Function at 0x1800377d0
Capabilities:
Check os version
Persist via default file association registry key
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x570
mov rax, qword [0x1800964f0]
xor rax, rsp
mov qword [rsp + 0x560], rax
mov rbx, rcx
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 0x9c
call fcn.180055310
lea rcx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x9c
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edx, 0x22
lea rcx, [rsp + 0x162]
mov word [rsp + 0x160], dx
mov r8d, 0x3fe
xor edx, edx
call fcn.180055310
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x160]
repne scasb al, byte [rdi]
xor ecx, ecx
nop dword [rax + rax]
movzx eax, byte [rbx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x180037850
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x160]
repne scasb al, byte [rdi]
mov eax, dword [str.____1_]
mov dword [rdi - 1], eax
movzx eax, word [0x18008332c]
mov word [rdi + 3], ax
movzx eax, byte [0x18008332e]
mov byte [rdi + 5], al
mov eax, dword [rsp + 0x64]
cmp eax, 6
jne 0x180037aad
cmp dword [rsp + 0x68], 1
jne 0x180037b52
mov rax, qword [str.WebMind_Document]
lea rcx, [rsp + 0x100]
xor ebx, ebx
mov qword [rcx], rax
mov rax, qword [0x1800832e0]
lea rdx, str.WebMind
mov qword [rcx + 8], rax
movzx eax, byte [0x1800832e8]
xor r9d, r9d
mov byte [rcx + 0x10], al
xor eax, eax
xor r8d, r8d
mov qword [rsp + 0x111], rax
mov dword [rsp + 0x119], eax
mov byte [rsp + 0x11d], al
lea rax, [rsp + 0x58]
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x2001f
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x180037962
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x100]
lea r9d, [rbx + 1]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], select
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x160]
repne scasb al, byte [rdi]
lea rax, [rsp + 0x58]
lea rdx, str.WebMindShellopencommand
mov qword [rsp + 0x40], rax
not rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov edi, ecx
mov qword [rsp + 0x30], rbx
mov rcx, 0xffffffff80000000
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x2001f
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x1800379f1
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x160]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
or rcx, 0xffffffffffffffff
movabs rax, 0x646e694d626557
lea rdi, [rsp + 0x120]
mov qword [rsp + 0x120], rax
xor eax, eax
lea rdx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
mov qword [rsp + 0x128], rax
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], rax
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x158], rax
repne scasb al, byte [rdi]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], rax
not rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov edi, ecx
mov qword [rsp + 0x30], rbx
mov rcx, 0xffffffff80000001
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x28], 0x2001f
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x180037b52
lea rax, [rsp + 0x120]
lea rdx, str.Progid
jmp 0x180037b2a
cmp eax, 5
jne 0x180037b52
cmp dword [rsp + 0x68], 1
jne 0x180037b52
xor eax, eax
or rcx, 0xffffffffffffffff
xor ebx, ebx
lea rdi, [rsp + 0x160]
lea rdx, str.http_shellopencommand
xor r9d, r9d
repne scasb al, byte [rdi]
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x40], rax
not rcx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov edi, ecx
mov qword [rsp + 0x30], rbx
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x28], 0x2001f
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x180037b52
lea rax, [rsp + 0x160]
xor edx, edx
mov rcx, qword [rsp + 0x50]
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rsp + 0x560]
xor rcx, rsp
call fcn.180050540
mov rbx, qword [rsp + 0x588]
add rsp, 0x570
pop rdi
ret