Function at 0x1401bb890
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x3990
call fcn.1401bf960
sub rsp, rax
mov qword [rsp + 0x3980], 0xfffffffffffffffe
mov rax, qword [0x14025e510]
xor rax, rsp
mov qword [rsp + 0x3988], rax
mov rcx, qword [rsp + 0x39a0]
add rcx, 0xb8
mov r8, 0xffffffffffffffff
xor edx, edx
call fcn.14001b73c
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
xor edx, edx
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401bbd31
mov rcx, qword [rsp + 0x39a0]
add rcx, 0xb8
mov r8, 0xffffffffffffffff
xor edx, edx
call fcn.14001b73c
movzx eax, word [0x14021d84c]
mov word [rsp + 0x90], ax
lea rdi, [rsp + 0x92]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov dword [rsp + 0x78], 0x104
mov dword [rsp + 0x84], 0
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x4b8]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x4bc]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x84]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov dword [rsp + 0x7c], eax
cmp dword [rsp + 0x84], 0
je 0x1401bbd26
mov dword [rsp + 0x74], 0
jmp 0x1401bb9fc
mov eax, dword [rsp + 0x74]
add eax, 1
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x84]
cmp dword [rsp + 0x74], eax
jae 0x1401bbd26
mov dword [rsp + 0x70], 0xff
lea rax, [rsp + 0x4b0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x2b0]
mov edx, dword [rsp + 0x74]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov dword [rsp + 0x7c], eax
cmp dword [rsp + 0x7c], 0
jne 0x1401bbd21
movzx ecx, word [rsp + 0x2b0]
call qword [sym.imp.USER32.dll_IsCharAlphaNumericW]
test eax, eax
je 0x1401bba7f
jmp 0x1401bbd26
lea rdx, str..msi
lea rcx, [rsp + 0x2b0]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x1401bba9d
jmp 0x1401bbd26
lea rax, [rsp + 0x4c0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rsp + 0x2b0]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401bbd21
xor eax, eax
mov word [rsp + 0x4d0], ax
lea rdi, [rsp + 0x4d2]
xor eax, eax
mov ecx, 0x3fe
rep stosb byte [rdi], al
mov dword [rsp + 0x4c8], 1
mov dword [rsp + 0x4cc], 0x400
lea rax, [rsp + 0x4cc]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4d0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x4c0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401bbd13
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x8d8]
call fcn.1400062b0
nop
lea rax, str._shellopencommand
mov qword [rsp + 0x3938], rax
cmp qword [rsp + 0x3938], 0
jne 0x1401bbb7b
mov dword [rsp + 0x3940], 0
jmp 0x1401bbb8f
mov rcx, qword [rsp + 0x3938]
call fcn.14002f9b0
mov dword [rsp + 0x3940], eax
mov r8d, dword [rsp + 0x3940]
lea rdx, str._shellopencommand
lea rcx, [rsp + 0x8d8]
call fcn.140004560
mov rax, qword [rsp + 0x8d8]
mov qword [rsp + 0x3970], rax
lea rax, [rsp + 0x8d0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x3970]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1401bbd06
xor eax, eax
mov word [rsp + 0x8e0], ax
lea rdi, [rsp + 0x8e2]
xor eax, eax
mov ecx, 0xffe
rep stosb byte [rdi], al
mov dword [rsp + 0x4cc], 0x1000
lea rax, [rsp + 0x4cc]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x8e0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x4c8]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x8d0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401bbcf7
lea rdx, [rsp + 0x8e0]
mov rcx, qword [rsp + 0x39a0]
call fcn.1401b9dc0
mov qword [rsp + 0x18e0], rax
cmp qword [rsp + 0x18e0], 0
je 0x1401bbcf7
xor eax, eax
mov word [rsp + 0x18f0], ax
lea rdi, [rsp + 0x18f2]
xor eax, eax
mov ecx, 0x1ffe
rep stosb byte [rdi], al
mov r8d, 0x1000
lea rdx, [rsp + 0x18f0]
mov rcx, qword [rsp + 0x18e0]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
mov rdx, qword [rsp + 0x39a0]
add rdx, 0xb8
mov r9d, 1
lea r8, [rsp + 0x18f0]
mov rcx, qword [rsp + 0x39a0]
call fcn.1401ba0f0
mov rax, qword [rsp + 0x18e0]
mov qword [rsp + 0x38f0], rax
mov rcx, qword [rsp + 0x38f0]
call fcn.140008c14
mov rcx, qword [rsp + 0x8d0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x8d8]
call fcn.1400053e0
mov rcx, qword [rsp + 0x4c0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1401bb9f1
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rcx, qword [rsp + 0x3988]
xor rcx, rsp
call fcn.14002f990
add rsp, 0x3990
pop rdi
ret