Function at 0x140010c50
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
mov r11, rsp
push rbx
push rdi
sub rsp, 0x78
xor edi, edi
lea rax, [r11 + 8]
lea rdx, str.SOFTWAREClasses.igp
mov qword [r11 - 0x48], rax
lea rax, [r11 - 0x38]
xor r9d, r9d
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x58], rdi
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov ebx, edi
mov dword [rsp + 0x20], edi
mov qword [r11 - 0x38], rdi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140010cdf
mov rbx, qword [rsp + 0x50]
lea rax, str.Intel.GraphicsControlPanel.igp.1
lea r9d, [rdi + 1]
lea rdx, [0x140034f78]
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], 0x42
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x140010cdf
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, edi
lea rax, [rsp + 0x98]
lea rdx, str.SOFTWAREClassesIntel.GraphicsControlPanel.igp.1
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140010d81
mov eax, edi
test rbx, rbx
je 0x140010d3a
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x58]
test eax, eax
jne 0x140010d81
lea rax, str.Intel_Graphics_Profiles
lea rdx, [0x140034f78]
mov r9d, 1
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], 0x30
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x140010d81
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rdi
lea rax, [rsp + 0xa0]
lea rdx, str.SOFTWAREClassesIntel.GraphicsControlPanel.igp.1DefaultIcon
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov qword [rsp + 0x60], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140010e23
mov eax, edi
test rbx, rbx
je 0x140010ddc
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x60]
test eax, eax
jne 0x140010e23
lea rax, str._SystemRoot_System32GfxUIEx.exe__2
lea rdx, [0x140034f78]
mov r9d, 1
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], 0x4a
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x140010e23
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, rdi
lea rax, [rsp + 0xa8]
lea rdx, str.SOFTWAREClassesIntel.GraphicsControlPanel.igp.1_shellopencommand
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf003f
mov qword [rsp + 0x68], rdi
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140010eb2
test rbx, rbx
je 0x140010e7e
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
mov rbx, qword [rsp + 0x68]
test edi, edi
jne 0x140010eb2
lea rax, str.GfxUIEx.exe__1
lea r9d, [rdi + 1]
lea rdx, [0x140034f78]
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], 0x1e
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x140010ec0
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
add rsp, 0x78
pop rdi
pop rbx
ret