Function at 0x140018530
Capabilities:
Get common file path
Open clipboard
Query or enumerate registry value
Read clipboard data
Set registry value
Write clipboard data

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rax - 0x128]
sub rsp, 0x210
movaps xmmword [rax - 0x28], xmm6
mov rax, qword [0x140075030]
xor rax, rsp
mov qword [rbp + 0xf0], rax
mov rdi, r8
mov rsi, rcx
xor ebx, ebx
xorps xmm6, xmm6
movaps xmmword [rsp + 0x30], xmm6
add edx, 0xfffffb00
cmp edx, 0x17
ja case.0x140018595.1282
movsxd rax, edx
lea rcx, [0x140000000]
mov edx, dword [rcx + rax*4 + 0x18cd0]
add rdx, rcx
jmp rdx
mov dword [rsi + 0x10], 1
xor r8d, r8d
mov edx, 0x203
mov rcx, rsi
call fcn.140014590
jmp case.0x140018595.1282
mov dword [rsi + 0x10], ebx
jmp case.0x140018595.1282
lea rcx, [rbp - 0x40]
call fcn.140018d90
nop
mov dword [rbp - 0x48], 2
mov dword [rbp - 0x58], 4
mov dword [rbp - 0x50], 4
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea rax, [rbp - 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x54]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x50]
xor r8d, r8d
lea rdx, str.TaskbarGlomLevel
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [rbp - 0x54], 2
je 0x14001865a
mov eax, dword [rbp - 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.TaskbarGlomLevel
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp - 0x20]
call fcn.140020aa0
mov edx, 0x104
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rdx, str.explorer.exe
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov r8b, 1
xor edx, edx
lea rcx, [rbp - 0x20]
call fcn.140015660
mov dword [rsp + 0x60], 0x30
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea rcx, str.shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [rsp + 0x68], rax
test rax, rax
jne 0x1400186cc
inc ebx
cmp ebx, 5
jl 0x1400186a1
mov qword [rbp - 0x78], 2
lea rdx, [rsp + 0x60]
mov ecx, 0xa
call qword [sym.imp.SHELL32.dll_SHAppBarMessage]
mov eax, dword [rbp - 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rbp - 0x54]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.TaskbarGlomLevel
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb case.0x140018595.1282
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018c28
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018c6d
jmp 0x140018c28
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp - 0x20]
call fcn.140020aa0
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x25]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rdx, str._rundll32.exe_shell32.dll_61
lea rcx, [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcatA]
mov r8b, 1
lea rdx, [rbp - 0x20]
xor ecx, ecx
call fcn.140015660
jmp case.0x140018595.1282
lea rcx, str.shutdown__r__t_0
call fcn.140028e50
jmp case.0x140018595.1282
lea rcx, str.shutdown__s__t_0
call fcn.140028e50
jmp case.0x140018595.1282
xor edx, edx
mov rcx, rsi
call fcn.1400157c0
jmp case.0x140018595.1282
xor edx, edx
mov rcx, rsi
call fcn.140017470
jmp case.0x140018595.1282
xor edx, edx
mov rcx, rsi
call fcn.140016150
jmp case.0x140018595.1282
xor edx, edx
mov rcx, rsi
call fcn.140016ac0
jmp case.0x140018595.1282
mov ecx, 0x18
call fcn.14001e550
mov byte [rax], 1
mov qword [rax + 8], rsi
lea rcx, [fcn.1400157c0]
mov qword [rax + 0x10], rcx
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x140018d50]
xor edx, edx
xor ecx, ecx
call fcn.140025b60
mov qword [rbp - 0x70], rax
test rax, rax
je 0x140018c92
xorps xmm0, xmm0
movaps xmm1, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 8
movd eax, xmm0
test eax, eax
je 0x140018c73
movdqa xmmword [rbp - 0x70], xmm1
lea rcx, [rbp - 0x70]
call fcn.14001e388
test eax, eax
jne 0x140018c73
jmp case.0x140018595.1282
mov ecx, 0x18
call fcn.14001e550
mov byte [rax], 1
mov qword [rax + 8], rsi
lea rcx, [fcn.140017470]
mov qword [rax + 0x10], rcx
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x140018d50]
xor edx, edx
xor ecx, ecx
call fcn.140025b60
mov qword [rbp - 0x70], rax
test rax, rax
je 0x140018ca0
jmp 0x140018857
mov ecx, 0x18
call fcn.14001e550
mov byte [rax], 1
mov qword [rax + 8], rsi
lea rcx, [fcn.140016150]
mov qword [rax + 0x10], rcx
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x140018d50]
xor edx, edx
xor ecx, ecx
call fcn.140025b60
mov qword [rbp - 0x70], rax
test rax, rax
je 0x140018cae
jmp 0x140018857
mov ecx, 0x18
call fcn.14001e550
mov byte [rax], 1
mov qword [rax + 8], rsi
lea rcx, [fcn.140016ac0]
mov qword [rax + 0x10], rcx
mov qword [rbp - 0x60], rax
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x140018d50]
xor edx, edx
xor ecx, ecx
call fcn.140025b60
mov qword [rbp - 0x70], rax
test rax, rax
je 0x140018cbc
xorps xmm0, xmm0
movaps xmm1, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x70], xmm0
movdqa xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 8
movd eax, xmm0
test eax, eax
je 0x140018c73
movdqa xmmword [rbp - 0x70], xmm1
lea rcx, [rbp - 0x70]
call fcn.14001e388
test eax, eax
jne 0x140018c73
jmp case.0x140018595.1282
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], rbx
mov ecx, 0x48
call fcn.14001e550
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp - 0x70], rax
lea rax, [rsp + 0x40]
mov qword [rbp - 0x60], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140018a8e
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
mov r14, rax
test rax, rax
je 0x140018a8e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140018a8e
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
mov rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140018a50
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140007f00
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rsp + 0x70]
movups xmmword [rsp + 0x50], xmm1
jmp 0x140018ab5
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
xor r8d, r8d
lea rdx, [0x14006a1dd]
lea rcx, [rsp + 0x40]
call fcn.140007f00
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rbx
mov r8d, 3
lea rdx, [0x14006d290]
lea rcx, [rbp - 0x40]
call fcn.140007f00
nop
lea r8, [rsp + 0x40]
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x70]
call fcn.140019330
lea r8, [rbp - 0x70]
mov edx, 0x205
mov rcx, rsi
call fcn.140014590
nop
lea rcx, [rbp - 0x70]
call fcn.1400190f0
jmp case.0x140018595.1282
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rbx
mov r8d, 3
lea rdx, [0x14006d290]
lea rcx, [rbp - 0x40]
call fcn.140007f00
lea r8, [rbp - 0x40]
lea rdx, [rsp + 0x60]
mov rcx, rdi
call fcn.1400196a0
lea r14, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae r14, qword [rsp + 0x60]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov rdi, 0xffffffffffffffff
mov r9d, edi
mov r8, r14
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
test eax, eax
js 0x140018bf0
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x140018bf0
call qword [sym.imp.USER32.dll_EmptyClipboard]
lea ecx, [rsi + 1]
movsxd rdx, ecx
add rdx, rdx
mov ecx, 0x2042
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rbx, rax
test rax, rax
je 0x140018bea
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x140018bea
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, edi
mov r8, r14
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rbx
lea ecx, [rdi + 0xe]
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb case.0x140018595.1282
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018c28
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018cca
call fcn.14001e740
nop
psrldq xmm6, 8
movd eax, xmm6
test eax, eax
jne 0x140018c67
mov rcx, qword [rbp + 0xf0]
xor rcx, rsp
call fcn.14001e530
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.140027ca4
nop
call fcn.140025808
nop
mov ecx, 1
call fcn.14001e294
int3
xor ecx, ecx
call fcn.140028e44
int3
call fcn.140018210
int3
call fcn.140018130
nop
mov dword [rbp - 0x68], ebx
mov ecx, 6
call fcn.14001e294
nop
mov dword [rbp - 0x68], ebx
mov ecx, 6
call fcn.14001e294
nop
mov dword [rbp - 0x68], ebx
mov ecx, 6
call fcn.14001e294
nop
mov dword [rbp - 0x68], ebx
mov ecx, 6
call fcn.14001e294
nop
call fcn.140025808
int3