Function at 0x140073dc4
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r14, rcx
lea rcx, [0x14013ed4c]
mov r8, rcx
call fcn.1400b2d6c
xor r8d, r8d
lea rdx, str.___1____2____3____4_
mov rcx, rax
mov r13, rax
call fcn.1400b2d6c
xor r8d, r8d
mov qword [rsp + 0x98], rax
lea rdx, str.__print_to_default___1_
mov rcx, r13
call fcn.1400b2d6c
xor r8d, r8d
mov qword [rsp + 0x30], rax
lea rdx, str.__print_to___2____1_
mov rcx, r13
call fcn.1400b2d6c
lea rsi, [0x14014a6d0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x90], rsi
mov bpl, 1
xor r8d, r8d
lea rcx, [0x14013f5d0]
mov rdx, rsi
call fcn.1400b2d6c
xor r8d, r8d
lea rcx, str.SoftwareClasses_
mov rdx, rax
mov r15, rax
call fcn.1400b2d6c
lea rcx, [rsi + 1]
or rdx, 0xffffffffffffffff
mov r12, rax
call fcn.1400b2ccc
mov rbx, rax
mov rdi, rax
test rax, rax
je 0x140073e9e
cmp byte [rbx], 0
je 0x140073e9e
movsx ecx, byte [rbx]
call fcn.140107548
mov byte [rbx], al
add rbx, 1
jne 0x140073e89
xor r8d, r8d
lea rdx, str._File
mov rcx, rdi
call fcn.1400b2d6c
mov r9, rax
xor r8d, r8d
mov rdx, r12
mov rcx, r14
call fcn.1400b5fcc
and bpl, al
lea rax, [0x1401446a4]
cmp rsi, rax
je 0x140073f7e
test rsi, rsi
je 0x140073eec
mov rdx, rax
mov rcx, rsi
call fcn.14012a690
test eax, eax
je 0x140073f7e
lea rax, [0x140144fb0]
cmp rsi, rax
je 0x140073f75
test rsi, rsi
je 0x140073f0c
mov rdx, rax
mov rcx, rsi
call fcn.14012a690
test eax, eax
je 0x140073f75
lea rax, [0x140144fa8]
cmp rsi, rax
je 0x140073f75
test rsi, rsi
je 0x140073f2c
mov rdx, rax
mov rcx, rsi
call fcn.14012a690
test eax, eax
je 0x140073f75
lea rax, [0x140144fc0]
cmp rsi, rax
je 0x140073f75
test rsi, rsi
je 0x140073f4c
mov rdx, rax
mov rcx, rsi
call fcn.14012a690
test eax, eax
je 0x140073f75
lea rax, [0x140144fb8]
cmp rsi, rax
je 0x140073f75
test rsi, rsi
je 0x140073f6c
mov rdx, rax
mov rcx, rsi
call fcn.14012a690
test eax, eax
je 0x140073f75
lea rdx, [0x14014aa24]
jmp 0x140073f85
lea rdx, [0x14014aa28]
jmp 0x140073f85
lea rdx, [0x14014aa18]
xor r8d, r8d
mov rcx, r13
call fcn.1400b2d6c
xor r8d, r8d
lea rdx, [0x14014aa48]
mov rcx, r12
mov rdi, rax
call fcn.1400b2d6c
lea r9, [0x14014a828]
mov rdx, rax
lea r8, str.ApplicationCompany
mov rcx, r14
mov rbx, rax
call fcn.1400b5fcc
lea r9, [0x14013f5d0]
mov rdx, rbx
lea r8, str.ApplicationName
mov rcx, r14
and bpl, al
call fcn.1400b5fcc
xor r8d, r8d
lea rdx, str.DefaultIcon
mov rcx, r12
and bpl, al
call fcn.1400b2d6c
mov r9, rdi
xor r8d, r8d
mov rdx, rax
mov rcx, r14
call fcn.1400b5fcc
xor r8d, r8d
lea rdx, str._shellopen
mov rcx, r12
and bpl, al
call fcn.1400b2d6c
mov r9, rdi
lea r8, str.Icon
mov rdx, rax
mov rcx, r14
call fcn.1400b5fcc
xor r8d, r8d
lea rdx, str._shellopencommand
mov rcx, r12
and bpl, al
call fcn.1400b2d6c
mov r9, qword [rsp + 0x98]
xor r8d, r8d
mov rdx, rax
mov rcx, r14
call fcn.1400b5fcc
and bpl, al
lea rax, [0x1401455d8]
cmp rsi, rax
je 0x14007407b
test rsi, rsi
je 0x1400740cb
mov rdx, rax
mov rcx, rsi
call fcn.14012a690
test eax, eax
jne 0x1400740cb
xor r8d, r8d
lea rdx, str._shellPrintcommand
mov rcx, r12
call fcn.1400b2d6c
mov r9, qword [rsp + 0x30]
xor r8d, r8d
mov rdx, rax
mov rcx, r14
call fcn.1400b5fcc
xor r8d, r8d
lea rdx, str._shellPrintTocommand
mov rcx, r12
and bpl, al
call fcn.1400b2d6c
mov r9, qword [rsp + 0x38]
xor r8d, r8d
mov rdx, rax
mov rcx, r14
call fcn.1400b5fcc
and bpl, al
lea r8, str.OpenWithProgids
mov rdx, rsi
lea rcx, str.SoftwareClasses_
call fcn.1400b2d6c
mov rdi, rax
test rax, rax
jne 0x1400740ed
xor ebx, ebx
jmp 0x140074104
call fcn.1400b2af0
mov r8, rax
or rdx, 0xffffffffffffffff
mov rcx, rdi
call fcn.1400be600
mov rbx, rax
test r15, r15
jne 0x14007410d
xor eax, eax
jmp 0x140074121
call fcn.1400b2af0
mov r8, rax
or rdx, 0xffffffffffffffff
mov rcx, r15
call fcn.1400be600
and dword [rsp + 0x28], 0
xor r9d, r9d
and qword [rsp + 0x20], 0
mov r8, rax
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov rcx, r14
mov ebx, eax
call fcn.1400b623c
mov rdx, rax
mov dword [rsp + 0x20], ebx
mov r9, r15
lea rcx, str.LoggedWriteRegNone__s___s___s_____d_n
mov r8, rdi
call fcn.1400b3458
xor edx, edx
movzx ecx, bpl
test ebx, ebx
cmove edx, ecx
lea rcx, [rsp + 0x90]
mov bpl, dl
call fcn.1400b14e4
mov rsi, qword [rsp + 0x90]
test rsi, rsi
jne 0x140073e47
mov rbx, qword [rsp + 0x80]
mov al, bpl
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret