Function at 0x1400380e0
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0xa0
mov qword [rbp - 0x11], 0xfffffffffffffffe
mov qword [rsp + 0xf8], rbx
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r12, qword [rbp + 0x7f]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x39], xmm0
mov dword [rsp + 0x28], r9d
lea rax, [rbp - 0x41]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x39]
call fcn.140036260
mov rdi, rax
shr rax, 0x27
not eax
or r14, 0xffffffffffffffff
test al, 1
jne 0x1400382de
cmp byte [rbp - 0x41], 0
jne 0x140038163
movabs rdi, 0x8000000000
jmp 0x1400382de
mov edx, 0x104
lea rcx, [rbp - 0x29]
call fcn.14000c890
nop
xor ecx, ecx
mov edi, ecx
mov r15, qword [rbp - 0x21]
mov rax, r15
mov rbx, qword [rbp - 0x29]
sub rax, rbx
sar rax, 1
mov dword [rbp - 0x3d], eax
mov r13, qword [rbp - 0x39]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
lea r9, [rbp - 0x3d]
mov r8, rbx
xor edx, edx
mov rcx, qword [r13 + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
cmp eax, 0x103
je 0x1400382b6
cmp esi, 0xea
jne 0x1400381e2
mov edx, dword [rbp - 0x3d]
lea rcx, [rbp - 0x29]
call fcn.140007690
mov r15, qword [rbp - 0x21]
mov rbx, qword [rbp - 0x29]
xor esi, esi
jmp 0x140038258
test esi, esi
jne 0x14003829a
xor esi, esi
mov qword [rbp + 7], rsi
mov qword [rbp + 0xf], rsi
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], rsi
mov word [rbp - 9], si
cmp word [rbx], si
jne 0x14003820e
mov r8d, esi
jmp 0x14003821b
mov r8, r14
inc r8
cmp word [rbx + r8*2], si
jne 0x140038211
mov rdx, rbx
lea rcx, [rbp - 9]
call fcn.140007d00
nop
lea rdx, [rbp - 9]
mov rcx, r12
call fcn.1400296a0
nop
cmp qword [rbp + 0xf], 8
jb 0x140038246
mov rcx, qword [rbp - 9]
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], rsi
mov word [rbp - 9], si
inc edi
mov rax, r15
sub rax, rbx
sar rax, 1
mov dword [rbp - 0x3d], eax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x3d]
mov r8, rbx
mov edx, edi
mov rcx, qword [r13 + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esi, eax
cmp eax, 0x103
jne 0x1400381c2
jmp 0x1400382b6
call fcn.140035fa0
mov rdi, rax
mov eax, esi
or rdi, rax
movabs rax, 0x3b2100000000
or rdi, rax
jmp 0x1400382c0
movabs rdi, 0x8000000000
test rbx, rbx
je 0x1400382de
mov rcx, rbx
call qword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void____ptr64_]
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], 0
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x140038309
lock dec dword [rcx + 8]
jne 0x140038309
mov rbx, qword [rbp - 0x31]
mov rdx, qword [rbx]
mov rcx, rbx
call qword [rdx]
lock dec dword [rbx + 0xc]
jne 0x140038309
mov rcx, qword [rbp - 0x31]
mov rdx, qword [rcx]
call qword [rdx + reloc.msi.dll_MsiConfigureFeatureFromDescriptorA]
mov rax, rdi
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140108d90
mov rbx, qword [rsp + 0xf8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret