Function at 0x140018940
Capabilities:
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov rax, qword [0x140034030]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor edi, edi
mov qword [rsp + 0x40], rdi
lea rsi, [rsp + 0x70]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdi
mov ebx, 2
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 0
lea rdx, str.SoftwareClassesApplications
mov r14, qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, 0xffffffff80000001
xor r8d, r8d
xor r9d, r9d
call r14
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 1
lea rdx, str.SoftwareClassesApplicationscrashreporter.exe
mov rcx, 0xffffffff80000001
xor r8d, r8d
xor r9d, r9d
call r14
test eax, eax
jne 0x140018a52
mov rcx, qword [rsp + 0x70]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea rdx, str.IsHostApp
mov rbx, qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor r8d, r8d
xor r9d, r9d
call rbx
mov rcx, qword [rsp + 0x70]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea rdx, str.NoOpenWith
xor r8d, r8d
xor r9d, r9d
call rbx
mov rcx, qword [rsp + 0x70]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea rdx, str.NoStartPage
xor r8d, r8d
xor r9d, r9d
call rbx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
movsxd rcx, dword [rax]
shl rcx, 3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
xor r12d, r12d
mov r13, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
lea rbx, [rsp + 0x50]
xor ebp, ebp
call r13
movsxd rax, dword [rax]
cmp rbp, rax
jge 0x140018bc5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___wargv]
mov rax, qword [rax]
mov r14, qword [rax + rbp*8]
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], 0
mov rcx, r14
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov r15, rax
cmp rax, 7
ja 0x140018bb2
mov qword [rsp + 0x60], r15
mov r8, r15
add r8, r15
mov rcx, rbx
mov rdx, r14
call sub.VCRUNTIME140.dll_memmove
mov word [rsp + r15*2 + 0x50], 0
mov rcx, rsi
mov rdx, rbx
call fcn.140018510
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x88]
cmp r15, 0x10
mov rcx, rsi
cmovae rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
mov qword [rdi + rbp*8], rax
cmp r15, 0x10
jb 0x140018b49
lea rdx, [r15 + 1]
cmp rdx, 0x1000
jb 0x140018b41
mov rax, qword [r14 - 8]
add r14, 0xfffffffffffffff8
sub r14, rax
cmp r14, 0x20
jae 0x140018bfb
add r15, 0x28
mov rdx, r15
mov r14, rax
mov rcx, r14
call fcn.14001bac4
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0xf
mov byte [rsp + 0x70], 0
mov rax, qword [rsp + 0x68]
cmp rax, 8
jb 0x140018baa
mov rcx, qword [rsp + 0x50]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140018ba5
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140018bfb
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001bac4
inc rbp
jmp 0x140018a79
mov rcx, rbx
mov rdx, r15
mov r8, r14
call fcn.14001cd20
jmp 0x140018ae2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
mov ecx, dword [rax]
mov rdx, rdi
call fcn.140007a70
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14001ca10
xor eax, eax
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3