Function at 0x180046780
Capabilities:
Contain obfuscated stackstrings
Get common file path
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x18007cd08]
xor rax, rsp
mov qword [rbp + 0x150], rax
mov r8d, 0x4f
lea rdx, [0x18007c810]
xor ecx, ecx
call fcn.180047aa0
mov sil, 1
movzx r14d, sil
xor r15d, r15d
mov qword [rbp - 0x38], r15
mov qword [rbp - 0x30], ILFindLastID
mov byte [rbp - 0x48], r15b
xor r9d, r9d
mov r8d, 0x109
lea rdx, [rbp - 0x48]
xor ecx, ecx
call fcn.180065c00
test al, al
jne 0x180046a38
mov dword [rbp + 0x10], 0x6c0043
mov dword [rbp + 0x14], 0x730075
mov dword [rbp + 0x18], 0x650074
lea esi, [r15 + 0x65]
mov dword [rbp + 0x1c], 0x430072
mov eax, 0x6f
mov word [rbp + 0x20], ax
mov dword [rbp + 0x22], 0x410070
mov dword [rbp + 0x26], 0x720072
mov dword [rbp + 0x2a], 0x790061
mov dword [rbp + 0x2e], 0x690053
mov dword [rbp + 0x32], 0x65007a
mov word [rbp + 0x36], r15w
mov r15b, 1
movzx r13d, r15b
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
xorps xmm1, xmm1
movups xmmword [rsp + 0x68], xmm1
movups xmmword [rsp + 0x78], xmm1
movups xmmword [rbp - 0x78], xmm1
xor r14d, r14d
mov qword [rsp + 0x60], r14
mov dword [rsp + 0x68], 0x30
lea r9, [rsp + 0x60]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesEncodeIncrementalHandleCreate
mov ebx, eax
mov qword [rsp + 0x50], r14
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
xor r9d, r9d
xor edx, edx
lea rcx, [rdx - 1]
lea r8d, [rsi - 0x61]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov r14, rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 8]
call sub.ADVAPI32.dll_LsaOpenPolicy
movzx edx, r15b
mov rcx, qword [rsp + 0x50]
test rcx, rcx
mov eax, 0
cmove edx, eax
mov r15d, r13d
test ebx, ebx
mov r12d, eax
cmovne r15d, eax
mov ebx, r13d
test r14, r14
cmove ebx, eax
test dl, dl
je 0x180046909
call sub.ADVAPI32.dll_LsaClose
test bl, bl
je 0x1800469f5
mov dword [rbp - 0x28], 0x746e49
mov word [rbp - 0x25], si
mov dword [rbp - 0x24], 0x614272
mov eax, 0x73
mov word [rbp - 0x21], ax
mov word [rbp - 0x20], si
mov ecx, 0x2f
mov word [rbp - 0x1f], cx
mov r8d, 0x69
mov word [rbp - 0x1e], r8w
mov dword [rbp - 0x1d], 0x33706c
mov eax, 0x32
mov word [rbp - 0x1a], ax
mov word [rbp - 0x19], cx
mov dword [rbp - 0x18], 0x6e7573
mov eax, 0x34
mov word [rbp - 0x15], ax
mov qword [rsp + 0x20], 0x100
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rbx, rax
mov rcx, rax
call qword [sym.imp.dbghelp.dll_GetTimestampForLoadedLibrary]
mov dword [rsp + 0x20], r12d
lea r9, [rsp + 0x58]
xor r8d, r8d
mov edx, 0xf003f
lea rcx, [rbp - 0x28]
call qword [sym.imp.SHLWAPI.dll_SHRegOpenUSKeyA]
mov edi, eax
test rbx, rbx
je 0x1800469bd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test edi, edi
jne 0x1800469ec
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.SHLWAPI.dll_SHRegWriteUSValueA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.SHLWAPI.dll_SHRegCloseUSKey]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r15b, r15b
je 0x180046e35
mov qword [rsp + 0x58], r12
lea r8, [rsp + 0x58]
xor edx, edx
xor ecx, ecx
call sub.RPCRT4.dll_MesDecodeIncrementalHandleCreate
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x180046a20
call sub.RPCRT4.dll_MesHandleFree
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x180046e35
call sub.RPCRT4.dll_MesHandleFree
jmp 0x180046e35
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], ILFindLastID
mov byte [rbp - 0x68], 0
xor r8d, r8d
xor edx, edx
lea rcx, [rdx - 1]
call qword [sym.imp.dbghelp.dll_SymInitialize]
mov ebx, eax
xor r8d, r8d
xor edx, edx
lea rcx, [rdx - 1]
call qword [sym.imp.dbghelp.dll_SymInitialize]
mov edi, eax
movsd xmm0, qword [0x18007c8b8]
mulsd xmm0, qword [0x1800774f8]
addsd xmm0, qword [0x1800774e8]
cvttsd2si rcx, xmm0
mov dword [rsp + 0x50], ecx
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
lea r9, [0x18007c838]
mov r8d, 0x69
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x48]
call fcn.180043350
movzx esi, sil
test ebx, ebx
cmove esi, r15d
mov ebx, r14d
test edi, edi
cmove ebx, r15d
lea r8, [rbp - 0x68]
xor edx, edx
lea ecx, [rdx + 0x10]
call fcn.180047ca0
test al, al
jne 0x180046c40
mov eax, 0x67
mov word [rbp + 0x10], ax
mov dword [rbp + 0x12], 0x6e0065
mov dword [rbp + 0x16], 0x720065
mov dword [rbp + 0x1a], 0x740061
mov dword [rbp + 0x1e], 0x520065
mov dword [rbp + 0x22], 0x6e0061
mov dword [rbp + 0x26], 0x6f0064
mov dword [rbp + 0x2a], 0x42006d
mov eax, 0x79
mov word [rbp + 0x2e], ax
mov dword [rbp + 0x30], 0x650074
mov dword [rbp + 0x34], 0x73
mov dil, 1
movzx r14d, dil
mov dword [rsp + 0x50], r15d
lea rax, [rbp + 0x10]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
xor r9d, r9d
xor edx, edx
lea rcx, [rdx - 1]
lea r8d, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rsi, rax
mov edx, 0x14
lea ecx, [rdx + 0x2c]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
movzx ecx, dil
test rsi, rsi
cmove ecx, r15d
test rax, rax
cmove r14d, r15d
test cl, cl
je 0x180046bc3
mov qword [rsp + 0x20], 0x100
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
test rax, rax
je 0x180046bba
mov rcx, rax
call qword [sym.imp.dbghelp.dll_ImageNtHeader]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14b, r14b
je 0x180046c2b
mov edx, 0x14
lea r8d, [rdx - 0x12]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_InitializeAcl]
mov rcx, rbx
test eax, eax
jne 0x180046c1c
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x36]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirA]
mov edx, 0x200
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_SHGetSettings]
jmp 0x180046de7
call qword [sym.imp.ADVAPI32.dll_IsValidAcl]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, 0x200
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_SHGetSettings]
jmp 0x180046de7
test sil, sil
je 0x180046db4
movzx eax, word [0x180076690]
mov word [rbp - 8], ax
mov eax, dword [str.raphic]
mov dword [rbp - 6], eax
movzx eax, word [0x180076698]
mov word [rbp - 2], ax
mov eax, 0x73
mov word [rbp], ax
movzx eax, word [0x18007669c]
mov word [rbp + 1], ax
movzx eax, word [0x1800766a0]
mov word [rbp + 3], ax
movzx eax, byte [0x1800766a2]
mov byte [rbp + 5], al
mov r8d, 1
lea rdx, [0x180074cc4]
lea rcx, [rbp - 8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
movzx eax, word [0x1800766a4]
mov word [rbp + 6], ax
mov word [rbp + 8], 0x79
mov byte [rbp - 0x28], 0
mov r8d, 1
lea rdx, [0x1800735ec]
lea rcx, [rbp - 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, 0x61
mov word [rbp - 0x27], ax
mov edi, 0x74
mov word [rbp - 0x26], di
mov eax, dword [str.a_bi]
mov dword [rbp - 0x25], eax
movzx eax, byte [0x1800766b0]
mov byte [rbp - 0x21], al
lea rcx, [rbp - 0x28]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x180046d00
movzx eax, word [0x180073204]
mov word [rcx], ax
mov dword [rbp - 0x20], 0x203a73
lea rcx, [rbp - 0x28]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x180046d21
movzx eax, word [0x1800766b4]
mov word [rcx], ax
mov dword [rbp - 0x1c], 0x202020
mov dword [rbp - 0x19], 0x202020
mov eax, 0x20
mov word [rbp - 0x16], ax
movzx eax, word [0x1800766b8]
mov word [rbp - 0x15], ax
movsd xmm0, qword [str.______i_]
movsd qword [rbp - 0x13], xmm0
movzx eax, byte [0x1800766c8]
mov byte [rbp - 0xb], al
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x40], r15
lea rax, [rbp + 0x40]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
lea r8, [rbp - 0x28]
lea rdx, [rbp - 8]
lea rcx, [r9 - 1]
call qword [sym.imp.dbghelp.dll_SymFindFileInPath]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.dbghelp.dll_SymCleanup]
test bl, bl
je 0x180046dd4
xor r8d, r8d
xor edx, edx
lea rcx, [rdx - 1]
call qword [sym.imp.dbghelp.dll_SymEnumerateModules64]
mov rcx, 0xffffffffffffffff
call qword [sym.imp.dbghelp.dll_SymCleanup]
xor r9d, r9d
xor r8d, r8d
mov edx, 0xbe
xor ecx, ecx
call fcn.180054cc0
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x180046e25
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180046e20
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180046e20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18006e8b0
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], ILFindLastID
mov byte [rbp - 0x68], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x180046e73
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180046e6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180046e6e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18006e8b0
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.18006edc0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret