Function at 0x14000a790
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x2350
call fcn.140127d30
sub rsp, rax
mov qword [rsp + 0xa8], 0xfffffffffffffffe
mov qword [rsp + 0x23a0], rbx
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x2340], rax
mov rsi, rdx
mov r14, rcx
mov edx, 0x5c
call fcn.14010bd78
test rax, rax
je 0x14000a7ea
lea rdi, [rax + 2]
jmp 0x14000a7ed
mov rdi, r14
mov edx, 0x2e
lea rcx, [rax + 2]
call fcn.14010bd78
mov rbx, rax
xor r15d, r15d
or r12, 0xffffffffffffffff
test rax, rax
jne 0x14000a824
lea rdx, str.grldr
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x14000a847
jmp 0x14000aa7f
lea rdx, str..exe
mov rcx, rax
call fcn.14010c4b4
test eax, eax
jne 0x14000a847
lea rdx, str.grub
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
call fcn.1400da76c
mov rdx, rax
mov ecx, r15d
test rax, rax
setne cl
test ecx, ecx
jne 0x14000a867
mov ecx, 0x80004005
call fcn.140001000
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rdx, str.TEAM_SET_::UDM_EDIT0_OnEditFile
test rdx, 0xffffffffffff0000
jne 0x14000a8aa
movzx edi, dx
mov ecx, edi
call fcn.1400dcc48
test rax, rax
je 0x14000a8c7
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140002350
jmp 0x14000a8c7
xor eax, eax
mov rcx, r12
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rcx, [rsp + 0x60]
call fcn.140002570
nop
mov r8b, 0x22
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x80]
call fcn.140008190
nop
mov r8, r14
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400080c0
nop
lea r8, [0x140140138]
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.1400080c0
nop
mov r8, rsi
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.1400080c0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
mov rdi, qword [rsp + 0x60]
add rdi, 0xffffffffffffffe8
cmp rcx, rdi
je 0x14000a976
cmp dword [rdi + 0x10], 0
jl 0x14000a967
mov rax, qword [rdi]
cmp qword [rcx], rax
jne 0x14000a967
call fcn.140001e00
mov rsi, rax
mov ecx, r12d
lock xadd dword [rdi + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x14000a95c
mov rcx, qword [rdi]
mov rax, qword [rcx]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x60], rax
jmp 0x14000a976
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x60]
call fcn.140002570
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000a997
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000a9bb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000a9dc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000a9ff
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, r12
lea rdi, str._EXIT__UDM_EDIT_
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str._EXIT__UDM_EDIT_
lea rcx, [rsp + 0x60]
call fcn.140002660
mov rcx, qword [0x14019ab58]
mov rax, qword [rcx]
mov rdi, qword [rsp + 0x60]
mov rdx, rdi
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test rax, rax
jle 0x14000aa64
lea rdx, [rdi - 0x18]
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x14000afc7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14000afc7
lea rdx, [rdi - 0x18]
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000aa7f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp word [r14], 0x7a
jbe 0x14000afaa
test rbx, rbx
je 0x14000afc7
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140005480
nop
mov word [rsp + 0x330], r15w
mov dword [rsp + 0x68], r15d
mov dword [rsp + 0x58], 0x2000
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x330]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
lea r8, [0x14014f7a8]
mov rdx, rbx
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp word [rsp + 0x330], 0
je 0x14000ac29
xor eax, eax
mov rcx, r12
lea rdi, [rsp + 0x330]
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
test ecx, ecx
jne 0x14000ab85
mov rbx, qword [rsp + 0x50]
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x14000ac29
cmp dword [rdx + 0x10], eax
jge 0x14000ab57
cmp dword [rbx - 0xc], eax
jge 0x14000ab40
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rbx - 0x10], r15d
mov rax, qword [rsp + 0x50]
mov word [rax], r15w
mov rbx, qword [rsp + 0x50]
jmp 0x14000ac29
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x14000ab6e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
jmp 0x14000ac29
mov rcx, qword [rsp + 0x50]
mov esi, dword [rcx - 0x10]
lea rbx, [rsp + 0x330]
sub rbx, rcx
sar rbx, 1
mov edx, 1
sub edx, dword [rcx - 8]
mov eax, dword [rcx - 0xc]
sub eax, edi
or eax, edx
jge 0x14000abbd
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.140001da0
mov rcx, qword [rsp + 0x50]
cmp rbx, rsi
ja 0x14000abde
movsxd rax, edi
lea rsi, [rax + rax]
lea r8, [rcx + rbx*2]
movsxd rdx, dword [rcx - 0xc]
add rdx, rdx
mov r9, rsi
call fcn.14010c284
jmp 0x14000abfc
movsxd rax, edi
lea rsi, [rax + rax]
movsxd rdx, dword [rcx - 0xc]
add rdx, rdx
mov r9, rsi
lea r8, [rsp + 0x330]
call fcn.14010bce0
test edi, edi
js 0x14000ac1e
mov rax, qword [rsp + 0x50]
cmp edi, dword [rax - 0xc]
jg 0x14000ac1e
mov dword [rax - 0x10], edi
mov rax, qword [rsp + 0x50]
mov word [rsi + rax], r15w
mov rbx, qword [rsp + 0x50]
jmp 0x14000ac29
mov ecx, 0x80070057
call fcn.140001000
int3
mov dword [rsp + 0x58], 0x2000
mov word [rsp + 0x330], r15w
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x330]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
lea r8, str.shell
mov rdx, rbx
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea rdx, str.open
lea rsi, [rsp + 0x330]
cmp word [rsp + 0x330], 0
cmove rsi, rdx
test rbx, rbx
jne 0x14000ac93
mov ecx, r15d
jmp 0x14000aca4
xor eax, eax
mov rcx, r12
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rdx, rbx
lea rcx, [rsp + 0x50]
call fcn.140002570
xor eax, eax
mov rcx, r12
lea rdi, str._shell_
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, str._shell_
lea rcx, [rsp + 0x50]
call fcn.140002660
test rsi, rsi
jne 0x14000ace5
mov ecx, r15d
jmp 0x14000acf6
xor eax, eax
mov rcx, r12
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
mov r8d, ecx
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.140002660
xor eax, eax
mov rcx, r12
lea rdi, [0x1401400c8]
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
lea rdx, [0x1401400c8]
lea rcx, [rsp + 0x50]
call fcn.140002660
mov dword [rsp + 0x58], 0x2000
mov word [rsp + 0x330], r15w
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x330]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
lea r8, [0x14014f7a8]
mov rdx, qword [rsp + 0x50]
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
lea rbx, [rsp + 0x330]
lea rcx, [rsp + 0x330]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rsi, [rsp + rcx*2 + 0x330]
mov word [rsp + 0x120], r15w
cmp word [rsp + 0x330], 0
je 0x14000aee7
mov edx, 0x25
lea edi, [rdx + 0xc]
lea r8d, [rdx + 0x27]
lea r9d, [rdx + 5]
nop dword [rax]
cmp dx, word [rbx]
je 0x14000adce
add rbx, 2
jmp 0x14000aedd
movzx eax, word [rbx + 2]
cmp di, ax
jne 0x14000adf8
lea r13, [rsp + 0x120]
mov r8d, 0x104
lea rdx, [rsp + 0x120]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
jmp 0x14000ae01
cmp r8w, ax
jne 0x14000ae77
mov r13, r14
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, eax
lea rcx, [rsp + 0x232e]
sub rcx, rbx
sar rcx, 1
cmp eax, ecx
cmovg ebp, ecx
cmp ebp, 2
je 0x14000ae44
mov r8, rsi
sub r8, rbx
sub r8, 2
sar r8, 1
add r8, r8
lea rdx, [rbx + 4]
movsxd rax, ebp
lea rcx, [rbx + rax*2]
call fcn.14010cd30
movsxd rdi, ebp
add rdi, rdi
mov r8, rdi
mov rdx, r13
mov rcx, rbx
call fcn.14010cd30
add rbx, rdi
lea eax, [rbp - 2]
movsxd rcx, eax
lea rsi, [rsi + rcx*2]
mov edx, 0x25
lea edi, [rdx + 0xc]
lea r8d, [rdx + 0x27]
lea r9d, [rdx + 5]
jmp 0x14000aedd
cmp dx, ax
jne 0x14000aea4
mov r8, rsi
sub r8, rbx
sar r8, 1
lea rdx, [rbx + 2]
mov rcx, rbx
call fcn.14010cd30
sub rsi, 2
mov edx, 0x25
lea r8d, [rdx + 0x27]
lea r9d, [rdx + 5]
jmp 0x14000aedd
cmp r9w, ax
jne 0x14000aed9
mov r8, rsi
sub r8, rbx
sub r8, 2
sar r8, 1
add r8, r8
lea rdx, [rbx + 4]
mov rcx, rbx
call fcn.14010cd30
sub rsi, 4
mov edx, 0x25
lea r8d, [rdx + 0x27]
lea r9d, [rdx + 5]
jmp 0x14000aedd
add rbx, 2
cmp word [rbx], 0
jne 0x14000adc0
mov dword [rsp + 0xb0], 0x68
mov qword [rsp + 0xb8], r15
xor edx, edx
lea r8d, [rdx + 0x58]
lea rcx, [rsp + 0xc0]
call fcn.14010c6c0
mov qword [rsp + 0x88], r15
xor eax, eax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x330]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r12d
dec r12d
test r12d, r12d
jg 0x14000afc7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14000afc7
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r15
xor r9d, r9d
mov r8, r14
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rcx, qword [rsp + 0x2340]
xor rcx, rsp
call fcn.14010bcc0
mov rbx, qword [rsp + 0x23a0]
add rsp, 0x2350
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret