Function at 0x1401053b0
Capabilities:
Link many functions at runtime
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x7c0]
sub rsp, 0x8c0
mov rax, qword [0x140672360]
xor rax, rsp
mov qword [rbp + 0x7b0], rax
movzx r13d, r8b
mov r12, rdx
mov r15, rcx
mov qword [rbp - 0x78], rcx
xor eax, eax
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x150], xmm1
mov qword [rbp + 0x160], rax
lea rax, vtable.AutoLock.0
mov qword [rbp + 0xd8], rax
lea rsi, [0x140686c78]
mov qword [rbp + 0xe0], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov r8, qword [0x140687dc0]
mov rdx, qword [0x140687db8]
lea rcx, [rbp + 0x150]
call fcn.1400eeb30
mov rdi, qword [rbp + 0x158]
mov rbx, qword [rbp + 0x150]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp rdi, rbx
jne 0x140105465
xor bl, bl
jmp 0x1401069fc
lea rax, str.0cg_
mov rcx, qword [str.0cg_]
cmp rcx, rax
je 0x1401054a1
test byte [rcx + 0x1c], 1
je 0x1401054a1
cmp byte [rcx + 0x19], 4
jb 0x1401054a1
mov edx, 0x13
mov qword [rsp + 0x20], r12
mov r9, r15
lea r8, [0x1405f92a0]
mov rcx, qword [rcx + 0x10]
call fcn.140079e40
mov rdi, qword [rbp + 0x150]
mov qword [rsp + 0x60], rdi
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0xd0], rax
cmp rdi, rax
je 0x1401069fa
xor esi, esi
mov r14d, 0x5c
mov qword [rbp + 0x100], rsi
mov qword [rbp + 0x110], rsi
mov qword [rbp + 0x118], 7
mov word [rbp + 0x100], si
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], si
lea r8d, [r14 - 0x55]
lea rdx, str.Classes
lea rcx, [rsp + 0x68]
call fcn.1400739a0
nop
mov qword [rbp + 0x120], rsi
mov rcx, rsi
mov qword [rbp + 0x130], rcx
mov edx, 7
mov qword [rbp + 0x138], rdx
mov word [rbp + 0x120], si
cmp qword [rdi + 0x18], 0
jbe 0x140105609
lea r9, [rdi + 8]
mov rbx, qword [r9 + 0x10]
cmp qword [r9 + 0x18], 8
jb 0x14010555a
mov r9, qword [r9]
lea rcx, [rbp + 0x120]
cmp rbx, 7
ja 0x140105584
mov qword [rbp + 0x130], rbx
lea r8, [rbx + rbx]
mov rdx, r9
call fcn.14035bc80
mov word [rbp + rbx*2 + 0x120], si
jmp 0x140105594
lfence
mov qword [rsp + 0x20], rbx
mov rdx, rbx
call fcn.1400735a0
mov rdx, qword [rbp + 0x130]
mov r8, qword [rbp + 0x138]
mov rax, r8
sub rax, rdx
cmp rax, 1
jb 0x1401055d7
lea rcx, [rdx + 1]
mov qword [rbp + 0x130], rcx
lea rax, [rbp + 0x120]
cmp r8, 8
cmovae rax, qword [rbp + 0x120]
mov word [rax + rdx*2], r14w
mov word [rax + rcx*2], si
jmp 0x1401055fb
lfence
mov qword [rsp + 0x20], 1
lea r9, [0x1405e45bc]
mov edx, 1
lea rcx, [rbp + 0x120]
call fcn.1400735a0
mov rcx, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x138]
lea r9, [rsp + 0x68]
mov rsi, qword [rsp + 0x68]
mov r14, qword [rbp - 0x80]
cmp r14, 8
cmovae r9, rsi
mov rax, rdx
sub rax, rcx
mov r8, qword [rsp + 0x78]
cmp r8, rax
ja 0x140105669
lea rdi, [r8 + rcx]
mov qword [rbp + 0x130], rdi
lea rbx, [rbp + 0x120]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x120]
lea rcx, [rbx + rcx*2]
add r8, r8
mov rdx, r9
call fcn.14035bc80
xor eax, eax
mov word [rbx + rdi*2], ax
mov rdi, qword [rsp + 0x60]
jmp 0x14010568b
lfence
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0x120]
call fcn.1400735a0
mov r14, qword [rbp - 0x80]
mov rsi, qword [rsp + 0x68]
lea rdx, [rbp + 0x120]
cmp qword [rbp + 0x138], 8
cmovae rdx, qword [rbp + 0x120]
lea rax, [rbp + 0xe8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
xor r8d, r8d
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
sete bl
mov rdx, qword [rbp + 0x138]
cmp rdx, 8
jb 0x14010570b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140105706
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140106a41
call fcn.140359090
xor eax, eax
mov word [rbp + 0x120], ax
cmp r14, 8
jb 0x14010574f
lea rdx, [r14*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140105747
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140106a47
mov rcx, rsi
call fcn.140359090
xor esi, esi
mov word [rsp + 0x68], si
test bl, bl
je 0x1401069a2
mov dword [rbp + 0xf8], 0x208
lea r9, [rbp + 0xf8]
lea r8, [rbp + 0x180]
mov rdx, r15
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x140105c52
cmp dword [rbp + 0xf8], 2
jle 0x140105c52
lea rax, [rbp + 0x180]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], si
jne 0x1401057b0
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x100]
call fcn.1400739a0
mov rcx, qword [rbp + 0x110]
mov rdx, qword [rbp + 0x118]
mov rax, rdx
sub rax, rcx
cmp rax, 0x13
jb 0x140105821
lea rdi, [rcx + 0x13]
mov qword [rbp + 0x110], rdi
lea rbx, [rbp + 0x100]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x100]
lea rcx, [rbx + rcx*2]
mov r8d, 0x26
lea rdx, str._shellopencommand
call fcn.14035bc80
mov word [rbx + rdi*2], si
jmp 0x140105845
lfence
mov qword [rsp + 0x20], 0x13
lea r9, str._shellopencommand
mov edx, 0x13
lea rcx, [rbp + 0x100]
call fcn.1400735a0
mov dword [rbp + 0xf8], 0x208
lea rbx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rbx, qword [rbp + 0x100]
mov rdi, qword [rbp + 0xe8]
cmp byte [0x14068a040], sil
jne 0x1401058b8
lea rcx, str.Advapi32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1401058a8
lea rdx, str.RegGetValueW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14068a048], rax
mov byte [0x14068a040], 1
jmp 0x1401058bf
mov rax, qword [0x14068a048]
mov byte [0x14068a040], 1
jmp 0x1401058bf
mov rax, qword [0x14068a048]
mov rdx, rbx
test rax, rax
je 0x1401058f8
lea rcx, [rbp + 0xf8]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x180]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rsi
mov r9d, 0x10000006
xor r8d, r8d
mov rcx, rdi
call qword [case.0x1401cd220.0]
jmp 0x14010590f
lea r9, [rbp + 0xf8]
lea r8, [rbp + 0x180]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
sete al
test al, al
je 0x140105a47
cmp dword [rbp + 0xf8], 2
jle 0x140105c52
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], si
mov r8, 0xffffffffffffffff
inc r8
cmp word [r12 + r8*2], si
jne 0x140105944
mov rdx, r12
lea rcx, [rbp + 0x30]
call fcn.1400739a0
nop
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], si
lea rax, [rbp + 0x180]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140105980
lea rdx, [rbp + 0x180]
lea rcx, [rbp - 0x70]
call fcn.1400739a0
nop
movzx r8d, r13b
lea rdx, [rbp + 0x30]
lea rcx, [rbp - 0x70]
call fcn.140100de0
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x1401059ee
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401059e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140106a4d
call fcn.140359090
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], si
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x140105a3e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140105a39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140106a53
call fcn.140359090
mov word [rbp + 0x30], si
jmp 0x140105c52
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0xffffffff80000002
je 0x140105c52
lea rbx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rbx, qword [rbp + 0x100]
cmp byte [0x14068a040], sil
jne 0x140105abb
lea rcx, str.Advapi32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140105aab
lea rdx, str.RegGetValueW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14068a048], rax
mov byte [0x14068a040], 1
jmp 0x140105ac2
mov rax, qword [0x14068a048]
mov byte [0x14068a040], 1
jmp 0x140105ac2
mov rax, qword [0x14068a048]
mov rdx, rbx
test rax, rax
je 0x140105aff
lea rcx, [rbp + 0xf8]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x180]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rsi
mov r9d, 0x10000006
xor r8d, r8d
mov rcx, 0xffffffff80000000
call qword [case.0x1401cd220.0]
jmp 0x140105b1a
lea r9, [rbp + 0xf8]
lea r8, [rbp + 0x180]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
sete al
test al, al
je 0x140105c52
cmp dword [rbp + 0xf8], 2
jle 0x140105c52
mov qword [rbp + 0x50], rsi
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x68], 7
mov word [rbp + 0x50], si
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [r12 + r8*2], si
jne 0x140105b50
mov rdx, r12
lea rcx, [rbp + 0x50]
call fcn.1400739a0
nop
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], si
lea rax, [rbp + 0x180]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140105b90
lea rdx, [rbp + 0x180]
lea rcx, [rbp - 0x50]
call fcn.1400739a0
nop
movzx r8d, r13b
lea rdx, [rbp + 0x50]
lea rcx, [rbp - 0x50]
call fcn.140100de0
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x140105bfe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140105bf9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140106a59
call fcn.140359090
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], si
mov rdx, qword [rbp + 0x68]
cmp rdx, 8
jb 0x140105c4e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140105c49
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140106a5f
call fcn.140359090
mov word [rbp + 0x50], si
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [r15 + r8*2], 0
jne 0x140105c60
mov rdx, r15
lea rcx, [rbp + 0x100]
call fcn.1400739a0
mov rcx, qword [rbp + 0x110]
mov rdx, qword [rbp + 0x118]
mov rax, rdx
sub rax, rcx
cmp rax, 0x13
jb 0x140105cce
lea rdi, [rcx + 0x13]
mov qword [rbp + 0x110], rdi
lea rbx, [rbp + 0x100]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x100]
lea rcx, [rbx + rcx*2]
mov r8d, 0x26
lea rdx, str._shellopencommand
call fcn.14035bc80
mov word [rbx + rdi*2], si
jmp 0x140105cf2
lfence
mov qword [rsp + 0x20], 0x13
lea r9, str._shellopencommand
mov edx, 0x13
lea rcx, [rbp + 0x100]
call fcn.1400735a0
mov dword [rbp + 0xf8], 0x208
lea rbx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rbx, qword [rbp + 0x100]
mov rdi, qword [rbp + 0xe8]
cmp byte [0x14068a040], 0
jne 0x140105d65
lea rcx, str.Advapi32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140105d55
lea rdx, str.RegGetValueW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14068a048], rax
mov byte [0x14068a040], 1
jmp 0x140105d6c
mov rax, qword [0x14068a048]
mov byte [0x14068a040], 1
jmp 0x140105d6c
mov rax, qword [0x14068a048]
mov rdx, rbx
test rax, rax
je 0x140105da5
lea rcx, [rbp + 0xf8]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x180]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rsi
mov r9d, 0x10000006
xor r8d, r8d
mov rcx, rdi
call qword [case.0x1401cd220.0]
jmp 0x140105dbc
lea r9, [rbp + 0xf8]
lea r8, [rbp + 0x180]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
sete al
test al, al
je 0x140105f05
cmp dword [rbp + 0xf8], 2
jle 0x140105f05
mov qword [rbp + 0x70], rsi
mov qword [rbp + 0x80], rsi
mov qword [rbp + 0x88], 7
mov word [rbp + 0x70], si
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [r12 + r8*2], 0
jne 0x140105e00
mov rdx, r12
lea rcx, [rbp + 0x70]
call fcn.1400739a0
nop
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], si
lea rax, [rbp + 0x180]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140105e40
lea rdx, [rbp + 0x180]
lea rcx, [rbp - 0x30]
call fcn.1400739a0
nop
movzx r8d, r13b
lea rdx, [rbp + 0x70]
lea rcx, [rbp - 0x30]
call fcn.140100de0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x140105eae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140105ea9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140106a65
call fcn.140359090
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], si
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x140105f01
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140105efc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140106a6b
call fcn.140359090
mov word [rbp + 0x70], si
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [r15 + r8*2], 0
jne 0x140105f10
mov rdx, r15
lea rcx, [rbp + 0x100]
call fcn.1400739a0
mov rcx, qword [rbp + 0x110]
mov rdx, qword [rbp + 0x118]
mov rax, rdx
sub rax, rcx
cmp rax, 0xd
jb 0x140105f7e
lea rdi, [rcx + 0xd]
mov qword [rbp + 0x110], rdi
lea rbx, [rbp + 0x100]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x100]
lea rcx, [rbx + rcx*2]
mov r8d, 0x1a
lea rdx, str.OpenWithList
call fcn.14035bc80
mov word [rbx + rdi*2], si
jmp 0x140105fa2
lfence
mov qword [rsp + 0x20], 0xd
lea r9, str.OpenWithList
mov edx, 0xd
lea rcx, [rbp + 0x100]
call fcn.1400735a0
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rdx, qword [rbp + 0x100]
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140106503
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea rax, [rbp + 0x140]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1401064f6
mov r15d, esi
cmp dword [rbp + 0x140], esi
jbe 0x1401064f2
nop
mov r9d, 0x104
lea r8, [rbp + 0x390]
mov edx, r15d
mov rcx, qword [rbp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x1401064e2
lea rax, str.open
mov qword [rbp + 0x168], rax
lea rax, [0x1405f90f0]
mov qword [rbp + 0x170], rax
lea r14, [rbp + 0x168]
nop dword [rax + rax]
mov rsi, qword [r14]
mov r8d, 0xd
lea rdx, str.Applications_
lea rcx, [rbp + 0x100]
call fcn.1400739a0
lea rax, [rbp + 0x390]
mov rdx, 0xffffffffffffffff
nop word [rax + rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x1401060c0
mov rcx, qword [rbp + 0x110]
mov r8, qword [rbp + 0x118]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x14010611d
lea rdi, [rcx + rdx]
mov qword [rbp + 0x110], rdi
lea rbx, [rbp + 0x100]
cmp r8, 8
cmovae rbx, qword [rbp + 0x100]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
lea rdx, [rbp + 0x390]
call fcn.14035bc80
xor eax, eax
mov word [rbx + rdi*2], ax
jmp 0x140106138
lfence
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x390]
lea rcx, [rbp + 0x100]
call fcn.1400735a0
mov rcx, qword [rbp + 0x110]
mov rdx, qword [rbp + 0x118]
mov rax, rdx
sub rax, rcx
cmp rax, 7
jb 0x14010618e
lea rdi, [rcx + 7]
mov qword [rbp + 0x110], rdi
lea rbx, [rbp + 0x100]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x100]
lea rcx, [rbx + rcx*2]
mov r8d, 0xe
lea rdx, str._shell_
call fcn.14035bc80
xor eax, eax
mov word [rbx + rdi*2], ax
jmp 0x1401061b2
lfence
mov qword [rsp + 0x20], 7
lea r9, str._shell_
mov edx, 7
lea rcx, [rbp + 0x100]
call fcn.1400735a0
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp word [rsi + rdx*2], 0
jne 0x1401061c0
mov rcx, qword [rbp + 0x110]
mov rax, qword [rbp + 0x118]
sub rax, rcx
lfence
cmp rdx, rax
ja 0x140106223
mov rdi, qword [rbp + 0x110]
add rdi, rdx
mov qword [rbp + 0x110], rdi
lea rbx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rbx, qword [rbp + 0x100]
lea rcx, [rbx + rcx*2]
lea r8, [rdx + rdx]
mov rdx, rsi
call fcn.14035bc80
xor esi, esi
mov word [rbx + rdi*2], si
jmp 0x140106239
mov qword [rsp + 0x20], rdx
mov r9, rsi
lea rcx, [rbp + 0x100]
call fcn.1400735a0
xor esi, esi
mov rcx, qword [rbp + 0x110]
mov rdx, qword [rbp + 0x118]
mov rax, rdx
sub rax, rcx
cmp rax, 8
jb 0x14010628d
lea rdi, [rcx + 8]
mov qword [rbp + 0x110], rdi
lea rbx, [rbp + 0x100]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x100]
lea rcx, [rbx + rcx*2]
mov r8d, 0x10
lea rdx, str.command
call fcn.14035bc80
mov word [rbx + rdi*2], si
jmp 0x1401062b1
lfence
mov qword [rsp + 0x20], 8
lea r9, str.command
mov edx, 8
lea rcx, [rbp + 0x100]
call fcn.1400735a0
mov dword [rbp + 0xf8], 0x208
lea rbx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rbx, qword [rbp + 0x100]
mov rdi, qword [rbp + 0xe8]
cmp byte [0x14068a040], 0
jne 0x140106324
lea rcx, str.Advapi32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x140106314
lea rdx, str.RegGetValueW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14068a048], rax
mov byte [0x14068a040], 1
jmp 0x14010632b
mov rax, qword [0x14068a048]
mov byte [0x14068a040], 1
jmp 0x14010632b
mov rax, qword [0x14068a048]
mov rdx, rbx
test rax, rax
je 0x140106364
lea rcx, [rbp + 0xf8]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x180]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rsi
mov r9d, 0x10000006
xor r8d, r8d
mov rcx, rdi
call qword [case.0x1401cd220.0]
jmp 0x14010637b
lea r9, [rbp + 0xf8]
lea r8, [rbp + 0x180]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
sete al
test al, al
je 0x1401064ce
cmp dword [rbp + 0xf8], 2
jle 0x1401064ce
mov qword [rbp + 0x90], rsi
mov qword [rbp + 0xa0], rsi
mov qword [rbp + 0xa8], 7
mov word [rbp + 0x90], si
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [r12 + r8*2], 0
jne 0x1401063c0
mov rdx, r12
lea rcx, [rbp + 0x90]
call fcn.1400739a0
nop
mov qword [rbp - 0x10], rsi
mov qword [rbp], rsi
mov qword [rbp + 8], 7
mov word [rbp - 0x10], si
lea rax, [rbp + 0x180]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140106400
lea rdx, [rbp + 0x180]
lea rcx, [rbp - 0x10]
call fcn.1400739a0
nop
movzx r8d, r13b
lea rdx, [rbp + 0x90]
lea rcx, [rbp - 0x10]
call fcn.140100de0
nop
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x140106471
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010646c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140106a71
call fcn.140359090
mov qword [rbp], rsi
mov qword [rbp + 8], 7
mov word [rbp - 0x10], si
mov rdx, qword [rbp + 0xa8]
cmp rdx, 8
jb 0x1401064c7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401064c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140106a77
call fcn.140359090
mov word [rbp + 0x90], si
add r14, 8
lea rax, [rbp + 0x178]
cmp r14, rax
jne 0x140106090
inc r15d
cmp r15d, dword [rbp + 0x140]
jb 0x140106040
mov r15, qword [rbp - 0x78]
mov rcx, qword [rbp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [r15 + r8*2], 0
jne 0x140106510
mov rdx, r15
lea rcx, [rbp + 0x100]
call fcn.1400739a0
mov rcx, qword [rbp + 0x110]
mov rdx, qword [rbp + 0x118]
mov rax, rdx
sub rax, rcx
cmp rax, 0x10
jb 0x14010657e
lea rdi, [rcx + 0x10]
mov qword [rbp + 0x110], rdi
lea rbx, [rbp + 0x100]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x100]
lea rcx, [rbx + rcx*2]
mov r8d, 0x20
lea rdx, str.OpenWithProgids
call fcn.14035bc80
mov word [rbx + rdi*2], si
jmp 0x1401065a2
lfence
mov qword [rsp + 0x20], 0x10
lea r9, str.OpenWithProgids
mov edx, 0x10
lea rcx, [rbp + 0x100]
call fcn.1400735a0
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rdx, qword [rbp + 0x100]
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140106990
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rsi
lea rax, [rbp + 0x144]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x140106983
cmp dword [rbp + 0x144], eax
jbe 0x140106981
xor r14d, r14d
nop
mov dword [rbp + 0x148], 0x104
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x148]
lea r8, [rbp + 0x5a0]
mov edx, esi
mov rcx, qword [rbp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x140106973
lea rax, [rbp + 0x5a0]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140106691
lea rdx, [rbp + 0x5a0]
lea rcx, [rbp + 0x100]
call fcn.1400739a0
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rcx, qword [rbp + 0x100]
mov r8d, 4
lea rdx, str.AppX
call fcn.14036ef28
test eax, eax
je 0x140106973
mov rcx, qword [rbp + 0x110]
mov rdx, qword [rbp + 0x118]
mov rax, rdx
sub rax, rcx
cmp rax, 0x13
jb 0x140106735
lea rdi, [rcx + 0x13]
mov qword [rbp + 0x110], rdi
lea rbx, [rbp + 0x100]
cmp rdx, 8
cmovae rbx, qword [rbp + 0x100]
lea rcx, [rbx + rcx*2]
mov r8d, 0x26
lea rdx, str._shellopencommand
call fcn.14035bc80
mov word [rbx + rdi*2], r14w
jmp 0x140106759
lfence
mov qword [rsp + 0x20], 0x13
lea r9, str._shellopencommand
mov edx, 0x13
lea rcx, [rbp + 0x100]
call fcn.1400735a0
mov dword [rbp + 0xf8], 0x208
lea rbx, [rbp + 0x100]
cmp qword [rbp + 0x118], 8
cmovae rbx, qword [rbp + 0x100]
mov rdi, qword [rbp + 0xe8]
cmp byte [0x14068a040], 0
jne 0x1401067cc
lea rcx, str.Advapi32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1401067bc
lea rdx, str.RegGetValueW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14068a048], rax
mov byte [0x14068a040], 1
jmp 0x1401067d3
mov rax, qword [0x14068a048]
mov byte [0x14068a040], 1
jmp 0x1401067d3
mov rax, qword [0x14068a048]
mov rdx, rbx
test rax, rax
je 0x14010680c
lea rcx, [rbp + 0xf8]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x180]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r14
mov r9d, 0x10000006
xor r8d, r8d
mov rcx, rdi
call qword [case.0x1401cd220.0]
jmp 0x140106823
lea r9, [rbp + 0xf8]
lea r8, [rbp + 0x180]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
sete al
test al, al
je 0x140106973
cmp dword [rbp + 0xf8], 2
jle 0x140106973
mov qword [rbp + 0xb0], r14
mov qword [rbp + 0xc0], r14
mov qword [rbp + 0xc8], 7
mov word [rbp + 0xb0], r14w
mov r8, 0xffffffffffffffff
inc r8
cmp word [r12 + r8*2], 0
jne 0x140106865
mov rdx, r12
lea rcx, [rbp + 0xb0]
call fcn.1400739a0
nop
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], r14w
lea rax, [rbp + 0x180]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x1401068a3
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x10]
call fcn.1400739a0
nop
movzx r8d, r13b
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x10]
call fcn.140100de0
nop
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x140106914
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010690f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140106a7d
call fcn.140359090
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], r14w
mov rdx, qword [rbp + 0xc8]
cmp rdx, 8
jb 0x14010696b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140106966
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140106a35
call fcn.140359090
mov word [rbp + 0xb0], r14w
inc esi
cmp esi, dword [rbp + 0x144]
jb 0x140106640
xor esi, esi
mov rcx, qword [rbp + 0xf0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbp + 0xe8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdi, qword [rsp + 0x60]
mov rdx, qword [rbp + 0x118]
cmp rdx, 8
jb 0x1401069e4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401069df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140106a3b
call fcn.140359090
add rdi, 0x48
mov qword [rsp + 0x60], rdi
cmp rdi, qword [rbp + 0xd0]
jne 0x1401054c6
mov bl, 1
lea rcx, [rbp + 0x150]
call fcn.14006ead0
movzx eax, bl
mov rcx, qword [rbp + 0x7b0]
xor rcx, rsp
call fcn.140359070
mov rbx, qword [rsp + 0x918]
add rsp, 0x8c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
nop
call fcn.140368068
int3