Function at 0x140004e3c
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
xor r14d, r14d
mov r12, r9
mov r13, r8
mov rbp, rdx
mov qword [r11 - 0x38], r14
mov qword [r11 - 0x30], r14
mov qword [r11 - 0x40], r14
mov dword [r11 + 8], r14d
mov rsi, r14
mov rdi, r14
cmp rcx, r14
je 0x1400051ec
cmp word [rcx], r14w
je 0x1400051ec
cmp rdx, r14
je 0x1400051ec
cmp word [rdx], r14w
je 0x1400051ec
cmp r8, r14
je 0x1400051ec
cmp r9, r14
je 0x1400051ec
mov qword [r8], r14
lea rax, [r11 - 0x38]
mov rdx, rcx
mov qword [r9], r14
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov r9d, 0x20019
mov qword [r11 - 0x58], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jl 0x14000517a
mov rdx, qword [str.shell]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x48]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jl 0x14000517a
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jl 0x14000517a
mov rdx, qword [str.RedirectFileType]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x30], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
mov ebp, r14d
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
cmovge ebp, dword [rsp + 0x30]
cmp ebx, r14d
mov dword [rsp + 0x30], ebp
jl 0x14000503d
cmp ebp, 1
je 0x140004fc4
cmp ebp, 2
jne 0x14000503d
mov edx, dword [rsp + 0x80]
xor ecx, ecx
add rdx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
cmp rax, r14
je 0x1400050c8
mov r8d, dword [rsp + 0x80]
xor edx, edx
mov rcx, rax
add r8, 2
call sub.MSVCR90.dll_memset
mov rdx, qword [str.RedirectFileType]
mov rcx, qword [rsp + 0x38]
lea r11, [rsp + 0x80]
lea r8, [rsp + 0x30]
mov r9, rsi
mov qword [rsp + 0x20], r11
call fcn.140003b54
cmp eax, r14d
mov ebx, eax
jl 0x140005160
mov ebp, dword [rsp + 0x30]
cmp ebp, 1
je 0x14000504e
cmp ebp, 2
je 0x14000504e
jmp 0x140005123
cmp ebx, 0x80070002
je 0x14000504e
cmp ebx, r14d
jl 0x14000517a
mov rdx, qword [str.RedirectVerb]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x30], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
cmovge ebp, dword [rsp + 0x30]
cmp ebx, r14d
mov dword [rsp + 0x30], ebp
jl 0x14000512a
cmp ebp, 1
je 0x1400050ad
cmp ebp, 2
jne 0x14000512a
mov edx, dword [rsp + 0x80]
xor ecx, ecx
add rdx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
cmp rax, r14
jne 0x1400050d2
mov ebx, 0x8007000e
jmp 0x140005160
mov r8d, dword [rsp + 0x80]
xor edx, edx
mov rcx, rax
add r8, 2
call sub.MSVCR90.dll_memset
mov rdx, qword [str.RedirectVerb]
mov rcx, qword [rsp + 0x38]
lea r11, [rsp + 0x80]
lea r8, [rsp + 0x30]
mov r9, rdi
mov qword [rsp + 0x20], r11
call fcn.140003b54
cmp eax, r14d
mov ebx, eax
jl 0x140005160
cmp dword [rsp + 0x30], 1
je 0x14000513c
cmp dword [rsp + 0x30], 2
je 0x14000513c
mov ebx, 0x8000ffff
jmp 0x140005160
cmp ebx, 0x80070002
jne 0x140005137
mov ebx, r14d
jmp 0x14000513c
cmp ebx, r14d
jl 0x140005160
cmp rsi, r14
je 0x14000516d
cmp word [rsi], r14w
je 0x140005160
cmp rdi, r14
je 0x140005160
cmp word [rdi], r14w
je 0x140005160
mov qword [r13], rsi
mov qword [r12], rdi
mov rdi, r14
mov rsi, r14
cmp rsi, r14
je 0x14000516d
mov rcx, rsi
call fcn.1400034bc
cmp rdi, r14
je 0x14000517a
mov rcx, rdi
call fcn.1400034bc
mov rcx, qword [rsp + 0x40]
cmp rcx, r14
je 0x1400051aa
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx ecx, ax
or ecx, 0x80070000
cmp eax, r14d
cmovle ecx, eax
mov rax, qword [rsp + 0x40]
cmp ecx, r14d
cmovge rax, r14
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x48]
cmp rcx, r14
je 0x1400051da
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx ecx, ax
or ecx, 0x80070000
cmp eax, r14d
cmovle ecx, eax
mov rax, qword [rsp + 0x48]
cmp ecx, r14d
cmovge rax, r14
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x38]
cmp rcx, r14
je 0x1400051f1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400051f1
mov ebx, 0x80070057
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret