Function at 0x1400223b0
Capabilities:
Delete registry key
Query or enumerate registry key
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov r15d, r8d
mov r14, rdx
mov rbx, rcx
xor r12d, r12d
test rcx, rcx
je 0x140022950
test rdx, rdx
je 0x140022950
mov edi, r12d
mov qword [rbp - 0x40], r12
mov dword [rbp - 0x38], r12d
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x10], r12
mov dword [rbp - 8], r12d
mov qword [rbp], r12
mov esi, r12d
mov qword [rbp - 0x58], r12
mov dword [rbp - 0x50], r12d
mov qword [rbp - 0x48], r12
mov rdx, rcx
lea rcx, [rsp + 0x68]
call fcn.140009580
nop
lea r8, str.Capabilities
lea rdx, [0x140075380]
lea rcx, [rsp + 0x68]
call fcn.14000a5f0
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.140009580
nop
lea r8, str.ShellFileAssociations
lea rdx, [0x140075380]
lea rcx, [rsp + 0x78]
call fcn.14000a5f0
mov qword [rbp - 0x80], r12
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x2000e
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rbx, 0xffffffff80000002
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
or r13, 0xffffffffffffffff
test eax, eax
jne 0x1400224a1
mov rdi, qword [rbp - 0x80]
mov qword [rbp - 0x40], rdi
mov dword [rbp - 0x38], r12d
jmp 0x14002250d
mov qword [rbp - 0x78], r12
lea rax, [rbp + 8]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400224f0
mov eax, r12d
mov rdi, qword [rbp - 0x78]
mov qword [rbp - 0x40], rdi
mov dword [rbp - 0x38], r12d
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1400228d9
mov rbx, 0xffffffff80000002
mov qword [rbp - 0x70], r12
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140022544
mov eax, r12d
mov rsi, qword [rbp - 0x70]
mov qword [rbp - 0x58], rsi
mov dword [rbp - 0x50], r12d
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1400228d9
call fcn.140002dfc
mov rcx, rax
test rax, rax
je 0x14002297b
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x70], rax
call fcn.140002dfc
mov rcx, rax
test rax, rax
je 0x140022970
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x60]
call fcn.1400222ac
mov ebx, eax
test eax, eax
js 0x140022895
mov rdx, r14
lea rcx, [rsp + 0x60]
call fcn.140009210
mov r9d, r15d
mov r8, qword [rsp + 0x60]
lea rdx, str.__s___d
lea rcx, [rsp + 0x70]
call fcn.14000a5cc
mov r15d, 1
mov rax, qword [rsp + 0x70]
test rax, rax
jne 0x1400225ea
lea eax, [r15 + 0xc]
jmp 0x14002261d
mov rcx, r13
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x1400225ed
lea ecx, [rcx*2 + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, r15d
xor r8d, r8d
lea rdx, str.ApplicationDescription
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx ebx, ax
mov r14d, 0x80070000
or ebx, r14d
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140022895
cmp byte [0x1400916f8], r12b
jne 0x14002267a
lea rcx, [0x140070628]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002266a
lea rdx, [0x140070528]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400916f0], rax
jmp 0x140022671
mov rax, qword [0x1400916f0]
mov byte [0x1400916f8], r15b
jmp 0x140022681
mov rax, qword [0x1400916f0]
lea rdx, str.FileAssociations
mov rcx, rdi
test rax, rax
je 0x14002269a
xor r9d, r9d
xor r8d, r8d
call rax
jmp 0x1400226a0
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rbp - 0x68], r12
lea rax, [rbp + 0xc]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.FileAssociations
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, eax
test eax, eax
jne 0x1400226f3
mov ecx, r12d
mov rax, qword [rbp - 0x68]
mov qword [rbp - 0x10], rax
mov dword [rbp - 8], r12d
movzx ebx, cx
or ebx, r14d
test ecx, ecx
cmovle ebx, ecx
test ebx, ebx
js 0x140022895
mov edi, r12d
mov r14d, 0x104
mov dword [rbp + 0x60], r14d
mov r8d, r14d
lea rcx, [rsp + 0x58]
call fcn.140022988
nop
mov r8, qword [rsp + 0x58]
cmp dword [r8 - 8], r15d
jle 0x14002273f
mov edx, dword [r8 - 0x10]
lea rcx, [rsp + 0x58]
call fcn.140002948
mov r8, qword [rsp + 0x58]
lea rax, [rbp + 0x10]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x60]
mov edx, edi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140022873
mov dword [rbp + 0x78], r14d
mov qword [rbp - 0x28], r12
mov dword [rbp - 0x20], r12d
mov qword [rbp - 0x18], r12
mov r8d, r14d
lea rcx, [rsp + 0x50]
call fcn.140022988
nop
mov qword [rbp - 0x60], r12
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140022832
mov rax, qword [rbp - 0x60]
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x20], r12d
mov r8, qword [rsp + 0x50]
cmp dword [r8 - 8], r15d
jle 0x1400227de
mov edx, dword [r8 - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140002948
mov r8, qword [rsp + 0x50]
lea r9, [rbp + 0x78]
lea rdx, [0x1400706b8]
lea rcx, [rbp - 0x28]
call fcn.14000ca90
test eax, eax
jne 0x140022832
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x140022837
mov rcx, r13
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x140022803
lea ecx, [rcx*2 + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, r15d
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rax, qword [rsp + 0x50]
mov dword [rbp + 0x60], r14d
add edi, r15d
lea rdx, [rax - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14002285b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x28]
test rcx, rcx
je 0x14002286a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rbp - 0x58]
jmp 0x140022721
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140022895
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1400228b7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1400228d9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1400228fb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14002291d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x58]
test rcx, rcx
je 0x14002292d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14002293d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x14002294c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x140022955
mov eax, 0x80004003
mov rbx, qword [rsp + 0x168]
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140002fa4
nop
mov ecx, 0x80004005
call fcn.140002fa4
int3