Function at 0x14001ab70
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push rbp
push rbx
push r12
push r14
push r15
lea rbp, [rsp - 0x290]
sub rsp, 0x390
mov rax, qword [0x1400db800]
xor rax, rsp
mov qword [rbp + 0x270], rax
mov r15, rdx
mov r14, r9
mov edx, 0x2e
mov r12, r8
call fcn.140096720
mov rbx, rax
test rax, rax
je 0x14001ae67
lea rax, [rsp + 0x58]
mov qword [rsp + 0x388], rsi
mov qword [rsp + 0x40], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
mov qword [rsp + 0x380], rdi
mov qword [rsp + 0x38], rax
xor edi, edi
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], 2
mov rdx, rbx
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test eax, eax
jne 0x14001ae4f
lea r9, [rbx + 2]
mov edx, 0x80
lea r8, str._sfile
lea rcx, [rsp + 0x60]
call fcn.140001040
lea rcx, [rsp + 0x60]
call qword [sym.imp.USER32.dll_CharLowerW]
mov rbx, 0xffffffffffffffff
lea rcx, [rsp + 0x60]
mov rax, rbx
cmp word [rcx + rax*2 + 2], di
lea rax, [rax + 1]
jne 0x14001ac43
mov rcx, qword [rsp + 0x50]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
lea rax, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x60]
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001ad0d
mov rax, rbx
nop dword [rax + rax]
cmp word [r15 + rax*2 + 2], di
lea rax, [rax + 1]
jne 0x14001acd0
mov rcx, qword [rsp + 0x50]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], r15
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14, r14
je 0x14001adb0
lea r9, [rsp + 0x60]
mov edx, 0x104
lea r8, str._sDefaultIcon
lea rcx, [rbp + 0x60]
call fcn.140001040
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0x60]
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14001adb0
mov rax, rbx
cmp word [r14 + rax*2 + 2], di
lea rax, [rax + 1]
jne 0x14001ad73
mov rcx, qword [rsp + 0x50]
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], r14
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r9, [rsp + 0x60]
mov edx, 0x104
lea r8, str._s_shellopencommand
lea rcx, [rbp + 0x60]
call fcn.140001040
lea rax, [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0x60]
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x38], rax
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test eax, eax
jne 0x14001ae4f
nop dword [rax]
cmp word [r12 + rbx*2 + 2], di
lea rbx, [rbx + 1]
jne 0x14001ae10
mov rcx, qword [rsp + 0x50]
lea eax, [rbx*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], r12
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
mov esi, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
mov rsi, qword [rsp + 0x388]
sete dil
mov eax, edi
mov rdi, qword [rsp + 0x380]
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.140094850
add rsp, 0x390
pop r15
pop r14
pop r12
pop rbx
pop rbp
ret