Function at 0x140011e30
Capabilities:
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xb0
movaps xmmword [rsp + 0xa0], xmm7
movaps xmmword [rsp + 0x90], xmm6
mov rax, qword [0x14002f010]
xor rax, rsp
mov qword [rsp + 0x88], rax
lea r14, [rsp + 0x68]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
lea rdx, str.SoftwareClassesApplications
mov rsi, qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, 0xffffffff80000001
xor r8d, r8d
xor r9d, r9d
call rsi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 1
lea rdx, str.SoftwareClassesApplicationscrashreporter.exe
mov rcx, 0xffffffff80000001
xor r8d, r8d
xor r9d, r9d
call rsi
test eax, eax
jne 0x140011f7e
mov rcx, qword [rsp + 0x68]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rdx, str.IsHostApp
mov rsi, qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor r8d, r8d
xor r9d, r9d
call rsi
mov rcx, qword [rsp + 0x68]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rdx, str.NoOpenWith
xor r8d, r8d
xor r9d, r9d
call rsi
mov rcx, qword [rsp + 0x68]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea rdx, str.NoStartPage
xor r8d, r8d
xor r9d, r9d
call rsi
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r15, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
call r15
movsxd rcx, dword [rax]
shl rcx, 3
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
call r15
cmp dword [rax], 0
jg 0x140011fe5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___argc]
mov ecx, dword [rax]
mov rdx, rdi
call fcn.1400081f0
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140027320
xor eax, eax
movaps xmm6, xmmword [rsp + 0x90]
movaps xmm7, xmmword [rsp + 0xa0]
add rsp, 0xb0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
xor esi, esi
mov r12, qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll___p___wargv]
movaps xmm6, xmmword [0x1400281b0]
lea rbx, [rsp + 0x48]
mov r13, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__strdup]
movaps xmm7, xmmword [0x1400281d0]
jmp 0x14001204a
call r13
mov qword [rdi + rsi*8], rax
mov rax, qword [rsp + 0x80]
cmp rax, 0x10
jae 0x140012088
movups xmmword [rsp + 0x78], xmm7
mov byte [rsp + 0x68], 0
mov rcx, rbx
call section..text
add rsi, 1
call r15
movsxd rax, dword [rax]
cmp rsi, rax
jge 0x140011fa0
call r12
mov rax, qword [rax]
mov rdx, qword [rax + rsi*8]
movups xmmword [rsp + 0x58], xmm6
mov word [rsp + 0x48], 0
mov rcx, rbx
call fcn.140001070
mov rcx, r14
mov rdx, rbx
call fcn.1400120d0
cmp qword [rsp + 0x80], 0xf
mov rcx, r14
jbe 0x140012010
mov rcx, qword [rsp + 0x68]
jmp 0x140012010
mov rcx, qword [rsp + 0x68]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jae 0x1400120a1
call fcn.140026280
jmp 0x140012025
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400120be
add rax, 0x28
mov rdx, rax
mov rcx, r8
jmp 0x14001209a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
ud2