Function at 0x140020040
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push r12
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov r12, rcx
lea rcx, [0x140085260]
call fcn.14000c1c0
mov rsi, rax
test rax, rax
jne 0x140020077
add rsp, 0x4c0
pop r12
pop rsi
pop rbp
ret
lea rax, [rsp + 0x60]
mov qword [rsp + 0x4e0], rbx
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400200d9
mov rbx, 0xffffffffffffffff
nop dword [rax]
cmp word [rsi + rbx*2 + 2], 0
lea rbx, [rbx + 1]
jne 0x1400200b0
lea r8, [rbx + rbx]
xor edx, edx
mov rcx, rsi
call fcn.1400452a0
mov rcx, rsi
call fcn.1400462d0
xor al, al
jmp 0x1400203b1
mov qword [rsp + 0x4b8], rdi
lea rcx, [rbp + 0x190]
mov qword [rsp + 0x4b0], r13
xor edx, edx
mov qword [rsp + 0x4a8], r14
mov r8d, 0x208
mov qword [rsp + 0x4a0], r15
call fcn.1400452a0
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x78]
mov qword [rsp + 0x58], rax
lea r8, [rbp + 0x3f0]
lea rax, [rsp + 0x70]
mov dword [rbp + 0x3f0], 0x104
mov qword [rsp + 0x50], rax
lea rdx, [rbp + 0x190]
lea rax, [rsp + 0x74]
xor r13d, r13d
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rsp + 0x78]
mov dword [rbp + 0x3e8], r13d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x38], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x3e8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [rbp + 0x3e8]
lea rbx, [r13 - 1]
test eax, eax
je 0x140020362
mov r15d, r13d
mov rcx, qword [rsp + 0x60]
lea rax, [rbp - 0x78]
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x3f8]
mov qword [rsp + 0x30], r13
lea r8, [rbp - 0x70]
mov qword [rsp + 0x28], r13
mov edx, r15d
mov qword [rsp + 0x20], r13
mov dword [rbp + 0x3f8], 0xff
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140020352
lea rdx, [rbp - 0x70]
mov rcx, r12
call fcn.140045430
test rax, rax
je 0x140020352
mov rax, rbx
nop dword [rax]
inc rax
cmp word [rsi + rax*2], r13w
jne 0x140020200
lea rdx, [rbp - 0x70]
mov rcx, rbx
inc rcx
cmp word [rdx + rcx*2], r13w
jne 0x140020211
add rax, 2
mov edx, 2
add rcx, rax
call fcn.1400462ec
mov r14, rax
test rax, rax
je 0x140020441
mov r8, rax
mov rdx, rsi
sub r8, rsi
movzx ecx, word [rdx]
mov word [r8 + rdx], cx
lea rdx, [rdx + 2]
test cx, cx
jne 0x140020241
lea rcx, [rax - 2]
nop word [rax + rax]
cmp word [rcx + 2], r13w
lea rcx, [rcx + 2]
jne 0x140020260
mov eax, dword [0x140083ab8]
mov dword [rcx], eax
lea rcx, [r14 - 2]
nop word [rax + rax]
cmp word [rcx + 2], r13w
lea rcx, [rcx + 2]
jne 0x140020280
lea r8, [rbp - 0x70]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1400202a0
lea r9, [rsp + 0x68]
mov qword [rsp + 0x68], r13
xor r8d, r8d
lea rdx, [0x1400852b0]
mov rcx, r14
call fcn.140029560
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140020330
mov edx, 1
call fcn.1400462ec
lea r9, [rsp + 0x68]
mov r8, rax
lea rdx, [0x1400852b0]
mov rcx, r14
mov rdi, rax
call fcn.140029560
cmp qword [rsp + 0x68], 4
jne 0x14002030d
cmp dword [rdi], 2
jb 0x1400203c5
test rdi, rdi
je 0x140020330
mov r8, rbx
inc r8
cmp byte [rdi + r8], r13b
jne 0x140020315
xor edx, edx
mov rcx, rdi
call fcn.1400452a0
mov rcx, rdi
call fcn.1400462d0
mov r8, rbx
inc r8
cmp word [r14 + r8*2], r13w
jne 0x140020333
add r8, r8
xor edx, edx
mov rcx, r14
call fcn.1400452a0
mov rcx, r14
call fcn.1400462d0
inc r15d
cmp r15d, dword [rbp + 0x3e8]
jb 0x1400201a1
cmp word [rsi + rbx*2 + 2], r13w
lea rbx, [rbx + 1]
jne 0x140020362
lea r8, [rbx + rbx]
xor edx, edx
mov rcx, rsi
call fcn.1400452a0
mov rcx, rsi
call fcn.1400462d0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov r14, qword [rsp + 0x4a8]
mov r13, qword [rsp + 0x4b0]
mov rdi, qword [rsp + 0x4b8]
mov r15, qword [rsp + 0x4a0]
mov rbx, qword [rsp + 0x4e0]
add rsp, 0x4c0
pop r12
pop rsi
pop rbp
ret
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rsi + r8*2], r13w
jne 0x1400203d0
add r8, r8
xor edx, edx
mov rcx, rsi
call fcn.1400452a0
mov rcx, rsi
call fcn.1400462d0
mov r8, rbx
inc r8
cmp word [r14 + r8*2], r13w
jne 0x1400203f2
add r8, r8
xor edx, edx
mov rcx, r14
call fcn.1400452a0
mov rcx, r14
call fcn.1400462d0
inc rbx
cmp byte [rdi + rbx], r13b
jne 0x140020411
mov r8, rbx
xor edx, edx
mov rcx, rdi
call fcn.1400452a0
mov rcx, rdi
call fcn.1400462d0
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x140020391
cmp word [rsi + rbx*2 + 2], r13w
lea rbx, [rbx + 1]
jne 0x140020441
jmp 0x14002036e