Function at 0x1400225f0
Capabilities:
Persist via contextmenuhandlers registry key
Persist via default file association registry key
Persist via filter handlers registry key
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov qword [rbp - 0x59], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400c0140]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rdi, rcx
mov qword [rbp - 0x39], 7
xor r12d, r12d
mov qword [rbp - 0x41], r12
mov word [rbp - 0x51], r12w
lea rax, [rbp - 0x79]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareClasses.exe
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r14, str.exefile
lea r13, [0x14008db30]
lea r15d, [r12 + 4]
test ebx, ebx
je 0x140022762
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClasses.exe
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400226fe
mov edx, 0x1000
mov rcx, r14
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r14
lea r9d, [r12 + 1]
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140022708
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.___HKLMSoftwareClasses.exe_did_not_exist_and_was_recreated__r_n_r_n
mov rcx, rdi
call fcn.140018560
mov rsi, rax
mov ebx, r12d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x14002273d
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove ebx, r15d
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test ebx, ebx
je 0x140022762
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x14002275a
or edx, r15d
xor r8d, r8d
call fcn.140003090
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClasses.exePersistentHandler
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea rbx, str.098f2470_bae0_11cd_b579_08002b30bfeb
test eax, eax
jne 0x1400227db
mov edx, 0x1000
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400227e5
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClasses.exe
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140022862
mov edx, 0x1000
lea rbx, str.application_x_msdownload
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.Content_Type
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14002286c
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9, r13
lea r8, str.SoftwareClasses.exe
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 0x29]
call fcn.14001e270
mov rbx, rax
lea rax, [rbp - 0x51]
cmp rax, rbx
je 0x1400228fc
cmp qword [rbp - 0x39], 8
jb 0x1400228a2
mov rcx, qword [rbp - 0x51]
call fcn.140063290
mov qword [rbp - 0x39], 7
mov qword [rbp - 0x41], r12
mov word [rbp - 0x51], r12w
cmp qword [rbx + 0x18], 8
jae 0x1400228d2
mov r8, qword [rbx + 0x10]
inc r8
add r8, r8
mov rdx, rbx
lea rcx, [rbp - 0x51]
call fcn.1400632b0
jmp 0x1400228dc
mov rax, qword [rbx]
mov qword [rbp - 0x51], rax
mov qword [rbx], r12
mov rax, qword [rbx + 0x10]
mov qword [rbp - 0x41], rax
mov rax, qword [rbx + 0x18]
mov qword [rbp - 0x39], rax
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r12
mov word [rbx], r12w
cmp qword [rbp - 0x11], 8
jb 0x14002290c
mov rcx, qword [rbp - 0x29]
call fcn.140063290
mov r9d, 1
mov r8, r14
mov rdx, r13
lea rcx, str.SoftwareClasses.exe
call fcn.14001e130
test eax, eax
je 0x1400229fb
lea rdx, str.___HKLMSoftwareClasses.exe_____has_been_changed_to
mov rcx, rdi
call fcn.140018560
mov rcx, rax
lea rdx, [rbp - 0x51]
call fcn.1400187c0
mov rcx, rax
lea rdx, [0x140093f34]
call fcn.140018f30
mov rsi, rax
mov ebx, r12d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x14002297c
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove ebx, r15d
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test ebx, ebx
je 0x1400229a1
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x140022999
or edx, 4
xor r8d, r8d
call fcn.140003090
lea rdx, str.___HKLMSoftwareClasses.exe_____was_reset_to_exefile__r_n_r_n
mov rcx, rdi
call fcn.140018560
mov rsi, rax
mov ebx, r12d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x1400229d6
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove ebx, r15d
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test ebx, ebx
je 0x1400229fb
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x1400229f3
or edx, 4
xor r8d, r8d
call fcn.140003090
lea rdx, str.SoftwareClasses.exe_shell
mov rcx, 0xffffffff80000002
call fcn.14001dea0
test eax, eax
je 0x140022a6c
lea rdx, str.___HKLMSoftwareClasses.exe_shell_found_and_deleted__r_n_r_n
mov rcx, rdi
call fcn.140018560
mov rsi, rax
mov ebx, r12d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x140022a47
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove ebx, r15d
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test ebx, ebx
je 0x140022a6c
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x140022a64
or edx, 4
xor r8d, r8d
call fcn.140003090
lea rdx, str.SoftwareClasses.exeDefaultIcon
mov rcx, 0xffffffff80000002
call fcn.14001dea0
test eax, eax
je 0x140022add
lea rdx, str.___HKLMSoftwareClasses.exeDefaultIcon_found_and_deleted__r_n_r_n
mov rcx, rdi
call fcn.140018560
mov rsi, rax
mov ebx, r12d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x140022ab8
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove ebx, r15d
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test ebx, ebx
je 0x140022add
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x140022ad5
or edx, 4
xor r8d, r8d
call fcn.140003090
lea rax, [rbp - 0x79]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r14, str.__1___
test ebx, ebx
je 0x140022d70
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile_shellopencommand
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140022b90
mov edx, 0x1000
mov rcx, r14
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r14
mov r9d, 1
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140022b9a
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile_shellopencommand
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140022c10
mov edx, 0x1000
mov rcx, r14
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r14
mov r9d, 1
xor r8d, r8d
lea rdx, str.IsolatedCommand
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140022c1a
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile_shell_runascommand
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140022c8c
mov edx, 0x1000
mov rcx, r14
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r14
mov r9d, 1
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140022c96
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile_shell_runascommand
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140022d0c
mov edx, 0x1000
mov rcx, r14
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r14
mov r9d, 1
xor r8d, r8d
lea rdx, str.IsolatedCommand
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140022d16
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.___HKLMSoftwareClassesexefile_did_not_exist_and_was_recreated__r_n_r_n
mov rcx, rdi
call fcn.140018560
mov rsi, rax
mov ebx, r12d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x140022d4b
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove ebx, r15d
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test ebx, ebx
je 0x140022d70
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x140022d68
or edx, 4
xor r8d, r8d
call fcn.140003090
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140022de9
mov edx, 0x1000
lea rbx, str.Application
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140022df3
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp - 0x69], 0x738
mov dword [rbp - 0x6d], 0
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rbp - 0x79]
test eax, eax
jne 0x140022e6f
mov dword [rsp + 0x28], r15d
lea rax, [rbp - 0x69]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, str.EditFlags
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140022e75
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile_shellopen
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rbp - 0x79]
test eax, eax
jne 0x140022ee3
mov dword [rsp + 0x28], r15d
lea rax, [rbp - 0x6d]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
lea rdx, str.EditFlags
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140022ee9
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140022f66
mov edx, 0x1000
lea rbx, str.__SystemRoot_System32_shell32.dll__10156
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 2
xor r8d, r8d
lea rdx, str.FriendlyTypeName
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140022f70
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefileDefaultIcon
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140022fe9
mov edx, 0x1000
lea rbx, [0x1400943d8]
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140022ff3
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile_shell_runas
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140023069
mov edx, 0x1000
mov rcx, r13
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r13
mov r9d, 1
xor r8d, r8d
lea rdx, str.HasLUAShield
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140023073
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile_shell_runasusercommand
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea rbx, str.ea72d00e_4960_42fa_ba92_7792a7944c1d
test eax, eax
jne 0x1400230f0
mov edx, 0x1000
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.DelegateExecute
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400230fa
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile_shell_runasuser
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea rbx, str._shell32.dll__50944
test eax, eax
jne 0x140023173
mov edx, 0x1000
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14002317d
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile_shell_runasuser
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400231f3
mov edx, 0x1000
mov rcx, r13
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r13
mov r9d, 1
xor r8d, r8d
lea rdx, str.Extended
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400231fd
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile_shell_runasuser
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea rbx, str.F211AA05_D4DF_4370_A2A0_9F19C09756A7
test eax, eax
jne 0x14002327a
mov edx, 0x1000
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
lea rdx, str.SuppressionPolicyEx
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140023284
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile_shellexContextMenuHandlers
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea rbx, str.Compatibility
test eax, eax
jne 0x1400232fd
mov edx, 0x1000
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140023307
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile_shellexContextMenuHandlersCompatibility
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea rbx, str.1d27f844_3a1f_4410_85ac_14651078412d
test eax, eax
jne 0x140023380
mov edx, 0x1000
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14002338a
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile_shellexDropHandler
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea rbx, str.86C86720_42A0_1069_A2E8_08002B30309D
test eax, eax
jne 0x140023403
mov edx, 0x1000
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x14002340d
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClassesexefile_shellexPropertySheetHandlersShimLayer_Property_Page
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
lea rbx, str.513D916F_2A8E_4F51_AEAB_0CBC76FB1AF8
test eax, eax
jne 0x140023486
mov edx, 0x1000
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140023490
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r9d, 1
mov r8, r14
mov rdx, r13
lea rcx, str.SoftwareClassesexefile_shellopencommand
call fcn.14001e130
test eax, eax
je 0x140023506
lea rdx, str.___HKLMSoftwareClassesexefile_shellopencommand_____was_changed._It_was_reset_to___1_____r_n_r_n
mov rcx, rdi
call fcn.140018560
mov rsi, rax
mov ebx, r12d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x1400234e1
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove ebx, r15d
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test ebx, ebx
je 0x140023506
or ebx, dword [rcx + 0x10]
cmp qword [rcx + 0x48], 0
jne 0x1400234fc
or ebx, 4
xor r8d, r8d
mov edx, ebx
call fcn.140003090
mov r9d, 1
mov r8, r14
lea rdx, str.IsolatedCommand
lea rcx, str.SoftwareClassesexefile_shellopencommand
call fcn.14001e130
test eax, eax
je 0x140023580
lea rdx, str.___HKLMSoftwareClassesexefile_shellopencommandIsolatedCommand_was_changed._It_was_reset_to___1_____r_n_r_n
mov rcx, rdi
call fcn.140018560
mov rsi, rax
mov ebx, r12d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x14002355b
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove ebx, r15d
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test ebx, ebx
je 0x140023580
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x140023578
or edx, 4
xor r8d, r8d
call fcn.140003090
mov r9d, 1
mov r8, r14
mov rdx, r13
lea rcx, str.SoftwareClassesexefile_shell_runascommand
call fcn.14001e130
test eax, eax
je 0x1400235f6
lea rdx, str.___HKLMSoftwareClassesexefile_shell_runascommand_____was_changed._It_was_reset_to___1_____r_n_r_n
mov rcx, rdi
call fcn.140018560
mov rsi, rax
mov ebx, r12d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x1400235d1
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove ebx, r15d
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test ebx, ebx
je 0x1400235f6
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x1400235ee
or edx, 4
xor r8d, r8d
call fcn.140003090
mov r9d, 1
mov r8, r14
lea rdx, str.IsolatedCommand
lea rcx, str.SoftwareClassesexefile_shell_runascommand
call fcn.14001e130
test eax, eax
je 0x140023670
lea rdx, str.___HKLMSoftwareClassesexefile_shell_runascommandIsolatedCommand_was_changed._It_was_reset_to___1_____r_n_r_n
mov rcx, rdi
call fcn.140018560
mov rsi, rax
mov ebx, r12d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x14002364b
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove ebx, r15d
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test ebx, ebx
je 0x140023670
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x140023668
or edx, 4
xor r8d, r8d
call fcn.140003090
lea rax, [rbp - 0x79]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREClasses.exe
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140023926
mov qword [rbp - 0x41], r12
lea rax, [rbp - 0x51]
cmp qword [rbp - 0x39], 8
cmovae rax, qword [rbp - 0x51]
mov word [rax], r12w
mov r9, r13
lea r8, str.SOFTWAREClasses.exe
mov rdx, 0xffffffff80000001
lea rcx, [rbp - 1]
call fcn.14001e270
mov rbx, rax
lea rax, [rbp - 0x51]
cmp rax, rbx
je 0x140023750
cmp qword [rbp - 0x39], 8
jb 0x1400236f6
mov rcx, qword [rbp - 0x51]
call fcn.140063290
mov qword [rbp - 0x39], 7
mov qword [rbp - 0x41], r12
mov word [rbp - 0x51], r12w
cmp qword [rbx + 0x18], 8
jae 0x140023726
mov r8, qword [rbx + 0x10]
inc r8
add r8, r8
mov rdx, rbx
lea rcx, [rbp - 0x51]
call fcn.1400632b0
jmp 0x140023730
mov rax, qword [rbx]
mov qword [rbp - 0x51], rax
mov qword [rbx], r12
mov rax, qword [rbx + 0x10]
mov qword [rbp - 0x41], rax
mov rax, qword [rbx + 0x18]
mov qword [rbp - 0x39], rax
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r12
mov word [rbx], r12w
cmp qword [rbp + 0x17], 8
jb 0x140023760
mov rcx, qword [rbp - 1]
call fcn.140063290
lea rdx, str.___HKCUSOFTWAREClasses.exe_____exists_and_is_set_to
mov rcx, rdi
call fcn.140018560
mov rcx, rax
lea rdx, [rbp - 0x51]
call fcn.1400187c0
mov rcx, rax
lea rdx, [0x140093f34]
call fcn.140018f30
mov rsi, rax
mov ebx, r12d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x1400237b0
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove ebx, r15d
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test ebx, ebx
je 0x1400237d5
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x1400237cd
or edx, 4
xor r8d, r8d
call fcn.140003090
lea rdx, str.SOFTWAREClasses.exe
mov rcx, 0xffffffff80000001
call fcn.14001dea0
test eax, eax
je 0x140023846
lea rdx, str.___HKCUSOFTWAREClasses.exe_has_been_deleted__r_n
mov rcx, rdi
call fcn.140018560
mov rsi, rax
mov ebx, r12d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x140023821
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove ebx, r15d
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test ebx, ebx
je 0x140023846
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x14002383e
or edx, 4
xor r8d, r8d
call fcn.140003090
mov qword [rbp - 0x11], 7
mov qword [rbp - 0x19], r12
mov word [rbp - 0x29], r12w
mov r8d, 0x11
lea rdx, str.SOFTWAREClasses_
lea rcx, [rbp - 0x29]
call fcn.140001780
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x29]
call fcn.1400158d0
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 8
cmovae rdx, qword [rbp - 0x29]
mov rcx, 0xffffffff80000001
call fcn.14001dea0
test eax, eax
je 0x140023916
lea rdx, str.___HKCUSOFTWAREClasses_
mov rcx, rdi
call fcn.140018560
mov rcx, rax
lea rdx, [rbp - 0x51]
call fcn.1400187c0
mov rcx, rax
lea rdx, str._has_been_deleted__r_n_r_n
call fcn.140018560
mov rsi, rax
mov ebx, r12d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x1400238f0
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove ebx, r15d
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test ebx, ebx
je 0x140023916
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x14002390d
or edx, 4
xor r8d, r8d
call fcn.140003090
nop
cmp qword [rbp - 0x11], 8
jb 0x140023926
mov rcx, qword [rbp - 0x29]
call fcn.140063290
lea rax, [rbp - 0x79]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareClasses.bat
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r14, str.batfile
test ebx, ebx
je 0x140023a3d
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClasses.bat
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400239d9
mov edx, 0x1000
mov rcx, r14
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r14
mov r9d, 1
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400239e3
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.___HKLMSoftwareClasses.bat_did_not_exist_and_was_recreated__r_n_r_n
mov rcx, rdi
call fcn.140018560
mov rsi, rax
mov ebx, r12d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x140023a18
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove ebx, r15d
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test ebx, ebx
je 0x140023a3d
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x140023a35
or edx, 4
xor r8d, r8d
call fcn.140003090
mov qword [rbp - 0x41], r12
lea rax, [rbp - 0x51]
cmp qword [rbp - 0x39], 8
cmovae rax, qword [rbp - 0x51]
mov word [rax], r12w
mov r9, r13
lea r8, str.SoftwareClasses.bat
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 1]
call fcn.14001e270
mov rbx, rax
lea rax, [rbp - 0x51]
cmp rax, rbx
je 0x140023ae3
cmp qword [rbp - 0x39], 8
jb 0x140023a89
mov rcx, qword [rbp - 0x51]
call fcn.140063290
mov qword [rbp - 0x39], 7
mov qword [rbp - 0x41], r12
mov word [rbp - 0x51], r12w
cmp qword [rbx + 0x18], 8
jae 0x140023ab9
mov r8, qword [rbx + 0x10]
inc r8
add r8, r8
mov rdx, rbx
lea rcx, [rbp - 0x51]
call fcn.1400632b0
jmp 0x140023ac3
mov rax, qword [rbx]
mov qword [rbp - 0x51], rax
mov qword [rbx], r12
mov rax, qword [rbx + 0x10]
mov qword [rbp - 0x41], rax
mov rax, qword [rbx + 0x18]
mov qword [rbp - 0x39], rax
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r12
mov word [rbx], r12w
cmp qword [rbp + 0x17], 8
jb 0x140023af3
mov rcx, qword [rbp - 1]
call fcn.140063290
mov r9d, 1
mov r8, r14
mov rdx, r13
lea rcx, str.SoftwareClasses.bat
call fcn.14001e130
test eax, eax
je 0x140023be2
lea rdx, str.___HKLMSoftwareClasses.bat_____was_changed_to
mov rcx, rdi
call fcn.140018560
mov rcx, rax
lea rdx, [rbp - 0x51]
call fcn.1400187c0
mov rcx, rax
lea rdx, [0x140093f34]
call fcn.140018f30
mov rsi, rax
mov ebx, r12d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x140023b63
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove ebx, r15d
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test ebx, ebx
je 0x140023b88
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x140023b80
or edx, 4
xor r8d, r8d
call fcn.140003090
lea rdx, str.___HKLMSoftwareClasses.bat_____was_reset_to_batfile__r_n_r_n
mov rcx, rdi
call fcn.140018560
mov rsi, rax
mov ebx, r12d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x140023bbd
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove ebx, r15d
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test ebx, ebx
je 0x140023be2
mov edx, dword [rcx + 0x10]
or edx, ebx
cmp qword [rcx + 0x48], 0
jne 0x140023bda
or edx, 4
xor r8d, r8d
call fcn.140003090
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClasses.batPersistentHandler_
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140023c5b
mov edx, 0x1000
lea rbx, str.5e941d80_bf96_11cd_b579_08002b30bfeb
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140023c65
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x79]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareClasses_batfile
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r14, str._SystemRoot_System32NOTEPAD.EXE__1
lea rsi, str._SystemRoot_System32NOTEPAD.EXE__p__1
test ebx, ebx
je 0x140023f0c
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClasses_batfile_shelleditcommand
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140023d1f
mov edx, 0x1000
mov rcx, r14
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r14
mov r9d, 2
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140023d29
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClasses_batfile_shellopencommand
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140023da2
mov edx, 0x1000
lea rbx, str.__1___
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140023dac
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClasses_batfile_shellprintcommand
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140023e1e
mov edx, 0x1000
mov rcx, rsi
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rsi
mov r9d, 2
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140023e28
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClasses_batfile_shell_runascommand
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140023ea1
mov edx, 0x1000
lea rbx, str._SystemRoot_System32cmd.exe__C___1___
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 2
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140023eab
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.___HKLMSoftwareClasses.bat_did_not_exist_and_was_recreated__r_n_r_n
mov rcx, rdi
call fcn.140018560
mov rsi, rax
mov ebx, r12d
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
test byte [rcx + rax + 0x10], 6
jne 0x140023ee0
mov rcx, qword [rcx + rax + 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x68]
cmp eax, 0xffffffff
cmove ebx, r15d
mov rax, qword [rsi]
movsxd rcx, dword [rax + 4]
add rcx, rsi
test ebx, ebx
je 0x140023f05
or ebx, dword [rcx + 0x10]
cmp qword [rcx + 0x48], 0
jne 0x140023efb
or ebx, 4
xor r8d, r8d
mov edx, ebx
call fcn.140003090
lea rsi, str._SystemRoot_System32NOTEPAD.EXE__p__1
mov qword [rsp + 0x40], r12
lea rax, [rbp - 0x79]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareClasses_batfile
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140023f85
mov edx, 0x1000
lea rbx, str.Windows_Batch_File
mov rcx, rbx
call fcn.140066080
lea ecx, [rax + rax + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov r9d, 1
xor r8d, r8d
mov rdx, r13
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140023f8f
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp - 0x61], 0x430
mov dword [rbp - 0x65], 0
lea rdx, [rbp - 0x61]
lea rcx, str.SoftwareClasses_batfile
call fcn.14001e500
lea rdx, [rbp - 0x65]
lea rcx, str.SoftwareClasses_batfile_shellopen
call fcn.14001e500
mov r9d, 2
lea r8, str.__SystemRoot_System32_acppage.dll__6002
lea rdx, str.FriendlyTypeName
lea rcx, str.SoftwareClasses_batfile
call fcn.14001e390
mov r9d, 2
mov r8, r14
mov rdx, r13
lea rcx, str.SoftwareClasses_batfile_shelleditcommand
call fcn.14001e130
test eax, eax
je 0x140024010
lea rdx, str.___HKLM_batfile_shelleditcommand_____was_changed._r_n____It_was_reset_to___1_____r_n_r_n
mov rcx, rdi
call fcn.140018560
mov rcx, rax
call fcn.140003410
mov r9d, 1
lea r14, str.__1___
mov r8, r14
mov rdx, r13
lea rcx, str.SoftwareClasses_batfile_shellopencommand
call fcn.14001e130
test eax, eax
je 0x14002404a
lea rdx, str.___HKLM_batfile_shellopencommand_____was_changed._r_n____It_was_reset_to___1_____r_n_r_n
mov rcx, rdi
call fcn.140018560
mov rcx, rax
call fcn.140003410
mov r9d, 2
mov r8, rsi
mov rdx, r13
lea rcx, str.SoftwareClasses_batfile_shellprintcommand
call fcn.14001e130
test eax, eax
je 0x14002407d
lea rdx, str.___HKLM_batfile_shellprintcommand_____was_changed._r_n____It_was_reset_to___1_____r_n_r_n
mov rcx, rdi
call fcn.140018560
mov rcx, rax
call fcn.140003410
mov r9d, 2
lea r8, str._SystemRoot_System32cmd.exe__C___1___
mov rdx, r13
lea rcx, str.SoftwareClasses_batfile_shell_runascommand
call fcn.14001e130
test eax, eax
je 0x1400240b4
lea rdx, str.___HKLM_batfile_shellprintcommand_____was_changed._r_n____It_was_reset_to___1_____r_n_r_n
mov rcx, rdi
call fcn.140018560
mov rcx, rax
call fcn.140003410
mov r9d, 2
lea r8, str._SystemRoot_System32imageres.dll__68
mov rdx, r13
lea rcx, str.SoftwareClasses_batfileDefaultIcon
call fcn.14001e390
mov r9d, 1
mov r8, r13
lea rdx, str.HasLUAShield
lea rcx, str.SoftwareClasses_batfile_shell_runas
call fcn.14001e390
mov r9d, 1
lea r8, str.ea72d00e_4960_42fa_ba92_7792a7944c1d
lea rdx, str.DelegateExecute
lea rcx, str.SoftwareClasses_batfile_shell_runasusercommand
call fcn.14001e390
mov r9d, 1
lea r8, str._shell32.dll__50944
mov rdx, r13
lea rcx, str.SoftwareClasses_batfile_shell_runasuser
call fcn.14001e390
mov r9d, 1
mov r8, r13
lea rdx, str.Extended
lea rcx, str.SoftwareClasses_batfile_shell_runasuser
call fcn.14001e390
mov r9d, 1
lea r8, str.F211AA05_D4DF_4370_A2A0_9F19C09756A7
lea rdx, str.SuppressionPolicyEx
lea rcx, str.SoftwareClasses_batfile_shell_runasuser
call fcn.14001e390
mov r9d, 1
lea r8, str.1531d583_8375_4d3f_b5fb_d23bbd169f22
mov rdx, r13
lea rcx, str.SoftwareClasses_batfile_shellex8895b1c6_b41f_4c1c_a562_0d564250836f
call fcn.14001e390
mov r9d, 1
lea r8, str.Compatibility
mov rdx, r13
lea rcx, str.SoftwareClasses_batfile_shellexContextMenuHandlers
call fcn.14001e390
mov r9d, 1
lea r8, str.1d27f844_3a1f_4410_85ac_14651078412d
mov rdx, r13
lea rcx, str.SoftwareClasses_batfile_shellexContextMenuHandlersCompatibility
call fcn.14001e390
mov r9d, 1
lea r8, str.86C86720_42A0_1069_A2E8_08002B30309D
mov rdx, r13
lea rcx, str.SoftwareClasses_batfile_shellexDropHandler
call fcn.14001e390
mov r9d, 1
lea r8, str.513D916F_2A8E_4F51_AEAB_0CBC76FB1AF8
mov rdx, r13
lea rcx, str.SoftwareClasses_batfile_shellexPropertySheetHandlersShimLayer_Property_Page
call fcn.14001e390
lea r11, [rbp - 0x79]
mov qword [rsp + 0x20], r11
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREClasses.bat
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140024375
mov qword [rbp - 0x41], r12
lea rax, [rbp - 0x51]
cmp qword [rbp - 0x39], 8
cmovae rax, qword [rbp - 0x51]
mov word [rax], r12w
mov r9, r13
lea r8, str.SOFTWAREClasses.bat
mov rdx, 0xffffffff80000001
lea rcx, [rbp - 1]
call fcn.14001e270
nop
mov rdx, rax
lea rcx, [rbp - 0x51]
call fcn.140001540
nop
cmp qword [rbp + 0x17], 8
jb 0x140024278
mov rcx, qword [rbp - 1]
call fcn.140063290
lea rdx, str.___HKCUSOFTWAREClasses.bat_____exists_and_is_set_to
mov rcx, rdi
call fcn.140018560
mov rcx, rax
lea rdx, [rbp - 0x51]
call fcn.1400187c0
mov rcx, rax
lea rdx, [0x140093f34]
call fcn.140018f30
mov rcx, rax
call fcn.140003410
lea rdx, str.SOFTWAREClasses.bat
mov rcx, 0xffffffff80000001
call fcn.14001dea0
test eax, eax
je 0x1400242d8
lea rdx, str.___HKCUSOFTWAREClasses.bat_has_been_deleted__r_n
mov rcx, rdi
call fcn.140018560
mov rcx, rax
call fcn.140003410
mov qword [rbp - 0x11], 7
mov qword [rbp - 0x19], r12
mov word [rbp - 0x29], r12w
mov r8d, 0x11
lea rdx, str.SOFTWAREClasses_
lea rcx, [rbp - 0x29]
call fcn.140001780
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x29]
call fcn.1400158d0
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 8
cmovae rdx, qword [rbp - 0x29]
mov rcx, 0xffffffff80000001
call fcn.14001dea0
test eax, eax
je 0x140024365
lea rdx, str.___HKCUSOFTWAREClasses_
mov rcx, rdi
call fcn.140018560
mov rcx, rax
lea rdx, [rbp - 0x51]
call fcn.1400187c0
mov rcx, rax
lea rdx, str._has_been_deleted__r_n_r_n
call fcn.140018560
mov rcx, rax
call fcn.140003410
nop
cmp qword [rbp - 0x11], 8
jb 0x140024375
mov rcx, qword [rbp - 0x29]
call fcn.140063290
lea rax, [rbp - 0x79]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareClasses.com
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x1400243de
mov r9d, 1
lea r8, str.comfile
mov rdx, r13
lea rcx, str.SoftwareClasses.com
call fcn.14001e390
lea rdx, str.___HKLMSoftwareClasses.com_did_not_exist_and_was_recreated__r_n_r_n
mov rcx, rdi
call fcn.140018560
mov rcx, rax
call fcn.140003410
mov qword [rbp - 0x41], r12
lea rax, [rbp - 0x51]
cmp qword [rbp - 0x39], 8
cmovae rax, qword [rbp - 0x51]
mov word [rax], r12w
mov r9, r13
lea r8, str.SoftwareClasses.com
mov rdx, 0xffffffff80000002
lea rcx, [rbp - 1]
call fcn.14001e270
nop
mov rdx, rax
lea rcx, [rbp - 0x51]
call fcn.140001540
nop
cmp qword [rbp + 0x17], 8
jb 0x14002442c
mov rcx, qword [rbp - 1]
call fcn.140063290
mov r9d, 1
lea r8, str.comfile
mov rdx, r13
lea rcx, str.SoftwareClasses.com
call fcn.14001e130
test eax, eax
je 0x140024495
lea rdx, str.___HKLMSoftwareClasses.com_____has_been_changed_to
mov rcx, rdi
call fcn.140018560
mov rcx, rax
lea rdx, [rbp - 0x51]
call fcn.1400187c0
mov rcx, rax
lea rdx, [0x140093f34]
call fcn.140018f30
mov rcx, rax
call fcn.140003410
lea rdx, str.___HKLMSoftwareClasses.com_____was_reset_to_comfile__r_n_r_n
mov rcx, rdi
call fcn.140018560
mov rcx, rax
call fcn.140003410
mov r9d, 1
lea r8, str.098f2470_bae0_11cd_b579_08002b30bfeb
mov rdx, r13
lea rcx, str.SoftwareClasses.comPersistentHandler_
call fcn.14001e390
lea r11, [rbp - 0x79]
mov qword [rsp + 0x20], r11
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareClassescomfile
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x140024516
mov r9d, 1
mov r8, r14
mov rdx, r13
lea rcx, str.SoftwareClassescomfile_shellopencommand
call fcn.14001e390
lea rdx, str.___HKLMSoftwareClassescomfile_did_not_exist_and_was_recreated__r_n_r_n
mov rcx, rdi
call fcn.140018560
mov rcx, rax
call fcn.140003410
mov r9d, 1
lea r8, str.MS_DOS_Application
mov rdx, r13
lea rcx, str.SoftwareClassescomfile
call fcn.14001e390
mov dword [rbp - 0x71], 0x30
lea rdx, [rbp - 0x71]
lea rcx, str.SoftwareClassescomfile
call fcn.14001e500
lea r8, str.EditFlags
lea rdx, str.SoftwareClassescomfile_shellopen
mov rcx, 0xffffffff80000002
call fcn.14001e460
mov r9d, 2
lea r8, str.__SystemRoot_System32_shell32.dll__8464
lea rdx, str.FriendlyTypeName
lea rcx, str.SoftwareClassescomfile
call fcn.14001e390
mov r9d, 2
lea r8, str._SystemRoot_System32_shell32.dll_2
mov rdx, r13
lea rcx, str.SoftwareClassescomfileDefaultIcon
call fcn.14001e390
mov r9d, 1
lea r8, str.86C86720_42A0_1069_A2E8_08002B30309D
mov rdx, r13
lea rcx, str.SoftwareClassescomfile_shellexDropHandler
call fcn.14001e390
mov r9d, 1
mov r8, r14
mov rdx, r13
lea rcx, str.SoftwareClassescomfile_shellopencommand
call fcn.14001e130
test eax, eax
je 0x1400245ee
lea rdx, str.___HKLMSoftwareClassescomfile_shellopencommand_____was_changed._r_n____It_was_reset_to___1_____r_n_r_n
mov rcx, rdi
call fcn.140018560
mov rcx, rax
call fcn.140003410
lea rax, [rbp - 0x79]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREClasses.com
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
mov rcx, qword [rbp - 0x79]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140024774
mov qword [rbp - 0x41], r12
lea rax, [rbp - 0x51]
cmp qword [rbp - 0x39], 8
cmovae rax, qword [rbp - 0x51]
mov word [rax], r12w
mov r9, r13
lea r8, str.SOFTWAREClasses.com
mov rdx, 0xffffffff80000001
lea rcx, [rbp - 1]
call fcn.14001e270
nop
mov rdx, rax
lea rcx, [rbp - 0x51]
call fcn.140001540
nop
cmp qword [rbp + 0x17], 8
jb 0x140024676
mov rcx, qword [rbp - 1]
call fcn.140063290
lea rdx, str.___HKCUSOFTWAREClasses.com_____exists_and_is_set_to
mov rcx, rdi
call fcn.140018560
mov rcx, rax
lea rdx, [rbp - 0x51]
call fcn.1400187c0
mov rcx, rax
lea rdx, [0x140093f34]
call fcn.140018f30
mov rcx, rax
call fcn.140003410
lea rdx, str.SOFTWAREClasses.com
mov rcx, 0xffffffff80000001
call fcn.14001dea0
test eax, eax
je 0x1400246d6
lea rdx, str.___HKCUSOFTWAREClasses.com_has_been_deleted__r_n
mov rcx, rdi
call fcn.140018560
mov rcx, rax
call fcn.140003410
mov qword [rbp - 0x11], 7
mov qword [rbp - 0x19], r12
mov word [rbp - 0x29], r12w
mov r8d, 0x11
lea rdx, str.SOFTWAREClasses_
lea rcx, [rbp - 0x29]
call fcn.140001780
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rbp - 0x51]
lea rcx, [rbp - 0x29]
call fcn.1400158d0
lea rdx, [rbp - 0x29]
cmp qword [rbp - 0x11], 8
cmovae rdx, qword [rbp - 0x29]
mov rcx, 0xffffffff80000001
call fcn.14001dea0
test eax, eax
je 0x140024763
lea rdx, str.___HKCUSOFTWAREClasses_
mov rcx, rdi
call fcn.140018560
mov rcx, rax
lea rdx, [rbp - 0x51]
call fcn.1400187c0
mov rcx, rax
lea rdx, str._has_been_deleted__r_n_r_n
call fcn.140018560
mov rcx, rax
call fcn.140003410
nop
cmp qword [rbp - 0x11], 8
jb 0x140024774
mov rcx, qword [rbp - 0x29]
call fcn.140063290
nop
cmp qword [rbp - 0x39], 8
jb 0x140024784
mov rcx, qword [rbp - 0x51]
call fcn.140063290
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140063080
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret