Function at 0x14018f6f0
Capabilities:
Inspect load icon resource
Set registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x1f8
movaps xmmword [rsp + 0x1e0], xmm6
mov r8d, 0x105
lea r14, [rsp + 0xd0]
mov dword [rcx + 0x5c], 0xffffffff
mov rbx, rcx
mov dword [rcx + 0x64], 0xffffffff
mov rdx, r14
xor ecx, ecx
mov dword [rsp + 0xa0], 0x2af8
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x14018fd37
mov rcx, r14
call sym.strlen
lea rax, [r14 + rax - 1]
cmp rax, r14
jne 0x14018f769
jmp 0x14018f76e
sub rax, 1
cmp rax, r14
je 0x14018f76e
cmp byte [rax], 0x5c
jne 0x14018f760
lea r13, [rsp + 0xb0]
lea r12, [rax + 1]
mov rcx, 0xffffffff80000001
mov r8, r13
lea rdx, str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BROWSER_EMULATION
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x14018fd37
lea rdi, [rsp + 0xa0]
mov r9d, 4
xor r8d, r8d
mov rdx, r12
mov rcx, qword [rsp + 0xb0]
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0xb0]
test eax, eax
jne 0x14018fe52
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rsi, rax
test rax, rax
je 0x14018fd37
xor ecx, ecx
call qword [sym.imp.ole32.dll_OleInitialize]
mov r12d, eax
test eax, eax
jne 0x14018fd37
lea rax, [dbg.wndproc]
mov rcx, rsi
lea r15, str.WebView
mov rbp, qword [sym.imp.USER32.dll_LoadIconA]
mov edx, 0x64
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x118], 0
mov dword [rsp + 0xd0], 0x50
mov qword [rsp + 0xe8], rsi
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0x110], r15
call rbp
mov edx, 0x64
mov rcx, rsi
mov qword [rsp + 0xf0], rax
call rbp
mov rcx, r14
mov qword [rsp + 0x118], rax
call qword [sym.imp.USER32.dll_RegisterClassExA]
cmp dword [rbx + 0x18], 1
sbb ebp, ebp
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov edx, 0x58
mov r8, qword [sym.imp.GDI32.dll_GetDeviceCaps]
and ebp, 0xfffb0000
mov r14, rax
mov rcx, rax
add ebp, 0xcf0000
mov qword [rsp + 0x60], r8
call r8
imul eax, dword [rbx + 0x10]
pxor xmm0, xmm0
mov r8, qword [rsp + 0x60]
movsd xmm6, qword [0x1403a7540]
mov edx, 0x5a
mov rcx, r14
cvtsi2sd xmm0, eax
divsd xmm0, xmm6
cvttsd2si eax, xmm0
mov dword [rbx + 0x10], eax
call r8
imul eax, dword [rbx + 0x14]
pxor xmm0, xmm0
xor ecx, ecx
mov rdx, r14
cvtsi2sd xmm0, eax
divsd xmm0, xmm6
cvttsd2si eax, xmm0
mov dword [rbx + 0x14], eax
call qword [sym.imp.USER32.dll_ReleaseDC]
mov rax, qword [rbx + 0x10]
xor r8d, r8d
mov rcx, rdi
mov edx, 0xcf0000
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], rax
call qword [sym.imp.USER32.dll_AdjustWindowRect]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
lea rdx, [rsp + 0x90]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [rsp + 0x98]
mov ecx, dword [rsp + 0xa8]
mov qword [rsp + 0x58], rbx
sub ecx, dword [rsp + 0xa0]
mov r9d, dword [rsp + 0x9c]
mov qword [rsp + 0x50], rsi
mov eax, edx
mov dword [rsp + 0x30], ecx
mov r8d, dword [rsp + 0xac]
shr eax, 0x1f
sub r8d, dword [rsp + 0xa4]
mov qword [rsp + 0x48], 0
add eax, edx
mov edx, ecx
mov dword [rsp + 0x38], r8d
mov qword [rsp + 0x40], 0
shr edx, 0x1f
sar eax, 1
add edx, ecx
sar edx, 1
sub eax, edx
mov edx, r9d
shr edx, 0x1f
mov dword [rsp + 0xa0], eax
add edx, r9d
mov r9d, r8d
mov dword [rsp + 0x20], eax
shr r9d, 0x1f
sar edx, 1
add r9d, r8d
sar r9d, 1
sub edx, r9d
lea r9d, [rcx + rax]
xor ecx, ecx
mov dword [rsp + 0xa8], r9d
lea r9d, [r8 + rdx]
mov r8, qword [rbx + 8]
mov dword [rsp + 0xac], r9d
mov r9d, ebp
mov dword [rsp + 0xa4], edx
mov dword [rsp + 0x28], edx
mov rdx, r15
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [rbx + 0x30], rax
mov rcx, rax
test rax, rax
je 0x14018fd31
mov r8, rbx
mov edx, 0xffffffeb
call qword [sym.imp.USER32.dll_SetWindowLongPtrA]
mov rax, qword [rbx + 0x38]
mov rbp, qword [rbx]
mov rcx, qword [rax]
test rbp, rbp
je 0x14018fc70
cmp byte [rbp], 0
je 0x14018fc70
mov rax, qword [rcx]
mov rdx, qword [0x1403a8b40]
lea r8, [rsp + 0x70]
call qword [rax]
test eax, eax
jne 0x14018fbba
mov rsi, rbp
mov ecx, 0xf
lea rdi, str.data:text_html_
repe cmpsb byte [rsi], byte [rdi]
lea r8, str.about:blank
mov r15, r8
seta sil
sbb sil, 0
movsx esi, sil
test esi, esi
cmovne r15, rbp
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_VariantInit]
mov eax, 8
xor edx, edx
mov r8, r15
