Function at 0x14000627c
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov r13, r8
mov r12, r9
xor r8d, r8d
mov r15, rdx
cmp word [str.XEV.GenericApp], r8w
mov eax, r8d
mov qword [rbp - 0x10], r8
mov r14d, r8d
sete al
mov qword [rbp - 8], r8
mov qword [rbp - 0x18], r8
mov esi, r8d
mov dword [rbp + 0x30], r8d
test eax, eax
je 0x1400062dd
mov ebx, 0x80070057
jmp 0x140006655
mov edi, 1
test r15, r15
je 0x1400062f0
mov eax, r8d
cmp word [rdx], r8w
jne 0x1400062f2
mov eax, edi
test eax, eax
jne 0x1400062d3
test r13, r13
je 0x1400062d3
test r12, r12
je 0x1400062d3
mov qword [r13], r8
lea rax, [rbp - 0x10]
mov qword [r9], r8
lea rdx, str.XEV.GenericApp
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r8d, r8d
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140006655
mov rcx, qword [rbp - 0x10]
lea rax, [rbp - 8]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
lea rdx, str.shell
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r8d, r8d
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140006655
mov rcx, qword [rbp - 8]
lea rax, [rbp - 0x18]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r8d, r8d
movzx ebx, ax
mov r15d, 0x80070000
or ebx, r15d
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140006655
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x20]
lea rdx, str.RedirectFileType
mov qword [rsp + 0x20], r8
mov dword [rbp - 0x20], r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor r8d, r8d
movzx ebx, ax
or ebx, r15d
mov r15d, r8d
test eax, eax
cmovle ebx, eax
test ebx, ebx
cmovns r15d, dword [rbp - 0x20]
js 0x1400064cb
mov ecx, r8d
lea eax, [r15 - 1]
cmp eax, edi
setbe cl
test ecx, ecx
je 0x1400064cb
mov edx, dword [rbp + 0x30]
xor ecx, ecx
add rdx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r14, rax
test rax, rax
jne 0x14000642e
mov ebx, 0x8007000e
jmp 0x140006655
mov r8d, dword [rbp + 0x30]
xor edx, edx
add r8, 2
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbp - 0x18]
lea r9, [rbp - 0x20]
xor eax, eax
lea rdx, str.RedirectFileType
mov dword [rbp - 0x20], eax
xor r8d, r8d
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor r8d, r8d
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140006639
mov ecx, dword [rbp - 0x20]
lea eax, [rcx - 1]
cmp eax, edi
ja 0x1400064a6
cmp dword [rbp + 0x30], 2
jae 0x14000649b
mov ebx, 0x8000ffff
jmp 0x1400064a9
mov eax, dword [rbp + 0x30]
cmp word [rax + r14 - 2], r8w
jne 0x140006494
mov r15d, ecx
test ebx, ebx
js 0x140006639
mov ecx, r8d
lea eax, [r15 - 1]
cmp eax, edi
setbe cl
test ecx, ecx
jne 0x1400064e3
mov ebx, 0x8000ffff
jmp 0x140006639
mov ecx, 0x80000000
lea eax, [rbx + rcx]
test ecx, eax
jne 0x1400064e3
cmp ebx, 0x80070002
jne 0x140006655
mov rcx, qword [rbp - 0x18]
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rbp - 0x20]
mov qword [rsp + 0x20], r8
lea rdx, str.RedirectVerb
mov dword [rbp - 0x20], r8d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor r8d, r8d
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
cmovns r15d, dword [rbp - 0x20]
js 0x1400065f4
mov ecx, r8d
lea eax, [r15 - 1]
cmp eax, edi
setbe cl
test ecx, ecx
je 0x1400065f4
mov edx, dword [rbp + 0x30]
xor ecx, ecx
add rdx, 2
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
jne 0x140006560
mov ebx, 0x8007000e
jmp 0x140006639
mov r8d, dword [rbp + 0x30]
xor edx, edx
add r8, 2
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbp - 0x18]
lea r9, [rbp - 0x20]
xor eax, eax
lea rdx, str.RedirectVerb
mov dword [rbp - 0x20], eax
xor r8d, r8d
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor r8d, r8d
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140006639
mov ecx, dword [rbp - 0x20]
lea eax, [rcx - 1]
cmp eax, edi
ja 0x1400065d8
cmp dword [rbp + 0x30], 2
jae 0x1400065cd
mov ebx, 0x8000ffff
jmp 0x1400065db
mov eax, dword [rbp + 0x30]
cmp word [rax + rsi - 2], r8w
jne 0x1400065c6
mov r15d, ecx
test ebx, ebx
js 0x140006639
mov ecx, r8d
lea eax, [r15 - 1]
cmp eax, edi
setbe cl
test ecx, ecx
jne 0x140006605
jmp 0x1400064c1
cmp ebx, 0x80070002
jne 0x140006601
mov ebx, r8d
jmp 0x140006605
test ebx, ebx
js 0x140006639
test r14, r14
je 0x140006613
mov eax, r8d
cmp word [r14], r8w
jne 0x140006615
mov eax, edi
test eax, eax
jne 0x140006639
test rsi, rsi
je 0x140006627
cmp word [rsi], r8w
je 0x140006627
mov edi, r8d
test edi, edi
jne 0x140006639
mov qword [r13], r14
mov r14, r8
mov qword [r12], rsi
mov rsi, r8
test r14, r14
je 0x140006647
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalFree]
test rsi, rsi
je 0x140006655
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140006683
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx ecx, ax
xor r8d, r8d
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov rax, qword [rbp - 0x10]
test ecx, ecx
cmovns rax, r8
mov qword [rbp - 0x10], rax
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x1400066b1
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp - 8]
xor r8d, r8d
movzx edx, ax
or edx, 0x80070000
test eax, eax
cmovle edx, eax
test edx, edx
cmovns rcx, r8
mov qword [rbp - 8], rcx
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400066c0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x50]
mov eax, ebx
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret