Function at 0x140039670
Capabilities:
Query or enumerate registry key

Disassembly:
jmp 0x140039670
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0xaf0
mov rdi, rsp
mov ecx, 0x2bc
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0xb00]
mov rax, qword [0x1401940e8]
xor rax, rsp
mov qword [rsp + 0xae8], rax
lea rax, [rsp + 0x310]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x540]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rax, [rsp + 0x770]
mov rdi, rax
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
lea rcx, [rsp + 0x998]
call fcn.1400036c5
nop
mov rcx, qword [rsp + 0xb10]
call fcn.140004a7a
test rax, rax
jne 0x140039735
mov dword [rsp + 0xa70], 0
lea rcx, [rsp + 0x998]
call fcn.1400049d0
mov eax, dword [rsp + 0xa70]
jmp 0x140039d11
mov r8, qword [rsp + 0xb10]
mov edx, 0x208
lea rcx, [rsp + 0x540]
call fcn.1400031e3
mov dx, MsiPreviewBillboardW
mov rcx, qword [rsp + 0xb10]
call fcn.14000155a
mov qword [rsp + 0x2f8], rax
cmp qword [rsp + 0x2f8], 0
je 0x140039796
mov rax, qword [rsp + 0x2f8]
add rax, 2
mov r8, rax
mov edx, 0x208
lea rcx, [rsp + 0x310]
call fcn.1400031e3
jmp 0x1400397b0
mov r8, qword [rsp + 0xb10]
mov edx, 0x208
lea rcx, [rsp + 0x310]
call fcn.1400031e3
mov r8, qword [rsp + 0xb10]
mov edx, 0x208
lea rcx, [rsp + 0x770]
call fcn.1400031e3
mov rcx, qword [rsp + 0xb10]
call fcn.140004a7a
mov qword [rsp + 0xab0], rax
lea rcx, [rsp + 0x310]
call fcn.140004a7a
mov rcx, qword [rsp + 0xab0]
sub rcx, rax
mov rax, rcx
xor ecx, ecx
mov rdx, qword [rsp + 0xb10]
mov word [rdx + rax*2], cx
lea rax, [rsp + 0x2c8]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0xb18]
mov r9d, dword [rax]
xor r8d, r8d
mov rdx, qword [rsp + 0xb10]
mov rax, qword [rsp + 0xb08]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
je 0x1400398b4
cmp dword [rsp + 0x48], 2
jne 0x140039882
mov rax, qword [rsp + 0xb20]
mov ecx, dword [rsp + 0x48]
mov dword [rax], ecx
mov dword [rsp + 0xa74], 1
lea rcx, [rsp + 0x998]
call fcn.1400049d0
mov eax, dword [rsp + 0xa74]
jmp 0x140039d11
mov rax, qword [rsp + 0xb20]
mov ecx, dword [rsp + 0x48]
mov dword [rax], ecx
mov dword [rsp + 0xa78], 0
lea rcx, [rsp + 0x998]
call fcn.1400049d0
mov eax, dword [rsp + 0xa78]
jmp 0x140039d11
mov rdx, qword [rsp + 0xb08]
mov rcx, qword [rsp + 0xb28]
call fcn.140004e44
lea r8, [0x140147e04]
mov rdx, rax
lea rcx, [rsp + 0x9c8]
call fcn.1400024dc
mov qword [rsp + 0xab8], rax
mov rax, qword [rsp + 0xab8]
mov qword [rsp + 0xac0], rax
lea r8, [rsp + 0x770]
mov rdx, qword [rsp + 0xac0]
lea rcx, [rsp + 0x9f0]
call fcn.140005272
mov qword [rsp + 0xac8], rax
mov rdx, qword [rsp + 0xac8]
lea rcx, [rsp + 0x998]
call fcn.1400014a6
lea rcx, [rsp + 0x9f0]
call fcn.1400049d0
nop
lea rcx, [rsp + 0x9c8]
call fcn.1400049d0
lea rcx, [rsp + 0x998]
call fcn.140003567
mov qword [rsp + 0xa80], rax
lea rax, [rsp + 0x310]
mov qword [rsp + 0xa88], rax
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0xb18]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa80]
lea r8, [rsp + 0xa88]
lea rdx, [rsp + 0x2c8]
mov rcx, qword [rsp + 0xb00]
call fcn.14000299b
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
je 0x1400399be
cmp dword [rsp + 0x48], 2
jne 0x1400399f0
mov rax, qword [rsp + 0xb20]
mov ecx, dword [rsp + 0x48]
mov dword [rax], ecx
mov dword [rsp + 0xa90], 1
lea rcx, [rsp + 0x998]
call fcn.1400049d0
mov eax, dword [rsp + 0xa90]
jmp 0x140039d11
lea rax, [rsp + 0x2a8]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0xb18]
mov r9d, dword [rax]
xor r8d, r8d
lea rdx, [rsp + 0x540]
mov rax, qword [rsp + 0xb08]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x48], eax
lea rcx, [rsp + 0x540]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cdqe
lea rax, [rsp + rax*2 + 0x540]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movzx eax, word [rax - 2]
cmp eax, 0x5c
je 0x140039a78
mov eax, MsiPreviewBillboardW
mov rcx, qword [rsp + 0x40]
mov word [rcx], ax
mov rax, qword [rsp + 0x40]
add rax, 2
mov qword [rsp + 0x40], rax
xor eax, eax
mov rcx, qword [rsp + 0x40]
mov word [rcx], ax
mov dword [rsp + 0x54], 0x104
lea rax, [rsp + 0x2e8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x54]
lea r8, [rsp + 0x80]
xor edx, edx
mov rcx, qword [rsp + 0x2a8]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
jne 0x140039b8c
lea r8, [rsp + 0x80]
mov edx, 0x208
mov rcx, qword [rsp + 0x40]
call fcn.1400031e3
mov rax, qword [rsp + 0xb28]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0xb20]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0xb18]
lea r8, [rsp + 0x540]
mov rdx, qword [rsp + 0xb08]
mov rcx, qword [rsp + 0xb00]
call fcn.1400059f7
test eax, eax
jne 0x140039b30
jmp 0x140039b8c
mov dword [rsp + 0x54], 0x104
lea rax, [rsp + 0x2e8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x54]
lea r8, [rsp + 0x80]
xor edx, edx
mov rcx, qword [rsp + 0x2a8]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [rsp + 0x48], eax
cmp dword [rsp + 0x48], 0
je 0x140039ad4
mov rax, qword [rsp + 0x40]
sub rax, 2
mov qword [rsp + 0x40], rax
xor eax, eax
mov rcx, qword [rsp + 0x40]
mov word [rcx], ax
mov rdx, qword [rsp + 0xb08]
mov rcx, qword [rsp + 0xb28]
call fcn.140004e44
lea r8, [0x140147e14]
mov rdx, rax
lea rcx, [rsp + 0xa18]
call fcn.1400024dc
mov qword [rsp + 0xad0], rax
mov rax, qword [rsp + 0xad0]
mov qword [rsp + 0xad8], rax
lea r8, [rsp + 0x770]
mov rdx, qword [rsp + 0xad8]
lea rcx, [rsp + 0xa40]
call fcn.140005272
mov qword [rsp + 0xae0], rax
mov rdx, qword [rsp + 0xae0]
lea rcx, [rsp + 0x998]
call fcn.1400014a6
lea rcx, [rsp + 0xa40]
call fcn.1400049d0
nop
lea rcx, [rsp + 0xa18]
call fcn.1400049d0
lea rcx, [rsp + 0x998]
call fcn.140003567
mov qword [rsp + 0xa98], rax
lea rax, [rsp + 0x310]
mov qword [rsp + 0xaa0], rax
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0xb18]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xa98]
lea r8, [rsp + 0xaa0]
lea rdx, [rsp + 0x2c8]
mov rcx, qword [rsp + 0xb00]
call fcn.14000299b
mov dword [rsp + 0x48], eax
mov rax, qword [rsp + 0xb20]
mov ecx, dword [rsp + 0x48]
mov dword [rax], ecx
mov rcx, qword [rsp + 0x2a8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x2c8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x48], 0
jne 0x140039cf2
mov dword [rsp + 0xaa8], 1
lea rcx, [rsp + 0x998]
call fcn.1400049d0
mov eax, dword [rsp + 0xaa8]
jmp 0x140039d11
mov dword [rsp + 0xaac], 0
lea rcx, [rsp + 0x998]
call fcn.1400049d0
mov eax, dword [rsp + 0xaac]
mov rdi, rax
mov rcx, rsp
lea rdx, [0x140149ee0]
call fcn.140005466
mov rax, rdi
mov rcx, qword [rsp + 0xae8]
xor rcx, rsp
call fcn.1400023b0
add rsp, 0xaf0
pop rdi
ret