Function at 0x140005440
Capabilities:
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x188]
sub rsp, 0x288
mov rax, qword [0x1400a3758]
xor rax, rsp
mov qword [rbp + 0x160], rax
mov rbx, r8
mov byte [rsp + 0x30], dl
mov rsi, rcx
lea rax, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
mov rcx, 0xffffffff80000001
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
test eax, eax
jne 0x14000556c
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rdx, str.ProgId
lea rax, [rsp + 0x50]
mov dword [rsp + 0x34], 0x104
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x14000556c
lea r8, str._shellopencommand
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.140059b50
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400055db
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
mov dword [rsp + 0x34], 0x104
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x1400055db
lea rax, [rsp + 0x38]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.http_shellopencommand
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400055d3
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
mov dword [rsp + 0x34], 0x104
xor r8d, r8d
mov qword [rsp + 0x20], rax
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
mov edi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x14000575a
mov qword [rsp + 0x2b8], r12
mov rax, 0xffffffffffffffff
mov qword [rsp + 0x280], r13
mov rcx, rax
mov qword [rsp + 0x278], r14
mov qword [rsp + 0x270], r15
inc rcx
cmp word [rbx + rcx*2], 0
jne 0x140005605
lea rdx, [rsp + 0x50]
cmp word [rdx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140005614
lea r13, [rax + 6]
add r13, rcx
lea rcx, [r13*2]
call fcn.140059d40
cmp word [rsp + 0x50], 0x22
lea r12, [rsp + 0x50]
mov r14, rax
jne 0x140005650
lea r12, [rsp + 0x52]
mov edx, 0x22
jmp 0x140005655
mov edx, 0x20
mov rcx, r12
call fcn.14004eb30
mov r15, rax
test rax, rax
je 0x14000566f
xor eax, eax
mov word [r15], ax
add r15, 2
cmp byte [rsp + 0x30], 0
je 0x140005709
lea rdx, str.__1_
lea rcx, [rsp + 0x50]
call fcn.14004ebac
mov qword [rsp + 0x40], rax
mov rdx, r13
test rax, rax
je 0x1400056f5
mov rsi, rax
mov r8, r15
sub rsi, r15
sar rsi, 1
lea ecx, [rsi + 1]
movsxd rdi, ecx
mov rcx, r14
mov r9, rdi
call fcn.140059c30
movsxd rax, esi
lea r8, [0x140079ff4]
inc rax
mov rdx, r13
sub rdx, rdi
lea rcx, [r14 + rax*2]
call fcn.140059bc8
mov r8, rbx
mov rdx, r13
mov rcx, r14
call fcn.140059b50
mov r8, qword [rsp + 0x40]
mov rdx, r13
add r8, 6
mov rcx, r14
call fcn.140059b50
jmp 0x140005720
mov r9, rbx
lea r8, str.____s_
mov rcx, r14
call fcn.140005c50
jmp 0x140005720
mov rcx, r14
sub rcx, rbx
nop
movzx eax, word [rbx]
mov word [rcx + rbx], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x140005710
xor r8d, r8d
mov rdx, r14
mov rcx, r12
call fcn.1400057a0
mov rcx, r14
call fcn.140059d2c
mov r15, qword [rsp + 0x270]
mov al, 1
mov r14, qword [rsp + 0x278]
mov r13, qword [rsp + 0x280]
mov r12, qword [rsp + 0x2b8]
jmp 0x140005779
mov r9d, 0x10
lea r8, str.AutoRuns_Error
lea rdx, str.No_web_browser_is_configured.
mov rcx, rsi
call qword [sym.imp.USER32.dll_MessageBoxW]
xor al, al
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.14004bd30
add rsp, 0x288
pop rdi
pop rsi
pop rbx
pop rbp
ret