Function at 0x40a3f0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov rax, rsp
sub rsp, 0xf8
mov qword [rsp + 0xd0], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov qword [rax - 8], rbp
mov qword [rax - 0x10], rsi
mov qword [rax - 0x18], rdi
mov rbp, rcx
call fcn.00426d94
mov rcx, rax
xor edi, edi
mov eax, edi
test rcx, rcx
setne al
test eax, eax
jne 0x40a449
mov ecx, 0x80004005
call entry0
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
lea rax, [0x0045a368]
mov qword [rsp + 0x70], rax
mov rsi, rdi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x80], rdi
mov dword [rsp + 0x50], 0x200
mov qword [rsp + 0x58], rdi
lea r8, [rsp + 0x58]
mov rdx, qword [rsp + 0x108]
mov rcx, rbp
call fcn.00409030
mov dword [rsp + 0x40], eax
test eax, eax
je 0x40a4fd
lea rdx, [rbx - 0x18]
mov rbp, 0xffffffffffffffff
mov ecx, ebp
lock xadd dword [rdx + 0x10], ecx
add ecx, ebp
test ecx, ecx
jg 0x40a4d0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x108]
mov rdx, qword [rax]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x40a4f4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [rsp + 0x40]
jmp 0x40abee
mov rax, qword [rsp + 0x108]
mov rbp, qword [rax]
mov rcx, qword [rbp - 0x18]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbp - 8], 0
jl 0x40a536
cmp rax, qword [rbp - 0x18]
jne 0x40a536
lea rax, [rbp - 0x18]
lock add dword [rbp - 8], 1
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x78]
jmp 0x40a57e
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbp - 0x10]
call qword [rax]
mov rcx, rax
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x40a557
call fcn.00417bc0
int3
mov eax, dword [rbp - 0x10]
mov dword [rcx + 8], eax
mov eax, dword [rbp - 0x10]
add eax, 1
movsxd rdx, eax
lea r9, [rdx + rdx]
mov r8, rbp
add rdx, rdx
add rcx, 0x18
call fcn.00438330
mov rax, qword [rsp + 0x60]
add rax, 0x18
mov qword [rsp + 0xb0], rax
lea rdx, [rsp + 0xb0]
mov rbp, qword [rsp + 0x100]
mov rcx, rbp
call qword [rsp + 0x110]
mov dword [rsp + 0x40], eax
test eax, eax
jne 0x40aba4
test byte [rbp + 0xb0], 1
jne 0x40aba4
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x200
or eax, ecx
jge 0x40a5e5
mov edx, 0x200
lea rcx, [rsp + 0x48]
call fcn.004179f0
mov rbx, qword [rsp + 0x48]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x50]
mov r8, rbx
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov rdx, qword [rsp + 0x100]
mov dword [rdx + 0x88], eax
mov rbp, 0xffffffffffffffff
test rbx, rbx
jne 0x40a62c
mov ecx, edi
jmp 0x40a648
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x40ab99
xor edi, edi
cmp ecx, dword [rbx - 0xc]
jg 0x40ab99
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
mov dword [rsp + 0x40], 1
cmp dword [rdx + 0x88], 0
jne 0x40a947
lea rsi, [rbx - 0x18]
mov rcx, qword [rsi]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rsi + 0x10], 0
jl 0x40a697
cmp rax, qword [rsi]
jne 0x40a697
mov rbx, rsi
lock add dword [rsi + 0x10], 1
jmp 0x40a6d4
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rsi + 8]
call qword [rax]
mov rbx, rax
test rax, rax
je 0x40a941
mov ecx, dword [rsi + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rsi + 8]
add ecx, 1
movsxd rdx, ecx
lea r9, [rdx + rdx]
lea r8, [rsi + 0x18]
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.00438330
lea rax, [rbx + 0x18]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x60]
mov qword [rsp + 0xb8], rcx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0xa0], rcx
lea rbx, [rax - 0x18]
mov rcx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, rax
cmp dword [rbx + 0x10], 0
jl 0x40a71f
cmp rax, qword [rbx]
jne 0x40a71f
mov rax, rbx
lock add dword [rbx + 0x10], 1
jmp 0x40a769
mov rax, qword [rax]
mov r8d, 2
mov edx, dword [rbx + 8]
call qword [rax]
mov qword [rsp + 0x98], rax
test rax, rax
je 0x40a93b
mov ecx, dword [rbx + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rbx + 8]
add ecx, 1
movsxd rdx, ecx
lea r9, [rdx + rdx]
lea r8, [rbx + 0x18]
add rdx, rdx
lea rcx, [rax + 0x18]
call fcn.00438330
mov rax, qword [rsp + 0x98]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0x80]
test rax, rax
js 0x40a935
lea rdx, [rax + 1]
mov r8, rbp
lea rcx, [rsp + 0x70]
call fcn.00417f50
mov rdx, qword [rsp + 0x78]
mov rax, qword [rsp + 0xa0]
lea r9, [rdx + rax*8]
mov qword [rsp + 0x98], r9
mov rax, qword [rsp + 0x68]
lea rcx, [rax - 0x18]
mov rbx, qword [r9]
sub rbx, 0x18
cmp rcx, rbx
je 0x40a836
cmp dword [rbx + 0x10], 0
jl 0x40a822
mov rdx, qword [rbx]
cmp qword [rcx], rdx
jne 0x40a822
call fcn.00417a50
mov qword [rsp + 0xa0], rax
mov ecx, ebp
lock xadd dword [rbx + 0x10], ecx
add ecx, 0xffffffff
test ecx, ecx
jg 0x40a80c
mov rcx, qword [rbx]
mov rax, qword [rcx]
mov rdx, rbx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0xa0]
add rax, 0x18
mov rcx, qword [rsp + 0x98]
mov qword [rcx], rax
mov rax, qword [rsp + 0x68]
jmp 0x40a836
mov r8d, dword [rax - 0x10]
mov rdx, rax
mov rcx, r9
call fcn.00417880
mov rax, qword [rsp + 0x68]
lea rdx, [rax - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x40a852
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x40a872
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [rsp + 0x50], 0x200
mov ecx, 1
sub ecx, dword [rsi + 0x10]
mov eax, dword [rsi + 0xc]
sub eax, 0x200
or eax, ecx
jge 0x40a89d
mov edx, 0x200
lea rcx, [rsp + 0x48]
call fcn.004179f0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov r8, rbx
mov esi, dword [rsp + 0x40]
mov edx, esi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov rdx, qword [rsp + 0x100]
mov dword [rdx + 0x88], eax
test rbx, rbx
jne 0x40a8e6
mov ecx, edi
jmp 0x40a8fe
xor eax, eax
mov rcx, rbp
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
test ecx, ecx
js 0x40a92a
xor edi, edi
cmp ecx, dword [rbx - 0xc]
jg 0x40a92a
mov dword [rbx - 0x10], ecx
movsxd rax, ecx
mov word [rbx + rax*2], 0
add esi, 1
mov dword [rsp + 0x40], esi
cmp dword [rdx + 0x88], 0
je 0x40a672
mov rsi, qword [rsp + 0x78]
jmp 0x40a947
mov ecx, 0x80070057
call entry0
nop
call fcn.00427700
nop
call fcn.00417bc0
nop
call fcn.00417bc0
int3
cmp dword [rdx + 0x88], 0x103
je 0x40aa0f
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x40a96b
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
test rsi, rsi
je 0x40a9c5
cmp qword [rsp + 0x80], 0
jle 0x40a9bc
nop
nop
mov rdx, qword [rsi]
sub rdx, 0x18
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x40a99e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add edi, 1
add rsi, 8
movsxd rax, edi
cmp rax, qword [rsp + 0x80]
jl 0x40a980
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x78]
mov rcx, rsi
call fcn.00426ca4
nop
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x40a9e1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x108]
mov rdx, qword [rax]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x40aa05
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 0x17
jmp 0x40abee
mov dword [rdx + 0x88], edi
mov rax, qword [rsp + 0x58]
test rax, rax
je 0x40aa28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x40], edi
mov rax, qword [rsp + 0x80]
test rax, rax
jle 0x40aafb
mov rbx, rdi
lea r8, [0x004586f8]
mov rdx, qword [rsp + 0x108]
lea rcx, [rsp + 0xa8]
call fcn.00417070
nop
test rbx, rbx
js 0x40aaf5
cmp rbx, qword [rsp + 0x80]
jge 0x40aaf5
lea r8, [rsi + rbx*8]
mov rdx, rax
lea rcx, [rsp + 0xc0]
call fcn.00416ef0
mov r8, qword [rsp + 0x110]
mov rdx, rax
mov rcx, qword [rsp + 0x100]
call fcn.0040a3f0
nop
mov rdx, qword [rsp + 0xa8]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x40aac4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [rsp + 0x40]
add eax, 1
mov dword [rsp + 0x40], eax
movsxd rbx, eax
mov rax, qword [rsp + 0x80]
cmp rbx, rax
jge 0x40aae9
mov rsi, qword [rsp + 0x78]
jmp 0x40aa40
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x78]
jmp 0x40aafb
call fcn.00427700
nop
test rsi, rsi
je 0x40ab55
test rax, rax
jle 0x40ab4c
nop
nop
nop
mov rdx, qword [rsi]
sub rdx, 0x18
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x40ab2e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add edi, 1
add rsi, 8
movsxd rax, edi
cmp rax, qword [rsp + 0x80]
jl 0x40ab10
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x78]
mov rcx, rsi
call fcn.00426ca4
nop
lea rdx, [rbx - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x40ab71
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x108]
mov rdx, qword [rax]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x40ab95
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x40abee
mov ecx, 0x80070057
call entry0
nop
lea rdx, [rbx - 0x18]
mov rbp, 0xffffffffffffffff
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, ebp
test eax, eax
jg 0x40abc6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0x108]
mov rdx, qword [rax]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x40abea
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x118]
mov rbp, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xe0]
add rsp, 0xf8
ret