Function at 0x14001e690
Capabilities:
Delete registry value
Persist via default file association registry key
Persist via filter handlers registry key
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov qword [rbp - 0x59], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400c0140]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rsi, rdx
mov r12, rcx
mov qword [rbp - 0x39], 7
xor r13d, r13d
mov qword [rbp - 0x41], r13
mov word [rbp - 0x51], r13w
lea rax, [rbp - 0x79]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareClasses.exe
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r14, str.exefile
lea r15, [0x14008db30]
test ebx, ebx
je 0x14001e803
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClasses.exe
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001e79b
mov edx, 0x1000
mov rcx, r14
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r14
lea r9d, [r13 + 1]
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001e7a5
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.___HKLMSoftwareClasses.exe_did_not_exist_and_was_recreated__r_n_r_n
mov rcx, rsi
call fcn.140018560
mov rdi, rax
mov ebx, r13d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x14001e7de
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
mov eax, 4
cmove ebx, eax
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x14001e803
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x14001e7fb
or edx, 4
xor r8d, r8d
call fcn.140003090
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClasses.exePersistentHandler
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea rbx, str.098f2470_bae0_11cd_b579_08002b30bfeb
test eax, eax
jne 0x14001e87c
mov edx, 0x1000
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001e886
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClasses.exe
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001e903
mov edx, 0x1000
lea rbx, str.application_x_msdownload
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.Content_Type
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001e90d
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9, r15
lea r8, str.SoftwareClasses.exe
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x29]
call fcn.14001e270
mov rbx, rax
lea rax, [rbp - 0x51]
cmp rax, rbx
je 0x14001e99d
cmp qword [rbp - 0x39], 8
jb 0x14001e943
mov rcx, qword [rbp - 0x51]
call fcn.140063290
mov qword [rbp - 0x39], 7
mov qword [rbp - 0x41], r13
mov word [rbp - 0x51], r13w
cmp qword [rbx + 0x18], 8
jae 0x14001e973
mov r8, qword [rbx + 0x10]
inc r8
add r8, r8
mov rdx, rbx
lea rcx, [rbp - 0x51]
call fcn.1400632b0
jmp 0x14001e97d
mov rax, qword [rbx]
mov qword [rbp - 0x51], rax
mov qword [rbx], r13
mov rax, qword [rbx + 0x10]
mov qword [rbp - 0x41], rax
mov rax, qword [rbx + 0x18]
mov qword [rbp - 0x39], rax
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r13
mov word [rbx], r13w
cmp qword [rbp - 0x11], 8
jb 0x14001e9ad
mov rcx, qword [rbp - 0x29]
call fcn.140063290
mov r9d, 1
mov r8, r14
mov rdx, r15
lea rcx, str.SoftwareClasses.exe
call fcn.14001e130
test eax, eax
je 0x14001eaaa
lea rdx, str.___HKLMSoftwareClasses.exe_____has_been_changed_to
mov rcx, rsi
call fcn.140018560
mov rcx, rax
lea rdx, [rbp - 0x51]
call fcn.1400187c0
mov rcx, rax
lea rdx, [0x140093f34]
call fcn.140018f30
mov rdi, rax
mov ebx, r13d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x14001ea25
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
mov r14d, 4
cmove ebx, r14d
jmp 0x14001ea2b
mov r14d, 4
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x14001ea50
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x14001ea48
or edx, 4
xor r8d, r8d
call fcn.140003090
lea rdx, str.___HKLMSoftwareClasses.exe_____was_reset_to_exefile__r_n_r_n
mov rcx, rsi
call fcn.140018560
mov rdi, rax
mov ebx, r13d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x14001ea85
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove ebx, r14d
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x14001eaaa
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x14001eaa2
or edx, 4
xor r8d, r8d
call fcn.140003090
lea rdx, str.SoftwareClasses.exe_shell
mov rcx, 0xffffffff80000002
call fcn.14001dea0
test eax, eax
je 0x14001eb1f
lea rdx, str.___HKLMSoftwareClasses.exe_shell_found_and_deleted__r_n_r_n
mov rcx, rsi
call fcn.140018560
mov rdi, rax
mov ebx, r13d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x14001eafa
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
mov eax, 4
cmove ebx, eax
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x14001eb1f
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x14001eb17
or edx, 4
xor r8d, r8d
call fcn.140003090
lea rdx, str.SoftwareClasses.exeDefaultIcon
mov rcx, 0xffffffff80000002
call fcn.14001dea0
test eax, eax
je 0x14001eb94
lea rdx, str.___HKLMSoftwareClasses.exeDefaultIcon_found_and_deleted__r_n_r_n
mov rcx, rsi
call fcn.140018560
mov rdi, rax
mov ebx, r13d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x14001eb6f
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
mov eax, 4
cmove ebx, eax
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x14001eb94
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x14001eb8c
or edx, 4
xor r8d, r8d
call fcn.140003090
lea rax, [rbp - 0x79]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdi, str.__1___
test ebx, ebx
je 0x14001ed32
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile_shellopencommand
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001ec47
mov edx, 0x1000
mov rcx, rdi
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001ec51
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile_shell_runascommand
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001ecc3
mov edx, 0x1000
mov rcx, rdi
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001eccd
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.___HKLMSoftwareClassesexefile_did_not_exist_and_was_recreated__r_n_r_n
mov rcx, rsi
call fcn.140018560
mov rdi, rax
mov ebx, r13d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x14001ed06
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
mov eax, 4
cmove ebx, eax
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x14001ed2b
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x14001ed23
or edx, 4
xor r8d, r8d
call fcn.140003090
lea rdi, str.__1___
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea rbx, str.Application
test eax, eax
jne 0x14001edab
mov edx, 0x1000
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001edb5
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp - 0x65], 0x738
mov dword [rbp - 0x6d], 0
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rbp - 0x79]
test eax, eax
jne 0x14001ee3d
mov r14d, 4
mov dword [rsp + 0x28], r14d
lea rax, [rbp - 0x65]
mov qword [rsp + 0x20], rax
lea r9d, [r14 - 1]
xor r8d, r8d
lea rdx, str.EditFlags
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001ee49
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001ee49
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r14d, 4
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile_shellopen
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rbp - 0x79]
test eax, eax
jne 0x14001eeb7
mov dword [rsp + 0x28], r14d
lea rax, [rbp - 0x6d]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, str.EditFlags
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001eebd
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefileDefaultIcon
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001ef36
mov edx, 0x1000
lea rbx, [0x1400943d8]
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001ef40
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001efbd
mov edx, 0x1000
lea rbx, str.prop:FileDescription_Company_FileVersion
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.TileInfo
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001efc7
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001f044
mov edx, 0x1000
lea rbx, str.prop:FileDescription_Company_FileVersion_Create_Size
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.InfoTip
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001f04e
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile_shellexDropHandler
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea rbx, str.86C86720_42A0_1069_A2E8_08002B30309D
test eax, eax
jne 0x14001f0c7
mov edx, 0x1000
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001f0d1
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [r12 + 0x48c], 1
jne 0x14001f158
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile_shellexPropertySheetHandlersB41DB860_8EE4_11D2_9906_E49FADC173CA
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001f14e
mov edx, 0x1000
mov rcx, r15
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r15
mov r9d, 1
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001f158
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile_shellexPropertySheetHandlersShimLayer_Property_Page
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea rbx, str.513D916F_2A8E_4F51_AEAB_0CBC76FB1AF8
test eax, eax
jne 0x14001f1d1
mov edx, 0x1000
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001f1db
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x79]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile_shellopencommand
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001f21a
lea rdx, str.IsolatedCommand
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x14001f224
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x79]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile_shell_runascommand
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001f263
lea rdx, str.IsolatedCommand
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x14001f26d
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x79]
mov qword [rsp + 0x20], rax
mov r9d, 0xf013f
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14001f2ac
lea rdx, str.Content_Type
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x14001f2b6
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9d, 1
mov r8, rdi
mov rdx, r15
lea rcx, str.SoftwareClassesexefile_shellopencommand
call fcn.14001e130
test eax, eax
je 0x14001f333
lea rdx, str.___HKLMSoftwareClassesexefile_shellopencommand_____was_changed._It_was_reset_to___1_____r_n_r_n
mov rcx, rsi
call fcn.140018560
mov rdi, rax
mov ebx, r13d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x14001f307
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove ebx, r14d
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x14001f32c
or ebx, dword [rcx + 0x10]
cmp qword [rcx + 0x48], 0
jne 0x14001f322
or ebx, 4
xor r8d, r8d
mov edx, ebx
call fcn.140003090
lea rdi, str.__1___
mov r9d, 1
mov r8, rdi
mov rdx, r15
lea rcx, str.SoftwareClassesexefile_shell_runascommand
call fcn.14001e130
test eax, eax
je 0x14001f3a9
lea rdx, str.___HKLMSoftwareClassesexefile_shell_runascommand_____was_changed._It_was_reset_to___1_____r_n_r_n
mov rcx, rsi
call fcn.140018560
mov rdi, rax
mov ebx, r13d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x14001f384
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove ebx, r14d
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x14001f3a9
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x14001f3a1
or edx, 4
xor r8d, r8d
call fcn.140003090
lea rax, [rbp - 0x79]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREClasses.exe
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14001f65f
mov qword [rbp - 0x41], r13
lea rax, [rbp - 0x51]
cmp qword [rbp - 0x39], 8
cmovae rax, qword [rbp - 0x51]
mov word [rax], r13w
mov r9, r15
lea r8, str.SOFTWAREClasses.exe
mov rdx, 0xffffffff80000001
lea rcx, [rbp - 1]
call fcn.14001e270
mov rbx, rax
lea rax, [rbp - 0x51]
cmp rax, rbx
je 0x14001f489
cmp qword [rbp - 0x39], 8
jb 0x14001f42f
mov rcx, qword [rbp - 0x51]
call fcn.140063290
mov qword [rbp - 0x39], 7
mov qword [rbp - 0x41], r13
mov word [rbp - 0x51], r13w
cmp qword [rbx + 0x18], 8
jae 0x14001f45f
mov r8, qword [rbx + 0x10]
inc r8
add r8, r8
mov rdx, rbx
lea rcx, [rbp - 0x51]
call fcn.1400632b0
jmp 0x14001f469
mov rax, qword [rbx]
mov qword [rbp - 0x51], rax
mov qword [rbx], r13
mov rax, qword [rbx + 0x10]
mov qword [rbp - 0x41], rax
mov rax, qword [rbx + 0x18]
mov qword [rbp - 0x39], rax
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r13
mov word [rbx], r13w
cmp qword [rbp + 0x17], 8
jb 0x14001f499
mov rcx, qword [rbp - 1]
call fcn.140063290
lea rdx, str.___HKCUSOFTWAREClasses.exe_____exists_and_is_set_to
mov rcx, rsi
call fcn.140018560
mov rcx, rax
lea rdx, [rbp - 0x51]
call fcn.1400187c0
mov rcx, rax
lea rdx, [0x140093f34]
call fcn.140018f30
mov rdi, rax
mov ebx, r13d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x14001f4e9
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove ebx, r14d
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x14001f50e
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x14001f506
or edx, 4
xor r8d, r8d
call fcn.140003090
lea rdx, str.SOFTWAREClasses.exe
mov rcx, 0xffffffff80000001
call fcn.14001dea0
test eax, eax
je 0x14001f57f
lea rdx, str.___HKCUSOFTWAREClasses.exe_has_been_deleted__r_n
mov rcx, rsi
call fcn.140018560
mov rdi, rax
mov ebx, r13d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x14001f55a
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove ebx, r14d
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x14001f57f
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x14001f577
or edx, 4
xor r8d, r8d
call fcn.140003090
mov qword [rbp - 0x11], 7
mov qword [rbp - 0x19], r13
mov word [rbp - 0x29], r13w
mov r8d, 0x11
lea rdx, str.SOFTWAREClasses_
lea rcx, [rbp - 0x29]
call fcn.140001780
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x29]
call fcn.1400158d0
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 8
cmovae rdx, qword [rbp - 0x29]
mov rcx, 0xffffffff80000001
call fcn.14001dea0
test eax, eax
je 0x14001f64f
lea rdx, str.___HKCUSOFTWAREClasses_
mov rcx, rsi
call fcn.140018560
mov rcx, rax
lea rdx, [rbp - 0x51]
call fcn.1400187c0
mov rcx, rax
lea rdx, str._has_been_deleted__r_n_r_n
call fcn.140018560
mov rdi, rax
mov ebx, r13d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x14001f629
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove ebx, r14d
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x14001f64f
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x14001f646
or edx, 4
xor r8d, r8d
call fcn.140003090
nop
cmp qword [rbp - 0x11], 8
jb 0x14001f65f
mov rcx, qword [rbp - 0x29]
call fcn.140063290
lea rax, [rbp - 0x79]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareClasses.bat
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r14, str.batfile
test ebx, ebx
je 0x14001f77a
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClasses.bat
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001f712
mov edx, 0x1000
mov rcx, r14
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r14
mov r9d, 1
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001f71c
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.___HKLMSoftwareClasses.bat_did_not_exist_and_was_recreated__r_n_r_n
mov rcx, rsi
call fcn.140018560
mov rdi, rax
mov ebx, r13d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x14001f755
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
mov eax, 4
cmove ebx, eax
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x14001f77a
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x14001f772
or edx, 4
xor r8d, r8d
call fcn.140003090
mov qword [rbp - 0x41], r13
lea rax, [rbp - 0x51]
cmp qword [rbp - 0x39], 8
cmovae rax, qword [rbp - 0x51]
mov word [rax], r13w
mov r9, r15
lea r8, str.SoftwareClasses.bat
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 1]
call fcn.14001e270
mov rbx, rax
lea rax, [rbp - 0x51]
cmp rax, rbx
je 0x14001f820
cmp qword [rbp - 0x39], 8
jb 0x14001f7c6
mov rcx, qword [rbp - 0x51]
call fcn.140063290
mov qword [rbp - 0x39], 7
mov qword [rbp - 0x41], r13
mov word [rbp - 0x51], r13w
cmp qword [rbx + 0x18], 8
jae 0x14001f7f6
mov r8, qword [rbx + 0x10]
inc r8
add r8, r8
mov rdx, rbx
lea rcx, [rbp - 0x51]
call fcn.1400632b0
jmp 0x14001f800
mov rax, qword [rbx]
mov qword [rbp - 0x51], rax
mov qword [rbx], r13
mov rax, qword [rbx + 0x10]
mov qword [rbp - 0x41], rax
mov rax, qword [rbx + 0x18]
mov qword [rbp - 0x39], rax
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r13
mov word [rbx], r13w
cmp qword [rbp + 0x17], 8
jb 0x14001f830
mov rcx, qword [rbp - 1]
call fcn.140063290
mov r9d, 1
mov r8, r14
mov rdx, r15
lea rcx, str.SoftwareClasses.bat
call fcn.14001e130
test eax, eax
je 0x14001f92d
lea rdx, str.___HKLMSoftwareClasses.bat_____was_changed_to
mov rcx, rsi
call fcn.140018560
mov rcx, rax
lea rdx, [rbp - 0x51]
call fcn.1400187c0
mov rcx, rax
lea rdx, [0x140093f34]
call fcn.140018f30
mov rdi, rax
mov ebx, r13d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x14001f8a8
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
mov r14d, 4
cmove ebx, r14d
jmp 0x14001f8ae
mov r14d, 4
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x14001f8d3
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x14001f8cb
or edx, 4
xor r8d, r8d
call fcn.140003090
lea rdx, str.___HKLMSoftwareClasses.bat_____was_reset_to_batfile__r_n_r_n
mov rcx, rsi
call fcn.140018560
mov rdi, rax
mov ebx, r13d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x14001f908
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove ebx, r14d
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x14001f92d
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x14001f925
or edx, 4
xor r8d, r8d
call fcn.140003090
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClasses.batPersistentHandler_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001f9a6
mov edx, 0x1000
lea rbx, str.5e941d80_bf96_11cd_b579_08002b30bfeb
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, r15
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001f9b0
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x79]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareClasses_batfile
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r14, str._SystemRoot_System32NOTEPAD.EXE__1
lea r15, str._SystemRoot_System32NOTEPAD.EXE__p__1
test ebx, ebx
je 0x14001fbdd
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClasses_batfile_shelleditcommand
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001fa6e
mov edx, 0x1000
mov rcx, r14
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r14
mov r9d, 2
xor r8d, r8d
lea rdx, [0x14008db30]
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001fa78
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClasses_batfile_shellopencommand
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001faf5
mov edx, 0x1000
lea rbx, str.__1___
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, [0x14008db30]
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001faff
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClasses_batfile_shellprintcommand
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001fb75
mov edx, 0x1000
mov rcx, r15
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r15
mov r9d, 2
xor r8d, r8d
lea rdx, [0x14008db30]
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001fb7f
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.___HKLMSoftwareClasses.bat_did_not_exist_and_was_recreated__r_n_r_n
mov rcx, rsi
call fcn.140018560
mov rdi, rax
mov ebx, r13d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x14001fbb8
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
mov eax, 4
cmove ebx, eax
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x14001fbdd
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x14001fbd5
or edx, 4
xor r8d, r8d
call fcn.140003090
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x79]
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClasses_batfile
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
cmp dword [r12 + 0x48c], 2
jne 0x14001fc2f
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001fc78
lea rbx, str.Windows_Batch_File
jmp 0x14001fc40
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001fc78
lea rbx, str.MS_DOS_Batch_File
mov edx, 0x1000
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, [0x14008db30]
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001fc82
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp - 0x69], 0x430
mov dword [rbp - 0x5d], 0
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClasses_batfile
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rbp - 0x79]
test eax, eax
jne 0x14001fd08
mov ebx, 4
mov dword [rsp + 0x28], ebx
lea rax, [rbp - 0x69]
mov qword [rsp + 0x20], rax
lea r9d, [rbx - 1]
xor r8d, r8d
lea rdx, str.EditFlags
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001fd13
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14001fd13
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, 4
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClasses_batfile_shellopen
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rbp - 0x79]
test eax, eax
jne 0x14001fd80
mov dword [rsp + 0x28], ebx
lea rax, [rbp - 0x5d]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, str.EditFlags
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001fd86
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9d, 2
mov r8, r14
lea rdx, [0x14008db30]
lea rcx, str.SoftwareClasses_batfile_shelleditcommand
call fcn.14001e130
test eax, eax
je 0x14001fe04
lea rdx, str.___HKLM_batfile_shelleditcommand_____was_changed._r_n____It_was_reset_to___1_____r_n_r_n
mov rcx, rsi
call fcn.140018560
mov rdi, rax
mov ebx, r13d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x14001fddf
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
mov eax, 4
cmove ebx, eax
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x14001fe04
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x14001fdfc
or edx, 4
xor r8d, r8d
call fcn.140003090
mov r9d, 1
lea r14, str.__1___
mov r8, r14
lea rdx, [0x14008db30]
lea rcx, str.SoftwareClasses_batfile_shellopencommand
call fcn.14001e130
test eax, eax
je 0x14001fe89
lea rdx, str.___HKLM_batfile_shellopencommand_____was_changed._r_n____It_was_reset_to___1_____r_n_r_n
mov rcx, rsi
call fcn.140018560
mov rdi, rax
mov ebx, r13d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x14001fe64
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
mov eax, 4
cmove ebx, eax
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x14001fe89
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x14001fe81
or edx, 4
xor r8d, r8d
call fcn.140003090
mov r9d, 2
mov r8, r15
lea rdx, [0x14008db30]
lea rcx, str.SoftwareClasses_batfile_shellprintcommand
call fcn.14001e130
test eax, eax
je 0x14001ff07
lea rdx, str.___HKLM_batfile_shellprintcommand_____was_changed._r_n____It_was_reset_to___1_____r_n_r_n
mov rcx, rsi
call fcn.140018560
mov rdi, rax
mov ebx, r13d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x14001fee2
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
mov eax, 4
cmove ebx, eax
mov rax, qword [rdi]
movsxd rcx, dword [rax + 4]
add rcx, rdi
test ebx, ebx
je 0x14001ff07
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x14001feff
or edx, 4
xor r8d, r8d
call fcn.140003090
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClasses_batfileDefaultIcon
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001ff84
mov edx, 0x1000
lea rbx, str._SystemRoot_System32_shell32.dll__153
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 2
xor r8d, r8d
lea rdx, [0x14008db30]
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14001ff8e
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClasses_batfile_shellexDropHandler
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140020017
mov edx, 0x1000
lea rdi, str.86C86720_42A0_1069_A2E8_08002B30309D
mov rcx, rdi
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rdi
mov r9d, 1
xor r8d, r8d
lea rdx, [0x14008db30]
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140020028
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140020028
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdi, str.86C86720_42A0_1069_A2E8_08002B30309D
mov qword [rsp + 0x40], r13
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClasses_batfile_shellexPropertySheetHandlersShimLayer_Property_Page
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400200a5
mov edx, 0x1000
lea rbx, str.513D916F_2A8E_4F51_AEAB_0CBC76FB1AF8
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, [0x14008db30]
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400200af
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x79]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREClasses.bat
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140020238
mov qword [rbp - 0x41], r13
lea rax, [rbp - 0x51]
cmp qword [rbp - 0x39], 8
cmovae rax, qword [rbp - 0x51]
mov word [rax], r13w
lea r9, [0x14008db30]
lea r8, str.SOFTWAREClasses.bat
mov rdx, 0xffffffff80000001
lea rcx, [rbp - 1]
call fcn.14001e270
nop
mov rdx, rax
lea rcx, [rbp - 0x51]
call fcn.140001540
nop
cmp qword [rbp + 0x17], 8
jb 0x14002013b
mov rcx, qword [rbp - 1]
call fcn.140063290
lea rdx, str.___HKCUSOFTWAREClasses.bat_____exists_and_is_set_to
mov rcx, rsi
call fcn.140018560
mov rcx, rax
lea rdx, [rbp - 0x51]
call fcn.1400187c0
mov rcx, rax
lea rdx, [0x140093f34]
call fcn.140018f30
mov rcx, rax
call fcn.140003410
lea rdx, str.SOFTWAREClasses.bat
mov rcx, 0xffffffff80000001
call fcn.14001dea0
test eax, eax
je 0x14002019b
lea rdx, str.___HKCUSOFTWAREClasses.bat_has_been_deleted__r_n
mov rcx, rsi
call fcn.140018560
mov rcx, rax
call fcn.140003410
mov qword [rbp - 0x11], 7
mov qword [rbp - 0x19], r13
mov word [rbp - 0x29], r13w
mov r8d, 0x11
lea rdx, str.SOFTWAREClasses_
lea rcx, [rbp - 0x29]
call fcn.140001780
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x29]
call fcn.1400158d0
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 8
cmovae rdx, qword [rbp - 0x29]
mov rcx, 0xffffffff80000001
call fcn.14001dea0
test eax, eax
je 0x140020228
lea rdx, str.___HKCUSOFTWAREClasses_
mov rcx, rsi
call fcn.140018560
mov rcx, rax
lea rdx, [rbp - 0x51]
call fcn.1400187c0
mov rcx, rax
lea rdx, str._has_been_deleted__r_n_r_n
call fcn.140018560
mov rcx, rax
call fcn.140003410
nop
cmp qword [rbp - 0x11], 8
jb 0x140020238
mov rcx, qword [rbp - 0x29]
call fcn.140063290
lea rax, [rbp - 0x79]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareClasses.com
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1400202a5
mov r9d, 1
lea r8, str.comfile
lea rdx, [0x14008db30]
lea rcx, str.SoftwareClasses.com
call fcn.14001e390
lea rdx, str.___HKLMSoftwareClasses.com_did_not_exist_and_was_recreated__r_n_r_n
mov rcx, rsi
call fcn.140018560
mov rcx, rax
call fcn.140003410
mov qword [rbp - 0x41], r13
lea rax, [rbp - 0x51]
cmp qword [rbp - 0x39], 8
cmovae rax, qword [rbp - 0x51]
mov word [rax], r13w
lea r9, [0x14008db30]
lea r8, str.SoftwareClasses.com
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 1]
call fcn.14001e270
nop
mov rdx, rax
lea rcx, [rbp - 0x51]
call fcn.140001540
nop
cmp qword [rbp + 0x17], 8
jb 0x1400202f7
mov rcx, qword [rbp - 1]
call fcn.140063290
mov r9d, 1
lea r8, str.comfile
lea rdx, [0x14008db30]
lea rcx, str.SoftwareClasses.com
call fcn.14001e130
test eax, eax
je 0x140020364
lea rdx, str.___HKLMSoftwareClasses.com_____has_been_changed_to
mov rcx, rsi
call fcn.140018560
mov rcx, rax
lea rdx, [rbp - 0x51]
call fcn.1400187c0
mov rcx, rax
lea rdx, [0x140093f34]
call fcn.140018f30
mov rcx, rax
call fcn.140003410
lea rdx, str.___HKLMSoftwareClasses.com____was_reset_to_comfile__r_n_r_n
mov rcx, rsi
call fcn.140018560
mov rcx, rax
call fcn.140003410
mov r9d, 1
lea r8, str.098f2470_bae0_11cd_b579_08002b30bfeb
lea rdx, [0x14008db30]
lea rcx, str.SoftwareClasses.comPersistentHandler_
call fcn.14001e390
lea r11, [rbp - 0x79]
mov qword [rsp + 0x20], r11
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareClassescomfile
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1400203ed
mov r9d, 1
mov r8, r14
lea rdx, [0x14008db30]
lea rcx, str.SoftwareClassescomfile_shellopencommand
call fcn.14001e390
lea rdx, str.___HKLMSoftwareClassescomfile_did_not_exist_and_was_recreated__r_n_r_n
mov rcx, rsi
call fcn.140018560
mov rcx, rax
call fcn.140003410
mov r9d, 1
lea rdx, [0x14008db30]
lea rcx, str.SoftwareClassescomfile
cmp dword [r12 + 0x48c], 2
lea r8, str.Application
je 0x14002041a
lea r8, str.MS_DOS_Application
call fcn.14001e390
mov dword [rbp - 0x61], 0x30
mov dword [rbp - 0x71], 0
lea rdx, [rbp - 0x61]
lea rcx, str.SoftwareClassescomfile
call fcn.14001e500
lea rdx, [rbp - 0x71]
lea rcx, str.SoftwareClassescomfile_shellopen
call fcn.14001e500
mov r9d, 2
lea r8, str._SystemRoot_System32_shell32.dll_2
lea rdx, [0x14008db30]
lea rcx, str.SoftwareClassescomfileDefaultIcon
call fcn.14001e390
mov r9d, 1
mov r8, rdi
lea rdx, [0x14008db30]
lea rcx, str.SoftwareClassescomfile_shellexDropHandler
call fcn.14001e390
mov r9d, 1
mov r8, r14
lea rdx, [0x14008db30]
lea rcx, str.SoftwareClassescomfile_shellopencommand
call fcn.14001e130
test eax, eax
je 0x1400204c0
lea rdx, str.___HKLMSoftwareClassescomfile_shellopencommand_____was_changed._r_n____It_was_reset_to___1_____r_n_r_n
mov rcx, rsi
call fcn.140018560
mov rcx, rax
call fcn.140003410
lea rax, [rbp - 0x79]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREClasses.com
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14002064a
mov qword [rbp - 0x41], r13
lea rax, [rbp - 0x51]
cmp qword [rbp - 0x39], 8
cmovae rax, qword [rbp - 0x51]
mov word [rax], r13w
lea r9, [0x14008db30]
lea r8, str.SOFTWAREClasses.com
mov rdx, 0xffffffff80000001
lea rcx, [rbp - 1]
call fcn.14001e270
nop
mov rdx, rax
lea rcx, [rbp - 0x51]
call fcn.140001540
nop
cmp qword [rbp + 0x17], 8
jb 0x14002054c
mov rcx, qword [rbp - 1]
call fcn.140063290
lea rdx, str.___HKCUSOFTWAREClasses.com_____exists_and_is_set_to
mov rcx, rsi
call fcn.140018560
mov rcx, rax
lea rdx, [rbp - 0x51]
call fcn.1400187c0
mov rcx, rax
lea rdx, [0x140093f34]
call fcn.140018f30
mov rcx, rax
call fcn.140003410
lea rdx, str.SOFTWAREClasses.com
mov rcx, 0xffffffff80000001
call fcn.14001dea0
test eax, eax
je 0x1400205ac
lea rdx, str.___HKCUSOFTWAREClasses.com_has_been_deleted__r_n
mov rcx, rsi
call fcn.140018560
mov rcx, rax
call fcn.140003410
mov qword [rbp - 0x11], 7
mov qword [rbp - 0x19], r13
mov word [rbp - 0x29], r13w
mov r8d, 0x11
lea rdx, str.SOFTWAREClasses_
lea rcx, [rbp - 0x29]
call fcn.140001780
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x29]
call fcn.1400158d0
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 8
cmovae rdx, qword [rbp - 0x29]
mov rcx, 0xffffffff80000001
call fcn.14001dea0
test eax, eax
je 0x140020639
lea rdx, str.___HKCUSOFTWAREClasses_
mov rcx, rsi
call fcn.140018560
mov rcx, rax
lea rdx, [rbp - 0x51]
call fcn.1400187c0
mov rcx, rax
lea rdx, str._has_been_deleted__r_n_r_n
call fcn.140018560
mov rcx, rax
call fcn.140003410
nop
cmp qword [rbp - 0x11], 8
jb 0x14002064a
mov rcx, qword [rbp - 0x29]
call fcn.140063290
nop
cmp qword [rbp - 0x39], 8
jb 0x14002065a
mov rcx, qword [rbp - 0x51]
call fcn.140063290
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140063080
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret