Function at 0x1400376c0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x188]
sub rsp, 0x288
mov rax, qword [0x1401737a8]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov rbx, r8
mov byte [rsp + 0x30], dl
mov rsi, rcx
lea rax, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
mov rcx, 0xffffffff80000001
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x1400377ec
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rdx, str.ProgId
lea rax, [rsp + 0x50]
mov dword [rsp + 0x34], 0x104
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x1400377ec
lea r8, str._shellopencommand
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.1400f7f64
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003785b
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
mov dword [rsp + 0x34], 0x104
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x14003785b
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.http_shellopencommand
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140037853
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
mov dword [rsp + 0x34], 0x104
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x1400379ea
mov qword [rsp + 0x2b8], r12
mov rax, 0xffffffffffffffff
mov qword [rsp + 0x280], r13
mov rcx, rax
mov qword [rsp + 0x278], r14
mov qword [rsp + 0x270], r15
inc rcx
cmp word [rbx + rcx*2], 0
jne 0x140037885
lea rdx, [rsp + 0x50]
cmp word [rdx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140037894
lea r13, [rax + 6]
add r13, rcx
lea rcx, [r13*2]
call fcn.1400e8270
cmp word [rsp + 0x50], 0x22
lea r12, [rsp + 0x50]
mov r14, rax
jne 0x1400378d0
lea r12, [rsp + 0x52]
mov eax, 0x22
jmp 0x1400378d5
mov eax, 0x20
movzx edx, ax
mov rcx, r12
call fcn.1400e3bac
mov r15, rax
test rax, rax
je 0x1400378f2
xor eax, eax
mov word [r15], ax
add r15, 2
cmp byte [rsp + 0x30], 0
je 0x14003798c
lea rdx, str.__1_
lea rcx, [rsp + 0x50]
call fcn.1400e3cd4
mov qword [rsp + 0x40], rax
mov rdx, r13
test rax, rax
je 0x140037978
mov rsi, rax
mov r8, r15
sub rsi, r15
sar rsi, 1
lea ecx, [rsi + 1]
movsxd rdi, ecx
mov rcx, r14
mov r9, rdi
call fcn.1400e8844
movsxd rax, esi
lea r8, [0x14012627c]
inc rax
mov rdx, r13
sub rdx, rdi
lea rcx, [r14 + rax*2]
call fcn.1400e86e4
mov r8, rbx
mov rdx, r13
mov rcx, r14
call fcn.1400f7f64
mov r8, qword [rsp + 0x40]
mov rdx, r13
add r8, 6
mov rcx, r14
call fcn.1400f7f64
jmp 0x1400379b0
mov r9, rbx
lea r8, str.____s_
mov rcx, r14
call fcn.1400192b0
jmp 0x1400379b0
mov rcx, r14
sub rcx, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x1400379a0
xor r8d, r8d
mov rdx, r14
mov rcx, r12
call fcn.140037a30
mov rcx, r14
call fcn.1400e825c
mov r15, qword [rsp + 0x270]
mov al, 1
mov r14, qword [rsp + 0x278]
mov r13, qword [rsp + 0x280]
mov r12, qword [rsp + 0x2b8]
jmp 0x140037a09
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetDim
lea r8, str.Process_Explorer_Error
lea rdx, str.No_web_browser_is_configured.
mov rcx, rsi
call qword [sym.imp.USER32.dll_MessageBoxW]
xor al, al
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.1400e17a0
add rsp, 0x288
pop rdi
pop rsi
pop rbx
pop rbp
ret