Function at 0x14007b120
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x288
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1403542a0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov byte [rsp + 0x30], 0
mov eax, 2
imul rax, rax, 0
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], reloc.mfc110u.dll_Ordinal_520
jae 0x14007b16c
jmp 0x14007b171
call fcn.1400f3e98
xor eax, eax
mov rcx, qword [rsp + 0x50]
mov word [rsp + rcx + 0x60], ax
mov dword [rsp + 0x44], 0
mov dword [rsp + 0x48], reloc.mfc110u.dll_Ordinal_520
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.HTTP_shellopenddeexec
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007b2b5
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x1401fb410]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007b2b5
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, [0x1401f0e94]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007b2b5
lea r8, str.Accessing_HKEY_CLASSES_ROOTHTTP_shellopenddeexecApplication
mov edx, 3
lea rcx, [0x1401fb500]
call fcn.1400e3ba0
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x298]
call fcn.14000bbe0
mov rcx, qword [rsp + 0x298]
call fcn.1400108b0
test rax, rax
jbe 0x14007b2b5
lea r8, str.Got_value_from_HKEY_CLASSES_ROOTHTTP_shellopenddeexecApplication
mov edx, 3
lea rcx, [0x1401fb5d0]
call fcn.1400e3ba0
mov rcx, qword [rsp + 0x298]
call fcn.140004a60
mov r9, rax
lea r8, [0x1401fb620]
mov edx, 3
lea rcx, [0x1401fb660]
call fcn.1400e3ba0
mov byte [rsp + 0x30], 1
cmp qword [rsp + 0x38], 0
je 0x14007b2b5
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movzx eax, byte [rsp + 0x30]
test eax, eax
jne 0x14007b4ed
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x1401fb720]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007b3da
lea r8, str.Accessing_HKEY_CURRENT_USERSoftwareClientsStartMenuInternet
mov edx, 3
lea rcx, [0x1401fb778]
call fcn.1400e3ba0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, [0x1401f0eec]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007b3d5
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x298]
call fcn.14000bbe0
mov rcx, qword [rsp + 0x298]
call fcn.1400108b0
test rax, rax
jbe 0x14007b3bd
lea r8, str.Got_value_from_HKEY_CURRENT_USERSoftwareClientsStartMenuInternet
mov edx, 3
lea rcx, [0x1401fb948]
call fcn.1400e3ba0
mov rcx, qword [rsp + 0x298]
call fcn.140004a60
mov r9, rax
lea r8, [0x1401fb9a8]
mov edx, 3
lea rcx, [0x1401fb9f8]
call fcn.1400e3ba0
mov byte [rsp + 0x30], 1
cmp qword [rsp + 0x38], 0
je 0x14007b3bb
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14007b3d5
cmp qword [rsp + 0x38], 0
je 0x14007b3d0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rsp + 0x30], 0
jmp 0x14007b4ed
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareClientsStartMenuInternet
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14007b4ed
lea r8, str.Accessing_HKEY_LOCAL_MACHINESoftwareClientsStartMenuInternet
mov edx, 3
lea rcx, [0x1401fbc30]
call fcn.1400e3ba0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
xor r8d, r8d
lea rdx, [0x1401f0f24]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14007b4ed
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x298]
call fcn.14000bbe0
mov rcx, qword [rsp + 0x298]
call fcn.1400108b0
test rax, rax
jbe 0x14007b4d5
lea r8, str.Got_value_from_HKEY_LOCAL_MACHINESoftwareClientsStartMenuInternet
mov edx, 3
lea rcx, [0x1401fbd60]
call fcn.1400e3ba0
mov rcx, qword [rsp + 0x298]
call fcn.140004a60
mov r9, rax
lea r8, str.The_default_web_browser_is__s
mov edx, 3
lea rcx, [0x1401fbe00]
call fcn.1400e3ba0
mov byte [rsp + 0x30], 1
cmp qword [rsp + 0x38], 0
je 0x14007b4d3
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14007b4ed
cmp qword [rsp + 0x38], 0
je 0x14007b4e8
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [rsp + 0x30], 0
jmp 0x14007b4f6
movzx eax, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400f3d50
add rsp, 0x288
ret