Function at 0x7ff75297e74c
Capabilities:
Query or enumerate registry value
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov r12, rcx
mov rsi, qword [rdx + 0x18]
mov rbx, rsi
xor r13d, r13d
mov r14d, r13d
mov edi, r13d
lea r15, [0x7ff75298d100]
test rsi, rsi
je 0x7ff75297e792
test dword [rdx + 0x3c], 0x800
jne 0x7ff75297e960
mov dword [rbp + 0x48], r13d
call fcn.7ff75297f830
lea r15, str.ConsoleHostShortcutTargetX86
lea rcx, str.ConsoleHostShortcutTarget
test eax, eax
cmove r15, rcx
lea rax, [rbp + 0x48]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
mov r9d, 0x10000006
mov r8, r15
lea rdx, str.SOFTWAREMicrosoftPowerShell3
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x7ff75297e932
mov ecx, dword [rbp + 0x48]
shr rcx, 1
inc rcx
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.7ff752974da8
mov r14, rax
mov r8d, dword [rbp + 0x48]
add r8, 2
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
lea rax, [rbp + 0x48]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r13
mov r9d, 0x10000006
mov r8, r15
lea rdx, str.SOFTWAREMicrosoftPowerShell3
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
nop dword [rax + rax]
test eax, eax
jne 0x7ff75297e868
mov rsi, r14
jmp 0x7ff75297e8f3
call fcn.7ff75297f830
test eax, eax
je 0x7ff75297e8b3
lea rsi, str._AppData_MicrosoftWindowsStart_MenuProgramsWindows_PowerShellWindows_PowerShell_x86_.lnk
mov rcx, rsi
call fcn.7ff75297f76c
test al, al
jne 0x7ff75297e8f3
lea rsi, str._ProgramData_MicrosoftWindowsStart_MenuProgramsAdministrative_ToolsWindows_PowerShell__x86_.lnk
mov rcx, rsi
call fcn.7ff75297f76c
test al, al
jne 0x7ff75297e8f3
mov rsi, rbx
lea rcx, str._ProgramData_MicrosoftWindowsStart_MenuProgramsAccessoriesWindows_PowerShellWindows_PowerShell__x86_.lnk
call fcn.7ff75297f76c
test al, al
je 0x7ff75297e8f8
lea rsi, str._ProgramData_MicrosoftWindowsStart_MenuProgramsAccessoriesWindows_PowerShellWindows_PowerShell__x86_.lnk
jmp 0x7ff75297e8f3
lea rsi, str._AppData_MicrosoftWindowsStart_MenuProgramsWindows_PowerShellWindows_PowerShell.lnk
mov rcx, rsi
call fcn.7ff75297f76c
test al, al
jne 0x7ff75297e8f3
lea rsi, str._ProgramData_MicrosoftWindowsStart_MenuProgramsSystem_ToolsWindows_PowerShell.lnk
mov rcx, rsi
call fcn.7ff75297f76c
test al, al
jne 0x7ff75297e8f3
mov rsi, rbx
lea rcx, str._ProgramData_MicrosoftWindowsStart_MenuProgramsAccessoriesWindows_PowerShellWindows_PowerShell.lnk
call fcn.7ff75297f76c
test al, al
je 0x7ff75297e8f8
lea rsi, str._ProgramData_MicrosoftWindowsStart_MenuProgramsAccessoriesWindows_PowerShellWindows_PowerShell.lnk
mov edi, 1
mov qword [rbp - 0x28], r13
lea rdx, [rbp - 0x28]
mov ecx, 0x6d
call fcn.7ff75298020c
test eax, eax
js 0x7ff75297ed58
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
lea r8, [rbp - 0x28]
mov edx, 0x7ffffffe
mov rcx, rsi
call fcn.7ff752980338
mov rdx, qword [rbp - 0x28]
inc rdx
mov r8, rsi
lea r15, [0x7ff75298d100]
mov rcx, r15
call fcn.7ff752980300
test edi, edi
jne 0x7ff75297e983
lea r8, [rbp - 0x28]
mov edx, 0x7ffffffe
mov rcx, rsi
call fcn.7ff752980338
mov rdx, qword [rbp - 0x28]
inc rdx
mov r8, rsi
mov rcx, r15
call fcn.7ff752980300
mov qword [rbp - 8], r13
mov qword [rbp - 0x18], r13
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
lea r9, [0x7ff752985ff8]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x7ff7529852d8]
call qword [sym.imp.OLE32.dll_CoCreateInstance]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x7ff75297ed43
mov rcx, qword [rbp - 0x18]
mov rax, qword [rcx]
movabs r10, 0xdee01e7974d59970
lea r8, [rbp - 8]
lea rdx, [0x7ff752985320]
mov rax, qword [rax]
call qword [0x7ff752984648]
mov edi, eax
test eax, eax
js 0x7ff75297ed43
mov rcx, qword [rbp - 8]
mov rax, qword [rcx]
movabs r10, 0xefa096ef36568b70
mov r8d, 2
mov rdx, r15
mov rax, qword [rax + 0x28]
call qword [0x7ff752984648]
mov dword [rbp + 0x50], r13d
test eax, eax
js 0x7ff75297ea4f
mov rcx, qword [rbp - 0x18]
mov rax, qword [rcx]
movabs r10, 0xc3700fb312596a70
lea r9, [rbp + 0x50]
mov r8d, 0x104
mov rdx, r15
mov rax, qword [rax + 0x80]
call qword [0x7ff752984648]
mov edi, eax
test eax, eax
jns 0x7ff75297ea7a
jmp 0x7ff75297ed43
lea r8, [rbp - 0x28]
mov edx, 0x7ffffffe
lea rcx, str._windir_System32WindowsPowerShell_v1.0powershell.exe
call fcn.7ff752980338
mov rdx, qword [rbp - 0x28]
inc rdx
lea r8, str._windir_System32WindowsPowerShell_v1.0powershell.exe
mov rcx, r15
call fcn.7ff752980300
mov qword [rbp - 0x20], r13
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
lea r9, [0x7ff752985fd8]
xor edx, edx
lea r8d, [rdx + 3]
lea rcx, [0x7ff7529852f8]
call qword [sym.imp.OLE32.dll_CoCreateInstance]
nop dword [rax + rax]
mov edi, eax
test eax, eax
js 0x7ff75297ed39
mov qword [rbp + 0x58], r13
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], r13
lea rdx, [rbp - 0x30]
mov ecx, 0x76
call fcn.7ff75298020c
mov edi, eax
test eax, eax
js 0x7ff75297ed2f
lea rdx, [rbp - 0x28]
mov ecx, 0x77
call fcn.7ff75298020c
lea rax, [rbp + 0x58]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x30], 1
mov eax, dword [rbp + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
mov rdx, rsi
mov rcx, qword [rbp - 0x30]
call fcn.7ff75297f060
mov edi, eax
mov rcx, r14
call qword [sym.imp.msvcrt.dll____V_YAXPEAX_Z]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test edi, edi
js 0x7ff75297ed2f
mov rcx, qword [rbp - 0x20]
mov rax, qword [rcx]
movabs r10, 0xcfa59eeb5a587370
mov rdx, qword [rbp + 0x58]
mov rax, qword [rax + 0x28]
call qword [0x7ff752984648]
mov edi, eax
test eax, eax
js 0x7ff75297ed2f
call fcn.7ff75297ee58
test eax, eax
je 0x7ff75297ecd5
lea rdx, [rbp - 0x30]
mov ecx, 0x7a
call fcn.7ff75298020c
mov edi, eax
test eax, eax
js 0x7ff75297ed2f
lea rdx, [rbp - 0x28]
mov ecx, 0x7b
call fcn.7ff75298020c
xor edx, edx
lea rcx, [rbp + 0x58]
call qword [sym.imp.ATL.DLL_AtlComPtrAssign]
nop dword [rax + rax]
lea rax, [rbp + 0x58]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x30], 1
mov dword [rsp + 0x28], r13d
lea rsi, str._systemroot__system32windowspowershell_v1.0powershell_ise.exe
mov qword [rsp + 0x20], rsi
mov rdx, rsi
mov rcx, qword [rbp - 0x30]
call fcn.7ff75297f060
mov edi, eax
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test edi, edi
js 0x7ff75297ed2f
mov rcx, qword [rbp - 0x20]
mov rax, qword [rcx]
movabs r10, 0xcfa59eeb5a587370
mov rdx, qword [rbp + 0x58]
mov rax, qword [rax + 0x28]
call qword [0x7ff752984648]
mov edi, eax
test eax, eax
js 0x7ff75297ed2f
lea rdx, [rbp - 0x30]
mov ecx, 0x65
call fcn.7ff75298020c
mov edi, eax
test eax, eax
js 0x7ff75297ed2f
lea rdx, [rbp - 0x28]
mov ecx, 0x6f
call fcn.7ff75298020c
xor edx, edx
lea rcx, [rbp + 0x58]
call qword [sym.imp.ATL.DLL_AtlComPtrAssign]
nop dword [rax + rax]
lea rax, [rbp + 0x58]
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x30], 0
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], rsi
mov rdx, rsi
mov rcx, qword [rbp - 0x30]
call fcn.7ff75297f060
mov edi, eax
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.msvcrt.dll_free]
nop dword [rax + rax]
test edi, edi
js 0x7ff75297ed2f
mov rcx, qword [rbp - 0x20]
mov rax, qword [rcx]
movabs r10, 0xcfa59eeb5a587370
mov rdx, qword [rbp + 0x58]
mov rax, qword [rax + 0x28]
call qword [0x7ff752984648]
mov edi, eax
test eax, eax
js 0x7ff75297ed2f
mov qword [rbp - 0x10], r13
mov rcx, qword [rbp - 0x20]
mov rax, qword [rcx]
movabs r10, 0xdee01e7974d59970
lea r8, [rbp - 0x10]
lea rdx, [0x7ff752986038]
mov rax, qword [rax]
call qword [0x7ff752984648]
mov edi, eax
test eax, eax
js 0x7ff75297ed25
mov rax, qword [r12]
movabs r10, 0xad213e3b1ed97270
mov rdx, qword [rbp - 0x10]
mov rcx, r12
mov rax, qword [rax + 0x38]
call qword [0x7ff752984648]
mov edi, eax
lea rcx, [rbp - 0x10]
call fcn.7ff752974800
nop
lea rcx, [rbp + 0x58]
call fcn.7ff752974800
nop
lea rcx, [rbp - 0x20]
call fcn.7ff752974800
nop
lea rcx, [rbp - 0x18]
call fcn.7ff752974800
nop
lea rcx, [rbp - 8]
call fcn.7ff752974800
mov eax, edi
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret