Function at 0x14001d9cc
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x890
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rax, qword [0x1404f5550]
xor rax, rsp
mov qword [rsp + 0x880], rax
mov rbx, rdx
mov qword [rsp + 0x78], rdx
xor esi, esi
mov dil, sil
lea ebp, [rsi + 1]
cmp byte [rcx + 0x1138], sil
je 0x14001dc63
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x30], reloc.mfc90u.dll_CDHtmlControlSink::AddRef
mov word [rsp + 0x80], si
xor edx, edx
mov r8d, 0x7fe
lea rcx, [r11 - 0x816]
call sub.MSVCR90.dll_memset
lea rdx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
lea rcx, [rsp + 0x60]
call qword [0x1404094a8]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc90u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x14001dac4
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, str.Progid
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x58]
call qword [0x1404094a8]
nop
lea rdx, str.IE.HTTP
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc90u.dll_CLongBinary::classCLongBinary]
cmp eax, esi
jne 0x14001dc47
mov rcx, rbx
call qword [sym.imp.mfc90u.dll_CDumpContext::operator___1]
mov rcx, rax
call fcn.1403c0740
cmp eax, esi
je 0x14001dc47
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsIEXPLORE.EXE
lea rcx, [rsp + 0x68]
call qword [0x1404094a8]
nop
mov word [rsp + 0x80], si
mov dword [rsp + 0x30], reloc.mfc90u.dll_CDHtmlControlSink::AddRef
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc90u.dll_CDumpContext::operator___1]
mov rdx, rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x14001dc3b
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [0x14040a96c]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [rsp + 0x80], si
je 0x14001dc3b
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x50]
call qword [0x1404094a8]
nop
mov r8, rax
lea rdx, [0x1404160e8]
lea rcx, [rsp + 0x48]
call fcn.140015c64
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc90u.dll_CView::CView]
mov r8, rbx
lea rdx, [0x1404160e0]
lea rcx, [rsp + 0x50]
call fcn.140015c64
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc90u.dll_]
nop
lea rcx, [rsp + 0x50]
call qword [sym.imp.mfc90u.dll_CView::CView]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc90u.dll_COleDataSource::FlushClipboard]
mov rdx, rax
xor ecx, ecx
call fcn.140027f68
movzx edi, dil
cmp eax, esi
cmovge edi, ebp
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc90u.dll_CView::CView]
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.mfc90u.dll_CView::CView]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc90u.dll_CView::CView]
nop
lea rcx, [rsp + 0x60]
call qword [sym.imp.mfc90u.dll_CView::CView]
cmp dil, sil
jne 0x14001dc86
mov rcx, rbx
call qword [sym.imp.mfc90u.dll_CDumpContext::operator___1]
mov r8, rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rcx, rbx
call qword [sym.imp.mfc90u.dll_CView::CView]
mov al, bpl
mov rcx, qword [rsp + 0x880]
xor rcx, rsp
call fcn.1403c2380
lea r11, [rsp + 0x890]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret