Function at 0x18001e800
Capabilities:
Set registry value

Disassembly:
push rdi
sub rsp, 0x490
mov rax, qword [0x18011e900]
xor rax, rsp
mov qword [rsp + 0x480], rax
mov rdi, rcx
test rcx, rcx
je 0x18001ea9f
mov r8d, 0x104
mov qword [rsp + 0x4a8], rbx
lea rdx, [rsp + 0x270]
lea rcx, [0x180106678]
call qword [sym.imp.ole32.dll_StringFromGUID2]
lea r9, [rsp + 0x270]
mov edx, 0x104
lea r8, str.CLSID_s
lea rcx, [rsp + 0x60]
call fcn.18001e740
mov ebx, eax
test eax, eax
js 0x18001ea93
lea rax, [rsp + 0x50]
mov qword [rsp + 0x4b0], rsi
xor esi, esi
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x40], rsi
xor r9d, r9d
mov qword [rsp + 0x38], rax
xor r8d, r8d
mov qword [rsp + 0x30], rsi
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
jle 0x18001e8c8
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x18001ea8b
lea rbx, str.EpubShellExtThumbnailHandler.EpubThumbnailProvider_Class
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x50]
mov r9d, 1
add eax, eax
xor r8d, r8d
mov dword [rsp + 0x28], eax
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jle 0x18001e910
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
js 0x18001ea8b
lea r9, [rsp + 0x270]
mov edx, 0x104
lea r8, str.CLSID_sInprocServer32
lea rcx, [rsp + 0x60]
call fcn.18001e740
mov ebx, eax
test eax, eax
js 0x18001ea8b
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
jle 0x18001e997
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x18001ea8b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x50]
mov r9d, 1
add eax, eax
xor r8d, r8d
mov dword [rsp + 0x28], eax
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jle 0x18001e9d8
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
js 0x18001ea8b
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x30], rsi
xor r9d, r9d
mov dword [rsp + 0x28], 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov dword [rsp + 0x20], esi
mov qword [rsp + 0x50], rsi
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ebx, eax
test eax, eax
jle 0x18001ea37
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
js 0x18001ea8b
lea rbx, str.Apartment
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rcx, qword [rsp + 0x50]
lea rdx, str.ThreadingModel
add eax, eax
mov r9d, 1
mov dword [rsp + 0x28], eax
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, eax
test eax, eax
jle 0x18001ea80
movzx ebx, ax
or ebx, 0x80070000
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0x4b0]
mov eax, ebx
mov rbx, qword [rsp + 0x4a8]
jmp 0x18001eaa4
mov eax, 0x80070057
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.18009e950
add rsp, 0x490
pop rdi
ret