Function at 0x1400024b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov dword [rax + 0x18], r8d
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x158
xor esi, esi
mov rcx, r9
mov rbp, r9
mov ebx, r8d
mov r13, rdx
mov edi, esi
mov dword [rsp + 0x48], esi
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0x80], rsi
mov qword [rax - 0x110], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x98], rsi
mov dword [rax + 0x20], esi
call fcn.140002474
mov qword [rsp + 0xb0], rsi
lea ecx, [rsi + 2]
mov r14d, esi
mov rdx, rax
mov qword [rsp + 0xa0], rax
cmp rax, rsi
je 0x140002541
cmp word [rax], si
je 0x140002541
add rax, rcx
inc r14d
cmp word [rax], si
jne 0x140002536
cmp rbp, rsi
je 0x140002561
mov rax, qword [rbp + 0x20]
cmp rax, rsi
je 0x140002561
mov r15d, esi
jmp 0x14000255a
add rax, rcx
inc r15d
cmp word [rax], si
jne 0x140002554
jmp 0x140002564
mov r15d, esi
mov rax, r13
mov r9d, esi
cmp r13, rsi
je 0x140002581
cmp word [r13], si
je 0x140002581
add rax, rcx
inc r9d
cmp word [rax], si
jne 0x140002576
mov edx, ebx
mov rcx, rbp
mov qword [rsp + 0x70], rsi
call fcn.140001190
lea edx, [r15 + r14]
mov r8d, 0xffffffff
lea ecx, [rdx + 0x109]
mov dword [rsp + 0x1ac], esi
mov r10d, 3
add rcx, rcx
mov dword [rsp + 0x4c], eax
mov dword [rsp + 0x60], edx
cmp rcx, r8
ja 0x1400025c6
mov dword [rsp + 0x1a8], ecx
jmp 0x1400025ce
mov dword [rsp + 0x1ac], r10d
mov rax, qword [rsp + 0x1a8]
shr rax, 0x20
not al
test al, 1
je 0x140002e01
lea r12d, [r9 + 7]
mov dword [rsp + 0x1ac], esi
mov ebx, r12d
add rbx, rbx
cmp rbx, r8
ja 0x140002603
mov dword [rsp + 0x1a8], ebx
jmp 0x14000260b
mov dword [rsp + 0x1ac], r10d
mov rax, qword [rsp + 0x1a8]
shr rax, 0x20
not al
test al, 1
je 0x140002e01
lea esi, [rdx + 0x109]
xor ecx, ecx
add rsi, rsi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rdi, rax
xor eax, eax
mov dword [rsp + 0x1ac], eax
mov eax, 0xffffffff
cmp rsi, rax
ja 0x140002654
mov dword [rsp + 0x1a8], esi
jmp 0x14000265f
mov dword [rsp + 0x1ac], 3
mov rax, qword [rsp + 0x1a8]
shr rax, 0x20
not al
test al, 1
je 0x140002d81
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea esi, [r15 + r14 + 0x109]
xor ecx, ecx
mov edx, esi
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], esi
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, qword [rsp + 0x70]
mov rbx, rax
mov qword [rsp + 0x40], rax
xor eax, eax
cmp rcx, rax
je 0x140002d70
cmp rdi, rax
je 0x140002d70
cmp rbx, rax
je 0x140002d81
lea rdx, str.shell_
mov r8d, r12d
call fcn.1400015a4
mov r8d, r12d
mov rdx, r13
call fcn.140001628
mov r12, qword [rsp + 0x1a0]
mov rdx, qword [rsp + 0x70]
lea r11, [rsp + 0x58]
mov rcx, r12
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor ecx, ecx
cmp eax, ecx
jne 0x140002d70
mov eax, dword [rsp + 0x1b0]
mov edx, 0xffffffff
cmp eax, edx
je 0x140002c81
cmp dword [rsp + 0x1c0], ecx
je 0x140002c81
lea rax, [rax + rax*8]
lea rdx, str.WinWord
mov rbx, qword [rdx + rax*8 + 8]
mov qword [rsp + 0x90], rax
cmp word [rbx], cx
jne 0x140002771
mov rcx, qword [rsp + 0x58]
call fcn.1400020f8
mov qword [rsp + 0xb0], rax
test rax, rax
je 0x140002d69
mov rbx, rax
xor r9d, r9d
lea rdx, [fcn.14000624c]
lea rcx, [rsp + 0x1b8]
lea r8d, [r9 + 0x10]
call sub.USER32.dll_DdeInitializeW
test eax, eax
jne 0x140002bab
mov ecx, dword [rsp + 0x1b8]
mov r8d, 0x4b0
mov rdx, rbx
call sub.USER32.dll_DdeCreateStringHandleW
xor ecx, ecx
mov qword [rsp + 0xa8], rax
cmp rax, rcx
je 0x140002c7c
mov qword [rsp + 0x20], rcx
mov ecx, dword [rsp + 0x1b8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
call sub.USER32.dll_DdeConnectList
xor r11d, r11d
mov qword [rsp + 0x80], rax
cmp rax, r11
je 0x140002c7c
mov rdx, qword [0x1400090d8]
mov rcx, r13
mov dword [rsp + 0x1a8], r11d
lea r12d, [r11 + 1]
call fcn.1400012b8
cmp eax, r11d
je 0x140002842
mov rdx, qword [str.OpenAsReadOnly]
mov rcx, r13
call fcn.1400012b8
cmp eax, r11d
je 0x140002842
mov rdx, qword [rsp + 0x90]
lea rax, str.WinWord
mov r8d, esi
mov rdx, qword [rax + rdx*8 + 0x28]
mov rcx, rdi
call fcn.1400015a4
xor r11d, r11d
jmp 0x140002846
mov word [rdi], r11w
mov rax, rdi
mov ebx, r11d
mov r13d, 2
cmp word [rdi], r11w
je 0x140002863
add rax, r13
inc ebx
cmp word [rax], r11w
jne 0x140002858
add ebx, ebx
mov dword [rsp + 0x1a8], ebx
cmp dword [rsp + 0x4c], r11d
je 0x14000292f
lea rdx, str._Activate___1___
mov r8d, esi
mov rcx, rdi
call fcn.1400015a4
mov ebx, 0x20
mov dword [rsp + 0x1a8], ebx
xor esi, esi
cmp r15d, esi
je 0x140002a1e
lea rdx, str.__1_
mov rcx, rdi
call fcn.140001450
mov r9, rax
cmp rax, rsi
jne 0x1400028d2
lea rdx, [0x1400078c4]
mov rcx, rdi
call fcn.140001450
mov r9, rax
cmp rax, rsi
je 0x140002a1e
mov rcx, qword [rbp + 0x20]
cmp word [rcx], 0x22
jne 0x1400028ec
mov eax, r15d
cmp word [rcx + rax*2 - 2], 0x22
mov eax, 1
je 0x1400028ee
mov eax, esi
cmp word [r9], 0x22
mov r8d, dword [rsp + 0x60]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rcx
mov ebp, 4
mov rcx, rdi
cmove r13d, ebp
shr ebx, 1
add r8d, 0x108
mov edx, ebx
mov dword [rsp + 0x20], r13d
call fcn.140001ba4
cmp eax, esi
je 0x140002c72
jmp 0x140002a15
cmp ebx, r11d
jne 0x140002895
mov rdx, qword [str.ddeexec]
mov rcx, qword [rsp + 0x58]
lea eax, [r14 + r14 + 0x208]
mov dword [rsp + 0x1a8], eax
lea rax, [rsp + 0x88]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r14d, r14d
cmp eax, r14d
jne 0x1400029ff
mov rcx, qword [rsp + 0x88]
cmp dword [rsp + 0x54], r12d
jne 0x14000298d
mov byte [rdi], r14b
lea rax, [rsp + 0x1a8]
lea r9, [rsp + 0x54]
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x1400029ff
cmp r15d, r14d
je 0x140002a10
xor edx, edx
mov rcx, rdi
call fcn.14000165c
mov rbx, rax
cmp rax, r14
je 0x1400029f3
mov r8d, esi
mov rdx, rax
mov rcx, rdi
call fcn.140001628
mov rcx, rbx
call fcn.1400034bc
mov r11d, dword [rsp + 0x1a8]
lea ebx, [r11 + r11 - 2]
jmp 0x14000288e
mov ebx, dword [rsp + 0x1a8]
jmp 0x140002895
mov ebx, dword [rsp + 0x1a8]
xor esi, esi
mov r12d, esi
jmp 0x140002897
xor esi, esi
lea ebp, [rsi + 4]
mov ebx, dword [rsp + 0x1a8]
jmp 0x140002a23
mov ebp, 4
lea rdx, str.__1_
mov rcx, rdi
call fcn.140001450
mov r9, rax
cmp rax, rsi
jne 0x140002a55
lea rdx, [0x1400078c4]
mov rcx, rdi
call fcn.140001450
mov r9, rax
cmp rax, rsi
je 0x140002c72
cmp word [r9], 0x22
mov ecx, ebx
mov eax, r15d
cmove r13d, ebp
shr rcx, 1
mov ebp, 0xffffffff
add rcx, rax
mov dword [rsp + 0x50], esi
cmp rcx, rbp
ja 0x140002a7d
mov dword [rsp + 0x4c], ecx
jmp 0x140002a85
mov dword [rsp + 0x50], 3
mov rax, qword [rsp + 0x4c]
shr rax, 0x20
not al
test al, 1
je 0x140002c72
mov r8, qword [rsp + 0xa0]
mov dword [rsp + 0x30], esi
shr ebx, 1
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], r13d
mov r13d, dword [rsp + 0x60]
lea edx, [r15 + rbx]
lea r8d, [r13 + 0x108]
mov rcx, rdi
call fcn.140001ba4
cmp eax, esi
je 0x140002c72
cmp r12d, esi
je 0x140002c72
mov r12d, dword [rsp + 0x1b0]
mov r14, qword [rsp + 0x80]
mov eax, 0xbb8
cmp r12d, 1
mov rcx, r14
cmove ebp, eax
xor edx, edx
call sub.USER32.dll_DdeQueryNextServer
mov rbx, rax
cmp rax, rsi
je 0x140002c72
lea esi, [r13 + 1]
add rsi, rsi
xor r15d, r15d
mov ecx, 0xffffffff
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov r11d, dword [rsp + 0x1a8]
mov edx, 0xffffffff
lea rax, [rsi + r11]
mov dword [rsp + 0x50], r15d
cmp rax, rdx
ja 0x140002b41
mov dword [rsp + 0x4c], eax
jmp 0x140002b49
mov dword [rsp + 0x50], 3
mov rax, qword [rsp + 0x4c]
shr rax, 0x20
not al
test al, 1
je 0x140002bab
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], ebp
lea edx, [r11 + r13*2 + 2]
xor r9d, r9d
mov r8, rbx
mov rcx, rdi
mov dword [rsp + 0x28], 0x4050
mov dword [rsp + 0x20], r15d
call sub.USER32.dll_DdeClientTransaction
mov qword [rsp + 0x98], rax
cmp rax, r15
jne 0x140002bb5
cmp r12d, 1
je 0x140002bb5
mov rdx, rbx
mov rcx, r14
call sub.USER32.dll_DdeQueryNextServer
mov rbx, rax
cmp rax, r15
jne 0x140002b15
mov rbx, qword [rsp + 0x40]
jmp 0x140002d70
mov rax, qword [rsp + 0x90]
lea rcx, str.WinWord
xor esi, esi
mov dword [rsp + 0x48], 1
cmp dword [rcx + rax*8 + 0x34], esi
je 0x140002c72
mov esi, 0x90
lea rcx, [rsp + 0xc0]
xor edx, edx
mov r8, rsi
call sub.MSVCR90.dll_memset
mov ebp, 0xffffffff
lea r8, [rsp + 0xc0]
mov edx, ebp
mov rcx, rbx
mov dword [rsp + 0xc0], esi
call sub.USER32.dll_DdeQueryConvInfo
mov rbx, qword [rsp + 0x148]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetParent]
xor esi, esi
jmp 0x140002c37
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetParent]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_GetParent]
cmp rax, rsi
jne 0x140002c22
cmp qword [rsp + 0x148], rsi
je 0x140002c72
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsIconic]
cmp eax, esi
je 0x140002c61
mov edx, 9
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, ebp
call qword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SetForegroundWindow]
mov rbx, qword [rsp + 0x40]
jmp 0x140002d72
mov rbx, qword [rsp + 0x40]
mov rdx, qword [0x1400090d0]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x68]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x1a8], 0x208
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor esi, esi
cmp eax, esi
jne 0x140002c72
cmp dword [rsp + 0x54], 1
mov rcx, qword [rsp + 0x68]
jne 0x140002cc6
mov byte [rdi], sil
lea rax, [rsp + 0x1a8]
lea r9, [rsp + 0x54]
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
jne 0x140002c72
mov edx, 2
lea rax, [rsp + 0x78]
mov r9, r13
mov qword [rsp + 0x28], rax
lea ecx, [rdx + 0x1e]
mov r8, r12
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SHLWAPI.dll_AssocQueryStringByKeyW]
cmp eax, esi
jl 0x140002c72
cmp rbp, rsi
je 0x140002d22
mov rcx, qword [rbp + 0x28]
jmp 0x140002d25
mov rcx, rsi
cmp rbp, rsi
je 0x140002d30
mov rax, qword [rbp + 0x20]
jmp 0x140002d33
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov r8, qword [rsp + 0xa0]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rcx
mov r9d, r14d
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x20], rax
call fcn.140001d00
mov ecx, esi
cmp eax, esi
setne cl
mov dword [rsp + 0x48], ecx
jmp 0x140002d72
xor esi, esi
jmp 0x140002c72
xor esi, esi
cmp rbx, rsi
je 0x140002d83
mov rcx, rbx
call fcn.1400034bc
jmp 0x140002d83
xor esi, esi
cmp rdi, rsi
je 0x140002d90
mov rcx, rdi
call fcn.1400034bc
mov rax, qword [rsp + 0xb0]
cmp rax, rsi
je 0x140002da5
mov rcx, rax
call fcn.1400034bc
mov rax, qword [rsp + 0x70]
cmp rax, rsi
je 0x140002db7
mov rcx, rax
call fcn.1400034bc
mov rax, qword [rsp + 0x98]
cmp rax, rsi
je 0x140002dcc
mov rcx, rax
call sub.USER32.dll_DdeFreeDataHandle
mov rax, qword [rsp + 0xa8]
cmp rax, rsi
je 0x140002de8
mov ecx, dword [rsp + 0x1b8]
mov rdx, rax
call sub.USER32.dll_DdeFreeStringHandle
mov rax, qword [rsp + 0x80]
cmp rax, rsi
je 0x140002dfd
mov rcx, rax
call sub.USER32.dll_DdeDisconnectList
mov edi, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x1b8]
cmp ecx, esi
je 0x140002e11
call sub.USER32.dll_DdeUninitialize
mov rcx, qword [rsp + 0x68]
cmp rcx, rsi
je 0x140002e21
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x68], rsi
cmp rcx, rsi
je 0x140002e36
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x58], rsi
cmp rcx, rsi
je 0x140002e4e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
add rsp, 0x158
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret