Function at 0x14000272c
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x9c0]
sub rsp, 0xac0
mov rax, qword [0x14000c008]
xor rax, rsp
mov qword [rbp + 0x9b0], rax
mov r14, rdx
mov rbx, rcx
xor edi, edi
mov esi, edi
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x38], 0x28
mov r15d, 0x208
mov dword [rsp + 0x50], r15d
call fcn.140002508
mov r13d, eax
mov rcx, rbx
mov eax, edi
test rbx, rbx
je 0x1400027a9
cmp word [rbx], di
je 0x1400027a9
lea rcx, [rcx + 2]
inc eax
cmp word [rcx], di
jne 0x14000279e
lea edi, [rax + 0x14]
mov edx, edi
add rdx, rdx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r12, rax
test rax, rax
je 0x140002c2b
mov r8d, r15d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths_
lea rcx, [rbp + 0x190]
call fcn.140002ef0
lea ecx, [r13 + 1]
test ecx, 0xfffffffb
je 0x140002875
cmp r13d, 4
jae 0x140002c21
mov r8d, r15d
lea rcx, [r13*8]
add rcx, r13
lea r14, [0x140000000]
mov rdx, qword [r14 + rcx*8 + 0x9ab0]
lea rcx, [rbp + 0x190]
or esi, 0xffffffff
xor ebx, ebx
test rdx, rdx
je 0x14000283f
cmp word [rbp + 0x190], bx
je 0x14000283a
add rcx, 2
add r8d, esi
je 0x14000283f
cmp word [rcx], bx
jne 0x14000282c
call fcn.140002ef0
mov r8d, r15d
lea rcx, [rbp + 0x190]
cmp word [rbp + 0x190], bx
je 0x140002864
add rcx, 2
add r8d, esi
je 0x1400029fc
cmp word [rcx], bx
jne 0x140002852
lea rdx, str..exe
call fcn.140002ef0
jmp 0x1400029fc
mov r8d, edi
mov rdx, rbx
mov rcx, r12
call fcn.140002ef0
mov r8d, edi
or esi, 0xffffffff
xor ebx, ebx
cmp word [r12], bx
je 0x1400028a0
add rcx, 2
add r8d, esi
je 0x1400028ac
cmp word [rcx], bx
jne 0x140002892
lea rdx, str._shell_
call fcn.140002ef0
mov r8d, edi
mov rcx, r12
test r14, r14
je 0x1400028d4
cmp word [r12], bx
je 0x1400028cc
add rcx, 2
add r8d, esi
je 0x1400028d4
cmp word [rcx], bx
jne 0x1400028be
mov rdx, r14
call fcn.140002ef0
mov rcx, r12
cmp word [r12], bx
je 0x1400028eb
add rcx, 2
add edi, esi
je 0x1400028fa
cmp word [rcx], bx
jne 0x1400028de
mov r8d, edi
lea rdx, str.command
call fcn.140002ef0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r12
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002c15
movzx eax, byte [rbp - 0x80]
cmp dword [rsp + 0x34], 1
cmove eax, ebx
mov byte [rbp - 0x80], al
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002c15
lea rcx, [rbp - 0x80]
call fcn.140002e50
mov rdx, rax
test rax, rax
je 0x140002c15
mov word [rax + 8], bx
lea rax, [rbp - 0x80]
cmp rdx, rax
jbe 0x1400029ca
lea r8, [rdx - 2]
movzx ecx, word [r8]
lea eax, [rcx - 0x61]
cmp ax, 0x19
jbe 0x1400029b5
sub cx, 0x30
cmp cx, 0x2f
ja 0x1400029b1
movabs rax, 0x87fffffe03ff
bt rax, rcx
jb 0x1400029b5
mov eax, ebx
jmp 0x1400029ba
mov eax, 1
test eax, eax
je 0x1400029ca
mov rdx, r8
lea rax, [rbp - 0x80]
cmp r8, rax
ja 0x140002986
mov r8d, r15d
lea rcx, [rbp + 0x190]
test rdx, rdx
je 0x1400029f5
cmp word [rbp + 0x190], bx
je 0x1400029f0
add rcx, 2
add r8d, esi
je 0x1400029f5
cmp word [rcx], bx
jne 0x1400029e2
call fcn.140002ef0
lea r14, [0x140000000]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x190]
mov rdi, 0xffffffff80000002
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002a71
movzx eax, byte [rsp + 0x58]
cmp dword [rsp + 0x34], 1
cmove eax, ebx
mov byte [rsp + 0x58], al
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, str.UseUrl
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140002b85
lea eax, [r13 + 1]
test eax, 0xfffffffb
je 0x140002c1d
lea rbx, [r13*8]
add rbx, r13
xor eax, eax
cmp qword [r14 + rbx*8 + 0x9af0], rax
je 0x140002c19
mov r8d, r15d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths_
lea rcx, [rbp + 0x5a0]
call fcn.140002ef0
mov r8d, r15d
mov rdx, qword [r14 + rbx*8 + 0x9af0]
lea rcx, [rbp + 0x5a0]
xor ebx, ebx
test rdx, rdx
je 0x140002ae6
cmp word [rbp + 0x5a0], bx
je 0x140002ae1
add rcx, 2
add r8d, esi
je 0x140002ae6
cmp word [rcx], bx
jne 0x140002ad3
call fcn.140002ef0
lea rcx, [rbp + 0x5a0]
cmp word [rbp + 0x5a0], bx
je 0x140002b04
add rcx, 2
add r15d, esi
je 0x140002b13
cmp word [rcx], bx
jne 0x140002af6
mov r8d, r15d
lea rdx, str..exe
call fcn.140002ef0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x5a0]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140002c15
movzx eax, byte [rsp + 0x58]
cmp dword [rsp + 0x34], 1
cmove eax, ebx
mov byte [rsp + 0x58], al
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, str.UseUrl
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140002c15
cmp dword [rsp + 0x34], 1
jne 0x140002c01
movzx edx, word [rsp + 0x58]
movzx eax, dx
mov r8d, 0x31
cmp dx, r8w
jne 0x140002bc0
mov rcx, rbx
lea rcx, [rcx + 2]
movzx eax, word [rsp + rcx + 0x58]
test ax, ax
je 0x140002c0e
movzx r8d, word [rcx + r14 + 0x9a84]
cmp ax, r8w
je 0x140002ba3
movzx ecx, ax
movzx eax, r8w
sub ecx, eax
je 0x140002c0e
mov eax, 0x79
cmp dx, ax
jne 0x140002bf7
mov rax, rbx
lea rax, [rax + 2]
movzx edx, word [rsp + rax + 0x58]
test dx, dx
je 0x140002c0e
movzx ecx, word [rax + r14 + 0x9a88]
cmp dx, cx
je 0x140002bd8
movzx eax, cx
movzx eax, ax
movzx ecx, dx
sub ecx, eax
je 0x140002c0e
cmp dword [rsp + 0x34], 4
jne 0x140002c1d
cmp dword [rsp + 0x58], ebx
je 0x140002c1d
mov esi, 1
jmp 0x140002c21
mov esi, ebx
jmp 0x140002c21
mov esi, eax
jmp 0x140002c21
mov esi, dword [rsp + 0x30]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalFree]
nop
mov rcx, qword [rsp + 0x48]
xor ebx, ebx
test rcx, rcx
je 0x140002c3d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rbx
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140002c52
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov rcx, qword [rbp + 0x9b0]
xor rcx, rsp
call fcn.1400070a0
mov rbx, qword [rsp + 0xb10]
add rsp, 0xac0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret