Function at 0x140020660
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
sub rsp, 0x60
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov r12, rcx
xor r13d, r13d
mov qword [r11 - 0x38], r13
mov rax, qword [0x140056018]
mov qword [r11 - 0x30], rax
lea rax, str.Mount
mov qword [r11 - 0x58], rax
lea r9, [0x140045b00]
lea r8, [0x140045b00]
lea rdx, str.software_s_s_s
lea rcx, [r11 - 0x30]
call fcn.1400121a0
lea r11, [rsp + 0x40]
mov qword [rsp + 0x20], r11
lea r9d, [r13 + 1]
xor r8d, r8d
mov rbx, qword [rsp + 0x48]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop
lea rcx, [rbx - 0xc]
or edi, 0xffffffff
cmp rcx, qword [0x140056010]
je 0x140020708
mov eax, edi
lock xadd dword [rcx], eax
dec eax
test eax, eax
jg 0x140020708
call fcn.140025104
nop
mov dword [rsp + 0x80], 4
lea rbp, [r12 + 0xa8]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.OpenDrive
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov qword [rsp + 0x38], r13
mov rax, qword [0x140056018]
mov qword [rsp + 0x50], rax
lea rax, str.MountMenuItems
mov qword [rsp + 0x20], rax
lea r9, [0x140045b00]
lea r8, [0x140045b00]
lea rdx, str.software_s_s_s
lea rcx, [rsp + 0x50]
call fcn.1400121a0
lea r11, [rsp + 0x38]
mov qword [rsp + 0x20], r11
mov r9d, 1
xor r8d, r8d
mov rbx, qword [rsp + 0x50]
mov rdx, rbx
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop
lea rcx, [rbx - 0xc]
cmp rcx, qword [0x140056010]
je 0x1400207c8
lock xadd dword [rcx], edi
dec edi
test edi, edi
jg 0x1400207c8
call fcn.140025104
mov dword [rsp + 0x80], 4
lea rsi, [r12 + 0xac]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.Casscade
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rsp + 0x80], 4
lea rdi, [r12 + 0xa4]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, str.IntegrateExplorer
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rbx, [r12 + 0xa0]
test rbx, rbx
je 0x14002085c
lea rcx, [rbx - 0xa0]
jmp 0x14002085f
mov rcx, r13
mov edx, 0x402
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [rdi]
test ecx, ecx
js 0x140020879
cmp ecx, 2
jle 0x14002087c
mov dword [rdi], r13d
movsxd r8, dword [rdi]
xor r9d, r9d
mov edx, 0xf1
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
test rbx, rbx
je 0x14002089e
lea rcx, [rbx - 0xa0]
jmp 0x1400208a1
mov rcx, r13
mov edx, 0x40f
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [rsi]
test ecx, ecx
js 0x1400208bb
cmp ecx, 2
jle 0x1400208be
mov dword [rsi], r13d
movsxd r8, dword [rsi]
xor r9d, r9d
mov edx, 0xf1
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
test rbx, rbx
je 0x1400208e0
lea rcx, [rbx - 0xa0]
jmp 0x1400208e3
mov rcx, r13
mov edx, 0x410
mov rcx, qword [rcx + 8]
call qword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [rbp]
test ecx, ecx
js 0x1400208fe
cmp ecx, 2
jle 0x140020902
mov dword [rbp], r13d
movsxd r8, dword [rbp]
xor r9d, r9d
mov edx, 0xf1
mov rcx, rax
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140020928
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14002093c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x14002093e
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret