Function at 0x300070c8
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4e8
mov rax, qword [0x3000a228]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
xor r14d, r14d
mov rdi, r9
mov r13, r8
cmp rcx, r14
mov rbp, rdx
mov r12, rcx
mov rsi, r14
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], r14
mov dword [rsp + 0x34], r14d
mov dword [rsp + 0x58], 0x200
mov r15d, 0x80070000
je 0x30007447
cmp word [rcx], r14w
je 0x30007447
cmp r9, r14
je 0x30007447
cmp word [r9], r14w
je 0x30007447
lea r8, [rsp + 0x30]
xor edx, edx
mov rcx, r9
call fcn.300066cc
cmp eax, r14d
jl 0x3000719d
mov edx, dword [rsp + 0x30]
xor ecx, ecx
add rdx, rdx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
cmp rax, r14
mov rsi, rax
je 0x3000719d
lea r8, [rsp + 0x30]
mov rdx, rax
mov rcx, rdi
call fcn.300066cc
cmp eax, r14d
jge 0x3000719d
mov rcx, rsi
call fcn.300034e4
mov rsi, r14
cmp rsi, r14
mov ebx, r14d
cmovne rdi, rsi
cmp r13, r14
je 0x3000735d
cmp word [r13], r14w
je 0x3000735d
lea rax, [rsp + 0x48]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rdi
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, r15d
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jl 0x3000744c
mov rdx, qword [str.shell]
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, r15d
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jl 0x3000744c
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, r15d
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jl 0x3000744c
mov rdx, qword [0x3000c140]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, r15d
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jl 0x3000744c
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x30], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
mov ecx, 0x80070002
or ebx, r15d
cmp eax, r14d
cmovle ebx, eax
mov eax, r14d
cmp ebx, r14d
cmovge eax, dword [rsp + 0x30]
cmp ebx, r14d
jge 0x300072ef
cmp ebx, ecx
jne 0x3000744c
cmp ebx, ecx
je 0x30007309
cmp ebx, r14d
jl 0x3000735d
cmp eax, 1
je 0x30007302
cmp eax, 2
jne 0x30007309
cmp dword [rsp + 0x34], 2
ja 0x3000735d
mov rdx, qword [0x3000c1a8]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x30], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, r15d
cmp eax, r14d
cmovle ebx, eax
cmp ebx, r14d
jl 0x3000744c
cmp dword [rsp + 0x34], r14d
ja 0x3000735d
mov ebx, 0x80004005
jmp 0x3000744c
cmp rbp, r14
je 0x3000738c
cmp word [rbp], r14w
je 0x3000738c
lea r8, [rsp + 0x30]
mov rdx, r13
mov rcx, rdi
mov dword [rsp + 0x30], r14d
call fcn.30005a28
cmp eax, r14d
mov ebx, eax
jl 0x3000738c
cmp dword [rsp + 0x30], r14d
jne 0x300073e4
mov edx, 3
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_UrlIsW]
cmp eax, r14d
je 0x300073e1
lea rcx, [rsp + 0xd0]
xor edx, edx
mov r8d, 0x400
call sub.MSVCR80.dll_memset
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0xd0]
xor r9d, r9d
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_PathCreateFromUrlW]
lea rbp, [rsp + 0xd0]
mov ebx, r14d
cmp eax, r14d
cmovl rbp, r12
jmp 0x300073e4
mov rbp, r12
mov r12d, 0x70
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8, r12
call sub.MSVCR80.dll_memset
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], r12d
mov dword [rsp + 0x64], 0x101
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], rbp
mov dword [rsp + 0x90], 1
mov qword [rsp + 0xa8], rdi
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, r14d
jne 0x3000744c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, r15d
cmp eax, r14d
cmovle ebx, eax
jmp 0x3000744c
mov ebx, 0x80070057
mov rcx, rsi
call fcn.300034e4
mov rcx, qword [rsp + 0x48]
cmp rcx, r14
je 0x30007481
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx ecx, ax
or ecx, r15d
cmp eax, r14d
cmovle ecx, eax
mov rax, qword [rsp + 0x48]
cmp ecx, r14d
cmovge rax, r14
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x38]
cmp rcx, r14
je 0x300074ae
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx ecx, ax
or ecx, r15d
cmp eax, r14d
cmovle ecx, eax
mov rax, qword [rsp + 0x38]
cmp ecx, r14d
cmovge rax, r14
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x40]
cmp rcx, r14
je 0x300074db
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx ecx, ax
or ecx, r15d
cmp eax, r14d
cmovle ecx, eax
mov rax, qword [rsp + 0x40]
cmp ecx, r14d
cmovge rax, r14
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x50]
cmp rcx, r14
je 0x300074eb
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.30007ea0
add rsp, 0x4e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret