Function at 0x140005258
Capabilities:
Get file attributes
Query environment variable
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x8e8]
sub rsp, 0x9b0
mov qword [rbp - 0x78], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
mov rax, qword [0x14007c010]
xor rax, rsp
mov qword [rbp + 0x8a0], rax
mov bl, r8b
mov qword [rsp + 0x70], rdx
mov rsi, rcx
xor r13d, r13d
mov dword [rsp + 0x50], r13d
mov byte [rsp + 0x31], r13b
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x38], r13
mov r15d, r13d
or r12d, 0xffffffff
mov edi, r13d
mov qword [rsp + 0x60], r13
cmp r8b, 1
jbe 0x1400052f0
cmp bl, 2
je 0x1400052e7
cmp bl, 3
jne 0x1400052e0
lea r14, str.shell_newcommand
jmp 0x1400052f7
xor eax, eax
jmp 0x140005bfb
lea r14, str.shellprintcommand
jmp 0x1400052f7
lea r14, [0x140047558]
mov rcx, rdx
call fcn.140006c14
mov qword [rbp - 0x80], rax
mov rcx, rax
call fcn.14000bd14
lea rcx, str.SOFTWAREMicrosoftSharedMHTML
lea rdx, str.SOFTWAREMicrosoftSharedHTML
test eax, eax
cmovne rdx, rcx
mov r8d, 0x105
lea rcx, [rbp + 0x690]
call fcn.14000dc08
mov r8d, 0x105
lea rdx, [0x140047554]
lea rcx, [rbp + 0x690]
call fcn.14000dc84
mov r8d, 0x105
mov rdx, rsi
lea rcx, [rbp + 0x690]
call fcn.14000dc84
cmp word [rsi], 0x4f
jne 0x14000536d
mov sil, 1
jmp 0x140005542
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
lea rdx, [rbp + 0x690]
mov rcx, 0xffffffff80000001
call fcn.14000e39c
test eax, eax
jne 0x14000553f
mov dword [rsp + 0x4c], 0x20a
movzx eax, byte [rbp + 0x1a0]
cmp dword [rsp + 0x34], 1
cmove eax, r13d
mov byte [rbp + 0x1a0], al
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, [0x1400475d0]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400053f8
cmp word [rbp + 0x1a0], r13w
jne 0x140005643
mov sil, r13b
mov dword [rsp + 0x54], 0x20a
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov rdx, r14
mov rcx, qword [rsp + 0x40]
call fcn.14000e39c
test eax, eax
jne 0x14000553f
movzx eax, byte [rbp - 0x70]
cmp dword [rsp + 0x34], 1
cmove eax, r13d
mov byte [rbp - 0x70], al
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000553c
cmp word [rbp - 0x70], r13w
je 0x14000553c
mov r13b, 1
test sil, sil
jne 0x140005993
mov byte [rsp + 0x48], r13b
mov r8d, 0x105
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x480]
call fcn.14000dc08
lea rcx, [rbp + 0x480]
call fcn.140007384
mov rsi, rax
test rax, rax
je 0x140005993
xor edx, edx
mov rcx, rax
call fcn.14000d98c
mov r15d, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, r12d
je 0x1400054d5
test al, 0x10
je 0x140005993
test r15d, 0xfffffffb
jne 0x140005993
mov ecx, r15d
call fcn.14000b4e4
test eax, eax
je 0x140005993
mov rcx, qword [rsp + 0x38]
xor r13d, r13d
test rcx, rcx
je 0x140005505
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x54], 0x20a
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov rdx, r14
mov rcx, qword [rsp + 0x40]
call fcn.14000e39c
test eax, eax
mov sil, byte [rsp + 0x48]
je 0x140005428
mov r15, rdi
mov sil, dil
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140005552
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r13
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140005567
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
lea rdx, [rbp + 0x690]
mov rcx, 0xffffffff80000002
call fcn.14000e39c
test eax, eax
jne 0x1400056db
mov dword [rsp + 0x4c], 0x20a
movzx eax, byte [rbp + 0x1a0]
cmp dword [rsp + 0x34], 1
mov r13, rdi
cmove eax, edi
mov byte [rbp + 0x1a0], al
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
lea rdx, [0x1400475d0]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140005661
cmp word [rbp + 0x1a0], di
je 0x140005661
test sil, sil
je 0x140005646
lea rdx, [rbp + 0x1a0]
lea rcx, [0x14007f400]
call fcn.14000db08
test eax, eax
jne 0x140005bbd
xor edx, edx
lea rcx, [rbp + 0x1a0]
call fcn.14000d768
mov r12d, eax
xor edx, edx
lea rcx, [rbp + 0x1a0]
call fcn.14000dccc
mov rdi, rax
mov qword [rsp + 0x60], rax
xor r14d, r14d
jmp 0x140005878
mov sil, dil
mov r8d, 0x105
lea rdx, [rbp + 0x1a0]
lea rcx, [0x14007f400]
call fcn.14000dc08
jmp 0x140005614
mov dword [rsp + 0x54], 0x20a
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
mov rdx, r14
mov rcx, qword [rsp + 0x40]
call fcn.14000e39c
xor r14d, r14d
test eax, eax
jne 0x1400056de
movzx eax, byte [rbp - 0x70]
cmp dword [rsp + 0x34], 1
cmove eax, r14d
mov byte [rbp - 0x70], al
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400056de
mov r13b, r14b
cmp word [rbp - 0x70], r14w
je 0x1400056de
mov r13b, 1
mov al, dil
jmp 0x1400056e2
xor r14d, r14d
mov al, byte [rsp + 0x31]
test r15, r15
jne 0x1400059c9
test r13b, r13b
je 0x140005739
test sil, sil
je 0x140005999
lea rdx, [rbp - 0x70]
lea rcx, [0x14007f610]
call fcn.14000db08
test eax, eax
jne 0x1400059b4
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x70]
call fcn.14000d98c
mov r12d, eax
mov r15, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x60]
test r15, r15
jne 0x1400059c9
mov al, byte [rsp + 0x31]
test al, al
jne 0x1400059bc
cmp bl, 3
jne 0x1400059bc
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x14000575a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r14
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000576f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r12d, 0x20019
mov r9d, r12d
lea rdx, [rbp + 0x690]
mov rcx, 0xffffffff80000001
call fcn.14000e39c
test eax, eax
je 0x1400057c6
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, r12d
lea rdx, [rbp + 0x690]
mov rcx, 0xffffffff80000002
call fcn.14000e39c
test eax, eax
jne 0x1400059bc
mov dword [rsp + 0x4c], 0x20a
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, r12d
lea rdx, [0x140047558]
mov rcx, qword [rsp + 0x40]
call fcn.14000e39c
test eax, eax
jne 0x1400059bc
movzx eax, byte [rbp - 0x70]
cmp dword [rsp + 0x34], 1
cmove eax, r14d
mov byte [rbp - 0x70], al
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400059bc
cmp word [rbp - 0x70], r14w
je 0x1400059bc
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x70]
call fcn.14000d98c
mov r12d, eax
mov rdi, qword [rsp + 0x60]
cmp eax, 9
je 0x1400059bc
mov r8d, 0x105
mov rdx, rdi
lea rcx, [rbp + 0x1a0]
call fcn.14000dc08
mov word [rbp - 0x70], r14w
mov byte [rsp + 0x31], 1
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
lea rdx, [rbp + 0x1a0]
mov rcx, 0xffffffff80000000
call fcn.14000e39c
test eax, eax
jne 0x1400056de
mov qword [rsp + 0x58], r14
mov dword [rsp + 0x54], 0xca
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r15d, 0x20019
mov r9d, r15d
lea rdx, str.CurVer
mov rcx, qword [rsp + 0x68]
call fcn.14000e39c
test eax, eax
jne 0x14000596e
movzx eax, byte [rbp + 0x3b0]
cmp dword [rsp + 0x34], 1
cmove eax, r14d
mov byte [rbp + 0x3b0], al
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x3b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000596e
cmp word [rbp + 0x3b0], r14w
je 0x14000596e
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, r15d
lea rdx, [rbp + 0x3b0]
mov rcx, 0xffffffff80000000
call fcn.14000e39c
test eax, eax
jne 0x14000596e
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140005964
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x68], rax
mov r15, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140005983
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x58], r14
mov al, 1
mov byte [rsp + 0x31], al
jmp 0x1400056e2
mov sil, dil
xor r14d, r14d
mov r8d, 0x105
lea rdx, [rbp - 0x70]
lea rcx, [0x14007f610]
call fcn.14000dc08
jmp 0x140005711
xor r13d, r13d
jmp 0x140005baf
xor r13d, r13d
mov dword [rsp + 0x50], r13d
jmp 0x140005baf
xor r13d, r13d
mov rsi, qword [rsp + 0x70]
test rdi, rdi
je 0x1400059f8
mov rcx, qword [rsi + 0x18]
test rcx, rcx
je 0x1400059e4
call fcn.1400027dc
mov qword [rsi + 0x18], rdi
mov rdi, r13
mov rcx, rsi
call fcn.140006c14
mov r14, rax
jmp 0x1400059fc
mov r14, qword [rbp - 0x80]
cmp r12d, 9
je 0x140005a71
cmp bl, 2
je 0x140005a71
cmp bl, 1
jne 0x140005a15
mov rbx, qword [0x140047c30]
jmp 0x140005a23
movzx eax, bl
lea rcx, [0x140047c30]
mov rbx, qword [rcx + rax*8]
mov dword [rsp + 0x20], r13d
mov r9, rsi
mov r8d, r12d
mov rdx, rbx
mov rcx, r15
call fcn.1400039dc
mov dword [rsp + 0x50], eax
test eax, eax
jne 0x140005baf
cmp rbx, qword [0x140047c30]
jne 0x140005baf
mov dword [rsp + 0x20], r13d
mov r9, rsi
mov r8d, r12d
mov rdx, qword [0x140047c38]
mov rcx, r15
call fcn.1400039dc
jmp 0x140005bab
mov r8d, 0x104
lea rdx, [rbp + 0x480]
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x103
ja 0x140005b7b
cmp bl, 3
jne 0x140005b3f
cmp word [rbp + 0x480], r13w
jne 0x140005b3f
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140005abc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r13
mov dword [rsp + 0x4c], 0x20a
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
lea rdx, str.shell_newcommand
mov rcx, r15
call fcn.14000e39c
test eax, eax
jne 0x140005baf
movzx eax, byte [rbp + 0x480]
cmp dword [rsp + 0x34], 1
cmove eax, r13d
mov byte [rbp + 0x480], al
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x480]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140005baf
cmp word [rbp + 0x480], r13w
je 0x140005baf
mov rcx, qword [rsi + 0x28]
mov rax, r14
mov r8d, r13d
test r14, r14
je 0x140005b61
cmp word [r14], r13w
je 0x140005b61
lea rax, [rax + 2]
inc r8d
cmp word [rax], r13w
jne 0x140005b54
mov qword [rsp + 0x20], rcx
mov r9, qword [rsi + 0x20]
mov rdx, r14
lea rcx, [rbp + 0x480]
call fcn.140004a90
jmp 0x140005bab
test bl, bl
jne 0x140005b88
mov rdx, qword [0x140047c38]
jmp 0x140005b96
movzx eax, bl
lea rcx, [0x140047c30]
mov rdx, qword [rcx + rax*8]
mov r9d, r13d
cmp bl, 2
sete r9b
mov r8, r14
mov rcx, r15
call fcn.1400049a0
mov dword [rsp + 0x50], eax
test rdi, rdi
je 0x140005bbd
mov rcx, rdi
call fcn.1400027dc
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140005bcd
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r13
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140005be2
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x68], r13
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140005bf7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [rsp + 0x50]
mov rcx, qword [rbp + 0x8a0]
xor rcx, rsp
call fcn.14003ee60
mov rbx, qword [rsp + 0xa08]
add rsp, 0x9b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret