Function at 0x1400124a0
Capabilities:
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x14004b300]
xor rax, rsp
mov qword [rbp + 0x10], rax
xor edi, edi
mov qword [rsp + 0x58], rdi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.steam
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140012546
mov byte [0x14004c9cd], 1
mov dword [rsp + 0x54], 1
lea rax, [0x14004b1e4]
mov qword [rsp + 0x28], rax
lea rax, [0x140070b00]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x54]
xor r8d, r8d
lea rdx, str.URL_Protocol
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, str.Found_previous_registry_entry__HKCS__1_for_Steam
jmp 0x14001258f
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.steam
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140012ae6
lea rdx, str.Created_new_registry_entry__HKCS__1_for_Steam
lea rcx, [0x14004ca60]
call fcn.1400071d0
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.steamShellOpenCommand
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rsi, [0x14003863c]
test eax, eax
jne 0x140012618
mov byte [0x14004c9ce], 1
mov dword [rsp + 0x54], 1
lea rax, [0x14004b1e0]
mov qword [rsp + 0x28], rax
lea rax, [0x14006cb00]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x54]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, str.Found_previous_registry_entry__HKCS__2_for_Steam
jmp 0x140012661
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.steamShellOpenCommand
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400129a4
lea rdx, str.Created_new_registry_entry__HKCS__2_for_Steam
lea rcx, [0x14004ca60]
call fcn.1400071d0
mov dword [rsp + 0x28], 0x26
lea rax, str.URL:steam_protocol
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], rsi
mov r9d, 1
xor r8d, r8d
lea rdx, str.URL_Protocol
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140007410
mov rbx, rax
call fcn.140007430
mov rdx, qword [rax + 0x10]
movabs rcx, 0x7fffffffffffffff
sub rcx, rdx
cmp rcx, 1
jb 0x140012c4e
mov rcx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140012700
mov rcx, qword [rax]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 1
lea r9, [0x1400386e4]
mov r8, rax
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp - 0x58]
call fcn.14000a660
nop
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14001273a
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rbp - 0x58]
call fcn.1400054c0
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x60]
mov rax, rdx
sub rax, rcx
cmp rax, 9
jb 0x1400127be
lea rax, [rcx + 9]
mov qword [rbp - 0x68], rax
lea rbx, [rbp - 0x78]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x78]
add rbx, rcx
mov r8d, 9
lea rdx, str._______1_
mov rcx, rbx
call fcn.140033f80
mov byte [rbx + 9], 0
lea rax, [rbp - 0x78]
jmp 0x1400127df
mov qword [rsp + 0x20], 9
lea r9, str._______1_
xor r8d, r8d
mov edx, 9
lea rcx, [rbp - 0x78]
call fcn.1400019c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rax, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rax, qword [rsp + 0x68]
mov qword [rbp - 0x10], rax
mov rax, qword [rsp + 0x78]
mov qword [rbp - 8], rax
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x10], xmm0
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x38]
call fcn.140006a50
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x140012880
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001287b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012c54
call fcn.14001af20
movdqa xmm0, xmmword [0x140037990]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x1400128d6
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400128c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012c5a
call fcn.14001af20
movdqa xmm0, xmmword [0x140037990]
movdqu xmmword [rbp - 0x68], xmm0
mov byte [rbp - 0x78], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x14001291a
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012915
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012c60
call fcn.14001af20
mov eax, dword [rbp - 0x28]
lea eax, [rax*2 + 2]
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova rcx, qword [rbp - 0x38]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x20]
cmp rdx, 7
jbe 0x14001299d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012998
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012c66
call fcn.14001af20
mov al, 1
jmp 0x140012c23
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea r10, [rbp + 5]
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx ecx, dl
shl cl, 2
lea eax, [rcx + rdx]
add al, al
sub r8b, al
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x1400129b1
lea r9, [rsp + 0x50]
lea r8, [rbp + 5]
mov rdx, r10
lea rcx, [rbp - 0x58]
call fcn.140007e50
nop
mov r9d, 0x2c
lea r8, str.Unable_to_patch_Registry__HKCS__2__error_
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.140011e20
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x68]
lea rcx, [0x14004ca60]
call fcn.140006f40
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x140012a88
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012a83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012c6c
call fcn.14001af20
movdqa xmm0, xmmword [0x140037990]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x140012ad6
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012ad1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012c72
call fcn.14001af20
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140012c21
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea r10, [rbp + 5]
nop dword [rax]
nop word [rax + rax]
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx ecx, dl
shl cl, 2
lea eax, [rcx + rdx]
add al, al
sub r8b, al
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x140012b00
lea r9, [rsp + 0x50]
lea r8, [rbp + 5]
mov rdx, r10
lea rcx, [rbp - 0x58]
call fcn.140007e50
nop
mov r9d, 0x2c
lea r8, str.Unable_to_patch_Registry__HKCS__1__error_
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.140011e20
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x68]
lea rcx, [0x14004ca60]
call fcn.140006f40
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x140012bd7
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012bd2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012c78
call fcn.14001af20
movdqa xmm0, xmmword [0x140037990]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x140012c21
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012c1c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012c48
call fcn.14001af20
xor al, al
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.14001b0a0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.140020d94
int3
call fcn.140005310
nop
call fcn.140020d94
nop
call fcn.140020d94
nop
call fcn.140020d94
int3
call fcn.140020d94
nop
call fcn.140020d94
nop
call fcn.140020d94
nop
call fcn.140020d94
int3