mov r9d, 0xffffffff
mov ecx, 0xfde9
mov word [rsp + 0xb0], ax
mov rdi, qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rdi
xor ecx, ecx
mov edx, eax
mov rax, qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [rsp + 0x60], edx
add rdx, rdx
mov qword [rsp + 0x68], rax
call rax
mov r9d, dword [rsp + 0x60]
test rax, rax
mov r14, rax
je 0x14018fc5f
xor edx, edx
mov r8, r15
mov dword [rsp + 0x28], r9d
mov ecx, 0xfde9
mov r9d, 0xffffffff
mov qword [rsp + 0x20], r14
call rdi
mov rax, qword [sym.imp.OLEAUT32.dll_SysAllocString]
mov rcx, r14
mov qword [rsp + 0x60], rax
call rax
mov rcx, r14
mov r14, qword [sym.imp.KERNEL32.dll_GlobalFree]
mov qword [rsp + 0xb8], rax
call r14
cmp qword [rsp + 0xb8], 0
je 0x14018fc5f
mov rcx, qword [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov rdx, r13
mov rax, qword [rcx]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call qword [rax + 0x1a0]
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_VariantClear]
test esi, esi
je 0x14018fca0
mov rdx, qword [rbx + 8]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.USER32.dll_SetWindowTextA]
mov rcx, qword [rbx + 0x30]
mov edx, 0xa
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.USER32.dll_SetFocus]
nop
movaps xmm6, xmmword [rsp + 0x1e0]
mov eax, r12d
add rsp, 0x1f8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test al, al
jne 0x14018fd00
mov byte [rbp + 1], 0
mov rcx, qword [rsp + 0x70]
lea rdx, [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x90]
test eax, eax
jne 0x14018fc5f
mov rcx, qword [rsp + 0x78]
mov rdx, qword [0x1403a8ad0]
lea r8, [rsp + 0x80]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
je 0x14018fd42
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14018fbba
mov rax, qword [rcx]
mov rdx, qword [0x1403a8b40]
lea r8, [rsp + 0x70]
call qword [rax]
mov esi, eax
test eax, eax
jne 0x14018fbba
lea rbp, str.data:text_html__3C_21DOCTYPE_20html_3E_0A_3Chtml_20lang_22en_22_3E_0A_3Chead_3E_3Cmeta_20charset_22utf_8_22_3E_3Cmeta_20http_equiv_22IEedge_22_20content_22IEedge_22_3E_3C_2Fhead_3E_0A_3Cbody_3E_3Cdiv_20id_22app_22_3E_3C_2Fdiv_3E_3Cscript_20type_22text_2Fjavascript_22_3E_3C_2Fscript_3E_3C_2Fbody_3E_0A_3C_2Fhtml_3E
lea r15, str.about:blank
jmp 0x14018fac5
mov rcx, rbp
lea rsi, [rbp + 0xf]
lea r15, str._02x
call sym.strlen
mov ecx, 1
lea rdx, [rax + 1]
call sym.calloc
movzx edx, byte [rbp + 0xf]
mov r13, rax
mov rbp, rax
mov byte [rax], dl
test dl, dl
je 0x14018fc1c
nop dword [rax]
movzx eax, byte [rsi + 1]
cmp dl, 0x25
je 0x14018fc10
add rbp, 1
add rsi, 1
mov byte [rbp], al
test al, al
je 0x14018fc1c
mov edx, eax
jmp 0x14018fcd8
cmp byte [rsi + 2], 0
jne 0x14018fd18
add rbp, 1
add rsi, 1
mov edx, eax
mov byte [rbp], al
jmp 0x14018fcd8
lea rcx, [rsi + 1]
mov r8, rbp
mov rdx, r15
add rsi, 2
call sym.sscanf.constprop.0
movzx eax, byte [rsi + 1]
jmp 0x14018fce5
call qword [sym.imp.ole32.dll_OleUninitialize]
mov r12d, 0xffffffff
jmp 0x14018fbec
lea r8, [0x1403a7538]
mov edx, 1
mov ecx, 0xc
call qword [sym.imp.OLEAUT32.dll_SafeArrayCreate]
mov rsi, rax
test rax, rax
je 0x14018fe37
lea rdx, [rsp + 0x88]
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SafeArrayAccessData]
test eax, eax
jne 0x14018fe2e
mov rax, qword [rsp + 0x88]
mov edx, 8
mov r8, r13
mov ecx, 0xfde9
mov r9d, 0xffffffff
mov word [rax], dx
xor edx, edx
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
call rdi
xor ecx, ecx
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rbp, rdx
add rdx, rdx
call rax
mov r15, rax
test rax, rax
je 0x14018fe37
mov r9d, 0xffffffff
mov r8, r13
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call rdi
mov rcx, r15
mov rax, qword [rsp + 0x60]
call rax
mov rcx, r15
mov rdi, rax
call r14
mov rax, qword [rsp + 0x88]
mov qword [rax + 8], rdi
test rdi, rdi
je 0x14018fe2e
mov rcx, qword [rsp + 0x80]
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + 0x1d8]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
call qword [rax + 0x1f0]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov rcx, r13
call sym.free
mov rcx, qword [rsp + 0x80]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14018fc54
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r12d, 0xffffffff
jmp 0x14018fbec