Function at 0x140037840
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xa0
mov qword [rbp - 0x11], 0xfffffffffffffffe
mov qword [rsp + 0xf8], rbx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r12, qword [rbp + 0x7f]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rsp + 0x28], r9d
lea rax, [rbp - 0x41]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x39]
call fcn.1400359c0
mov rdi, rax
shr rax, 0x27
not eax
or r14, 0xffffffffffffffff
test al, 1
jne 0x140037a3e
cmp byte [rbp - 0x41], 0
jne 0x1400378c3
movabs rdi, 0x8000000000
jmp 0x140037a3e
mov edx, 0x104
lea rcx, [rbp - 0x29]
call fcn.14000c860
nop
xor ecx, ecx
mov edi, ecx
mov r15, qword [rbp - 0x21]
mov rax, r15
mov rbx, qword [rbp - 0x29]
sub rax, rbx
sar rax, 1
mov dword [rbp - 0x3d], eax
mov r13, qword [rbp - 0x39]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x3d]
mov r8, rbx
xor edx, edx
mov rcx, qword [r13 + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
cmp eax, 0x103
je 0x140037a16
cmp esi, 0xea
jne 0x140037942
mov edx, dword [rbp - 0x3d]
lea rcx, [rbp - 0x29]
call fcn.140007690
mov r15, qword [rbp - 0x21]
mov rbx, qword [rbp - 0x29]
xor esi, esi
jmp 0x1400379b8
test esi, esi
jne 0x1400379fa
xor esi, esi
mov qword [rbp + 7], rsi
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], rsi
mov word [rbp - 9], si
cmp word [rbx], si
jne 0x14003796e
mov r8d, esi
jmp 0x14003797b
mov r8, r14
inc r8
cmp word [rbx + r8*2], si
jne 0x140037971
mov rdx, rbx
lea rcx, [rbp - 9]
call fcn.140007d00
nop
lea rdx, [rbp - 9]
mov rcx, r12
call fcn.140029150
nop
cmp qword [rbp + 0xf], 8
jb 0x1400379a6
mov rcx, qword [rbp - 9]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], rsi
mov word [rbp - 9], si
inc edi
mov rax, r15
sub rax, rbx
sar rax, 1
mov dword [rbp - 0x3d], eax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x3d]
mov r8, rbx
mov edx, edi
mov rcx, qword [r13 + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
cmp eax, 0x103
jne 0x140037922
jmp 0x140037a16
call fcn.140035700
mov rdi, rax
mov eax, esi
or rdi, rax
movabs rax, 0x3b2100000000
or rdi, rax
jmp 0x140037a20
movabs rdi, 0x8000000000
test rbx, rbx
je 0x140037a3e
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], 0
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x140037a69
lock dec dword [rcx + 8]
jne 0x140037a69
mov rbx, qword [rbp - 0x31]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
lock dec dword [rbx + 0xc]
jne 0x140037a69
mov rcx, qword [rbp - 0x31]
mov rdx, qword [rcx]
call qword [rdx + reloc.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov rax, rdi
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140107280
mov rbx, qword [rsp + 0xf8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret