Function at 0x14000520c
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4e8
mov rax, qword [0x140007c50]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
xor r14d, r14d
mov rdi, r9
mov r13, r8
mov rbp, rdx
mov r12, rcx
mov dword [rsp + 0x58], 0x200
mov rsi, r14
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x34], r14d
mov r15d, 0x80070000
cmp rcx, r14
je 0x14000558a
cmp word [rcx], r14w
je 0x14000558a
cmp r9, r14
je 0x14000558a
cmp word [r9], r14w
je 0x14000558a
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, r9
call fcn.1400049d8
cmp eax, r14d
jl 0x1400052e0
mov edx, dword [rsp + 0x30]
xor ecx, ecx
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
cmp rax, r14
je 0x1400052e0
lea r8, [rsp + 0x30]
mov rdx, rax
mov rcx, rdi
call fcn.1400049d8
cmp eax, r14d
jge 0x1400052e0
mov rcx, rsi
call fcn.1400034bc
mov rsi, r14
cmp rsi, r14
mov ebx, r14d
cmovne rdi, rsi
cmp r13, r14
je 0x1400054a0
cmp word [r13], r14w
je 0x1400054a0
lea rax, [rsp + 0x48]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, r15d
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jl 0x14000558f
mov rdx, qword [str.shell]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, r15d
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jl 0x14000558f
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, r15d
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jl 0x14000558f
mov rdx, qword [0x140009110]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, r15d
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jl 0x14000558f
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x30], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
mov ecx, 0x80070002
or ebx, r15d
cmp eax, r14d
cmovle ebx, eax
mov eax, r14d
cmp ebx, r14d
cmovge eax, dword [rsp + 0x30]
cmp ebx, r14d
jge 0x140005432
cmp ebx, ecx
jne 0x14000558f
cmp ebx, ecx
je 0x14000544c
cmp ebx, r14d
jl 0x1400054a0
cmp eax, 1
je 0x140005445
cmp eax, 2
jne 0x14000544c
cmp dword [rsp + 0x34], 2
ja 0x1400054a0
mov rdx, qword [0x140009138]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x30], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, r15d
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jl 0x14000558f
cmp dword [rsp + 0x34], r14d
ja 0x1400054a0
mov ebx, 0x80004005
jmp 0x14000558f
cmp rbp, r14
je 0x1400054cf
cmp word [rbp], r14w
je 0x1400054cf
lea r8, [rsp + 0x30]
mov rdx, r13
mov rcx, rdi
mov dword [rsp + 0x30], r14d
call fcn.140004c18
cmp eax, r14d
mov ebx, eax
jl 0x1400054cf
cmp dword [rsp + 0x30], r14d
jne 0x140005527
mov edx, 3
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_UrlIsW]
cmp eax, r14d
je 0x140005524
lea rcx, [rsp + 0xd0]
xor edx, edx
mov r8d, 0x400
call sub.MSVCR90.dll_memset
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0xd0]
xor r9d, r9d
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_PathCreateFromUrlW]
lea rbp, [rsp + 0xd0]
mov ebx, r14d
cmp eax, r14d
cmovl rbp, r12
jmp 0x140005527
mov rbp, r12
mov r12d, 0x70
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8, r12
call sub.MSVCR90.dll_memset
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x64], 0x101
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], rbp
mov dword [rsp + 0x90], 1
mov qword [rsp + 0xa8], rdi
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, r14d
jne 0x14000558f
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r15d
cmp eax, r14d
cmovle ebx, eax
jmp 0x14000558f
mov ebx, 0x80070057
mov rcx, rsi
call fcn.1400034bc
mov rcx, qword [rsp + 0x48]
cmp rcx, r14
je 0x1400055c4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx ecx, ax
or ecx, r15d
cmp eax, r14d
cmovle ecx, eax
mov rax, qword [rsp + 0x48]
cmp ecx, r14d
cmovge rax, r14
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x38]
cmp rcx, r14
je 0x1400055f1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx ecx, ax
or ecx, r15d
cmp eax, r14d
cmovle ecx, eax
mov rax, qword [rsp + 0x38]
cmp ecx, r14d
cmovge rax, r14
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x40]
cmp rcx, r14
je 0x14000561e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx ecx, ax
or ecx, r15d
cmp eax, r14d
cmovle ecx, eax
mov rax, qword [rsp + 0x40]
cmp ecx, r14d
cmovge rax, r14
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x50]
cmp rcx, r14
je 0x14000562e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.140005a74
add rsp, 0x4e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret