Function at 0x401680
Capabilities:
Check os version
Link many functions at runtime
Query or enumerate registry value
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x1d0
mov rax, qword [0x004115d0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov r14d, r9d
mov rbp, rcx
xor r15d, r15d
lea rax, [0x004118f0]
mov qword [0x004118d0], rax
lea rax, [0x00409810]
lea ebx, [r15 + 1]
mov qword [0x00411910], rax
lea rdi, [0x004118d0]
lea rax, [0x00409820]
mov qword [0x004118e0], r15
mov byte [0x004118e8], bl
mov byte [0x004118e9], r15b
mov qword [0x00411918], rax
mov word [0x004118ea], r15w
mov dword [0x004118ec], r15d
mov qword [0x00411900], r15
mov qword [0x004118f0], r15
mov byte [0x00411908], bl
mov byte [0x00411909], r15b
mov word [0x0041190a], r15w
mov dword [0x0041190c], r15d
mov qword [0x00411040], rdi
lea rsi, [0x00411910]
mov r8, qword [rsi]
lea rax, [rdi + 8]
lea rcx, [0x00403654]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], r15
mov r9d, ebx
mov rdx, rdi
mov qword [rsp + 0x28], r15
add rsi, 8
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
mov rdi, qword [rdi]
cmp rdi, r15
jne 0x401744
cmp qword [0x00411970], r15
jne 0x4018e4
cmp byte [0x00411958], r15b
jne 0x40186a
lea rcx, [rsp + 0xa0]
mov dword [rsp + 0xa0], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp eax, r15d
je 0x4017db
cmp dword [rsp + 0xa4], 6
setb al
mov byte [0x00411959], al
cmp al, r15b
jne 0x40183e
lea rcx, str.advapi32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
cmp rax, r15
je 0x401836
lea rdx, str.EventWrite
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x00411960], rax
cmp rax, r15
je 0x401836
lea rdx, str.EventRegister
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x004115e8], rax
cmp rax, r15
jne 0x401846
lea rax, [0x0040342c]
mov qword [0x004115e8], rax
mov byte [0x00411959], bl
mov al, bl
mov byte [0x00411958], bl
jmp 0x401870
lea rdx, str.EventUnregister
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x00411968], rax
cmp rax, r15
je 0x401828
mov al, byte [0x00411959]
jmp 0x40183e
mov al, byte [0x00411959]
cmp al, r15b
jne 0x401899
lea r9, [0x00411970]
lea r8, [0x00411978]
lea rdx, [0x004033f0]
lea rcx, [0x00409800]
call qword [0x004115e8]
jmp 0x4018e4
lea rdx, [0x00411978]
lea rax, [0x00409800]
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rcx
lea rcx, [0x00403360]
mov r9d, ebx
mov r8, rax
mov qword [0x00411970], rdx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], r15
call qword [sym.imp.ADVAPI32.dll_RegisterTraceGuidsW]
mov rax, qword [0x00411040]
mov rdi, qword [rax + 0x30]
cmp rdi, r15
je 0x40194d
xor edx, edx
lea rcx, [rsp + 0x62]
lea r8d, [rdx + 0x36]
call sub.msvcrt.dll_memset
mov eax, 0x1bcf
mov r11d, 0x38
movdqu xmm0, xmmword [0x00409f38]
lea rdx, [rsp + 0x60]
mov rcx, rdi
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x60], r11w
mov dword [rsp + 0x8c], 0x20000
mov byte [rsp + 0x64], r15b
mov word [rsp + 0x66], ax
mov dword [rsp + 0x90], eax
call qword [sym.imp.ADVAPI32.dll_TraceEvent]
cmp dword [0x0041199c], r15d
je 0x4019a4
cmp byte [0x00411959], r15b
je 0x40196b
bt dword [0x00411998], 8
jae 0x4019a4
jmp 0x40198a
bt qword [0x00411988], 8
jae 0x4019a4
mov rcx, qword [0x00411990]
mov rax, rcx
and eax, 0x100
cmp rax, rcx
jne 0x4019a4
mov rcx, qword [0x00411970]
lea r8, [0x00409f48]
lea rdx, [0x00409f58]
call fcn.004035e4
lea rcx, [0x00411920]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [0x004099f0]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], r15d
call fcn.004028ac
cmp dword [rsp + 0x40], r15d
jne 0x401a01
lea rcx, str.Kernel32.DLL
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp rax, r15
je 0x401a67
lea rdx, [0x00409a70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, r15
je 0x401a67
mov ecx, ebx
call rax
mov edx, ebx
jmp 0x401a5d
cmp dword [0x00411afc], r15d
jne 0x401a4d
lea rcx, str.Kernel32.DLL
mov dword [0x00411afc], ebx
mov rdi, r15
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp rax, r15
je 0x401a3c
lea rdx, [0x00409a70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, r15
cmovne rdi, rax
mov eax, r15d
cmp rdi, r15
setne al
mov dword [0x00411af8], eax
jmp 0x401a53
mov eax, dword [0x00411af8]
cmp eax, r15d
je 0x401a67
mov edx, 2
mov ecx, 0xc0
call sub.urlmon.dll_Ordinal_410
lea rcx, str.FEATURE_ENABLESAFESEARCHPATH_KB963027
call fcn.004020b0
cmp eax, r15d
jne 0x401aaf
lea rcx, [0x0040a130]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp rax, r15
je 0x401aa3
lea rdx, str.SetSearchPathMode
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, r15
je 0x401aa3
mov ecx, ebx
call rax
lea rcx, [0x00409f34]
call sub.KERNEL32.dll_SetDllDirectoryW
call fcn.00401280
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetErrorMode]
lea rcx, [rsp + 0x40]
call fcn.00402684
xor r9d, r9d
xor r8d, r8d
mov edx, ebx
xor ecx, ecx
mov rdi, rax
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_HeapSetInformation]
mov qword [0x004118c8], rbp
mov dword [rsp + 0x44], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rsp + 0x44]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp eax, r15d
je 0x401b89
cmp dword [rsp + 0x44], r15d
lea rax, str.Microsoft.InternetExplorer.Default
lea rsi, str.Microsoft.InternetExplorer.64Bit
mov ecx, 0x29
cmovne rsi, rax
call qword [sym.imp.SHLWAPI.dll_IsOS]
cmp eax, r15d
je 0x401b89
mov rax, qword [0x00411950]
cmp rax, r15
jne 0x401b84
mov rax, qword [0x00411948]
cmp rax, r15
jne 0x401b68
lea rcx, str.Shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x00411948], rax
cmp rax, r15
jne 0x401b68
mov rax, qword [0x00411950]
jmp 0x401b7f
lea rdx, [0x00409a08]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x00411950], rax
cmp rax, r15
je 0x401b89
mov rcx, rsi
call rax
call sub.iertutil.dll_Ordinal_46
mov ecx, 0x25
call qword [sym.imp.SHLWAPI.dll_IsOS]
cmp eax, r15d
je 0x401bac
call sub.iertutil.dll_Ordinal_32
cmp eax, ebx
jne 0x401bac
call sub.iertutil.dll_Ordinal_44
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, str._ResetDestinationList
lea esi, [rbx + rax]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, str._ResetDestinationList
mov r8d, eax
mov rcx, rdi
mov ebp, eax
call qword [sym.imp.SHLWAPI.dll_StrCmpNICW]
cmp eax, r15d
jne 0x401bee
mov r8d, ebp
mov edx, esi
mov rcx, rdi
call fcn.00403704
jmp 0x401bf1
mov eax, r15d
cmp eax, r15d
je 0x401c03
call sub.IEFRAME.dll_Ordinal_212
mov ebx, r15d
jmp 0x401e8d
mov rcx, rdi
call fcn.00401010
cmp eax, r15d
jne 0x401e8d
mov ebp, 7
lea rdx, str.SCODEF:
mov rcx, rdi
mov r8, rbp
call qword [sym.imp.msvcrt.dll_wcsncmp]
cmp eax, r15d
jne 0x401c9c
lea rsi, [rdi + 0xe]
jmp 0x401c41
cmp word [rsi], r15w
je 0x401c55
add rsi, 2
movzx ecx, word [rsi]
call qword [sym.imp.msvcrt.dll_iswspace]
cmp eax, r15d
je 0x401c37
jmp 0x401c55
add rsi, 2
movzx ecx, word [rsi]
call qword [sym.imp.msvcrt.dll_iswspace]
cmp eax, r15d
jne 0x401c51
lea rdx, str.CREDAT:
mov r8, rbp
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcsncmp]
cmp eax, r15d
jne 0x401c9c
cmp dword [rsp + 0x40], r15d
jne 0x401c92
mov edx, r14d
mov rcx, rdi
call sub.IEFRAME.dll_Ordinal_251
jmp 0x401e8b
mov ebx, 5
jmp 0x401e8d
cmp dword [rsp + 0x40], r15d
jne 0x401d54
mov esi, 0x11c
lea rcx, [rsp + 0xa0]
xor edx, edx
mov r8, rsi
call sub.msvcrt.dll_memset
mov r8b, bl
mov edx, 2
xor ecx, ecx
mov dword [rsp + 0xa0], esi
mov dword [rsp + 0xa4], 6
mov dword [rsp + 0xa8], r15d
mov word [rsp + 0x1b6], r15w
mov word [rsp + 0x1b4], r15w
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, bl
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, bl
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, bl
mov edx, 0x10
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
lea rcx, [rsp + 0xa0]
mov edx, 0x33
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
cmp eax, r15d
je 0x401d54
lea rcx, [rsp + 0x50]
call fcn.00403bc4
mov rdi, qword [rsp + 0x50]
mov ebp, r15d
call sub.iertutil.dll_Ordinal_325
mov ecx, 0x25
movzx r12d, al
call qword [sym.imp.SHLWAPI.dll_IsOS]
cmp eax, r15d
je 0x401dfd
cmp rdi, r15
je 0x401d7f
cmp r15w, word [rdi]
jne 0x401dfd
call sub.iertutil.dll_Ordinal_44
cmp eax, r15d
jne 0x401dfd
call sub.iertutil.dll_Ordinal_42
cmp eax, r15d
je 0x401dfd
cmp r12d, r15d
jne 0x401dfd
call fcn.00405740
mov esi, eax
call sub.iertutil.dll_Ordinal_32
cmp eax, ebx
jne 0x401dde
cmp esi, ebx
jne 0x401db3
call fcn.00403af0
jmp 0x401dfb
cmp esi, 0xa
jne 0x401dc2
lea ecx, [rsi - 8]
call fcn.0040556c
jmp 0x401dfd
cmp esi, 2
jne 0x401dfd
call fcn.004056a8
cmp eax, ebx
jne 0x401dfd
mov ecx, ebx
call fcn.0040556c
cmp eax, r15d
jl 0x401dfd
jmp 0x401dac
cmp esi, 2
je 0x401df6
cmp esi, 0xa
je 0x401df6
cmp esi, ebx
jne 0x401dfd
call fcn.004056a8
cmp eax, 2
jne 0x401dfd
call fcn.004039d4
mov ebp, eax
call sub.iertutil.dll_Ordinal_32
cmp eax, ebx
jne 0x401e73
mov ecx, 0x25
call qword [sym.imp.SHLWAPI.dll_IsOS]
cmp eax, r15d
je 0x401e73
lea rax, [rsp + 0x50]
mov esi, 4
lea r9, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4c]
lea r8, str.HaveCreatedQuickLaunchItems
lea rdx, str.SoftwareMicrosoftInternet_ExplorerSetup
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x44], esi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x4c], r15d
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp eax, r15d
jne 0x401e6e
cmp dword [rsp + 0x44], esi
jne 0x401e6e
cmp dword [rsp + 0x4c], r15d
jne 0x401e73
call fcn.00403748
cmp ebp, r15d
jne 0x401e8d
mov r9d, dword [rsp + 0x40]
mov r8d, r12d
mov edx, r14d
mov rcx, rdi
call sub.IEFRAME.dll_Ordinal_250
mov ebx, eax
mov rcx, qword [0x00411ae8]
cmp rcx, r15
je 0x401eaf
cmp rcx, qword [0x004118c8]
je 0x401ea8
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x00411ae8], r15
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rcx, [0x00411920]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
cmp byte [0x00411958], r15b
je 0x401f0d
mov rdi, qword [0x00411970]
cmp rdi, r15
je 0x401f0d
cmp byte [0x00411959], r15b
jne 0x401eee
mov rcx, rdi
call qword [0x00411968]
jmp 0x401f06
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov dword [rdi + 0x20], r15d
mov byte [rdi + 0x28], r15b
mov qword [rdi + 8], r15
mov qword [rdi], r15
mov qword [0x00411970], r15
mov rdi, qword [0x00411040]
lea rsi, [0x00411040]
cmp rdi, rsi
je 0x401f44
jmp 0x401f38
mov rcx, qword [rdi + 8]
cmp rcx, r15
je 0x401f35
call qword [sym.imp.ADVAPI32.dll_UnregisterTraceGuids]
mov qword [rdi + 8], r15
mov rdi, qword [rdi]
cmp rdi, r15
jne 0x401f22
mov qword [0x00411040], rsi
lea r9, [rsp + 0x48]
lea r8, str.TerminateOnShutdown
lea rdx, str.SoftwareMicrosoftWindows_NTCurrentVersionImage_File_Execution_Optionsiexplore.exe
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x48], r15d
call fcn.00404af4
cmp dword [rsp + 0x48], r15d
je 0x401f80
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, ebx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, ebx
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.00403050
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret