Function at 0x1400125a0
Capabilities:
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x14004c300]
xor rax, rsp
mov qword [rbp + 0x10], rax
xor edi, edi
mov qword [rsp + 0x58], rdi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.steam
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140012646
mov byte [0x14004d9cd], 1
mov dword [rsp + 0x54], 1
lea rax, [0x14004c1e4]
mov qword [rsp + 0x28], rax
lea rax, [0x140071b00]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x54]
xor r8d, r8d
lea rdx, str.URL_Protocol
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, str.Found_previous_registry_entry__HKCS__1_for_Steam
jmp 0x14001268f
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.steam
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140012be6
lea rdx, str.Created_new_registry_entry__HKCS__1_for_Steam
lea rcx, [0x14004da60]
call fcn.1400071d0
mov qword [rsp + 0x60], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.steamShellOpenCommand
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rsi, [0x14003961c]
test eax, eax
jne 0x140012718
mov byte [0x14004d9ce], 1
mov dword [rsp + 0x54], 1
lea rax, [0x14004c1e0]
mov qword [rsp + 0x28], rax
lea rax, [0x14006db00]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x54]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rdx, str.Found_previous_registry_entry__HKCS__2_for_Steam
jmp 0x140012761
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
lea rdx, str.steamShellOpenCommand
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140012aa4
lea rdx, str.Created_new_registry_entry__HKCS__2_for_Steam
lea rcx, [0x14004da60]
call fcn.1400071d0
mov dword [rsp + 0x28], 0x26
lea rax, str.URL:steam_protocol
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x28], 2
mov qword [rsp + 0x20], rsi
mov r9d, 1
xor r8d, r8d
lea rdx, str.URL_Protocol
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140007410
mov rbx, rax
call fcn.140007430
mov rdx, qword [rax + 0x10]
movabs rcx, 0x7fffffffffffffff
sub rcx, rdx
cmp rcx, 1
jb 0x140012d4e
mov rcx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140012800
mov rcx, qword [rax]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], 1
lea r9, [0x1400396c4]
mov r8, rax
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp - 0x58]
call fcn.14000a660
nop
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x14001283a
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rbp - 0x58]
call fcn.1400054c0
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rbp - 0x68]
mov rdx, qword [rbp - 0x60]
mov rax, rdx
sub rax, rcx
cmp rax, 9
jb 0x1400128be
lea rax, [rcx + 9]
mov qword [rbp - 0x68], rax
lea rbx, [rbp - 0x78]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x78]
add rbx, rcx
mov r8d, 9
lea rdx, str._______1_
mov rcx, rbx
call fcn.140034b30
mov byte [rbx + 9], 0
lea rax, [rbp - 0x78]
jmp 0x1400128df
mov qword [rsp + 0x20], 9
lea r9, str._______1_
xor r8d, r8d
mov edx, 9
lea rcx, [rbp - 0x78]
call fcn.1400019c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rax, [rsp + 0x68]
cmp qword [rbp - 0x80], 0xf
cmova rax, qword [rsp + 0x68]
mov qword [rbp - 0x10], rax
mov rax, qword [rsp + 0x78]
mov qword [rbp - 8], rax
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp - 0x10], xmm0
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x38]
call fcn.140006a50
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x140012980
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001297b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012d54
call fcn.14001af38
movdqa xmm0, xmmword [0x140038970]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x1400129d6
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400129c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012d5a
call fcn.14001af38
movdqa xmm0, xmmword [0x140038970]
movdqu xmmword [rbp - 0x68], xmm0
mov byte [rbp - 0x78], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x140012a1a
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012a15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012d60
call fcn.14001af38
mov eax, dword [rbp - 0x28]
lea eax, [rax*2 + 2]
lea rcx, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova rcx, qword [rbp - 0x38]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rbp - 0x20]
cmp rdx, 7
jbe 0x140012a9d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012a98
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012d66
call fcn.14001af38
mov al, 1
jmp 0x140012d23
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea r10, [rbp + 5]
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx ecx, dl
shl cl, 2
lea eax, [rcx + rdx]
add al, al
sub r8b, al
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x140012ab1
lea r9, [rsp + 0x50]
lea r8, [rbp + 5]
mov rdx, r10
lea rcx, [rbp - 0x58]
call fcn.140007e60
nop
mov r9d, 0x2c
lea r8, str.Unable_to_patch_Registry__HKCS__2__error_
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.140011f20
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x68]
lea rcx, [0x14004da60]
call fcn.140006f40
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x140012b88
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012b83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012d6c
call fcn.14001af38
movdqa xmm0, xmmword [0x140038970]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x140012bd6
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012bd1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012d72
call fcn.14001af38
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140012d21
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
lea r10, [rbp + 5]
nop dword [rax]
nop word [rax + rax]
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx ecx, dl
shl cl, 2
lea eax, [rcx + rdx]
add al, al
sub r8b, al
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x140012c00
lea r9, [rsp + 0x50]
lea r8, [rbp + 5]
mov rdx, r10
lea rcx, [rbp - 0x58]
call fcn.140007e60
nop
mov r9d, 0x2c
lea r8, str.Unable_to_patch_Registry__HKCS__1__error_
xor edx, edx
lea rcx, [rbp - 0x58]
call fcn.140011f20
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x68]
lea rcx, [0x14004da60]
call fcn.140006f40
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0xf
jbe 0x140012cd7
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012cd2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012d78
call fcn.14001af38
movdqa xmm0, xmmword [0x140038970]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x140012d21
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140012d1c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140012d48
call fcn.14001af38
xor al, al
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.14001b0b0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.140020dc4
int3
call fcn.140005310
nop
call fcn.140020dc4
nop
call fcn.140020dc4
nop
call fcn.140020dc4
int3
call fcn.140020dc4
nop
call fcn.140020dc4
nop
call fcn.140020dc4
nop
call fcn.140020dc4
int3