Function at 0x300019d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x6b0
mov rax, qword [0x3000a228]
xor rax, rsp
mov qword [rsp + 0x6a0], rax
xor r14d, r14d
mov r13, rdx
xor edx, edx
mov rbx, rcx
mov dword [rsp + 0x4c], 0x28
mov dword [rsp + 0x48], 0x208
mov ebp, r14d
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
call fcn.3000190c
cmp rbx, r14
mov rcx, rbx
mov edi, eax
mov eax, r14d
je 0x30001a41
cmp word [rbx], r14w
je 0x30001a41
add rcx, 2
add eax, 1
cmp word [rcx], r14w
jne 0x30001a34
lea r12d, [rax + 0x14]
xor ecx, ecx
mov edx, r12d
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp rax, r14
mov rsi, rax
je 0x30001c9a
mov rdx, qword [str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths_]
lea rcx, [rsp + 0x290]
mov r8d, 0x208
call fcn.300017e4
cmp edi, 3
je 0x30001ab9
cmp edi, 0xffffffff
je 0x30001ab9
lea rax, str.WinWord
mov rdx, rdi
mov ebx, 0x208
shl rdx, 6
lea rcx, [rsp + 0x290]
mov r8d, ebx
mov rdx, qword [rdx + rax]
call fcn.30001870
mov r8d, ebx
lea rdx, str..exe
jmp 0x30001bc9
mov r8d, r12d
mov rdx, rbx
mov rcx, rsi
call fcn.300017e4
lea rdx, str._shell_
mov r8d, r12d
call fcn.30001870
mov r8d, r12d
mov rdx, r13
mov rcx, rsi
call fcn.30001870
lea rdx, str.command
mov r8d, r12d
mov rcx, rsi
call fcn.30001870
lea r11, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rsi
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r14d
jne 0x30001c92
movzx eax, byte [rsp + 0x80]
cmp dword [rsp + 0x30], 1
mov rcx, qword [rsp + 0x38]
cmove eax, r14d
lea r9, [rsp + 0x30]
xor r8d, r8d
mov byte [rsp + 0x80], al
lea rax, [rsp + 0x48]
xor edx, edx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x30001c92
lea rdx, str..exe
lea rcx, [rsp + 0x80]
call fcn.30001758
cmp rax, r14
mov rdx, rax
je 0x30001c92
mov word [rax + 8], r14w
lea rax, [rsp + 0x80]
cmp rdx, rax
jbe 0x30001bc3
lea r8, [rdx - 2]
movzx ecx, word [r8]
call fcn.30001190
cmp eax, r14d
je 0x30001bc3
lea rax, [rsp + 0x80]
mov rdx, r8
cmp r8, rax
ja 0x30001ba1
mov r8d, 0x208
lea rcx, [rsp + 0x290]
call fcn.30001870
lea rax, [rsp + 0x40]
lea rdx, [rsp + 0x290]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r14d
jne 0x30001c92
movzx eax, byte [rsp + 0x50]
cmp dword [rsp + 0x30], 1
mov rcx, qword [rsp + 0x40]
cmove eax, r14d
lea r9, [rsp + 0x30]
lea rdx, str.UseUrl
mov byte [rsp + 0x50], al
lea rax, [rsp + 0x4c]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x30001c92
cmp dword [rsp + 0x30], 1
jne 0x30001c7f
lea rdx, [0x30009aa8]
lea rcx, [rsp + 0x50]
call fcn.3000135c
cmp eax, r14d
je 0x30001c8d
lea rdx, [0x30009aa0]
lea rcx, [rsp + 0x50]
call fcn.3000135c
cmp eax, r14d
je 0x30001c8d
cmp dword [rsp + 0x30], 4
jne 0x30001c92
cmp dword [rsp + 0x50], r14d
je 0x30001c92
mov ebp, 1
mov rcx, rsi
call fcn.300034e4
mov rcx, qword [rsp + 0x38]
cmp rcx, r14
je 0x30001caa
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x38], r14
cmp rcx, r14
je 0x30001cbf
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebp
mov rcx, qword [rsp + 0x6a0]
xor rcx, rsp
call fcn.30007ea0
add rsp, 0x6b0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret