Function at 0x1400247c0
Capabilities:
Set registry value

Disassembly:
push rbx
sub rsp, 0x50
lea rax, [rsp + 0x60]
mov qword [rsp + 0x68], rdi
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rdx, str.SoftwareClassesexefile_shellpintostartscreencommand
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140024849
lea rbx, str.470C0EBD_5D73_4d58_9CED_E91E22E23282
mov edx, 0x1000
mov rcx, rbx
call fcn.140066080
lea r9d, [rdi + 1]
lea rdx, str.DelegateExecute
lea ecx, [rax + rax + 2]
xor r8d, r8d
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140024854
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x60]
lea rdx, str.SoftwareClassesexefile_shellpintostartscreen
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400248d2
lea rbx, str._shell32.dll__51201
mov edx, 0x1000
mov rcx, rbx
call fcn.140066080
lea rdx, str.MUIVerb
mov r9d, 1
lea ecx, [rax + rax + 2]
xor r8d, r8d
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400248dd
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x60]
lea rdx, str.SoftwareClassesexefile_shellpintostartscreen
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x14002495b
lea rbx, [0x14008db30]
mov edx, 0x1000
mov rcx, rbx
call fcn.140066080
lea rdx, str.NeverDefault
mov r9d, 1
lea ecx, [rax + rax + 2]
xor r8d, r8d
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140024966
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x60]
lea rdx, str.SoftwareClassesexefile_shellpintostartscreen
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1400249e4
lea rbx, str._shell32.dll__51202
mov edx, 0x1000
mov rcx, rbx
call fcn.140066080
lea rdx, str.Description
mov r9d, 1
lea ecx, [rax + rax + 2]
xor r8d, r8d
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400249ef
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x60]
lea rdx, str.SoftwareClassesexefile_shellpintostartscreen
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], edi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rdi, qword [rsp + 0x68]
test eax, eax
jne 0x140024a72
lea rbx, str.Single
mov edx, 0x1000
mov rcx, rbx
call fcn.140066080
lea rdx, str.MultiSelectModel
mov r9d, 1
lea ecx, [rax + rax + 2]
xor r8d, r8d
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140024a7d
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x50
pop rbx
ret