Function at 0x1400ee970
Capabilities:
Check if file exists
Create process on windows
Create process suspended
Get file attributes
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov r12d, edx
mov rcx, qword [rcx]
cmp dword [rcx - 0x10], 0
je 0x1400ef1aa
xor r14d, r14d
mov qword [rbp - 0x18], r14
mov dword [rbp - 0x10], r14d
mov qword [rbp - 8], r14
add rcx, 0xffffffffffffffe8
call fcn.140001b90
lea rdi, [rax + 0x18]
mov qword [rsp + 0x70], rdi
lea rcx, str._h_r_
mov rax, qword [str._h_r_]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x60], rbx
test r12d, r12d
je 0x1400ef146
or rsi, 0xffffffffffffffff
dec r12d
je 0x1400eeb9f
dec r12d
jne 0x1400eed4a
lea rdx, str.Chrome
lea rcx, [rbp - 0x68]
call fcn.14000fdc0
nop
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x28]
call fcn.1400ee7c0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400eea72
cmp dword [rbx + 0x10], r12d
jl 0x1400eea63
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400eea63
call fcn.140001b90
mov rdi, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400eea58
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x60], rax
jmp 0x1400eea72
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.14000c510
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400eea91
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400eeaaf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0x60]
cmp dword [rax - 0x10], 0
je 0x1400eed45
mov r8d, 0xa
lea rdx, str.chrome.exe
lea rcx, [rsp + 0x60]
call fcn.140005090
mov rdi, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400eed45
lea rcx, str._h_r_
mov rax, qword [str._h_r_]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp - 0x70], rax
mov r8, qword [rsp + 0x70]
lea rdx, str._______1____s_
lea rcx, [rbp - 0x70]
call fcn.14000ee80
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r14
mov rbx, qword [rbp - 0x70]
mov r9, rbx
mov r8, rdi
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400eeb5c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400eeb7c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x1400eeb9a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x1400ef1aa
lea rdx, str.Firefox
lea rcx, [rbp - 0x78]
call fcn.14000fdc0
nop
lea rdx, [rbp - 0x78]
lea rcx, [rbp - 0x60]
call fcn.1400ee7c0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x1400eec18
cmp dword [rbx + 0x10], 0
jl 0x1400eec09
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x1400eec09
call fcn.140001b90
mov rdi, rax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1400eebfe
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
lea rax, [rdi + 0x18]
mov qword [rsp + 0x60], rax
jmp 0x1400eec18
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.14000c510
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400eec37
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400eec55
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0x60]
cmp dword [rax - 0x10], 0
je 0x1400eed45
mov r8d, reloc.WS2_32.dll_inet_addr
lea rdx, str.firefox.exe
lea rcx, [rsp + 0x60]
call fcn.140005090
mov rdi, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400eed45
lea rcx, str._h_r_
mov rax, qword [str._h_r_]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
add rax, 0x18
mov qword [rbp - 0x80], rax
mov r8, qword [rsp + 0x70]
lea rdx, str._requestPending__osint__url___s_
lea rcx, [rbp - 0x80]
call fcn.14000ee80
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r14
mov rbx, qword [rbp - 0x80]
mov r9, rbx
mov r8, rdi
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400eed02
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400eed22
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x1400eed40
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x1400ef1aa
mov rdi, qword [rsp + 0x70]
lea r12, [rdi - 0x18]
mov rcx, r12
call fcn.140001b90
lea rbx, [rax + 0x18]
mov qword [rsp + 0x78], rbx
cmp dword [rbx - 0x10], 0
jl 0x1400eedba
lea rdx, str.file:___
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_wcsstr]
test rax, rax
je 0x1400eedba
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x1400eedba
lea r8, [0x140117ea0]
lea rdx, str.file:___
lea rcx, [rsp + 0x78]
call fcn.14000f750
lea r8, [0x140118dec]
lea rdx, [0x140122f5c]
lea rcx, [rsp + 0x78]
call fcn.14000f750
mov rbx, qword [rsp + 0x78]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, rbx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jg 0x1400ef0ee
mov qword [rbp - 0x40], r14
mov dword [rbp - 0x38], r14d
mov qword [rbp - 0x30], r14
lea rcx, str._h_r_
mov rax, qword [str._h_r_]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x68], rbx
mov r9d, 0x20019
lea r8, str.http_shellopencommand
mov rdx, 0xffffffff80000000
lea rcx, [rbp - 0x40]
call fcn.140002190
test eax, eax
jne 0x1400ef0bf
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x50], r14
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov r13, qword [rbp - 0x40]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov r11d, dword [rbp + 0xb0]
inc r11d
mov dword [rbp + 0xb0], r11d
lea edx, [r11 + 1]
test edx, edx
jns 0x1400eee98
mov ecx, 0x80070057
call fcn.140001000
int3
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x1400eeebf
lea rcx, [rsp + 0x68]
call fcn.140001b30
mov rbx, qword [rsp + 0x68]
mov r11d, dword [rbp + 0xb0]
lea eax, [r11 + r11]
mov dword [rbp + 0xc0], eax
mov dword [rbp + 0xb0], r14d
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0xc8]
xor r8d, r8d
lea rdx, [0x140117ea0]
mov rcx, r13
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ef092
mov eax, dword [rbp + 0xc8]
cmp eax, 1
je 0x1400eef17
cmp eax, 2
jne 0x1400ef092
mov ecx, dword [rbp + 0xc0]
test rbx, rbx
je 0x1400eef45
test ecx, ecx
je 0x1400eef41
test cl, 1
jne 0x1400ef092
mov eax, ecx
shr rax, 1
cmp word [rbx + rax*2 - 2], 0
je 0x1400eef45
jmp 0x1400ef092
mov word [rbx], r14w
shr ecx, 1
mov dword [rbp + 0xb0], ecx
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_wcsnlen]
test eax, eax
js 0x1400ef087
cmp eax, dword [rbx - 0xc]
jg 0x1400ef087
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r14w
mov r8, rdi
lea rdx, [0x140134b4c]
lea rcx, [rsp + 0x68]
call fcn.14000f750
test eax, eax
jne 0x1400eefca
lea r8d, [rax + 2]
lea rdx, [0x140134b44]
lea rcx, [rsp + 0x68]
call fcn.140005090
mov r8d, dword [rdi - 0x10]
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.140005090
mov r8d, 1
lea rdx, [0x140133b7c]
lea rcx, [rsp + 0x68]
call fcn.140005090
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp]
call sub.MSVCR100.dll_memset
xor r11d, r11d
mov qword [rbp - 0x58], r11
mov qword [rbp - 0x50], r11
mov qword [rbp - 0x48], r11
mov rbx, qword [rsp + 0x68]
mov ecx, dword [rbx - 0x10]
inc ecx
movsxd rdi, ecx
mov eax, 2
mul rdi
cmovo rax, rsi
mov rcx, rax
call fcn.1400d6a4c
mov r13, rax
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.MSVCR100.dll_memset
mov r8, rbx
mov rdx, rdi
mov rcx, r13
call qword [sym.imp.MSVCR100.dll_wcscpy_s]
lea r11, [rbp - 0x58]
mov qword [rsp + 0x48], r11
lea rax, [rbp]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400ef07d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call sub.MSVCR100.dll_void___cdecl_operator_delete___void____ptr64_
jmp 0x1400ef0bf
mov ecx, 0x80070057
call fcn.140001000
int3
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call qword [sym.imp.MSVCR100.dll_wcsnlen]
test eax, eax
js 0x1400ef0b4
cmp eax, dword [rbx - 0xc]
jg 0x1400ef0b4
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r14w
jmp 0x1400ef0bf
mov ecx, 0x80070057
call fcn.140001000
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400ef0da
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x1400ef0e9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x78]
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400ef109
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400ef129
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
lock xadd dword [r12 + 0x10], esi
dec esi
test esi, esi
jg 0x1400ef144
mov rcx, qword [r12]
mov rax, qword [rcx]
mov rdx, r12
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x1400ef1aa
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r14
mov r9, rdi
lea r8, str.iexplore.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rdx, [rbx - 0x18]
or rsi, 0xffffffffffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1400ef18c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x1400ef1aa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
add rsp, 0x170
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret