Function at 0x1400207f4
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x14002f008]
xor rax, rsp
mov qword [rbp + 0x160], rax
xor r13d, r13d
mov r15, rcx
test rdx, rdx
jne 0x140020972
mov qword [rsp + 0x38], r13
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], r13
lea r8, [rsp + 0x50]
mov r14d, 0x104
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
mov r12d, r13d
mov dword [rsp + 0x40], r14d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
mov ebx, eax
test eax, eax
jne 0x14002094e
or rsi, 0xffffffffffffffff
cmp word [rsp + 0x50], 0x2e
je 0x140020909
lea rcx, [rsp + 0x50]
mov rax, rsi
inc rax
cmp word [rcx + rax*2], r13w
jne 0x140020887
mov edi, eax
lea rax, [rdi + 0x14]
cmp rax, r14
ja 0x140020909
lea r8, str.ShellOpenCommand
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.14000db30
lea rdx, [rsp + 0x50]
mov rcx, r15
call fcn.14002125c
add rdi, rdi
mov rbx, rax
cmp rdi, 0x208
jae 0x140020962
mov word [rsp + rdi + 0x50], r13w
test rax, rax
je 0x140020901
mov rcx, rsi
inc rcx
cmp word [rax + rcx*2], r13w
jne 0x1400208de
test rcx, rcx
je 0x140020901
mov r8, rax
lea rdx, [rsp + 0x50]
lea rcx, str._s_s_r_n
call fcn.14000ed0c
mov rcx, rbx
call fcn.14000b4a0
cmp dword [0x14002f70c], r13d
jne 0x140020968
mov qword [rsp + 0x38], r13
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], r13
lea r8, [rsp + 0x50]
inc r12d
mov qword [rsp + 0x28], r13
mov edx, r12d
mov qword [rsp + 0x20], r13
mov rcx, r15
mov dword [rsp + 0x40], r14d
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
mov ebx, eax
test eax, eax
je 0x140020873
cmp ebx, 0x103
jne 0x140020ab4
mov ebx, r13d
jmp 0x140020ab4
call fcn.140015398
int3
mov eax, 1
jmp 0x140020ab6
cmp word [rdx], 0x2e
jne 0x140020994
mov r8, rdx
mov ecx, 0x400023a5
mov edx, 1
call fcn.1400057e4
mov eax, 0x7b
jmp 0x140020ab6
mov rcx, rdx
call fcn.1400088a8
mov rcx, rax
call fcn.140008660
mov rdi, rax
test rax, rax
je 0x140020968
mov edx, 0x20
mov rcx, rax
call fcn.14000e3dc
test rax, rax
je 0x1400209c2
mov word [rax], r13w
or rsi, 0xffffffffffffffff
mov rax, rsi
inc rax
cmp word [rdi + rax*2], r13w
jne 0x1400209c9
add rax, 0x14
mov r14d, 0x104
mov r8, rdi
cmp rax, r14
jbe 0x1400209fe
mov edx, 1
mov ecx, 0x400023db
call fcn.1400057e4
mov ebx, 0x7b
jmp 0x140020aac
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.14000dc10
lea r8, str.ShellOpenCommand
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.14000db30
lea rax, [rsp + 0x48]
mov r9d, 0x2000000
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, r15
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
mov ebx, eax
test eax, eax
je 0x140020a5a
mov r8, rdi
mov edx, 1
mov ecx, 0x400023a5
call fcn.1400057e4
jmp 0x140020aac
lea rdx, [rsp + 0x50]
mov rcx, r15
call fcn.14002125c
mov r14, rax
test rax, rax
je 0x140020a92
inc rsi
cmp word [rax + rsi*2], r13w
jne 0x140020a6f
test rsi, rsi
je 0x140020a92
mov r8, rax
lea rcx, str._s_s_r_n
mov rdx, rdi
call fcn.14000ed0c
jmp 0x140020aa4
mov r8, rdi
mov edx, 1
mov ecx, 0x400023a5
call fcn.1400057e4
mov rcx, r14
call fcn.14000b4a0
mov rcx, rdi
call fcn.14000b4a0
mov eax, ebx
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.1400151c0
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x270
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret