Function at 0x14000a064
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x608]
sub rsp, 0x6f0
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14007c010]
xor rax, rsp
mov qword [rbp + 0x5e0], rax
mov ebx, ecx
xor esi, esi
mov edi, esi
mov qword [rbp - 0x68], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x50], rsi
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x80], rsi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x58], rsi
mov dword [rbp - 0x60], 0x104
lea rax, str..mht
lea rdx, str..htm
test ecx, ecx
cmovne rdx, rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r14d, 0x20019
mov r9d, r14d
mov r15, 0xffffffff80000000
mov rcx, r15
call fcn.14000e39c
test eax, eax
je 0x14000a14d
lea rax, str..mhtml
lea rdx, str..html
test ebx, ebx
cmovne rdx, rax
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9d, r14d
mov rcx, r15
call fcn.14000e39c
test eax, eax
jne 0x14000a45c
movzx eax, byte [rbp - 0x50]
cmp dword [rsp + 0x30], 1
cmove eax, esi
mov byte [rbp - 0x50], al
lea rax, [rbp - 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000a45c
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea rdx, [rbp - 0x50]
mov rcx, r15
call fcn.14000e39c
test eax, eax
jne 0x14000a45c
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea rdx, [0x140048430]
mov rcx, r15
call fcn.14000e39c
test eax, eax
jne 0x14000a45c
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea rdx, str.42042206_2D85_11D3_8CFF_005004838597
mov rcx, qword [rsp + 0x50]
call fcn.14000e39c
test eax, eax
jne 0x14000a45c
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea rdx, str.Old_Icon
mov rcx, qword [rbp - 0x70]
call fcn.14000e39c
test eax, eax
jne 0x14000a45c
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea rdx, [rbp - 0x50]
mov rcx, qword [rbp - 0x78]
call fcn.14000e39c
test eax, eax
jne 0x14000a45c
mov dword [rsp + 0x40], 0x104
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea r15, str.DefaultIcon
mov rdx, r15
mov rcx, qword [rsp + 0x48]
call fcn.14000e39c
test eax, eax
jne 0x14000a30e
movzx eax, byte [rbp + 0x1c0]
cmp dword [rsp + 0x30], 1
cmove eax, esi
mov byte [rbp + 0x1c0], al
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000a30e
cmp word [rbp + 0x1c0], si
je 0x14000a30e
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
mov rdx, r15
mov rcx, qword [rsp + 0x38]
call fcn.14000e39c
test eax, eax
jne 0x14000a45c
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000a31b
jmp 0x14000a45c
mov rdx, r15
mov rcx, qword [rsp + 0x38]
call fcn.14000b1f4
mov dword [rsp + 0x44], 0x104
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea r15, str.ShellEx
mov rdx, r15
mov rcx, qword [rsp + 0x48]
call fcn.14000e39c
test eax, eax
jne 0x14000a435
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea rdx, str.IconHandler
mov rcx, qword [rsp + 0x60]
call fcn.14000e39c
test eax, eax
jne 0x14000a435
movzx eax, byte [rbp + 0x3d0]
cmp dword [rsp + 0x30], 1
cmove eax, esi
mov byte [rbp + 0x3d0], al
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x3d0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000a435
cmp word [rbp + 0x3d0], si
je 0x14000a435
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
mov rdx, r15
mov rcx, qword [rsp + 0x38]
call fcn.14000e39c
test eax, eax
jne 0x14000a45c
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
lea rdx, str.IconHandler
mov rcx, qword [rsp + 0x78]
call fcn.14000e39c
test eax, eax
jne 0x14000a45c
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x3d0]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x14000a442
jmp 0x14000a45c
mov rdx, r15
mov rcx, qword [rsp + 0x38]
call fcn.14000b1f4
test ebx, ebx
jne 0x14000a457
lea rdx, str.42042206_2D85_11D3_8CFF_005004838597
mov rcx, qword [rsp + 0x50]
call fcn.14000b1f4
mov edi, 1
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14000a46c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x58], rsi
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000a481
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x60], rsi
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14000a496
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x68], rsi
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14000a4ab
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x48], rsi
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14000a4c0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x70], rsi
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x14000a4d5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x78], rsi
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x14000a4e9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x80], rsi
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x14000a4fc
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x78], rsi
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x14000a50f
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x70], rsi
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14000a523
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x50], rsi
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x14000a538
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], rsi
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x14000a54c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rcx, qword [rbp + 0x5e0]
xor rcx, rsp
call fcn.14003ee60
lea r11, [rsp + 0x6f0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret