Function at 0x1800061f0
Capabilities:
Check os version
Delete registry key
Delete registry value
Persist via contextmenuhandlers registry key
Persist via default file association registry key
Query or enumerate registry value
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1730]
mov eax, 0x1830
call fcn.180019420
sub rsp, rax
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rsp + 0x1870], rbx
mov rax, qword [0x18004f0b0]
xor rax, rsp
mov qword [rbp + 0x1720], rax
mov qword [rsp + 0x50], r9
mov rbx, r8
mov qword [rsp + 0x58], rbx
mov r14, rdx
mov r12, rcx
mov r15, qword [rbp + 0x1790]
mov qword [rsp + 0x40], r15
mov r13, qword [rbp + 0x17a8]
mov rax, qword [rbp + 0x17b8]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts_]
movaps xmmword [rbp + 0x130], xmm0
movaps xmm1, xmmword [0x1800356b0]
movaps xmmword [rbp + 0x140], xmm1
movaps xmm0, xmmword [0x1800356c0]
movaps xmmword [rbp + 0x150], xmm0
movaps xmm1, xmmword [0x1800356d0]
movaps xmmword [rbp + 0x160], xmm1
movaps xmm0, xmmword [0x1800356e0]
movaps xmmword [rbp + 0x170], xmm0
movaps xmm1, xmmword [0x1800356f0]
movaps xmmword [rbp + 0x180], xmm1
movaps xmm0, xmmword [0x180035700]
movaps xmmword [rbp + 0x190], xmm0
movsd xmm1, qword [0x180035710]
movsd qword [rbp + 0x1a0], xmm1
movzx eax, word [0x180035718]
mov word [rbp + 0x1a8], ax
xor eax, eax
mov qword [rbp + 0x1aa], rax
mov qword [rbp + 0x1b2], rax
mov qword [rbp + 0x1ba], rax
mov qword [rbp + 0x1c2], rax
mov qword [rbp + 0x1ca], rax
mov qword [rbp + 0x1d2], rax
mov qword [rbp + 0x1da], rax
mov qword [rbp + 0x1e2], rax
mov qword [rbp + 0x1ea], rax
mov dword [rbp + 0x1f2], eax
mov word [rbp + 0x1f6], ax
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp + 0x3d0]
call fcn.18001c150
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp + 0x300]
call fcn.18001c150
xor edx, edx
mov r8d, 0xc8
lea rcx, [rbp + 0x4a0]
call fcn.18001c150
xor edx, edx
mov r8d, 0x190
lea rcx, [rbp + 0x700]
call fcn.18001c150
xor edx, edx
mov r8d, 0x190
lea rcx, [rbp + 0xdc0]
call fcn.18001c150
xor edx, edx
mov r8d, 0x7d0
lea rcx, [rbp + 0xf50]
call fcn.18001c150
xor edx, edx
mov r8d, 0x190
lea rcx, [rbp + 0x890]
call fcn.18001c150
xor edx, edx
mov r8d, 0x190
lea rcx, [rbp + 0x570]
call fcn.18001c150
xor edx, edx
mov r8d, 0x190
lea rcx, [rbp + 0xa20]
call fcn.18001c150
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x200]
call fcn.18001c150
xor esi, esi
mov edi, esi
mov r9, r14
mov r8, rbx
lea rdx, str._s_s
lea rcx, [rbp + 0x200]
call fcn.180008b90
mov ecx, esi
nop word [rax + rax]
movzx eax, word [rbp + rcx + 0x130]
mov word [rbp + rcx + 0x3d0], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x180006420
lea rcx, [rbp + 0x3d0]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], si
jne 0x180006444
xor edx, edx
nop
movzx eax, word [r14 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x180006450
lea rax, [rbp + 0x3d0]
sub rax, 2
nop dword [rax]
lea rax, [rax + 2]
cmp word [rax], si
jne 0x180006470
movups xmm4, xmmword [str.OpenWithProgids]
movups xmmword [rax], xmm4
movups xmm5, xmmword [0x180035730]
movups xmmword [rax + 0x10], xmm5
movzx r11d, word [0x180035740]
mov word [rax + 0x20], r11w
mov rcx, rsi
nop
movzx eax, word [rbp + rcx + 0x130]
mov word [rbp + rcx + 0x300], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1800064a0
lea rcx, [rbp + 0x300]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], si
jne 0x1800064c4
xor edx, edx
nop
movzx eax, word [r14 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1800064d0
lea rax, [rbp + 0x300]
sub rax, 2
nop dword [rax]
lea rax, [rax + 2]
cmp word [rax], si
jne 0x1800064f0
movups xmm0, xmmword [str.UserChoice]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x180035758]
movsd qword [rax + 0x10], xmm1
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rbp + rcx + 0x130]
mov word [rbp + rcx + 0x4a0], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x180006520
lea rcx, [rbp + 0x4a0]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], si
jne 0x180006544
xor edx, edx
nop
movzx eax, word [r14 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x180006550
lea rcx, [rbp + 0x4a0]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], si
jne 0x180006570
movups xmm0, xmmword [str.OpenWithList]
movups xmmword [rcx], xmm0
movsd xmm1, qword [0x180035770]
movsd qword [rcx + 0x10], xmm1
mov eax, dword [0x180035778]
mov dword [rcx + 0x18], eax
lea rcx, [rbp + 0x130]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], si
jne 0x1800065a4
xor edx, edx
nop
movzx eax, word [r14 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1800065b0
mov r8, qword [r12 + 0x18]
cmp r8, 8
jb 0x1800065d3
mov rcx, qword [r12]
jmp 0x1800065d6
mov rcx, r12
lea rdx, [rbp + 0x700]
nop dword [rax]
movzx eax, word [rcx]
mov word [rdx], ax
lea rcx, [rcx + 2]
lea rdx, [rdx + 2]
test ax, ax
jne 0x1800065e0
lea rax, [rbp + 0x700]
sub rax, 2
nop
lea rax, [rax + 2]
cmp word [rax], si
jne 0x180006600
movups xmm2, xmmword [str.SoftwareClasses_]
movups xmmword [rax], xmm2
movups xmm3, xmmword [0x180035790]
movups xmmword [rax + 0x10], xmm3
mov r9d, dword [0x1800357a0]
mov dword [rax + 0x20], r9d
movzx r10d, word [0x1800357a4]
mov word [rax + 0x24], r10w
lea rcx, [rbp + 0x700]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], si
jne 0x180006641
xor edx, edx
nop dword [rax]
movzx eax, word [r14 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x180006650
mov rcx, rsi
nop word [rax + rax]
movzx eax, word [rbp + rcx + 0x700]
mov word [rbp + rcx + 0xdc0], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x180006670
lea rax, [rbp + 0xdc0]
sub rax, 2
lea rax, [rax + 2]
cmp word [rax], si
jne 0x180006694
movups xmmword [rax], xmm4
movups xmmword [rax + 0x10], xmm5
mov word [rax + 0x20], r11w
cmp r8, 8
jb 0x1800066b5
mov rcx, qword [r12]
jmp 0x1800066b8
mov rcx, r12
lea rdx, [rbp + 0xf50]
nop
movzx eax, word [rcx]
mov word [rdx], ax
lea rcx, [rcx + 2]
lea rdx, [rdx + 2]
test ax, ax
jne 0x1800066c0
lea rax, [rbp + 0xf50]
sub rax, 2
nop
lea rax, [rax + 2]
cmp word [rax], si
jne 0x1800066e0
movups xmmword [rax], xmm2
movups xmmword [rax + 0x10], xmm3
mov dword [rax + 0x20], r9d
mov word [rax + 0x24], r10w
lea rcx, [rbp + 0xf50]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], si
jne 0x180006704
lea r11, [rbp + 0x200]
xor edx, edx
nop word [rax + rax]
movzx eax, word [r11 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x180006720
lea rcx, [rbp + 0xf50]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], si
jne 0x180006740
movups xmm0, xmmword [str.DefaultIcon]
movups xmmword [rcx], xmm0
movsd xmm1, qword [0x1800357b8]
movsd qword [rcx + 0x10], xmm1
movzx eax, word [0x1800357c0]
mov word [rcx + 0x18], ax
cmp r8, 8
jb 0x180006777
mov rcx, qword [r12]
jmp 0x18000677a
mov rcx, r12
lea rdx, [rbp + 0x890]
movzx eax, word [rcx]
mov word [rdx], ax
lea rcx, [rcx + 2]
lea rdx, [rdx + 2]
test ax, ax
jne 0x180006781
lea rax, [rbp + 0x890]
sub rax, 2
nop
lea rax, [rax + 2]
cmp word [rax], si
jne 0x1800067a0
movups xmmword [rax], xmm2
movups xmmword [rax + 0x10], xmm3
mov dword [rax + 0x20], r9d
mov word [rax + 0x24], r10w
lea rcx, [rbp + 0x890]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], si
jne 0x1800067c4
lea r11, [rbp + 0x200]
xor edx, edx
nop word [rax + rax]
movzx eax, word [r11 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1800067e0
lea rax, [rbp + 0x890]
sub rax, 2
nop dword [rax]
lea rax, [rax + 2]
cmp word [rax], si
jne 0x180006800
movups xmm0, xmmword [str._shellopencommand]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1800357d8]
movups xmmword [rax + 0x10], xmm1
movsd xmm0, qword [0x1800357e8]
movsd qword [rax + 0x20], xmm0
cmp r8, 8
jb 0x180006837
mov rcx, qword [r12]
jmp 0x18000683a
mov rcx, r12
lea rdx, [rbp + 0x570]
movzx eax, word [rcx]
mov word [rdx], ax
lea rcx, [rcx + 2]
lea rdx, [rdx + 2]
test ax, ax
jne 0x180006841
lea rax, [rbp + 0x570]
sub rax, 2
nop
lea rax, [rax + 2]
cmp word [rax], si
jne 0x180006860
movups xmmword [rax], xmm2
movups xmmword [rax + 0x10], xmm3
mov dword [rax + 0x20], r9d
mov word [rax + 0x24], r10w
lea rcx, [rbp + 0x570]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], si
jne 0x180006884
lea r11, [rbp + 0x200]
xor edx, edx
nop word [rax + rax]
movzx eax, word [r11 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x1800068a0
lea rcx, [rbp + 0x570]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], si
jne 0x1800068c0
movups xmm0, xmmword [str._shellexContextMenuHandlers_]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x180035800]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [0x180035810]
movups xmmword [rcx + 0x20], xmm0
movsd xmm1, qword [0x180035820]
movsd qword [rcx + 0x30], xmm1
mov eax, dword [0x180035828]
mov dword [rcx + 0x38], eax
cmp r8, 8
jb 0x18000690b
mov rcx, qword [r12]
jmp 0x18000690e
mov rcx, r12
lea rdx, [rbp + 0xa20]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx], ax
lea rcx, [rcx + 2]
lea rdx, [rdx + 2]
test ax, ax
jne 0x180006920
lea rax, [rbp + 0xa20]
sub rax, 2
nop
lea rax, [rax + 2]
cmp word [rax], si
jne 0x180006940
movups xmmword [rax], xmm2
movups xmmword [rax + 0x10], xmm3
mov dword [rax + 0x20], r9d
mov word [rax + 0x24], r10w
lea rcx, [rbp + 0xa20]
sub rcx, 2
lea rcx, [rcx + 2]
cmp word [rcx], si
jne 0x180006964
lea r8, [rbp + 0x200]
xor edx, edx
nop word [rax + rax]
movzx eax, word [r8 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x180006980
lea rcx, [rbp + 0xa20]
sub rcx, 2
nop dword [rax]
lea rcx, [rcx + 2]
cmp word [rcx], si
jne 0x1800069a0
movups xmm0, xmmword [str._shellexDropHandler]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x180035840]
movups xmmword [rcx + 0x10], xmm1
movsd xmm0, qword [0x180035850]
movsd qword [rcx + 0x20], xmm0
movzx eax, word [0x180035858]
mov word [rcx + 0x28], ax
cmp byte [rbp + 0x17b0], sil
je 0x180007295
lea rcx, [rbp + 0x570]
sub rcx, 2
nop
lea rcx, [rcx + 2]
cmp word [rcx], si
jne 0x1800069f0
xor edx, edx
nop dword [rax + rax]
movzx eax, word [r13 + rdx*2]
mov word [rcx + rdx*2], ax
lea rdx, [rdx + 1]
test ax, ax
jne 0x180006a00
xor bl, bl
mov esi, 1
mov dword [rsp + 0x34], esi
xor ecx, ecx
mov dword [rsp + 0x30], ecx
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x34]
lea r8, str.ProgId
lea rdx, [rbp + 0x300]
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x180006c65
mov ecx, dword [rsp + 0x30]
call fcn.18001d564
mov r15, rax
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov rcx, rax
call fcn.18001c150
mov dword [rsp + 0x34], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x34]
lea r8, str.ProgId
lea rdx, [rbp + 0x300]
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test r15, r15
je 0x180006c60
mov rax, r15
lea r8, [rbp + 0x200]
sub r8, r15
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x180006ad4
add rax, 2
test ecx, ecx
jne 0x180006ac0
movzx ebx, bl
test edx, edx
cmove ebx, esi
mov rcx, r15
call fcn.18001d55c
test bl, bl
je 0x180006c60
xor ebx, ebx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x30]
lea r8, [rbp + 0x200]
lea rdx, [rbp + 0x3d0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x180006c60
lea rax, [rbp + 0x200]
mov qword [rsp + 0x20], rax
lea r9, [0x180035c10]
lea r8, [rbp + 0x700]
mov rdx, 0xffffffff80000003
mov rcx, r12
call fcn.1800051f0
test al, al
je 0x180006c60
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x30]
lea r8, [rbp + 0x200]
lea rdx, [rbp + 0xdc0]
mov rcx, 0xffffffff80000003
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov r15, qword [rsp + 0x40]
test eax, eax
jne 0x180006c65
mov qword [rsp + 0x20], r15
lea r9, [0x180035c10]
lea r8, [rbp + 0xf50]
mov rdx, 0xffffffff80000003
mov rcx, r12
call fcn.1800051f0
test al, al
je 0x180006c65
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [0x180035c10]
lea r8, [rbp + 0x890]
mov rdx, 0xffffffff80000003
mov rcx, r12
call fcn.1800051f0
test al, al
je 0x180006c65
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, [rbp + 0x570]
mov rcx, 0xffffffff80000003
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x180006c65
mov qword [rsp + 0x20], r13
lea r9, [0x180035c10]
lea r8, [rbp + 0xa20]
mov rdx, 0xffffffff80000003
mov rcx, r12
call fcn.1800051f0
test al, al
je 0x180006c65
mov rax, qword [rsp + 0x48]
mov byte [rax], bl
jmp 0x180007469
mov r15, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov byte [rax], sil
lea rdx, [rbp + 0x300]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, [rbp + 0x3d0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, [rbp + 0x4a0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, [rbp + 0x130]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, [rbp + 0x130]
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov dword [rsp + 0x3c], esi
xor r12d, r12d
mov dword [rsp + 0x38], r12d
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x3c]
lea r8, [0x180035c10]
mov rdx, r14
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
or rbx, 0xffffffffffffffff
test eax, eax
jne 0x180006e15
mov ecx, dword [rsp + 0x38]
call fcn.18001d564
mov rdi, rax
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov rcx, rax
call fcn.18001c150
mov dword [rsp + 0x3c], esi
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x3c]
lea r8, [0x180035c10]
mov rdx, r14
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test rdi, rdi
je 0x180006e15
mov rax, rbx
nop word [rax + rax]
inc rax
cmp word [rdi + rax*2], r12w
jne 0x180006d70
test rax, rax
je 0x180006e15
mov rax, rdi
lea r9, [rbp + 0x200]
sub r9, rdi
movzx edx, word [rax]
movzx ecx, word [rax + r9]
sub edx, ecx
jne 0x180006da4
add rax, 2
test ecx, ecx
jne 0x180006d90
test edx, edx
je 0x180006e15
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xbb0]
call fcn.18001c150
mov r8, qword [rsp + 0x58]
lea rdx, str._sBackup
lea rcx, [rbp + 0xbb0]
call fcn.180008b90
mov rax, rbx
nop word [rax + rax]
lea rax, [rax + 1]
cmp word [rdi + rax*2], r12w
jne 0x180006de0
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, esi
lea r8, [rbp + 0xbb0]
mov rdx, r14
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea rcx, [rbp + 0x200]
mov rax, rbx
nop
lea rax, [rax + 1]
cmp word [rcx + rax*2], r12w
jne 0x180006e20
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x200]
mov qword [rsp + 0x20], rax
mov r9d, esi
lea r8, [0x180035c10]
lea rdx, [rbp + 0x700]
mov rcx, 0xffffffff80000003
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rbp + 0x200]
lea rdx, [rbp + 0xdc0]
mov rcx, 0xffffffff80000003
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov rax, rbx
nop dword [rax + rax]
lea rax, [rax + 1]
cmp word [r15 + rax*2], r12w
jne 0x180006e90
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r15
mov r9d, esi
lea r8, [0x180035c10]
lea rdx, [rbp + 0xf50]
mov rcx, 0xffffffff80000003
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov rax, rbx
mov rcx, qword [rsp + 0x50]
lea rax, [rax + 1]
cmp word [rcx + rax*2], r12w
jne 0x180006ed1
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, esi
lea r8, [0x180035c10]
lea rdx, [rbp + 0x890]
mov rcx, 0xffffffff80000003
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, esi
xor r8d, r8d
lea rdx, [rbp + 0x570]
mov rcx, 0xffffffff80000003
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov rax, rbx
lea rax, [rax + 1]
cmp word [r13 + rax*2], r12w
jne 0x180006f31
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r13
mov r9d, esi
lea r8, [0x180035c10]
lea rdx, [rbp + 0xa20]
mov rcx, 0xffffffff80000003
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rbp + 0x200]
lea rdx, [rbp + 0x3d0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea rcx, [rbp + 0x200]
mov rax, rbx
nop dword [rax]
lea rax, [rax + 1]
cmp word [rcx + rax*2], r12w
jne 0x180006fa0
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x200]
mov qword [rsp + 0x20], rax
mov r9d, esi
lea r8, str.ProgId
lea rdx, [rbp + 0x300]
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor edx, edx
mov r8d, VarUI4FromDisp
lea rcx, [rbp - 0x4c]
call fcn.18001c150
mov dword [rbp - 0x50], VarUI4FromDisp
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rbp - 0x4c], 6
jb 0x180007243
cmp dword [rbp - 0x48], 2
jb 0x18000745c
mov byte [rbp + 0xd0], r12b
xor eax, eax
mov qword [rbp + 0xd1], rax
mov qword [rbp + 0xd9], rax
mov qword [rbp + 0xe1], rax
mov dword [rbp + 0xe9], eax
mov word [rbp + 0xed], ax
mov byte [rbp + 0xef], al
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], rax
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], rax
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], rax
call fcn.1800061a0
mov rcx, rax
call fcn.18000a9f0
mov qword [rbp - 0x60], 7
mov qword [rbp - 0x68], r12
mov word [rbp - 0x78], r12w
cmp word [rax], r12w
jne 0x1800070a8
mov r8, r12
jmp 0x1800070ba
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], r12w
jne 0x1800070b0
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.180008580
nop
mov qword [rbp - 0x80], 7
mov qword [rsp + 0x78], r12
mov word [rsp + 0x68], r12w
mov r9, rbx
xor r8d, r8d
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call fcn.180008410
nop
mov r8d, 0xc
lea rdx, str.Assohash.dll
lea rcx, [rsp + 0x68]
call fcn.1800082a0
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test rax, rax
je 0x180007149
lea rdx, str.HashAssociation
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180007149
lea r8, [rbp + 0xd0]
lea rdx, [rbp + 0x200]
mov rcx, r14
call rax
lea rcx, [rbp + 0xd0]
mov rax, rbx
inc rax
cmp byte [rcx + rax], 0
jne 0x180007153
test rax, rax
je 0x1800071f1
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, ebx
lea r8, [rbp + 0xd0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, ebx
lea r8, [rbp + 0xd0]
mov edx, esi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rax, [rbp + 0x200]
nop
lea rbx, [rbx + 1]
cmp word [rax + rbx*2], 0
jne 0x1800071b0
lea eax, [rbx*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, esi
lea r8, str.Hash
lea rdx, [rbp + 0x300]
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
nop
mov r8, qword [rbp - 0x80]
cmp r8, 8
jb 0x18000720d
inc r8
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x68]
call fcn.180008740
mov qword [rbp - 0x80], 7
mov qword [rsp + 0x78], r12
mov word [rsp + 0x68], r12w
mov r8, qword [rbp - 0x60]
cmp r8, 8
jb 0x18000745c
inc r8
mov rdx, qword [rbp - 0x78]
lea rcx, [rbp - 0x78]
call fcn.180008740
jmp 0x18000745c
lea rax, [rbp + 0x200]
nop word [rax + rax]
lea rbx, [rbx + 1]
cmp word [rax + rbx*2], r12w
jne 0x180007250
lea eax, [rbx*2 + 2]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x200]
mov qword [rsp + 0x20], rax
mov r9d, esi
lea r8, [0x180035c10]
lea rdx, [rbp + 0x130]
mov rcx, 0xffffffff80000003
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
jmp 0x18000745c
lea rdx, [rbp + 0x300]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, [rbp + 0x3d0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, [rbp + 0x4a0]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, [rbp + 0x130]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea rdx, [rbp + 0x130]
mov rcx, 0xffffffff80000001
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
lea rdx, [rbp + 0x200]
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov esi, 1
mov dword [rsp + 0x34], esi
mov dword [rsp + 0x30], edi
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0xbb0]
call fcn.18001c150
mov r8, rbx
lea rdx, str._sBackup
lea rcx, [rbp + 0xbb0]
call fcn.180008b90
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x34]
lea r8, [rbp + 0xbb0]
mov rdx, r14
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x180007469
mov ecx, dword [rsp + 0x30]
call fcn.18001d564
mov rdi, rax
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov rcx, rax
call fcn.18001c150
mov dword [rsp + 0x34], esi
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x34]
lea r8, [rbp + 0xbb0]
mov rdx, r14
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test rdi, rdi
je 0x180007469
or rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp word [rdi + rax*2], 0
jne 0x1800073d1
test rax, rax
je 0x18000745c
mov rax, rdi
lea r8, [rbp + 0x200]
sub r8, rdi
nop dword [rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x180007404
add rax, 2
test ecx, ecx
jne 0x1800073f0
test edx, edx
je 0x180007445
nop dword [rax + rax]
lea rbx, [rbx + 1]
cmp word [rdi + rbx*2], 0
jne 0x180007410
lea eax, [rbx*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, esi
lea r8, [0x180035c10]
mov rdx, r14
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea r8, [rbp + 0xbb0]
mov rdx, r14
mov rcx, 0xffffffff80000000
call qword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
test rdi, rdi
je 0x180007469
mov rcx, rdi
call fcn.18001d55c
mov rcx, qword [rbp + 0x1720]
xor rcx, rsp
call fcn.180019490
mov rbx, qword [rsp + 0x1870]
add rsp, 0x1830
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret