Function at 0x18000ee50
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x1f8]
sub rsp, 0x2e0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x180248950]
xor rax, rsp
mov qword [rbp + 0x1d0], rax
mov rsi, rcx
mov dword [rsp + 0x28], 1
xor r14d, r14d
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov r8, rcx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x18000f18f
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], r14
mov dword [rsp + 0x30], r14d
mov word [rbp - 0x40], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp - 0x3e]
call fcn.1800be330
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x1801ec460]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000f18b
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.shell
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000f18b
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.opencommand
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000f18b
mov dword [rsp + 0x30], 0x104
mov dword [rsp + 0x34], 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, [0x1801f3ee0]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x30], r14d
jbe 0x18000f18b
mov qword [rbp - 0x70], 7
mov qword [rbp - 0x78], r14
mov word [rsp + 0x78], r14w
cmp word [rbp - 0x40], r14w
jne 0x18000efe7
mov r8d, r14d
jmp 0x18000effa
lea rax, [rbp - 0x40]
or r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], r14w
jne 0x18000eff0
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x78]
call fcn.180005450
nop
mov r9d, 4
xor r8d, r8d
lea rdx, str..exe
lea rcx, [rsp + 0x78]
call fcn.1800128a0
mov rdi, rax
cmp eax, 0xffffffff
je 0x18000f17a
mov r9d, 1
xor r8d, r8d
lea rdx, [0x1801ebb00]
lea rcx, [rsp + 0x78]
call fcn.1800128a0
mov rbx, rax
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], r14
mov word [rsp + 0x58], r14w
xor r8d, r8d
lea rdx, [0x1801f3ee0]
lea rcx, [rsp + 0x58]
call fcn.180005450
nop
xor r8d, r8d
lea rdx, [rbp - 0x68]
lea rcx, [rsp + 0x78]
test ebx, ebx
lea eax, [rdi + 5]
je 0x18000f08b
lea eax, [rdi + 4]
movsxd r9, eax
call fcn.180011af0
mov rbx, rax
lea rax, [rsp + 0x58]
cmp rax, rbx
je 0x18000f0d3
cmp qword [rsp + 0x70], 8
jb 0x18000f0b2
mov rcx, qword [rsp + 0x58]
call fcn.1800b5354
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], r14
mov word [rsp + 0x58], r14w
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.1800146e0
cmp qword [rbp - 0x50], 8
jb 0x18000f0e3
mov rcx, qword [rbp - 0x68]
call fcn.1800b5354
lea r8, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae r8, qword [rsp + 0x58]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r14
mov r9, rsi
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
cmp eax, 0x20
ja 0x18000f141
cmp qword [rsp + 0x70], 8
jb 0x18000f12b
mov rcx, qword [rsp + 0x58]
call fcn.1800b5354
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], r14
mov word [rsp + 0x58], r14w
jmp 0x18000f17a
cmp qword [rsp + 0x70], 8
jb 0x18000f153
mov rcx, qword [rsp + 0x58]
call fcn.1800b5354
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], r14
mov word [rsp + 0x58], r14w
cmp qword [rbp - 0x70], 8
jb 0x18000f18f
mov rcx, qword [rsp + 0x78]
call fcn.1800b5354
jmp 0x18000f18f
cmp qword [rbp - 0x70], 8
jb 0x18000f18b
mov rcx, qword [rsp + 0x78]
call fcn.1800b5354
xor eax, eax
jmp 0x18000f194
mov eax, 1
mov rcx, qword [rbp + 0x1d0]
xor rcx, rsp
call fcn.1800b5370
lea r11, [rsp + 0x2e0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret