Function at 0x1000048e8
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x560
mov rax, qword [0x10000f100]
xor rax, rsp
mov qword [rsp + 0x550], rax
xor edi, edi
cmp dword [0x100011408], edi
mov r12d, edi
mov r14d, edi
mov dword [0x100010488], edi
jne 0x10000497d
lea r8d, [rdi + 4]
lea rdx, [0x100010ebc]
lea rcx, [0x100001768]
call fcn.1000057d4
cmp eax, edi
je 0x10000494f
cmp eax, 4
jbe 0x10000497d
mov esi, 0x10
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4b1
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
call fcn.100005554
mov dword [0x100010488], 0x80070714
jmp 0x100004e9c
mov r15, qword [rsp + 0x30]
mov r13d, dword [rsp + 0x38]
mov esi, 0x10
lea ebx, [rsi - 0xf]
mov ebp, edi
xor edx, edx
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x3c], edi
lea r8d, [rdx + 0x68]
call sub.msvcrt.dll_memset
cmp byte [0x100011622], dil
mov dword [rsp + 0x80], 0x68
jne 0x100004adc
lea rdx, [rsp + 0x38]
lea rcx, [0x100001770]
mov r8d, 4
call fcn.1000057d4
cmp eax, edi
je 0x100004954
cmp eax, 4
ja 0x100004954
mov eax, dword [rsp + 0x38]
cmp eax, ebx
jne 0x1000049fa
mov word [rsp + 0xc0], di
jmp 0x100004a18
cmp eax, 2
jne 0x100004a0b
mov word [rsp + 0xc0], 6
jmp 0x100004a18
cmp eax, 3
jne 0x100004a1f
mov word [rsp + 0xc0], ax
mov dword [rsp + 0xbc], ebx
cmp ebp, edi
jne 0x100004b25
movzx eax, word [0x100011418]
cmp ax, di
je 0x100004aaf
test bl, al
je 0x100004a40
lea r15, [0x100001780]
jmp 0x100004a50
test al, 2
lea rax, [0x100001788]
cmove rax, r15
mov r15, rax
lea rdx, [rsp + 0xf0]
mov r8d, 0x104
mov rcx, r15
call fcn.1000057d4
cmp eax, edi
je 0x100004954
lea rcx, [0x100001760]
or eax, 0xffffffff
lea r8, [rsp + 0xf0]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov ecx, 0x7f
mov r9d, eax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
je 0x100004aac
cmp r13d, 0xfffffffe
je 0x100004aac
mov r13d, ebx
mov r12d, ebx
jmp 0x100004aaf
mov r13d, edi
cmp r12d, edi
jne 0x100004b8c
lea rdx, [rsp + 0xf0]
lea rcx, [0x100001790]
mov r8d, 0x104
call fcn.1000057d4
cmp eax, edi
je 0x100004954
jmp 0x100004b25
lea r8, [0x100011622]
lea rax, [rsp + 0xf0]
mov edx, 0x104
sub r8, rax
lea rcx, [rsp + 0xf0]
lea rax, [rdx + 0x7ffffefa]
cmp rax, rdi
je 0x100004b1a
mov al, byte [r8 + rcx]
cmp al, dil
je 0x100004b1a
mov byte [rcx], al
add rcx, rbx
sub rdx, rbx
jne 0x100004afb
cmp rdx, rdi
jne 0x100004b22
sub rcx, rbx
mov byte [rcx], dil
cmp ebp, ebx
jne 0x100004b8c
lea rdx, [rsp + 0xf0]
lea rcx, [0x1000017a0]
mov r8d, 0x104
call fcn.1000057d4
cmp eax, edi
je 0x100004954
cmp byte [0x100011622], dil
jne 0x100004d3e
lea rcx, [0x100001760]
or eax, 0xffffffff
lea r8, [rsp + 0xf0]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov ecx, 0x7f
mov r9d, eax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
je 0x100004d3e
lea r9, [rsp + 0x3c]
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0xf0]
mov edx, 0x104
call fcn.100001f9c
cmp eax, edi
je 0x100004e9c
cmp r14d, edi
mov ebx, dword [rsp + 0x3c]
jne 0x100004bda
cmp word [0x100010490], 1
je 0x100004bda
cmp dword [0x100011400], edi
je 0x100004bda
cmp ebx, edi
jne 0x100004be2
mov r14d, 1
call fcn.100002640
cmp ebx, edi
je 0x100004cff
cmp dword [0x10000f4bc], edi
je 0x100004f2e
cmp ebx, edi
je 0x100004cff
test byte [0x100010ec4], 4
je 0x100004cff
lea rcx, [0x100001660]
call fcn.100007d9c
xor ebx, ebx
cmp rax, rbx
mov rdi, rax
je 0x100004f0e
lea rdx, [0x10000f4e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp rax, rbx
mov r11, rax
je 0x100004ecf
cmp dword [0x100011410], 0
movzx ecx, word [0x100010490]
lea rax, [0x1000105d8]
mov qword [rsp + 0x48], rax
lea rax, [0x100010670]
mov qword [rsp + 0x40], rbx
mov rbx, qword [rsp + 0x30]
mov word [rsp + 0x68], cx
movzx ecx, word [0x100011418]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x6c], ecx
je 0x100004c95
bts ecx, 0x10
mov dword [rsp + 0x6c], ecx
mov eax, dword [0x100010ec4]
test al, 8
je 0x100004ca7
bts ecx, 0x11
mov dword [rsp + 0x6c], ecx
test sil, al
je 0x100004cb4
bts ecx, 0x12
mov dword [rsp + 0x6c], ecx
mov eax, dword [0x100011728]
test al, 0x40
je 0x100004cc6
bts ecx, 0x13
mov dword [rsp + 0x6c], ecx
test al, al
jns 0x100004cd2
bts ecx, 0x14
mov dword [rsp + 0x6c], ecx
mov eax, dword [0x100010ec8]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x70], eax
call r11
mov rcx, rdi
test eax, eax
mov dword [0x100010488], eax
js 0x100004e8d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edi, edi
jmp 0x100004d25
mov rbx, qword [rsp + 0x30]
cmp rbx, rdi
je 0x100004e93
lea rdx, [rsp + 0x80]
mov rcx, rbx
call fcn.100004f68
cmp eax, edi
je 0x100004e93
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, 1
add ebp, ebx
cmp ebp, 2
jb 0x100004991
cmp dword [0x100010440], edi
je 0x100004e86
cmp byte [0x1000103f0], dil
je 0x100004e86
lea rax, [rsp + 0x30]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x100004e86
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
lea rdx, [0x1000103f0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x310]
mov ebx, 0x238
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, edi
jne 0x100004e7b
lea rcx, [rsp + 0x201]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x200], dil
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x200]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, edi
je 0x100004e13
lea r8, [0x1000015b9]
lea rcx, [rsp + 0x200]
mov edx, 0x104
call fcn.100007fa4
lea rax, [0x100010670]
lea r9, [rsp + 0x200]
lea r8, str.rundll32.exe__sadvpack.dll_DelNodeRunDLL32___s_
lea rcx, [rsp + 0x310]
mov rdx, rbx
mov qword [rsp + 0x20], rax
call fcn.100001aac
lea rcx, [rsp + 0x310]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [rsp + 0x310]
lea rdx, [0x1000103f0]
add eax, 1
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x100004e9e
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov rcx, qword [rsp + 0x550]
xor rcx, rsp
call fcn.10000c850
lea r11, [rsp + 0x560]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea r8, [0x10000f4e0]
xor r9d, r9d
mov edx, 0x4c9
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], esi
call fcn.100005554
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.100007b04
mov dword [0x100010488], eax
jmp 0x100004e9c
lea r8, [0x100001660]
xor r9d, r9d
mov edx, 0x4c8
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], esi
call fcn.100005554
jmp 0x100004ef6
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4c7
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
call fcn.100005554
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [0x100010488], 0x8007042b
jmp 0x100004e9c