Function at 0x14002f4e0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x188]
sub rsp, 0x288
mov rax, qword [0x1401222f0]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov byte [rsp + 0x30], dl
lea rax, [rsp + 0x38]
mov rbx, r8
mov rsi, rcx
lea rdx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x14002f60c
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea rdx, str.ProgId
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x34], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x14002f60c
lea r8, str._shellopencommand
lea rcx, [rsp + 0x50]
mov edx, 0x104
call fcn.1400abdb0
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002f67b
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x34], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x14002f67b
lea rax, [rsp + 0x38]
lea rdx, str.http_shellopencommand
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002f673
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x34], 0x104
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x14002f7fc
mov qword [rsp + 0x2b8], r12
mov qword [rsp + 0x280], r13
or rax, 0xffffffffffffffff
mov qword [rsp + 0x278], r14
mov qword [rsp + 0x270], r15
mov rcx, rax
inc rcx
cmp word [rbx + rcx*2], 0
jne 0x14002f6a2
lea rdx, [rsp + 0x50]
cmp word [rdx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x14002f6b1
lea r12, [rax + 6]
add r12, rcx
lea rcx, [r12 + r12]
call fcn.1400a82f0
cmp word [rsp + 0x50], 0x22
lea r13, [rsp + 0x50]
mov r15, rax
jne 0x14002f6ee
lea r13, [rsp + 0x52]
mov edx, 0x22
lea rcx, [rsp + 0x52]
jmp 0x14002f6f8
mov edx, 0x20
lea rcx, [rsp + 0x50]
call fcn.1400a9720
mov r14, rax
test rax, rax
je 0x14002f710
xor eax, eax
add r14, 2
mov word [r14 - 2], ax
cmp byte [rsp + 0x30], 0
je 0x14002f7ab
lea rdx, str.__1_
lea rcx, [rsp + 0x50]
call fcn.1400a99c0
mov rdx, r12
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14002f797
mov rsi, rax
mov r8, r14
sub rsi, r14
sar rsi, 1
lea ecx, [rsi + 1]
movsxd rdi, ecx
mov rcx, r15
mov r9, rdi
call fcn.1400a9844
movsxd rax, esi
mov rdx, r12
lea rcx, [rax + 1]
lea r8, [0x1400da21c]
sub rdx, rdi
lea rcx, [r15 + rcx*2]
call fcn.1400a97ac
mov r8, rbx
mov rdx, r12
mov rcx, r15
call fcn.1400abdb0
mov r8, qword [rsp + 0x40]
mov rdx, r12
add r8, 6
mov rcx, r15
call fcn.1400abdb0
jmp 0x14002f7c2
lea r8, str.____s_
mov r9, rbx
mov rcx, r15
call fcn.1400aa928
jmp 0x14002f7c2
mov rcx, r15
sub rcx, rbx
movzx eax, word [rbx]
lea rbx, [rbx + 2]
mov word [rcx + rbx - 2], ax
test ax, ax
jne 0x14002f7b1
xor r8d, r8d
mov rdx, r15
mov rcx, r13
call fcn.14002f840
mov rcx, r15
call fcn.1400a82b0
mov r15, qword [rsp + 0x270]
mov r14, qword [rsp + 0x278]
mov r13, qword [rsp + 0x280]
mov r12, qword [rsp + 0x2b8]
mov al, 1
jmp 0x14002f81b
lea r8, str.Process_Explorer_Error
lea rdx, str.No_web_browser_is_configured.
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
mov rcx, rsi
call qword [sym.imp.USER32.dll_MessageBoxW]
xor al, al
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x288
pop rdi
pop rsi
pop rbx
pop rbp
ret