Function at 0x56286c
Capabilities:
Delete registry key
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x7d0
mov qword [rsp + 0x1c0], 0xfffffffffffffffe
mov qword [rax + 0x20], rbx
xor r14d, r14d
mov r13b, r14b
mov esi, r14d
lea edi, [r14 + 1]
mov r15d, 0x100
lea rax, [rsp + 0x170]
mov qword [rsp + 0x1b0], rax
lea rax, [rsp + 0x170]
mov qword [rsp + 0x1b8], rax
mov word [rsp + 0x170], r14w
lea rax, [rsp + 0x50]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x98], rax
mov word [rsp + 0x50], r14w
lea rax, [rsp + 0xa0]
mov qword [rsp + 0xe0], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0xe8], rax
mov word [rsp + 0xa0], r14w
mov word [rsp + 0x3d0], r14w
mov bpl, dil
lea rax, str.magnet_shellopencommand
lea r12, str.SoftwareClassesmagnet_shellopencommand
cmp esi, r14d
cmovne r12, rax
mov eax, esi
neg eax
sbb rbx, rbx
add rbx, 0xffffffff80000001
lea rax, [rsp + 0x820]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r14d
jne 0x5629b5
mov dword [rsp + 0x818], 0x800
lea rax, [rsp + 0x818]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x3d0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rsp + rcx*2 + 0x3ce]
lea rdx, [rsp + 0x3d0]
lea rcx, [rsp + 0x170]
call fcn.00406d38
mov word [rsp + 0x3d0], r14w
lea rax, [rsp + 0x820]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMagnet
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r14d
jne 0x562a6c
mov dword [rsp + 0x818], 0x800
lea rax, [rsp + 0x818]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x0079f048]
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x3d0]
repne scasw ax, word [rdi]
not rcx
lea edi, [rax + 1]
sub rcx, rdi
lea r8, [rsp + rcx*2 + 0x3d0]
lea rdx, [rsp + 0x3d0]
lea rcx, [rsp + 0x50]
call fcn.00406d38
mov rdx, qword [rsp + 0x98]
cmp rdx, qword [rsp + 0x90]
je 0x562b51
lea eax, [rdi + 0x21]
cmp word [rdx], ax
jne 0x562b51
mov edx, eax
mov r8, rdi
lea rcx, [rsp + 0x50]
call fcn.00421278
cmp rax, 0xffffffffffffffff
je 0x562b51
lea r9, [rax - 1]
mov r8, rdi
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x50]
call fcn.00421328
nop
lea rcx, [rsp + 0xa0]
cmp rax, rcx
je 0x562b14
mov r8, qword [rax + 0x40]
mov rdx, qword [rax + 0x48]
lea rcx, [rsp + 0xa0]
call fcn.00406d38
nop
lea rax, [rsp + 0x120]
mov rcx, qword [rsp + 0x168]
cmp rcx, rax
je 0x562b51
cmp rcx, r14
je 0x562b51
mov rax, qword [rsp + 0x120]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r15
jbe 0x562b4c
call fcn.006a4944
jmp 0x562b51
call fcn.006a3610
lea rcx, [rsp + 0xa0]
call fcn.00595310
cmp eax, r14d
jne 0x562f1f
lea r8, str.magnet.exe
lea rdx, [0x0085e988]
lea rcx, [rsp + 0xf0]
call fcn.00402658
nop
mov rdx, rax
lea rcx, [rsp + 0x120]
call fcn.00401f00
nop
lea rcx, [rsp + 0xa0]
cmp rax, rcx
je 0x562bb7
mov r8, qword [rax + 0x40]
mov rdx, qword [rax + 0x48]
lea rcx, [rsp + 0xa0]
call fcn.00406d38
nop
lea rax, [rsp + 0x120]
mov rcx, qword [rsp + 0x168]
cmp rcx, rax
je 0x562bf5
cmp rcx, r14
je 0x562bf5
mov rax, qword [rsp + 0x120]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r15
jbe 0x562bef
call fcn.006a4944
jmp 0x562bf5
call fcn.006a3610
nop
lea rax, [rsp + 0xf0]
mov rcx, qword [rsp + 0x118]
cmp rcx, rax
je 0x562c2b
cmp rcx, r14
je 0x562c2b
mov rdx, qword [rsp + 0xf0]
sub rdx, rcx
cmp rdx, r15
jbe 0x562c26
call fcn.006a4944
jmp 0x562c2b
call fcn.006a3610
lea rcx, [rsp + 0xa0]
call fcn.00595310
cmp eax, r14d
jne 0x562cff
lea rcx, [rsp + 0xf0]
call fcn.004d1424
nop
mov rdx, rax
lea rcx, [rsp + 0x120]
call fcn.00401f00
nop
lea rcx, [rsp + 0xa0]
cmp rax, rcx
je 0x562c83
mov r8, qword [rax + 0x40]
mov rdx, qword [rax + 0x48]
lea rcx, [rsp + 0xa0]
call fcn.00406d38
nop
lea rax, [rsp + 0x120]
mov rcx, qword [rsp + 0x168]
cmp rcx, rax
je 0x562cc1
cmp rcx, r14
je 0x562cc1
mov rax, qword [rsp + 0x120]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r15
jbe 0x562cbb
call fcn.006a4944
jmp 0x562cc1
call fcn.006a3610
nop
lea rax, [rsp + 0xf0]
mov rcx, qword [rsp + 0x118]
cmp rcx, rax
je 0x562cf7
cmp rcx, r14
je 0x562cf7
mov rdx, qword [rsp + 0xf0]
sub rdx, rcx
cmp rdx, r15
jbe 0x562cf2
call fcn.006a4944
jmp 0x562cf7
call fcn.006a3610
mov bpl, r14b
jmp 0x562e54
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x820]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREMagnet
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r14d
je 0x562e08
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xe8]
cmp rcx, rax
je 0x562d84
cmp rcx, r14
je 0x562d84
mov rax, qword [rsp + 0xa0]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r15
jbe 0x562d7e
call fcn.006a4944
jmp 0x562d84
call fcn.006a3610
nop
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x98]
cmp rcx, rax
je 0x562dbc
cmp rcx, r14
je 0x562dbc
mov rax, qword [rsp + 0x50]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r15
jbe 0x562db6
call fcn.006a4944
jmp 0x562dbc
call fcn.006a3610
nop
lea rax, [rsp + 0x170]
mov rcx, qword [rsp + 0x1b8]
cmp rcx, rax
je 0x5638b7
cmp rcx, r14
je 0x5638b7
mov rdx, qword [rsp + 0x170]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, r15
jbe 0x562dfe
call fcn.006a4944
jmp 0x5638b7
call fcn.006a3610
jmp 0x5638b7
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xe8]
sub rax, rcx
sar rax, 1
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, edi
xor r8d, r8d
lea rdx, [0x0079f048]
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 0x22
lea r8, [rsp + 0xa0]
lea rcx, [rsp + 0x380]
call fcn.0056abd4
nop
lea r8, str.___magnet
mov rdx, rax
lea rcx, [rsp + 0x2e0]
call fcn.0040fd24
nop
lea rcx, [rsp + 0x50]
cmp rax, rcx
je 0x562ea4
mov r8, qword [rax + 0x40]
mov rdx, qword [rax + 0x48]
lea rcx, [rsp + 0x50]
call fcn.00406d38
nop
lea rax, [rsp + 0x2e0]
mov rcx, qword [rsp + 0x328]
cmp rcx, rax
je 0x562ee2
cmp rcx, r14
je 0x562ee2
mov rax, qword [rsp + 0x2e0]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r15
jbe 0x562edc
call fcn.006a4944
jmp 0x562ee2
call fcn.006a3610
nop
lea rax, [rsp + 0x380]
mov rcx, qword [rsp + 0x3c8]
cmp rcx, rax
je 0x562f1f
cmp rcx, r14
je 0x562f1f
mov rax, qword [rsp + 0x380]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r15
jbe 0x562f1a
call fcn.006a4944
jmp 0x562f1f
call fcn.006a3610
mov rax, qword [0x00862cb8]
cmp byte [rax + 0x314f], r14b
jne 0x562f47
mov rcx, qword [rax + 0xb8]
cmp rcx, r14
je 0x562f47
mov edx, 0x2cf
call fcn.0041024c
jmp 0x562f4d
mov al, byte [rax + 0x2d70]
cmp al, r14b
je 0x563228
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x98]
sub r8, rdx
sar r8, 1
mov rcx, qword [rsp + 0x1b8]
call fcn.006a6b08
cmp eax, r14d
jne 0x562f87
cmp bpl, r14b
jne 0x563228
lea rax, [0x0079f088]
lea rdx, str.SoftwareClassesmagnet
cmp esi, r14d
cmovne rdx, rax
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x820]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, r14d
je 0x56309a
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xe8]
cmp rcx, rax
je 0x563016
cmp rcx, r14
je 0x563016
mov rax, qword [rsp + 0xa0]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r15
jbe 0x563010
call fcn.006a4944
jmp 0x563016
call fcn.006a3610
nop
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x98]
cmp rcx, rax
je 0x56304e
cmp rcx, r14
je 0x56304e
mov rax, qword [rsp + 0x50]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r15
jbe 0x563048
call fcn.006a4944
jmp 0x56304e
call fcn.006a3610
nop
lea rax, [rsp + 0x170]
mov rcx, qword [rsp + 0x1b8]
cmp rcx, rax
je 0x5638b7
cmp rcx, r14
je 0x5638b7
mov rdx, qword [rsp + 0x170]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, r15
jbe 0x563090
call fcn.006a4944
jmp 0x5638b7
call fcn.006a3610
jmp 0x5638b7
mov rax, qword [0x0086dd70]
mov rcx, qword [0x0086dd78]
sub rax, rcx
sar rax, 1
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, edi
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, edi
xor r8d, r8d
lea rdx, str.URL_Protocol
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, str.magnetDefaultIcon
lea rdx, str.SoftwareClassesmagnetDefaultIcon
cmp esi, r14d
cmovne rdx, rax
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x820]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x98]
sub rdx, rcx
sar rdx, 1
lea eax, [rdx + rdx + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, edi
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [0x0079f13e]
lea rdx, [0x0079f138]
lea rcx, [rsp + 0x50]
call fcn.00406b9c
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x820]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x98]
sub rdx, rcx
sar rdx, 1
lea eax, [rdx + rdx + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, edi
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.SOFTWAREMagnetHandlersDC
mov rbp, 0xffffffff80000002
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x820]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREMagnetHandlersDC
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rdx, qword [0x0086dd20]
mov rcx, qword [0x0086dd28]
sub rdx, rcx
sar rdx, 1
lea eax, [rdx + rdx + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, edi
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [0x0088b430]
sub eax, dword [0x0088b438]
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov rax, qword [0x0086dcd8]
mov qword [rsp + 0x20], rax
mov r9d, edi
xor r8d, r8d
lea rdx, [0x0079f180]
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rcx, [rsp + 0x2b0]
call fcn.004d1424
nop
mov r8, rax
lea rdx, [0x00798b68]
lea rcx, [rsp + 0x220]
call fcn.0040fe34
nop
lea r8, str.___magnet__URL
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.00402658
mov rdx, rax
lea rcx, [rsp + 0x1d0]
call fcn.00401f00
nop
lea rax, [rsp + 0xf0]
mov rcx, qword [rsp + 0x118]
cmp rcx, rax
je 0x563370
cmp rcx, r14
je 0x563370
mov rdx, qword [rsp + 0xf0]
sub rdx, rcx
cmp rdx, r15
jbe 0x56336a
call fcn.006a4944
jmp 0x563370
call fcn.006a3610
nop
lea rax, [rsp + 0x220]
mov rcx, qword [rsp + 0x248]
cmp rcx, rax
je 0x5633a7
cmp rcx, r14
je 0x5633a7
mov rdx, qword [rsp + 0x220]
sub rdx, rcx
cmp rdx, r15
jbe 0x5633a1
call fcn.006a4944
jmp 0x5633a7
call fcn.006a3610
nop
lea rax, [rsp + 0x2b0]
mov rcx, qword [rsp + 0x2d8]
cmp rcx, rax
je 0x5633dd
cmp rcx, r14
je 0x5633dd
mov rdx, qword [rsp + 0x2b0]
sub rdx, rcx
cmp rdx, r15
jbe 0x5633d8
call fcn.006a4944
jmp 0x5633dd
call fcn.006a3610
mov rax, qword [rsp + 0x210]
mov rcx, qword [rsp + 0x218]
sub rax, rcx
sar rax, 1
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, edi
xor r8d, r8d
lea rdx, str.ShellExecute
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea rcx, [rsp + 0x120]
call fcn.004d1424
nop
mov r8, rax
mov ebx, 0x22
mov dl, bl
lea rcx, [rsp + 0x250]
call fcn.00420660
nop
mov r8b, bl
mov rdx, rax
lea rcx, [rsp + 0x280]
call fcn.004211f0
nop
mov rdx, rax
lea rcx, [rsp + 0x330]
call fcn.00401f00
nop
lea rcx, [rsp + 0x1d0]
cmp rax, rcx
je 0x563489
mov r8, qword [rax + 0x40]
mov rdx, qword [rax + 0x48]
lea rcx, [rsp + 0x1d0]
call fcn.00406d38
nop
lea rax, [rsp + 0x330]
mov rcx, qword [rsp + 0x378]
cmp rcx, rax
je 0x5634c7
cmp rcx, r14
je 0x5634c7
mov rax, qword [rsp + 0x330]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r15
jbe 0x5634c1
call fcn.006a4944
jmp 0x5634c7
call fcn.006a3610
nop
lea rax, [rsp + 0x280]
mov rcx, qword [rsp + 0x2a8]
cmp rcx, rax
je 0x5634fe
cmp rcx, r14
je 0x5634fe
mov rdx, qword [rsp + 0x280]
sub rdx, rcx
cmp rdx, r15
jbe 0x5634f8
call fcn.006a4944
jmp 0x5634fe
call fcn.006a3610
nop
lea rax, [rsp + 0x250]
mov rcx, qword [rsp + 0x278]
cmp rcx, rax
je 0x563535
cmp rcx, r14
je 0x563535
mov rdx, qword [rsp + 0x250]
sub rdx, rcx
cmp rdx, r15
jbe 0x56352f
call fcn.006a4944
jmp 0x563535
call fcn.006a3610
nop
lea rax, [rsp + 0x120]
mov rcx, qword [rsp + 0x148]
cmp rcx, rax
je 0x56356b
cmp rcx, r14
je 0x56356b
mov rdx, qword [rsp + 0x120]
sub rdx, rcx
cmp rdx, r15
jbe 0x563566
call fcn.006a4944
jmp 0x56356b
call fcn.006a3610
mov rax, qword [rsp + 0x210]
mov rcx, qword [rsp + 0x218]
sub rax, rcx
sar rax, 1
lea eax, [rax + rax + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, edi
xor r8d, r8d
lea rdx, str.DefaultIcon
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x810], r14d
mov qword [rsp + 0x40], r14
lea rax, [rsp + 0x820]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREMagnetHandlersDCType
mov rcx, rbp
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, 4
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x810]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
lea rdx, str.urn:bitprint
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x810]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
lea rdx, str.urn:tigertree
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x810]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
lea rdx, str.urn:tree:tiger
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x810]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
lea rdx, str.urn:tree:tiger_
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x810]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
lea rdx, str.urn:tree:tiger_1024
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x810]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
lea rdx, str.bitprint
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x810]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
lea rdx, str.tigertree
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x810]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
lea rdx, str.tree:tiger
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x810]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
lea rdx, str.tree:tiger_
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x810]
mov qword [rsp + 0x20], rax
mov r9d, ebx
xor r8d, r8d
lea rdx, str.tree:tiger_1024
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x820]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r13b, dil
lea rax, [rsp + 0x1d0]
mov rcx, qword [rsp + 0x218]
cmp rcx, rax
je 0x563805
cmp rcx, r14
je 0x563805
mov rax, qword [rsp + 0x1d0]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r15
jbe 0x5637ff
call fcn.006a4944
jmp 0x563805
call fcn.006a3610
nop
lea rax, [rsp + 0xa0]
mov rcx, qword [rsp + 0xe8]
cmp rcx, rax
je 0x563843
cmp rcx, r14
je 0x563843
mov rax, qword [rsp + 0xa0]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r15
jbe 0x56383d
call fcn.006a4944
jmp 0x563843
call fcn.006a3610
nop
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x98]
cmp rcx, rax
je 0x56387b
cmp rcx, r14
je 0x56387b
mov rax, qword [rsp + 0x50]
sub rax, rcx
sar rax, 1
lea rdx, [rax + rax]
cmp rdx, r15
jbe 0x563875
call fcn.006a4944
jmp 0x56387b
call fcn.006a3610
nop
lea rax, [rsp + 0x170]
mov rcx, qword [rsp + 0x1b8]
cmp rcx, rax
je 0x5638b7
cmp rcx, r14
je 0x5638b7
mov rdx, qword [rsp + 0x170]
sub rdx, rcx
sar rdx, 1
add rdx, rdx
cmp rdx, r15
jbe 0x5638b2
call fcn.006a4944
jmp 0x5638b7
call fcn.006a3610
add esi, edi
cmp esi, 2
jl 0x5628a4
cmp r13b, r14b
jne 0x5638dd
xor r8d, r8d
lea rdx, [0x00889760]
mov rcx, qword [0x00862cd0]
call fcn.00415954
mov rbx, qword [rsp + 0x828]
add rsp, 0x7d0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret