Function at 0x140039e04
Capabilities:
Query or enumerate registry key

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp - 0x41], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x1401784a8]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, rdx
mov rbx, rcx
mov rax, rdx
cmp qword [rdx + 0x18], 8
jb 0x140039e46
mov rax, qword [rdx]
lea r14, [rdx + 0x10]
xor r15d, r15d
mov qword [r14], r15
mov word [rax], r15w
cmp rbx, 0xffffffff80000002
jne 0x140039e7b
lea rdx, str.REGISTRYMACHINE
mov rcx, rdi
call fcn.14000954c
movabs rax, 0x8000000000
jmp 0x14003a1d8
cmp rbx, 0xffffffff80000003
jne 0x140039e8d
lea rdx, str.REGISTRYUSER
jmp 0x140039e64
cmp rbx, 0xffffffff80000001
jne 0x140039f65
mov qword [rbp - 0x29], r15
mov esi, 7
mov qword [rbp - 0x21], rsi
mov word [rbp - 0x39], r15w
lea rcx, [rbp - 0x39]
call fcn.14003989c
mov rbx, rax
shr rax, 0x27
not eax
test al, 1
jne 0x140039f46
lea r8, [rbp - 0x39]
lea rdx, str.REGISTRYUSER_
lea rcx, [rbp - 0x19]
call fcn.14000f464
mov rbx, rax
cmp rdi, rax
je 0x140039f21
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140039efc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
call fcn.14000c220
mov qword [r14], r15
mov qword [rdi + 0x18], rsi
mov word [rdi], r15w
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], rsi
mov word [rbx], r15w
mov rdx, qword [rbp - 1]
cmp rdx, 8
jb 0x140039f3c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x19]
call fcn.14000c220
movabs rbx, 0x8000000000
mov rdx, qword [rbp - 0x21]
cmp rdx, 8
jb 0x14003a1d5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x39]
jmp 0x14003a1d0
cmp rbx, 0xffffffff80000000
jne 0x14003a05f
mov qword [rbp - 0x29], r15
mov esi, 7
mov qword [rbp - 0x21], rsi
mov word [rbp - 0x39], r15w
lea rcx, [rbp - 0x39]
call fcn.14003989c
mov rbx, rax
shr rax, 0x27
not eax
test al, 1
jne 0x14003a05a
lea r8, [rbp - 0x39]
lea rdx, str.REGISTRYUSER_
lea rcx, [rbp + 7]
call fcn.14000f464
nop
lea r8, str._Classes
mov rdx, rax
lea rcx, [rbp - 0x19]
call fcn.14000f4cc
mov rbx, rax
cmp rdi, rax
je 0x14003a00d
mov rdx, qword [rdi + 0x18]
cmp rdx, 8
jb 0x140039fe8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
call fcn.14000c220
mov qword [r14], r15
mov qword [rdi + 0x18], rsi
mov word [rdi], r15w
movups xmm0, xmmword [rbx]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], rsi
mov word [rbx], r15w
mov rdx, qword [rbp - 1]
cmp rdx, 8
jb 0x14003a028
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x19]
call fcn.14000c220
mov qword [rbp - 9], r15
mov qword [rbp - 1], rsi
mov word [rbp - 0x19], r15w
mov rdx, qword [rbp + 0x1f]
cmp rdx, 8
jb 0x14003a050
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 7]
call fcn.14000c220
movabs rbx, 0x8000000000
jmp 0x140039f46
mov dword [rbp - 0x49], r15d
lea rax, [rbp - 0x49]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 3]
call qword [sym.imp.ntdll.dll_NtQueryKey]
nop dword [rax + rax]
mov esi, eax
cmp eax, 0x80000005
je 0x14003a0e4
cmp esi, 0xc0000023
je 0x14003a0e4
mov edx, MsiPreviewDialogW
lea rcx, str.admin_appman_appvclientintegrationcachedregistry.cpp
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x14003a0b5
inc rax
jmp 0x14003a0bc
lea rax, str.admin_appman_appvclientintegrationcachedregistry.cpp
mov rdx, rax
lea rcx, [0x14017bba0]
call fcn.140007964
shl rax, 0x34
or rax, rsi
movabs rcx, 0x172110000000
or rax, rcx
jmp 0x14003a1d8
mov eax, dword [rbp - 0x49]
test eax, eax
je 0x140039e6c
mov edx, eax
lea rcx, [rbp - 0x39]
call fcn.14003ab88
nop
mov r9, qword [rbp - 0x31]
mov rsi, qword [rbp - 0x39]
sub r9, rsi
lea rcx, [rbp - 0x49]
mov qword [rsp + 0x20], rcx
mov r8, rsi
mov edx, 3
mov rcx, rbx
call qword [sym.imp.ntdll.dll_NtQueryKey]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x14003a17a
mov edx, MsiPreviewDialogW
lea rcx, str.admin_appman_appvclientintegrationcachedregistry.cpp
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
test rax, rax
je 0x14003a14e
inc rax
jmp 0x14003a155
lea rax, str.admin_appman_appvclientintegrationcachedregistry.cpp
mov rdx, rax
lea rcx, [0x14017bba0]
call fcn.140007964
shl rax, 0x34
or rbx, rax
movabs rax, 0x182110000000
or rbx, rax
jmp 0x14003a1c1
mov edx, dword [rsi]
shr rdx, 1
lea r9, [rsi + 4]
cmp rdx, qword [rdi + 0x18]
ja 0x14003a1af
cmp qword [rdi + 0x18], 8
jb 0x14003a193
mov rdi, qword [rdi]
mov qword [r14], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
mov word [rdi + rbx], r15w
jmp 0x14003a1b7
mov rcx, rdi
call fcn.14000c0c4
movabs rbx, 0x8000000000
test rsi, rsi
je 0x14003a1d5
mov rdx, qword [rbp - 0x29]
sub rdx, rsi
mov rcx, rsi
call fcn.14000c220
mov rax, rbx
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400d24e0
mov rbx, qword [rsp + 0xf0]
add rsp, 0xb0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret