Function at 0x14002dbbc
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1400400b0]
xor rax, rsp
mov qword [rbp + 0x170], rax
xor ebx, ebx
mov qword [rsp + 0x48], rcx
mov r13, rcx
test rdx, rdx
jne 0x14002ddbd
mov qword [rsp + 0x38], rbx
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rbx
lea r8, [rsp + 0x60]
mov esi, 0x104
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
mov edi, ebx
mov dword [rsp + 0x44], ebx
mov dword [rsp + 0x40], esi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14002dda8
or r15, 0xffffffffffffffff
lea r12, str.ShellOpenCommand
mov r14d, 0x7ffffffe
cmp word [rsp + 0x60], 0x2e
je 0x14002dd5b
lea rcx, [rsp + 0x60]
mov rax, r15
inc rax
cmp word [rcx + rax*2], bx
jne 0x14002dc65
mov r13d, eax
lea rax, [r13 + 0x14]
cmp rax, rsi
ja 0x14002dd56
mov rdx, rsi
lea rax, [rsp + 0x60]
cmp word [rax], bx
je 0x14002dc95
add rax, 2
sub rdx, 1
jne 0x14002dc86
mov rcx, rsi
mov rax, rdx
sub rcx, rdx
neg rax
sbb r8, r8
and r8, rcx
test rdx, rdx
je 0x14002dcf5
mov rdx, rsi
lea rcx, [rsp + 0x60]
lea rcx, [rcx + r8*2]
sub rdx, r8
je 0x14002dce7
mov r9, r12
mov rax, r14
sub r9, rcx
test rax, rax
je 0x14002dce7
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x14002dce7
mov word [rcx], r8w
dec rax
add rcx, 2
sub rdx, 1
jne 0x14002dcc6
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], bx
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x60]
call fcn.14002e808
mov rdi, rax
lea rax, [r13*2]
cmp rax, 0x208
jae 0x14002ddb7
mov word [rsp + rax + 0x60], bx
test rdi, rdi
je 0x14002dd4a
mov rcx, r15
inc rcx
cmp word [rdi + rcx*2], bx
jne 0x14002dd28
test rcx, rcx
je 0x14002dd4a
mov r8, rdi
lea rdx, [rsp + 0x60]
lea rcx, str._s_s_r_n
call fcn.14000dc90
mov rcx, rdi
call fcn.140014240
mov edi, dword [rsp + 0x44]
mov r13, qword [rsp + 0x48]
cmp dword [0x1400449b4], ebx
jne 0x14002ddf7
mov qword [rsp + 0x38], rbx
lea r9, [rsp + 0x40]
inc edi
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rbx
lea r8, [rsp + 0x60]
mov edx, edi
mov qword [rsp + 0x20], rbx
mov rcx, r13
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x40], esi
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x14002dc51
cmp eax, 0x103
cmovne ebx, eax
mov esi, ebx
jmp 0x14002df78
call fcn.14001fa58
int3
cmp word [rdx], 0x2e
jne 0x14002dddf
mov r8, rdx
mov ecx, 0x400023a5
mov edx, 1
call fcn.140002bfc
mov eax, 0x7b
jmp 0x14002df7a
mov rcx, rdx
call fcn.14000fbec
mov rcx, rax
call fcn.14000fcb0
mov rdi, rax
test rax, rax
jne 0x14002de01
mov eax, 1
jmp 0x14002df7a
mov edx, 0x20
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcsrchr]
nop dword [rax + rax]
test rax, rax
je 0x14002de1d
mov word [rax], bx
or r15, 0xffffffffffffffff
mov rax, r15
inc rax
cmp word [rdi + rax*2], bx
jne 0x14002de24
add rax, 0x14
mov esi, 0x104
mov r8, rdi
cmp rax, rsi
jbe 0x14002de57
mov edx, 1
mov ecx, 0x400023db
call fcn.140002bfc
mov esi, 0x7b
jmp 0x14002df70
mov rdx, rsi
lea rcx, [rsp + 0x60]
call fcn.1400158f0
mov rdx, rsi
lea rax, [rsp + 0x60]
cmp word [rax], bx
je 0x14002de7b
add rax, 2
sub rdx, 1
jne 0x14002de6c
mov rcx, rsi
mov rax, rdx
sub rcx, rdx
neg rax
sbb r8, r8
and r8, rcx
test rdx, rdx
je 0x14002dedd
lea rcx, [rsp + 0x60]
lea rcx, [rcx + r8*2]
sub rsi, r8
je 0x14002decf
lea r12, str.ShellOpenCommand
mov r14d, 0x7ffffffe
sub r12, rcx
test r14, r14
je 0x14002decf
movzx eax, word [r12 + rcx]
test ax, ax
je 0x14002decf
mov word [rcx], ax
dec r14
add rcx, 2
sub rsi, 1
jne 0x14002deb0
test rsi, rsi
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], bx
lea rax, [rsp + 0x50]
mov r9d, 0x2000000
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x60]
mov rcx, r13
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
je 0x14002df1e
mov r8, rdi
mov edx, 1
mov ecx, 0x400023a5
call fcn.140002bfc
jmp 0x14002df70
lea rdx, [rsp + 0x60]
mov rcx, r13
call fcn.14002e808
mov r14, rax
test rax, rax
je 0x14002df56
inc r15
cmp word [rax + r15*2], bx
jne 0x14002df33
test r15, r15
je 0x14002df56
mov r8, r14
lea rcx, str._s_s_r_n
mov rdx, rdi
call fcn.14000dc90
jmp 0x14002df68
mov r8, rdi
mov edx, 1
mov ecx, 0x400023a5
call fcn.140002bfc
mov rcx, r14
call fcn.140014240
mov rcx, rdi
call fcn.140014240
mov eax, esi
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.14001f920
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x280
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret