Function at 0x1400060ac
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3e8]
sub rsp, 0x4e8
mov rax, qword [0x14000a2a8]
xor rax, rsp
mov qword [rbp + 0x3d0], rax
xor r13d, r13d
mov dword [rsp + 0x58], 0x200
mov dword [rsp + 0x30], r13d
mov rdi, r9
mov qword [rsp + 0x38], r13
mov r12, r8
mov qword [rsp + 0x40], r13
mov r14, rdx
mov qword [rsp + 0x48], r13
mov r15, rcx
mov qword [rsp + 0x50], r13
mov esi, r13d
mov dword [rsp + 0x34], r13d
test rcx, rcx
je 0x14000641f
cmp word [rcx], r13w
je 0x14000641f
test r9, r9
je 0x14000641f
cmp word [r9], r13w
je 0x14000641f
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, r9
call fcn.140004afc
test eax, eax
js 0x14000617f
mov edx, dword [rsp + 0x30]
xor ecx, ecx
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
je 0x14000617f
lea r8, [rsp + 0x30]
mov rdx, rax
mov rcx, rdi
call fcn.140004afc
test eax, eax
jns 0x14000617f
mov rcx, rsi
call fcn.140003310
mov esi, r13d
test rsi, rsi
mov ebx, r13d
cmovne rdi, rsi
test r12, r12
je 0x14000634c
cmp word [r12], r13w
je 0x14000634c
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rdi
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140006424
mov rdx, qword [str.shell]
lea rax, [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140006424
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, r12
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140006424
mov rdx, qword [0x14000c230]
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140006424
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], r13
xor edx, edx
mov dword [rsp + 0x30], r13d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
mov ecx, r13d
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
cmovns ecx, dword [rsp + 0x30]
mov edx, 0x80000000
mov r8d, 0x80070002
lea eax, [rbx + rdx]
test edx, eax
jne 0x1400062df
cmp ebx, r8d
jne 0x140006424
cmp ebx, r8d
je 0x1400062f7
test ebx, ebx
js 0x14000634c
lea eax, [rcx - 1]
cmp eax, 1
ja 0x1400062f7
cmp dword [rsp + 0x34], 2
ja 0x14000634c
mov rdx, qword [0x14000c258]
lea rax, [rsp + 0x34]
mov rcx, qword [rsp + 0x50]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x30], r13d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140006424
cmp dword [rsp + 0x34], r13d
ja 0x14000634c
mov ebx, 0x80004005
jmp 0x140006424
test r14, r14
je 0x140006379
cmp word [r14], r13w
je 0x140006379
lea r8, [rsp + 0x30]
mov dword [rsp + 0x30], r13d
mov rdx, r12
mov rcx, rdi
call fcn.1400046f8
mov ebx, eax
test eax, eax
js 0x140006379
cmp dword [rsp + 0x30], r13d
jne 0x1400063c3
mov edx, 3
mov rcx, r15
call qword [sym.imp.SHLWAPI.dll_UrlIsW]
test eax, eax
je 0x1400063c0
xor edx, edx
lea rcx, [rbp - 0x30]
mov r8d, 0x400
call sub.VCRUNTIME140.dll_memset
xor r9d, r9d
lea r8, [rsp + 0x58]
lea rdx, [rbp - 0x30]
mov rcx, r15
call qword [sym.imp.SHLWAPI.dll_PathCreateFromUrlW]
lea r14, [rbp - 0x30]
mov ebx, r13d
test eax, eax
cmovs r14, r15
jmp 0x1400063c3
mov r14, r15
mov r15d, 0x70
lea rcx, [rsp + 0x60]
mov r8d, r15d
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], r15d
mov dword [rsp + 0x64], 0x101
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r14
mov dword [rbp - 0x70], 1
mov qword [rbp - 0x58], rdi
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x140006424
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x140006424
mov ebx, 0x80070057
mov rcx, rsi
call fcn.140003310
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000645d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx ecx, ax
mov edi, 0x80070000
or ecx, edi
test eax, eax
cmovle ecx, eax
mov rax, qword [rsp + 0x38]
test ecx, ecx
cmovns rax, r13
mov qword [rsp + 0x38], rax
jmp 0x140006462
mov edi, 0x80070000
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000648c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx ecx, ax
or ecx, edi
test eax, eax
cmovle ecx, eax
mov rax, qword [rsp + 0x40]
test ecx, ecx
cmovns rax, r13
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400064b6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx ecx, ax
or ecx, edi
test eax, eax
cmovle ecx, eax
mov rax, qword [rsp + 0x48]
test ecx, ecx
cmovns rax, r13
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400064c6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rbp + 0x3d0]
xor rcx, rsp
call fcn.140006dd0
add rsp, 0x4e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret