Function at 0x30005ff8
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov rax, rsp
sub rsp, 0x40
xor r13d, r13d
mov r12, rdx
mov rsi, rcx
cmp rcx, r13
mov dword [rax + 0x58], r13d
mov qword [rax - 0x10], r13
mov qword [rax - 8], r13
mov dword [rax + 0x50], r13d
mov rdi, r13
mov r14d, 0x80070000
je 0x30006036
cmp rdx, r13
jne 0x30006040
mov ebx, 0x80070057
jmp 0x300062ce
mov dword [rdx], r13d
mov rdx, qword [str.DefaultIcon]
lea r8, [rsp + 0x98]
call fcn.30004ce8
cmp eax, r13d
mov ebx, eax
jl 0x300062ce
cmp dword [rsp + 0x98], r13d
je 0x300061ac
mov rdx, qword [str.ShellExIconHandler]
lea r8, [rsp + 0x98]
mov rcx, rsi
call fcn.30004ce8
cmp eax, r13d
mov ebx, eax
jl 0x300062ce
cmp dword [rsp + 0x98], r13d
je 0x300061ac
mov rdx, qword [str.ShellExIconHandler]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, r14d
cmp eax, r13d
cmovle ebx, eax
cmp ebx, r13d
jl 0x300062ce
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x90]
lea r9, [rsp + 0x80]
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x80], r13d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, r14d
cmp eax, r13d
cmovle ebx, eax
mov eax, dword [rsp + 0x80]
cmp ebx, r13d
cmovge eax, dword [rsp + 0x80]
cmp ebx, r13d
mov dword [rsp + 0x80], eax
jl 0x300062ce
mov edx, dword [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp rax, r13
mov rdi, rax
je 0x30006264
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x90]
lea r8, [rsp + 0x80]
mov r9, rdi
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.30003bd4
cmp eax, r13d
mov ebx, eax
jl 0x300062ce
mov ebp, dword [rsp + 0x80]
cmp ebp, 1
je 0x30006197
cmp ebp, 2
jne 0x300062aa
mov rdx, qword [str.AB968F1E_E20B_403A_9EB8_72EB0EB6797E]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
cmp eax, r13d
je 0x300061b4
mov ebx, r13d
jmp 0x300062ce
mov rdx, qword [str.DefaultIcon]
lea rax, [rsp + 0x30]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, r14d
cmp eax, r13d
cmovle ebx, eax
cmp ebx, r13d
jl 0x300062ce
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x90]
lea r9, [rsp + 0x80]
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x80], r13d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, r14d
cmp eax, r13d
cmovle ebx, eax
cmp ebx, r13d
cmovge ebp, dword [rsp + 0x80]
cmp ebx, r13d
mov dword [rsp + 0x80], ebp
jl 0x300062ce
mov rcx, rdi
call fcn.300034e4
mov edx, dword [rsp + 0x90]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp rax, r13
mov rdi, rax
jne 0x3000626b
mov ebx, 0x8007000e
jmp 0x300062ce
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x90]
lea r8, [rsp + 0x80]
mov r9, rdi
xor edx, edx
mov qword [rsp + 0x20], rax
call fcn.30003bd4
cmp eax, r13d
mov ebx, eax
jl 0x300062ce
cmp dword [rsp + 0x80], 1
je 0x300062b1
cmp dword [rsp + 0x80], 2
je 0x300062b1
mov ebx, 0x80004005
jmp 0x300062ce
mov rdx, qword [str.__1_]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
mov ecx, r13d
cmp eax, r13d
sete cl
mov dword [r12], ecx
mov rcx, rdi
call fcn.300034e4
mov rcx, qword [rsp + 0x30]
cmp rcx, r13
je 0x30006303
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx ecx, ax
or ecx, r14d
cmp eax, r13d
cmovle ecx, eax
mov rax, qword [rsp + 0x30]
cmp ecx, r13d
cmovge rax, r13
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x38]
cmp rcx, r13
je 0x30006313
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret