Function at 0x1400410c4
Capabilities:
Delete registry key
Query or enumerate registry key
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x1400922d0]
xor rax, rsp
mov qword [rbp + 0x28], rax
mov r15d, r8d
mov r14, rdx
mov rbx, rcx
xor r12d, r12d
test rcx, rcx
je 0x1400416ab
test rdx, rdx
je 0x1400416ab
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov edi, r12d
mov qword [rbp - 0x60], r12
mov dword [rbp - 0x58], r12d
mov qword [rbp - 0x50], r12
movups xmmword [rbp - 8], xmm0
mov qword [rbp - 8], r12
mov dword [rbp], r12d
mov qword [rbp + 8], r12
movups xmmword [rbp - 0x78], xmm0
mov esi, r12d
mov qword [rbp - 0x78], r12
mov dword [rbp - 0x70], r12d
mov qword [rbp - 0x68], r12
mov qword [rsp + 0x60], r12
mov rdx, rcx
lea rcx, [rsp + 0x60]
call fcn.140002f00
lea r8, str.Capabilities
lea rdx, [0x140078d48]
lea rcx, [rsp + 0x60]
call fcn.14001d9e0
mov qword [rsp + 0x70], r12
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.140002f00
nop
lea r8, str.ShellFileAssociations
lea rdx, [0x140078d48]
lea rcx, [rsp + 0x70]
call fcn.14001d9e0
mov qword [rbp - 0x48], r12
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 0x2000e
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rbx, 0xffffffff80000002
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
or r13, 0xffffffffffffffff
test eax, eax
jne 0x1400411db
mov rdi, qword [rbp - 0x48]
mov qword [rbp - 0x60], rdi
mov dword [rbp - 0x58], r12d
jmp 0x140041247
mov qword [rbp - 0x40], r12
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14004122a
mov eax, r12d
mov rdi, qword [rbp - 0x40]
mov qword [rbp - 0x60], rdi
mov dword [rbp - 0x58], r12d
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14004162e
mov rbx, 0xffffffff80000002
mov qword [rbp - 0x38], r12
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004127e
mov eax, r12d
mov rsi, qword [rbp - 0x38]
mov qword [rbp - 0x78], rsi
mov dword [rbp - 0x70], r12d
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14004162e
call fcn.140002950
mov rcx, rax
test rax, rax
je 0x1400416e5
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x80], rax
call fcn.140002950
mov rcx, rax
test rax, rax
je 0x1400416d7
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x68]
call fcn.140040fb8
mov ebx, eax
test eax, eax
js 0x1400415e5
mov rdx, r14
lea rcx, [rsp + 0x68]
call fcn.14000a324
mov r9d, r15d
mov r8, qword [rsp + 0x68]
lea rdx, str.__s___d
lea rcx, [rbp - 0x80]
call fcn.140006970
mov r14d, 1
mov rax, qword [rbp - 0x80]
test rax, rax
jne 0x140041321
lea eax, [r14 + 0xc]
jmp 0x140041354
mov rcx, r13
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x140041324
lea ecx, [rcx*2 + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, r14d
xor r8d, r8d
lea rdx, str.ApplicationDescription
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
movzx ebx, ax
mov r15d, 0x80070000
or ebx, r15d
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1400415e5
cmp byte [0x140095088], r12b
jne 0x1400413b1
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400413a1
lea rdx, [0x14006cbc0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140095080], rax
jmp 0x1400413a8
mov rax, qword [0x140095080]
mov byte [0x140095088], r14b
jmp 0x1400413b8
mov rax, qword [0x140095080]
lea rdx, str.FileAssociations
mov rcx, rdi
test rax, rax
je 0x1400413d1
xor r9d, r9d
xor r8d, r8d
call rax
jmp 0x1400413d7
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov qword [rbp - 0x30], r12
lea rax, [rbp + 0x14]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.FileAssociations
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, eax
test eax, eax
jne 0x14004142a
mov ecx, r12d
mov rax, qword [rbp - 0x30]
mov qword [rbp - 8], rax
mov dword [rbp], r12d
movzx ebx, cx
or ebx, r15d
test ecx, ecx
cmovle ebx, ecx
test ebx, ebx
js 0x1400415e5
mov edi, r12d
mov r15d, 0x104
mov dword [rbp + 0x18], r15d
mov qword [rsp + 0x58], r12
mov r8d, r15d
lea rcx, [rsp + 0x58]
call fcn.1400416f0
nop
mov r8, qword [rsp + 0x58]
cmp dword [r8 - 8], r14d
jle 0x14004147b
mov edx, dword [r8 - 0x10]
lea rcx, [rsp + 0x58]
call fcn.140002da0
mov r8, qword [rsp + 0x58]
lea rax, [rbp + 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rbp + 0x18]
mov edx, edi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1400415c0
mov dword [rsp + 0x78], r15d
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x20], r12
mov dword [rbp - 0x18], r12d
mov qword [rbp - 0x10], r12
mov qword [rsp + 0x50], r12
mov r8d, r15d
lea rcx, [rsp + 0x50]
call fcn.1400416f0
nop
mov qword [rbp - 0x28], r12
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14004157c
mov rax, qword [rbp - 0x28]
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x18], r12d
mov r8, qword [rsp + 0x50]
cmp dword [r8 - 8], r14d
jle 0x140041527
mov edx, dword [r8 - 0x10]
lea rcx, [rsp + 0x50]
call fcn.140002da0
mov r8, qword [rsp + 0x50]
lea r9, [rsp + 0x78]
lea rdx, [0x140067c00]
lea rcx, [rbp - 0x20]
call fcn.140027588
test eax, eax
jne 0x14004157c
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x140041581
mov rcx, r13
inc rcx
cmp word [rax + rcx*2], r12w
jne 0x14004154d
lea ecx, [rcx*2 + 2]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, r14d
xor r8d, r8d
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rax, qword [rsp + 0x50]
mov dword [rbp + 0x18], r15d
add edi, r14d
lea rdx, [rax - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1400415a8
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x1400415b7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rbp - 0x78]
jmp 0x14004145d
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x1400415e5
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14004160a
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14004162e
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140041653
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x140041678
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x140041688
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x140041698
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rcx, qword [rbp - 0x60]
test rcx, rcx
je 0x1400416a7
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x1400416b0
mov eax, 0x80004003
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.140001020
mov rbx, qword [rsp + 0x188]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004005
call fcn.1400327c0
nop
jmp 0x1400416e4
nop
mov ecx, 0x80004005
call fcn.1400327c0
int3