Function at 0x140046f70
Capabilities:
Check os version
Persist via appinit_dlls registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x50
xor edi, edi
mov esi, r8d
mov rbp, rdx
mov dword [rsp + 0x88], edi
mov rbx, rdi
mov r9, rcx
mov rcx, qword [0x140080018]
lea r12, [0x140080018]
cmp rcx, r12
je 0x140046fd1
test byte [rcx + 0x3c], 1
je 0x140046fd1
cmp byte [rcx + 0x39], 5
jb 0x140046fd1
mov rcx, qword [rcx + 0x30]
lea r8, [0x1400712a0]
mov dx, 0x38
call fcn.1400012a0
mov rcx, qword [0x140080018]
cmp qword [0x14008d4c0], rbx
jne 0x140047006
cmp rcx, r12
je 0x140046fff
test byte [rcx + 0x3c], 1
je 0x140046fff
cmp byte [rcx + 0x39], 5
jb 0x140046fff
mov rcx, qword [rcx + 0x30]
lea r8, [0x1400712a0]
mov dx, 0x39
call fcn.1400249f0
xor eax, eax
jmp 0x1400474a6
lea r8, [rsp + 0x40]
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionWindows
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x140047050
mov rcx, qword [0x140080018]
cmp rcx, r12
je 0x140047487
test byte [rcx + 0x3c], 1
je 0x140047487
cmp byte [rcx + 0x39], 5
jb 0x140047487
mov dx, 0x3a
jmp 0x140047474
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jb 0x140047108
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
lea rdx, str.LoadAppInit_DLLs
xor r8d, r8d
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400470c5
mov rcx, qword [0x140080018]
cmp rcx, r12
je 0x140047487
test byte [rcx + 0x3c], 1
je 0x140047487
cmp byte [rcx + 0x39], 5
jb 0x140047487
mov dx, 0x3b
jmp 0x140047474
cmp dword [rsp + 0x38], ebx
jne 0x140047108
mov rcx, qword [0x140080018]
cmp rcx, r12
je 0x140047487
test byte [rcx + 0x3c], 1
je 0x140047487
cmp byte [rcx + 0x39], 5
jb 0x140047487
mov rcx, qword [rcx + 0x30]
lea r8, [0x1400712a0]
mov dx, 0x3c
call fcn.1400249f0
jmp 0x140047487
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x88]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.AppInit_DLLs
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140047458
mov eax, dword [rsp + 0x88]
test eax, eax
jne 0x140047177
mov rcx, qword [0x140080018]
cmp rcx, r12
je 0x140047487
test byte [rcx + 0x3c], 1
je 0x140047487
cmp byte [rcx + 0x39], 5
jb 0x140047487
xor r9d, r9d
mov dx, 0x3d
jmp 0x140047477
mov r9d, dword [rsp + 0x30]
cmp r9d, 1
je 0x1400471af
mov rcx, qword [0x140080018]
cmp rcx, r12
je 0x140047487
test byte [rcx + 0x3c], 1
je 0x140047487
cmp byte [rcx + 0x39], 5
jb 0x140047487
mov dx, 0x3e
jmp 0x140047477
mov rcx, rax
call fcn.14004c8b0
test rax, rax
mov rbx, rax
je 0x140047217
nop
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x88]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.AppInit_DLLs
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14004728e
cmp eax, 0xea
jne 0x140047254
mov rcx, rbx
call fcn.14004ca6c
mov ecx, dword [rsp + 0x88]
call fcn.14004c8b0
test rax, rax
mov rbx, rax
jne 0x1400471c0
mov rcx, qword [0x140080018]
cmp rcx, r12
je 0x140047487
test byte [rcx + 0x3c], 1
je 0x140047487
cmp byte [rcx + 0x39], 5
jb 0x140047487
mov rcx, qword [rcx + 0x30]
lea r8, [0x1400712a0]
mov dx, 0x3f
call fcn.1400249f0
jmp 0x140047487
mov rax, qword [0x140080018]
cmp rax, r12
je 0x140047487
test byte [rax + 0x3c], 1
je 0x140047487
cmp byte [rax + 0x39], 5
jb 0x140047487
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [0x140080018]
mov dx, 0x41
jmp 0x140047474
mov r9d, dword [rsp + 0x30]
cmp r9d, 1
je 0x1400472c6
mov rcx, qword [0x140080018]
cmp rcx, r12
je 0x140047487
test byte [rcx + 0x3c], 1
je 0x140047487
cmp byte [rcx + 0x39], 5
jb 0x140047487
mov dx, 0x40
jmp 0x140047477
mov eax, dword [rsp + 0x88]
shr rax, 1
cmp word [rbx + rax*2 - 2], di
je 0x140047314
mov rcx, qword [0x140080018]
cmp rcx, r12
je 0x140047487
test byte [rcx + 0x3c], 1
je 0x140047487
cmp byte [rcx + 0x39], 5
jb 0x140047487
mov rcx, qword [rcx + 0x30]
lea r8, [0x1400712a0]
mov dx, 0x42
call fcn.1400249f0
jmp 0x140047487
mov rcx, qword [0x140080018]
cmp rcx, r12
je 0x140047343
test byte [rcx + 0x3c], 1
je 0x140047343
cmp byte [rcx + 0x39], 5
jb 0x140047343
mov rcx, qword [rcx + 0x30]
lea r8, [0x1400712a0]
mov r9, rbx
mov dx, 0x43
call fcn.1400012a0
mov rcx, qword [0x14008d4c0]
mov rdx, rbx
call fcn.140048820
cmp al, 1
jne 0x1400473e1
mov rcx, qword [0x140080018]
cmp rcx, r12
je 0x140047385
test byte [rcx + 0x3c], al
je 0x140047385
cmp byte [rcx + 0x39], 5
jb 0x140047385
mov rcx, qword [rcx + 0x30]
lea r8, [0x1400712a0]
mov dx, 0x44
call fcn.1400249f0
mov rcx, qword [0x14008d4c0]
mov rdx, rbx
call fcn.140048fd0
cmp al, 1
jne 0x1400473b5
mov rcx, qword [0x140080018]
cmp rcx, r12
je 0x1400473e1
test byte [rcx + 0x3c], al
je 0x1400473e1
cmp byte [rcx + 0x39], 5
jb 0x1400473e1
mov dx, 0x45
jmp 0x1400473d1
mov rcx, qword [0x140080018]
cmp rcx, r12
je 0x1400473e1
test byte [rcx + 0x3c], 1
je 0x1400473e1
cmp byte [rcx + 0x39], 5
jb 0x1400473e1
mov dx, 0x46
mov rcx, qword [rcx + 0x30]
lea r8, [0x1400712a0]
call fcn.1400249f0
mov rcx, qword [0x14008d4c0]
mov r8d, esi
mov rdx, rbp
call fcn.1400488a0
cmp al, 1
jne 0x14004742a
mov edi, 1
mov rcx, qword [0x140080018]
cmp rcx, r12
je 0x140047487
test byte [rcx + 0x3c], dil
je 0x140047487
cmp byte [rcx + 0x39], 5
jb 0x140047487
mov rcx, qword [rcx + 0x30]
lea r8, [0x1400712a0]
mov dx, 0x47
call fcn.1400249f0
jmp 0x140047487
mov rcx, qword [0x140080018]
cmp rcx, r12
je 0x140047487
test byte [rcx + 0x3c], 1
je 0x140047487
cmp byte [rcx + 0x39], 5
jb 0x140047487
mov rcx, qword [rcx + 0x30]
lea r8, [0x1400712a0]
mov dx, 0x48
call fcn.1400249f0
jmp 0x140047487
mov rcx, qword [0x140080018]
cmp rcx, r12
je 0x140047487
test byte [rcx + 0x3c], 1
je 0x140047487
cmp byte [rcx + 0x39], 5
jb 0x140047487
mov dx, 0x49
mov r9d, eax
mov rcx, qword [rcx + 0x30]
lea r8, [0x1400712a0]
call fcn.14003b5c0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140047497
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rbx, rbx
je 0x1400474a4
mov rcx, rbx
call fcn.14004ca6c
mov eax, edi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x50
pop r12
pop rdi
pop rsi
ret