Function at 0x1400062e0
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0xc8
mov qword [rsp + 0xa0], 0xfffffffffffffffe
mov rdi, rdx
mov rbp, rcx
call fcn.14001f9e0
mov rcx, rax
xor esi, esi
mov r9d, esi
test rax, rax
setne r9b
test r9d, r9d
jne 0x140006330
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
lea rcx, [rsp + 0x70]
call fcn.140002050
nop
mov dword [rsp + 0x108], 0x200
mov qword [rsp + 0x48], rsi
mov rcx, qword [rdi]
sub rcx, 0x18
call fcn.140002780
add rax, 0x18
mov qword [rsp + 0x98], rax
mov r8d, 1
lea rdx, [rsp + 0x98]
mov rcx, rbp
call qword [rsp + 0x100]
mov dword [rsp + 0x40], eax
test eax, eax
jne 0x140006750
test byte [rbp + 0xb0], 1
jne 0x140006750
mov dword [rsp + 0x20], 0x20019
xor r9d, r9d
lea r8, [rsp + 0x48]
mov rdx, rdi
mov rcx, rbp
call fcn.140005410
mov dword [rsp + 0x40], eax
test eax, eax
je 0x14000641b
lea rcx, [rsp + 0x70]
call fcn.140003610
nop
lea rdx, [rbx - 0x18]
or edi, 0xffffffff
mov ecx, edi
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400063ef
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xf8]
mov rdx, qword [rdx]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
dec edi
test edi, edi
jg 0x140006412
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [rsp + 0x40]
jmp 0x1400067a0
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x200
or eax, ecx
jge 0x140006443
mov edx, 0x200
lea rcx, [rsp + 0x50]
call fcn.140002720
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x108]
mov r8, rbx
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [rbp + 0x88], eax
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.140030ec8
test eax, eax
js 0x140006745
cmp eax, dword [rbx - 0xc]
jg 0x140006745
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], si
mov dword [rsp + 0x40], 1
or edi, 0xffffffff
cmp dword [rbp + 0x88], 0
jne 0x1400065be
lea rax, [rsp + 0x58]
mov qword [rsp + 0xb0], rax
lea rcx, [rbx - 0x18]
call fcn.140002780
add rax, 0x18
mov qword [rsp + 0x58], rax
lea rcx, [rax - 0x18]
call fcn.140002780
add rax, 0x18
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x70]
call fcn.140004ce0
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000651b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [rsp + 0x108], 0x200
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, 0x200
or ecx, eax
jge 0x140006549
mov edx, 0x200
lea rcx, [rsp + 0x50]
call fcn.140002720
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x108]
mov rbx, qword [rsp + 0x50]
mov r8, rbx
mov edx, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [rbp + 0x88], eax
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.140030ec8
test eax, eax
js 0x1400065b3
cmp eax, dword [rbx - 0xc]
jg 0x1400065b3
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], si
inc dword [rsp + 0x40]
cmp dword [rbp + 0x88], 0
je 0x1400064c0
jmp 0x1400065be
mov ecx, 0x80070057
call fcn.140001000
int3
cmp dword [rbp + 0x88], 0x103
je 0x140006631
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x1400065de
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x70]
call fcn.140003610
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140006604
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xf8]
mov rdx, qword [rdx]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
dec edi
test edi, edi
jg 0x140006627
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 0x17
jmp 0x1400067a0
mov dword [rbp + 0x88], esi
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x14000664a
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x80]
test rbp, rbp
jle 0x1400066f8
mov rbx, rsi
nop
lea r8, [0x14004c074]
mov rdx, qword [rsp + 0xf8]
lea rcx, [rsp + 0x68]
call fcn.140004270
nop
test rbx, rbx
js 0x1400066f2
cmp rbx, rbp
jge 0x1400066f2
mov rcx, qword [rsp + 0x78]
lea r8, [rcx + rbx*8]
mov rdx, rax
lea rcx, [rsp + 0xa8]
call fcn.1400041c0
mov r8, qword [rsp + 0x100]
mov rdx, rax
mov rcx, qword [rsp + 0xf0]
call fcn.1400062e0
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400066d5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
inc esi
movsxd rbx, esi
mov rbp, qword [rsp + 0x80]
cmp rbx, rbp
jl 0x140006660
mov rbx, qword [rsp + 0x50]
jmp 0x1400066f8
call fcn.14001eb98
nop
lea rcx, [rsp + 0x70]
call fcn.140003610
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000671e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0xf8]
mov rdx, qword [rax]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
dec edi
test edi, edi
jg 0x140006741
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
jmp 0x1400067a0
mov ecx, 0x80070057
call fcn.140001000
nop
lea rcx, [rsp + 0x70]
call fcn.140003610
nop
lea rdx, [rbx - 0x18]
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140006779
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0xf8]
mov rdx, qword [rax]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
dec edi
test edi, edi
jg 0x14000679c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, dword [rsp + 0x40]
add rsp, 0xc8
pop rdi
pop rsi
pop rbp
pop rbx
ret