Function at 0x30005c34
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov r11, rsp
sub rsp, 0x50
xor r14d, r14d
mov r12, r9
mov r13, r8
cmp rcx, r14
mov rbp, rdx
mov qword [r11 - 0x10], r14
mov qword [r11 - 8], r14
mov qword [r11 - 0x18], r14
mov dword [r11 + 0x40], r14d
mov rsi, r14
mov rdi, r14
je 0x30005fdf
cmp word [rcx], r14w
je 0x30005fdf
cmp rdx, r14
je 0x30005fdf
cmp word [rdx], r14w
je 0x30005fdf
cmp r8, r14
je 0x30005fdf
cmp r9, r14
je 0x30005fdf
mov qword [r8], r14
lea rax, [r11 - 0x10]
mov rdx, rcx
mov qword [r9], r14
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov r9d, 0x20019
mov qword [r11 - 0x30], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jl 0x30005f6d
mov rdx, qword [str.shell]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jl 0x30005f6d
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jl 0x30005f6d
mov rdx, qword [str.RedirectFileType]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x30], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
mov ebp, r14d
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
cmovge ebp, dword [rsp + 0x30]
cmp ebx, r14d
mov dword [rsp + 0x30], ebp
jl 0x30005e30
cmp ebp, 1
je 0x30005db7
cmp ebp, 2
jne 0x30005e30
mov edx, dword [rsp + 0x90]
xor ecx, ecx
add rdx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp rax, r14
mov rsi, rax
je 0x30005ebb
mov r8d, dword [rsp + 0x90]
xor edx, edx
mov rcx, rax
add r8, 2
call sub.MSVCR80.dll_memset
mov rdx, qword [str.RedirectFileType]
mov rcx, qword [rsp + 0x38]
lea r11, [rsp + 0x90]
lea r8, [rsp + 0x30]
mov r9, rsi
mov qword [rsp + 0x20], r11
call fcn.30003bd4
cmp eax, r14d
mov ebx, eax
jl 0x30005f53
mov ebp, dword [rsp + 0x30]
cmp ebp, 1
je 0x30005e41
cmp ebp, 2
je 0x30005e41
jmp 0x30005f16
cmp ebx, 0x80070002
je 0x30005e41
cmp ebx, r14d
jl 0x30005f6d
mov rdx, qword [str.RedirectVerb]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x30], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
cmovge ebp, dword [rsp + 0x30]
cmp ebx, r14d
mov dword [rsp + 0x30], ebp
jl 0x30005f1d
cmp ebp, 1
je 0x30005ea0
cmp ebp, 2
jne 0x30005f1d
mov edx, dword [rsp + 0x90]
xor ecx, ecx
add rdx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp rax, r14
mov rdi, rax
jne 0x30005ec5
mov ebx, 0x8007000e
jmp 0x30005f53
mov r8d, dword [rsp + 0x90]
xor edx, edx
mov rcx, rax
add r8, 2
call sub.MSVCR80.dll_memset
mov rdx, qword [str.RedirectVerb]
mov rcx, qword [rsp + 0x38]
lea r11, [rsp + 0x90]
lea r8, [rsp + 0x30]
mov r9, rdi
mov qword [rsp + 0x20], r11
call fcn.30003bd4
cmp eax, r14d
mov ebx, eax
jl 0x30005f53
cmp dword [rsp + 0x30], 1
je 0x30005f2f
cmp dword [rsp + 0x30], 2
je 0x30005f2f
mov ebx, 0x8000ffff
jmp 0x30005f53
cmp ebx, 0x80070002
jne 0x30005f2a
mov ebx, r14d
jmp 0x30005f2f
cmp ebx, r14d
jl 0x30005f53
cmp rsi, r14
je 0x30005f60
cmp word [rsi], r14w
je 0x30005f53
cmp rdi, r14
je 0x30005f53
cmp word [rdi], r14w
je 0x30005f53
mov qword [r13], rsi
mov qword [r12], rdi
mov rdi, r14
mov rsi, r14
cmp rsi, r14
je 0x30005f60
mov rcx, rsi
call fcn.300034e4
cmp rdi, r14
je 0x30005f6d
mov rcx, rdi
call fcn.300034e4
mov rcx, qword [rsp + 0x40]
cmp rcx, r14
je 0x30005f9d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx ecx, ax
or ecx, 0x80070000
cmp eax, r14d
cmovle ecx, eax
mov rax, qword [rsp + 0x40]
cmp ecx, r14d
cmovge rax, r14
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x48]
cmp rcx, r14
je 0x30005fcd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx ecx, ax
or ecx, 0x80070000
cmp eax, r14d
cmovle ecx, eax
mov rax, qword [rsp + 0x48]
cmp ecx, r14d
cmovge rax, r14
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x38]
cmp rcx, r14
je 0x30005fe4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x30005fe4
mov ebx, 0x80070057
mov eax, ebx
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret