Function at 0x140039ae0
Capabilities:
Query or enumerate registry key

Disassembly:
push r12
push r14
sub rsp, 0xa8
mov rax, qword [0x1400c7070]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov r14, rcx
add rcx, 0x48
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
je 0x140039f1a
mov rcx, qword [r14 + 0x78]
mov qword [rsp + 0x98], r13
xor r13d, r13d
mov qword [rsp + 0x70], r13
test rcx, rcx
je 0x140039b4b
lea rdx, [rsp + 0x70]
call fcn.14005bc00
test al, al
je 0x140039b4b
mov rcx, qword [r14 + 0x78]
call fcn.140069370
mov rax, qword [rsp + 0x70]
mov qword [r14 + 0x78], rax
mov eax, dword [r14 + 0x80]
lea r8, str.RegCreateKey
mov r9, qword [r14 + 0x78]
lea rcx, str._i:__s__s_volatile_i_Begin._n
mov edx, dword [r14 + 8]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0xc8], rbx
call fcn.14005cb30
cmp byte [r14 + 0x84], r13b
je 0x140039e43
mov qword [rsp + 0x58], r13
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], r13
xor r9d, r9d
mov qword [rsp + 0x48], r13
xor r8d, r8d
mov qword [rsp + 0x40], r13
xor edx, edx
mov qword [rsp + 0x38], r13
mov rcx, 0xffffffff80000003
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x78], r13d
mov dword [rsp + 0x60], r13d
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x140039ecd
mov eax, dword [rsp + 0x60]
mov edx, 2
inc eax
mov qword [rsp + 0xd0], rbp
mov qword [rsp + 0xd8], rsi
mov ecx, eax
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x90], r15
mov dword [rsp + 0x60], eax
call fcn.140069790
mov rbx, rax
lea rdi, str.S_1_5_18
mov ebp, r13d
lea rsi, str.S_1_5_19
nop dword [rax]
mov eax, dword [rsp + 0x60]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x38], r13
mov r8, rbx
mov qword [rsp + 0x30], r13
mov edx, ebp
mov qword [rsp + 0x28], r13
mov rcx, 0xffffffff80000003
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x70], eax
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov r15d, eax
mov rdx, 0xffffffffffffffff
nop dword [rax]
movzx ecx, word [rbx + rdx*2 + 2]
cmp cx, word [rdi + rdx*2 + 2]
jne 0x140039c94
add rdx, 2
cmp rdx, 9
je 0x140039e02
movzx eax, word [rbx + rdx*2]
cmp ax, word [rdi + rdx*2]
je 0x140039c70
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
movzx eax, word [rbx + rcx*2 + 2]
cmp ax, word [rsi + rcx*2 + 2]
jne 0x140039cc4
add rcx, 2
cmp rcx, 9
je 0x140039e02
movzx eax, word [rbx + rcx*2]
cmp ax, word [rsi + rcx*2]
je 0x140039ca0
mov rax, 0xffffffffffffffff
lea rdx, str.S_1_5_20
movzx ecx, word [rbx + rax*2 + 2]
cmp cx, word [rdx + rax*2 + 2]
jne 0x140039cf6
add rax, 2
cmp rax, 9
je 0x140039e02
movzx ecx, word [rbx + rax*2]
cmp cx, word [rdx + rax*2]
je 0x140039cd2
mov edx, dword [r14 + 8]
lea r8, str.RegCreateKey
mov r9, rbx
lea rcx, str._i:__s_Writing_to_key_root__s._n
call fcn.14005cb30
lea rcx, str.int_x86
call sym.Installer.exe_Get
xor r8d, r8d
lea rdi, [r14 + 0x70]
mov qword [rsp + 0x20], rdi
mov rsi, rax
mov rdx, rbx
mov rcx, 0xffffffff80000003
mov r9d, 0xf013f
test eax, eax
je 0x140039d45
mov r9d, 0xf003f
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140039d6e
mov edx, dword [r14 + 8]
lea r8, str.RegCreateKey
mov r9, rbx
lea rcx, str._i:__s_Could_not_open_key_HKEY_USERS_s._n
call fcn.14005cb30
jmp 0x140039df4
mov rdx, qword [r14 + 0x78]
lea r8, [rsp + 0x68]
mov rcx, qword [rdi]
mov eax, r13d
cmp dword [r14 + 0x80], eax
mov qword [rsp + 0x40], r13
setne al
mov qword [rsp + 0x38], r8
xor r9d, r9d
mov qword [rsp + 0x30], r13
xor r8d, r8d
test esi, esi
jne 0x140039daa
mov dword [rsp + 0x28], 0xf013f
jmp 0x140039db2
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], eax
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [r14 + 0x70]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x140039de9
mov r9, qword [r14 + 0x78]
lea r8, str.RegCreateKey
mov edx, dword [r14 + 8]
lea rcx, str._i:__s_Could_not_create_key__s._n
call fcn.14005cb30
jmp 0x140039df4
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdi, str.S_1_5_18
lea rsi, str.S_1_5_19
inc ebp
test r15d, r15d
je 0x140039c30
mov r15, qword [rsp + 0x90]
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0xd8]
mov rbp, qword [rsp + 0xd0]
test rbx, rbx
je 0x140039ecd
mov rcx, rbx
call fcn.140069370
jmp 0x140039ecd
lea rcx, str.int_x86
call sym.Installer.exe_Get
mov rdx, qword [r14 + 0x78]
mov ecx, r13d
cmp dword [r14 + 0x80], ecx
mov r10, qword [r14 + 0x70]
setne cl
mov qword [rsp + 0x40], r13
xor r9d, r9d
xor r8d, r8d
test eax, eax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
jne 0x140039e8c
mov dword [rsp + 0x28], 0xf013f
jmp 0x140039e94
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ecx
mov rcx, r10
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x140039ec2
mov r9, qword [r14 + 0x78]
lea r8, str.RegCreateKey
mov edx, dword [r14 + 8]
lea rcx, str._i:__s_Could_not_create_key__s._n
call fcn.14005cb30
jmp 0x140039ecd
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [r14]
mov rcx, r14
mov byte [r14 + 0x10], 1
mov rax, qword [rax + 0x18]
call qword [0x1400926f0]
mov edx, dword [r14 + 8]
lea r8, str.RegCreateKey
mov r9d, eax
lea rcx, str._i:__s_End_execute._Next_command__i._n
call fcn.14005cb30
lea rcx, [r14 + 0x48]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r13, qword [rsp + 0x98]
xor eax, eax
mov rbx, qword [rsp + 0xc8]
jmp 0x140039f36
mov edx, dword [r14 + 8]
lea r8, str.RegCreateKey
lea rcx, str._i:__s_Error:_Multiple_threads_attempting_execution._n
call fcn.14005cb30
mov eax, 0x54f
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400625f0
add rsp, 0xa8
pop r14
pop r12
ret