Function at 0x401680
Capabilities:
Check os version
Link many functions at runtime
Query or enumerate registry value
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x1d0
mov rax, qword [0x004115d0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov r14d, r9d
mov rbp, rcx
xor r15d, r15d
lea rax, [0x00411920]
mov qword [0x00411900], rax
lea rax, [0x00409850]
lea ebx, [r15 + 1]
mov qword [0x00411940], rax
lea rdi, [0x00411900]
lea rax, [0x00409860]
mov qword [0x00411910], r15
mov byte [0x00411918], bl
mov byte [0x00411919], r15b
mov qword [0x00411948], rax
mov word [0x0041191a], r15w
mov dword [0x0041191c], r15d
mov qword [0x00411930], r15
mov qword [0x00411920], r15
mov byte [0x00411938], bl
mov byte [0x00411939], r15b
mov word [0x0041193a], r15w
mov dword [0x0041193c], r15d
mov qword [0x00411040], rdi
lea rsi, [0x00411940]
mov r8, qword [rsi]
lea rax, [rdi + 8]
lea rcx, [0x004036d4]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], r15
mov r9d, ebx
mov rdx, rdi
mov qword [rsp + 0x28], r15
add rsi, 8
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
mov rdi, qword [rdi]
cmp rdi, r15
jne 0x401744
cmp qword [0x004119a0], r15
jne 0x4018e4
cmp byte [0x00411988], r15b
jne 0x40186a
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0xa0], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, r15d
je 0x4017db
cmp dword [rsp + 0xa4], 6
setb al
mov byte [0x00411989], al
cmp al, r15b
jne 0x40183e
lea rcx, str.advapi32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
cmp rax, r15
je 0x401836
lea rdx, str.EventWrite
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x00411990], rax
cmp rax, r15
je 0x401836
lea rdx, str.EventRegister
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x004115e8], rax
cmp rax, r15
jne 0x401846
lea rax, [0x004034ac]
mov qword [0x004115e8], rax
mov byte [0x00411989], bl
mov al, bl
mov byte [0x00411988], bl
jmp 0x401870
lea rdx, str.EventUnregister
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x00411998], rax
cmp rax, r15
je 0x401828
mov al, byte [0x00411989]
jmp 0x40183e
mov al, byte [0x00411989]
cmp al, r15b
jne 0x401899
lea r9, [0x004119a0]
lea r8, [0x004119a8]
lea rdx, [0x00403470]
lea rcx, [0x00409840]
call qword [0x004115e8]
jmp 0x4018e4
lea rdx, [0x004119a8]
lea rax, [0x00409840]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rcx
lea rcx, [0x004033e0]
mov r9d, ebx
mov r8, rax
mov qword [0x004119a0], rdx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r15
call qword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
mov rax, qword [0x00411040]
mov rdi, qword [rax + 0x30]
cmp rdi, r15
je 0x40194d
xor edx, edx
lea rcx, [rsp + 0x62]
lea r8d, [rdx + 0x36]
call sub.msvcrt.dll_memset
mov eax, 0x1bcf
mov r11d, 0x38
movdqu xmm0, xmmword [0x0040a1b0]
lea rdx, [rsp + 0x60]
mov rcx, rdi
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x60], r11w
mov dword [rsp + 0x8c], 0x20000
mov byte [rsp + 0x64], r15b
mov word [rsp + 0x66], ax
mov dword [rsp + 0x90], eax
call qword [sym.imp.ADVAPI32.dll_TraceEvent]
cmp dword [0x004119cc], r15d
je 0x4019a4
cmp byte [0x00411989], r15b
je 0x40196b
bt dword [0x004119c8], 8
jae 0x4019a4
jmp 0x40198a
bt qword [0x004119b8], 8
jae 0x4019a4
mov rcx, qword [0x004119c0]
mov rax, rcx
and eax, 0x100
cmp rax, rcx
jne 0x4019a4
mov rcx, qword [0x004119a0]
lea r8, [0x0040a1c0]
lea rdx, [0x0040a1d0]
call fcn.00403664
lea rcx, [0x00411950]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [0x00409a30]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], r15d
call fcn.0040292c
cmp dword [rsp + 0x40], r15d
jne 0x401a01
lea rcx, str.Kernel32.DLL
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp rax, r15
je 0x401a67
lea rdx, str.SetProcessDEPPolicy
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, r15
je 0x401a67
mov ecx, ebx
call rax
mov edx, ebx
jmp 0x401a5d
cmp dword [0x00411bf4], r15d
jne 0x401a4d
lea rcx, str.Kernel32.DLL
mov dword [0x00411bf4], ebx
mov rdi, r15
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp rax, r15
je 0x401a3c
lea rdx, str.SetProcessDEPPolicy
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, r15
cmovne rdi, rax
mov eax, r15d
cmp rdi, r15
setne al
mov dword [0x00411bf0], eax
jmp 0x401a53
mov eax, dword [0x00411bf0]
cmp eax, r15d
je 0x401a67
mov edx, 2
mov ecx, 0xc0
call sub.urlmon.dll_Ordinal_410
lea rcx, str.FEATURE_ENABLESAFESEARCHPATH_KB963027
call fcn.00402130
cmp eax, r15d
jne 0x401aaf
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp rax, r15
je 0x401aa3
lea rdx, str.SetSearchPathMode
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, r15
je 0x401aa3
mov ecx, ebx
call rax
lea rcx, [0x0040a1ac]
call sub.KERNEL32.dll_SetDllDirectoryW
mov r12d, 0x29
mov ecx, r12d
call fcn.004070a8
cmp eax, r15d
je 0x401b23
lea rcx, [0x0040f658]
mov dword [rsp + 0x40], r15d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea rdx, str.rand_s
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, r15
je 0x401b23
lea rcx, [rsp + 0x40]
call rax
cmp eax, r15d
jne 0x401b23
movzx eax, byte [rsp + 0x40]
mov edi, r15d
add eax, ebx
mov dword [rsp + 0x40], eax
je 0x401b23
mov r9d, ebx
mov edx, 0x10000
xor ecx, ecx
mov r8d, 0x2000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
add edi, ebx
cmp edi, dword [rsp + 0x40]
jb 0x401b05
call fcn.00401280
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rcx, [rsp + 0x40]
call fcn.00402704
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
mov rsi, rax
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov qword [0x004118c8], rbp
mov dword [rsp + 0x44], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x44]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp eax, r15d
je 0x401bfb
cmp dword [rsp + 0x44], r15d
lea rax, str.Microsoft.InternetExplorer.Default
lea rdi, str.Microsoft.InternetExplorer.64Bit
mov ecx, r12d
cmovne rdi, rax
call qword [sym.imp.SHLWAPI.dll_IsOS]
cmp eax, r15d
je 0x401bfb
mov rax, qword [0x00411980]
cmp rax, r15
jne 0x401bf6
mov rax, qword [0x00411978]
cmp rax, r15
jne 0x401bda
lea rcx, str.Shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x00411978], rax
cmp rax, r15
jne 0x401bda
mov rax, qword [0x00411980]
jmp 0x401bf1
lea rdx, [0x00409a48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x00411980], rax
cmp rax, r15
je 0x401bfb
mov rcx, rdi
call rax
call sub.iertutil.dll_Ordinal_46
mov ecx, 0x25
call qword [sym.imp.SHLWAPI.dll_IsOS]
cmp eax, r15d
je 0x401c1e
call sub.iertutil.dll_Ordinal_32
cmp eax, ebx
jne 0x401c1e
call sub.iertutil.dll_Ordinal_44
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, str._ResetDestinationList
lea edi, [rbx + rax]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, str._ResetDestinationList
mov r8d, eax
mov rcx, rsi
mov ebp, eax
call qword [sym.imp.SHLWAPI.dll_StrCmpNICW]
cmp eax, r15d
jne 0x401c60
mov r8d, ebp
mov edx, edi
mov rcx, rsi
call fcn.00403784
jmp 0x401c63
mov eax, r15d
cmp eax, r15d
je 0x401c75
call sub.IEFRAME.dll_Ordinal_212
mov ebx, r15d
jmp 0x401eff
mov rcx, rsi
call fcn.00401010
cmp eax, r15d
jne 0x401eff
mov ebp, 7
lea rdx, str.SCODEF:
mov rcx, rsi
mov r8, rbp
call qword [sym.imp.msvcrt.dll_wcsncmp]
cmp eax, r15d
jne 0x401d0e
lea rdi, [rsi + 0xe]
jmp 0x401cb3
cmp word [rdi], r15w
je 0x401cc7
add rdi, 2
movzx ecx, word [rdi]
call qword [sym.imp.msvcrt.dll_iswspace]
cmp eax, r15d
je 0x401ca9
jmp 0x401cc7
add rdi, 2
movzx ecx, word [rdi]
call qword [sym.imp.msvcrt.dll_iswspace]
cmp eax, r15d
jne 0x401cc3
lea rdx, str.CREDAT:
mov r8, rbp
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcsncmp]
cmp eax, r15d
jne 0x401d0e
cmp dword [rsp + 0x40], r15d
jne 0x401d04
mov edx, r14d
mov rcx, rsi
call sub.IEFRAME.dll_Ordinal_251
jmp 0x401efd
mov ebx, 5
jmp 0x401eff
cmp dword [rsp + 0x40], r15d
jne 0x401dc6
mov edi, 0x11c
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8, rdi
call sub.msvcrt.dll_memset
mov r8b, bl
mov edx, 2
xor ecx, ecx
mov dword [rsp + 0xa0], edi
mov dword [rsp + 0xa4], 6
mov dword [rsp + 0xa8], r15d
mov word [rsp + 0x1b6], r15w
mov word [rsp + 0x1b4], r15w
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, bl
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, bl
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, bl
mov edx, 0x10
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
lea rcx, [rsp + 0xa0]
mov edx, 0x33
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
cmp eax, r15d
je 0x401dc6
lea rcx, [rsp + 0x50]
call fcn.00403c44
mov rsi, qword [rsp + 0x50]
mov ebp, r15d
call sub.iertutil.dll_Ordinal_325
mov ecx, 0x25
movzx r12d, al
call qword [sym.imp.SHLWAPI.dll_IsOS]
cmp eax, r15d
je 0x401e6f
cmp rsi, r15
je 0x401df1
cmp r15w, word [rsi]
jne 0x401e6f
call sub.iertutil.dll_Ordinal_44
cmp eax, r15d
jne 0x401e6f
call sub.iertutil.dll_Ordinal_42
cmp eax, r15d
je 0x401e6f
cmp r12d, r15d
jne 0x401e6f
call fcn.004057b0
mov edi, eax
call sub.iertutil.dll_Ordinal_32
cmp eax, ebx
jne 0x401e50
cmp edi, ebx
jne 0x401e25
call fcn.00403b70
jmp 0x401e6d
cmp edi, 0xa
jne 0x401e34
lea ecx, [rdi - 8]
call fcn.004055dc
jmp 0x401e6f
cmp edi, 2
jne 0x401e6f
call fcn.00405718
cmp eax, ebx
jne 0x401e6f
mov ecx, ebx
call fcn.004055dc
cmp eax, r15d
jl 0x401e6f
jmp 0x401e1e
cmp edi, 2
je 0x401e68
cmp edi, 0xa
je 0x401e68
cmp edi, ebx
jne 0x401e6f
call fcn.00405718
cmp eax, 2
jne 0x401e6f
call fcn.00403a54
mov ebp, eax
call sub.iertutil.dll_Ordinal_32
cmp eax, ebx
jne 0x401ee5
mov ecx, 0x25
call qword [sym.imp.SHLWAPI.dll_IsOS]
cmp eax, r15d
je 0x401ee5
lea rax, [rsp + 0x50]
mov edi, 4
lea r9, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4c]
lea r8, str.HaveCreatedQuickLaunchItems
lea rdx, str.SoftwareMicrosoftInternet_ExplorerSetup
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x4c], r15d
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp eax, r15d
jne 0x401ee0
cmp dword [rsp + 0x44], edi
jne 0x401ee0
cmp dword [rsp + 0x4c], r15d
jne 0x401ee5
call fcn.004037c8
cmp ebp, r15d
jne 0x401eff
mov r9d, dword [rsp + 0x40]
mov r8d, r12d
mov edx, r14d
mov rcx, rsi
call sub.IEFRAME.dll_Ordinal_250
mov ebx, eax
mov rcx, qword [0x00411be0]
cmp rcx, r15
je 0x401f21
cmp rcx, qword [0x004118c8]
je 0x401f1a
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x00411be0], r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, [0x00411950]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
cmp byte [0x00411988], r15b
je 0x401f7f
mov rdi, qword [0x004119a0]
cmp rdi, r15
je 0x401f7f
cmp byte [0x00411989], r15b
jne 0x401f60
mov rcx, rdi
call qword [0x00411998]
jmp 0x401f78
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov dword [rdi + 0x20], r15d
mov byte [rdi + 0x28], r15b
mov qword [rdi + 8], r15
mov qword [rdi], r15
mov qword [0x004119a0], r15
mov rdi, qword [0x00411040]
lea rsi, [0x00411040]
cmp rdi, rsi
je 0x401fb6
jmp 0x401faa
mov rcx, qword [rdi + 8]
cmp rcx, r15
je 0x401fa7
call qword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov qword [rdi + 8], r15
mov rdi, qword [rdi]
cmp rdi, r15
jne 0x401f94
mov qword [0x00411040], rsi
lea r9, [rsp + 0x48]
lea r8, str.TerminateOnShutdown
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionsiexplore.exe
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x48], r15d
call fcn.00404b78
cmp dword [rsp + 0x48], r15d
je 0x401ff2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, ebx
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.004030d0
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret