Function at 0x140006528
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x9c0]
sub rsp, 0xac0
mov rax, qword [0x14007c010]
xor rax, rsp
mov qword [rbp + 0x9b0], rax
xor r13d, r13d
mov dword [rsp + 0x34], 0x28
mov r12, rdx
mov qword [rsp + 0x38], r13
xor edx, edx
mov qword [rsp + 0x40], r13
mov r15d, r13d
mov dword [rsp + 0x48], 0x208
mov rdi, rcx
call fcn.14000d768
mov ebx, eax
mov eax, r13d
mov rcx, rdi
test rdi, rdi
je 0x1400065a4
cmp word [rdi], r13w
je 0x1400065a4
lea rcx, [rcx + 2]
inc eax
cmp word [rcx], r13w
jne 0x140006598
lea esi, [rax + 0x14]
lea ecx, [rsi + rsi]
call fcn.140002798
mov r14, rax
test rax, rax
je 0x1400068c1
mov r8d, 0x208
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths_
lea rcx, [rbp + 0x190]
call fcn.14000dc08
lea rcx, str.WinWord
cmp ebx, 9
je 0x140006619
cmp ebx, 0xffffffff
je 0x140006619
mov edi, 0x208
cmp ebx, 0xa
jae 0x140006735
lea rdx, [rbx + rbx*4]
mov r8d, edi
add rdx, rdx
mov rdx, qword [rcx + rdx*8]
lea rcx, [rbp + 0x190]
call fcn.14000dc84
lea rdx, str..exe
jmp 0x140006726
mov r8d, esi
mov rdx, rdi
mov rcx, r14
call fcn.14000dc08
mov r8d, esi
lea rdx, str._shell_
call fcn.14000dc84
mov r8d, esi
mov rdx, r12
mov rcx, r14
call fcn.14000dc84
mov r8d, esi
lea rdx, [0x1400476a8]
mov rcx, r14
call fcn.14000dc84
lea rax, [rsp + 0x40]
mov r9d, 0x20019
mov rdx, r14
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000000
call fcn.14000e39c
test eax, eax
jne 0x1400068b9
movzx eax, byte [rbp - 0x80]
lea r9, [rsp + 0x30]
cmp dword [rsp + 0x30], 1
mov rcx, qword [rsp + 0x40]
cmove eax, r13d
xor r8d, r8d
mov byte [rbp - 0x80], al
xor edx, edx
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400068b9
lea rdx, str..exe
lea rcx, [rbp - 0x80]
call fcn.14000de00
mov rdx, rax
test rax, rax
je 0x1400068b9
mov word [rax + 8], r13w
lea rax, [rbp - 0x80]
cmp rdx, rax
jbe 0x140006721
lea r8, [rdx - 2]
movzx ecx, word [r8]
lea eax, [rcx - 0x61]
cmp ax, 0x19
jbe 0x140006715
sub cx, 0x30
cmp cx, 0x2f
ja 0x140006721
movzx eax, cx
movabs rcx, 0x87fffffe03ff
bt rcx, rax
jae 0x140006721
lea rax, [rbp - 0x80]
mov rdx, r8
cmp r8, rax
ja 0x1400066e7
mov edi, 0x208
mov r8d, edi
lea rcx, [rbp + 0x190]
call fcn.14000dc84
lea rax, [rsp + 0x38]
mov rsi, 0xffffffff80000002
mov rcx, rsi
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
lea rdx, [rbp + 0x190]
call fcn.14000e39c
test eax, eax
jne 0x1400067a7
movzx eax, byte [rsp + 0x50]
lea r9, [rsp + 0x30]
cmp dword [rsp + 0x30], 1
lea rdx, str.UseUrl
mov rcx, qword [rsp + 0x38]
cmove eax, r13d
xor r8d, r8d
mov byte [rsp + 0x50], al
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140006874
cmp ebx, 8
ja 0x1400068b9
lea rbx, [rbx + rbx*4]
add rbx, rbx
lea r12, str.WinWord
cmp qword [r12 + rbx*8 + 0x48], r13
je 0x1400068b9
mov r8d, edi
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionApp_Paths_
lea rcx, [rbp + 0x5a0]
call fcn.14000dc08
mov rdx, qword [r12 + rbx*8 + 0x48]
lea rcx, [rbp + 0x5a0]
mov r8d, edi
call fcn.14000dc84
mov r8d, edi
lea rdx, str..exe
lea rcx, [rbp + 0x5a0]
call fcn.14000dc84
lea rax, [rsp + 0x38]
mov r9d, 0x20019
lea rdx, [rbp + 0x5a0]
mov qword [rsp + 0x20], rax
mov rcx, rsi
call fcn.14000e39c
test eax, eax
jne 0x1400068b9
movzx eax, byte [rsp + 0x50]
lea r9, [rsp + 0x30]
cmp dword [rsp + 0x30], 1
lea rdx, str.UseUrl
mov rcx, qword [rsp + 0x38]
cmove eax, r13d
xor r8d, r8d
mov byte [rsp + 0x50], al
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400068b9
cmp dword [rsp + 0x30], 1
jne 0x1400068a5
lea rdx, [0x1400476bc]
lea rcx, [rsp + 0x50]
call fcn.14000dab8
test eax, eax
jne 0x1400068b3
lea rdx, [0x1400476c0]
lea rcx, [rsp + 0x50]
call fcn.14000dab8
test eax, eax
jne 0x1400068b3
cmp dword [rsp + 0x30], 4
jne 0x1400068b9
cmp dword [rsp + 0x50], r13d
je 0x1400068b9
mov r15d, 1
mov rcx, r14
call fcn.1400027dc
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400068d1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x40], r13
test rcx, rcx
je 0x1400068e6
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, r15d
mov rcx, qword [rbp + 0x9b0]
xor rcx, rsp
call fcn.14003ee60
mov rbx, qword [rsp + 0xb10]
add rsp, 0xac0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret