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], rsi
mov word [rbp - 9], si
inc edi
mov rax, r15
sub rax, rbx
sar rax, 1
mov dword [rbp - 0x3d], eax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x3d]
mov r8, rbx
mov edx, edi
mov rcx, qword [r13 + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
cmp eax, 0x103
jne 0x140035b92
jmp 0x140035c86
call fcn.140033970
mov rdi, rax
mov eax, esi
or rdi, rax
movabs rax, 0x3b2100000000
or rdi, rax
jmp 0x140035c90
movabs rdi, 0x8000000000
test rbx, rbx
je 0x140035cae
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], 0
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x140035cd9
lock dec dword [rcx + 8]
jne 0x140035cd9
mov rbx, qword [rbp - 0x31]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
lock dec dword [rbx + 0xc]
jne 0x140035cd9
mov rcx, qword [rbp - 0x31]
mov rdx, qword [rcx]
call qword [rdx + reloc.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov rax, rdi
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400f5ff0
mov rbx, qword [rsp + 0xf8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret