Function at 0x1400350dc
Capabilities:
Check os version
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov byte [rax + 0x18], r8b
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp + 0x17], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov r12b, dl
mov r15, rcx
xor esi, esi
mov dword [rbp - 0x21], esi
mov eax, dword [0x14018d938]
lea rdi, [0x1401849a8]
lea r13d, [rsi + 1]
test r13b, al
jne 0x14003515e
or eax, r13d
mov dword [0x14018d938], eax
mov rcx, rdi
mov rax, qword [0x1401849a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x14018d940], rax
lea rcx, [0x1400f18e0]
call fcn.1400b13a0
nop
mov eax, dword [0x14018d938]
test al, 2
jne 0x140035196
or eax, 2
mov dword [0x14018d938], eax
mov rcx, rdi
mov rax, qword [0x1401849a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x14018d930], rax
lea rcx, [0x1400f18b0]
call fcn.1400b13a0
nop
mov eax, dword [0x14018d938]
test al, 4
jne 0x1400351ce
or eax, 4
mov dword [0x14018d938], eax
mov rcx, rdi
mov rax, qword [0x1401849a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x14018d928], rax
lea rcx, [0x1400f1880]
call fcn.1400b13a0
nop
mov eax, dword [0x14018d938]
test al, 8
jne 0x140035200
or eax, 8
mov dword [0x14018d938], eax
mov rcx, rdi
mov rax, qword [0x1401849a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x14018d948], rax
lea rcx, [0x1400f1850]
call fcn.1400b13a0
nop
mov rax, qword [0x14018d930]
cmp dword [rax - 0x10], esi
je 0x140035257
mov ecx, esi
mov rax, qword [0x14018d468]
test rax, rax
setne cl
test ecx, ecx
jne 0x14003522a
mov ecx, 0x80004005
call fcn.140001874
int3
mov rcx, qword [0x14018d948]
sub rax, rcx
movzx edx, word [rcx]
cmp dx, word [rcx + rax]
jne 0x14003524a
add rcx, 2
test dx, dx
jne 0x140035234
mov eax, esi
jmp 0x14003524f
sbb eax, eax
or eax, r13d
test eax, eax
je 0x1400359c8
lea rdx, [0x14018d468]
lea rcx, [0x14018d948]
call fcn.140001d7c
lea rcx, [0x14018d940]
call fcn.140001c0c
lea rcx, [0x14018d930]
call fcn.140001c0c
lea rcx, [0x14018d928]
call fcn.140001c0c
mov r14d, esi
mov rcx, rdi
mov rax, qword [0x1401849a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x31], rbx
mov rcx, rdi
mov rax, qword [0x1401849a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x29], rax
lea rax, [rbp - 0x39]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.Volatile_Environment
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, 0x82
test eax, eax
jne 0x1400354fd
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x39]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400354ed
mov dword [rbp + 0x77], 0x104
mov ecx, r13d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14003534b
mov edx, edi
lea rcx, [rbp - 0x31]
call fcn.140001f54
mov rbx, qword [rbp - 0x31]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x7f]
xor r8d, r8d
lea rdx, str.AppData
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400353a0
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400b1884
test eax, eax
js 0x140035395
cmp eax, dword [rbx - 0xc]
jg 0x140035395
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], si
jmp 0x1400353ad
mov ecx, 0x80070057
call fcn.140001874
int3
lea rcx, [rbp - 0x31]
call fcn.140001c0c
mov rbx, qword [rbp - 0x31]
mov dword [rbp + 0x77], 0x104
mov rax, qword [0x14018d940]
mov edx, r13d
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, edi
or ecx, edx
jge 0x1400353df
mov edx, edi
lea rcx, [0x14018d940]
call fcn.140001f54
mov rax, qword [0x14018d940]
lea rcx, [rbp + 0x77]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x7f]
xor r8d, r8d
lea rdx, str.Local_AppData
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140035447
mov rcx, qword [0x14018d940]
movsxd rdx, dword [rcx - 0xc]
call fcn.1400b1884
test eax, eax
js 0x14003543c
mov rcx, qword [0x14018d940]
cmp eax, dword [rcx - 0xc]
jg 0x14003543c
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [0x14018d940]
mov word [rax + rcx*2], si
jmp 0x140035453
mov ecx, 0x80070057
call fcn.140001874
int3
lea rcx, [0x14018d940]
call fcn.140001c0c
mov dword [rbp + 0x77], 0x104
mov rax, qword [rbp - 0x29]
mov ecx, r13d
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, edi
or eax, ecx
jge 0x140035478
mov edx, edi
lea rcx, [rbp - 0x29]
call fcn.140001f54
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov rdi, qword [rbp - 0x29]
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x7f]
xor r8d, r8d
lea rdx, str.A520A1A4_1780_4FF6_BD18_167343C5AF16
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400354d1
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.1400b1884
test eax, eax
js 0x1400354c6
cmp eax, dword [rdi - 0xc]
jg 0x1400354c6
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], si
jmp 0x1400354e1
mov ecx, 0x80070057
call fcn.140001874
int3
lea rdx, [0x14018d940]
lea rcx, [rbp - 0x29]
call fcn.140001d7c
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400354fd
lea rdx, [0x14018d940]
lea rcx, [rbp - 0x29]
call fcn.140001d7c
call fcn.140034f08
test al, al
je 0x140035727
mov dil, r13b
lea rax, [rbp - 0x39]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerMain
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400355f4
mov dword [rbp + 0x77], 0x104
mov ecx, r13d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov edx, 0x82
sub eax, edx
or eax, ecx
jge 0x140035563
lea rcx, [rbp - 0x31]
call fcn.140001f54
mov rbx, qword [rbp - 0x31]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x7f]
xor r8d, r8d
lea rdx, str.Isolation
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400355e1
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400b1884
test eax, eax
js 0x1400355d6
cmp eax, dword [rbx - 0xc]
jg 0x1400355d6
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], si
mov dil, sil
cmp dword [rbx - 0x10], esi
jl 0x1400355e1
lea rdx, str.PMIL
mov rcx, rbx
call fcn.1400b1a54
test rax, rax
je 0x1400355e1
sub rax, rbx
sar rax, 1
test eax, eax
jne 0x1400355e1
mov r14d, r13d
jmp 0x1400355e1
mov ecx, 0x80070057
call fcn.140001874
int3
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test dil, dil
je 0x14003572a
lea rax, [rbp - 0x39]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerAdvancedOptionsCRYPTOPROTECTEDMODESECURITY
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140035727
mov dword [rbp + 0x77], 0x104
mov ecx, r13d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov edx, 0x82
sub eax, edx
or eax, ecx
jge 0x14003564a
lea rcx, [rbp - 0x31]
call fcn.140001f54
mov rbx, qword [rbp - 0x31]
lea rax, [rbp + 0x77]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x7f]
xor r8d, r8d
lea rdx, str.DefaultValue
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400b1884
test eax, eax
js 0x14003571c
cmp eax, dword [rbx - 0xc]
jg 0x14003571c
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], si
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbx - 0x10], esi
jl 0x1400356c5
lea rdx, str.PMIL
mov rcx, rbx
call fcn.1400b1a54
test rax, rax
je 0x1400356c5
sub rax, rbx
sar rax, 1
test eax, eax
cmove r14d, r13d
mov ecx, dword [0x14018cd80]
lea r8d, [rcx + 2]
lea eax, [rcx + 1]
imul r8d, eax
imul r8d, ecx
mov eax, 0x2aaaaaab
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
shl eax, 3
sub r8d, eax
cmp r8d, 0xa
jne 0x14003572a
mov r8d, r13d
mov eax, r13d
mov edx, 0x1f
lea ecx, [rax + r8]
lea r8d, [rax]
mov eax, ecx
sub edx, r13d
jns 0x140035706
mov dword [0x14018cd80], ecx
jmp 0x14003572a
mov ecx, 0x80070057
call fcn.140001874
int3
mov r14d, r13d
or ebx, 0xffffffff
cmp qword [0x140187d58], 0xffffffff80000002
je 0x140035793
test r14d, r14d
je 0x1400357b8
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x140035793
cmp byte [0x14018cea4], sil
jne 0x140035793
lea rdx, str.Software_
lea rcx, [rbp + 0xf]
call fcn.140001cb0
nop
mov rdx, rax
lea rcx, [0x14018d930]
call fcn.140001d7c
nop
mov rdx, qword [rbp + 0xf]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1400357a6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400357a6
lea rdx, [0x14018d468]
lea rcx, [0x14018d930]
call fcn.140001d7c
lea rdx, [rbp - 0x29]
lea rcx, [0x14018d940]
call fcn.140001d7c
jmp 0x140035819
call fcn.140034f74
test al, al
jne 0x1400357da
mov r8d, 0x1e
lea rdx, str.Packageswindows_ie_ac_001AC
lea rcx, [0x14018d940]
call fcn.14000d9c4
lea rdx, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
lea rcx, [rbp - 0x19]
call fcn.140001cb0
nop
mov rdx, rax
lea rcx, [0x14018d930]
call fcn.140001d7c
nop
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140035819
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [0x14018d930]
cmp dword [rcx - 0x10], esi
jl 0x140035859
lea rdx, str.windows_ie_ac_001
call fcn.1400b1a54
test rax, rax
je 0x140035859
sub rax, qword [0x14018d930]
sar rax, 1
test eax, eax
jle 0x140035859
lea rdx, [0x14018d468]
lea rcx, [0x14018d928]
call fcn.140001d7c
jmp 0x1400358d2
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x140035893
cmp byte [0x14018cea4], sil
jne 0x140035893
lea rdx, str.Software_
lea rcx, [rbp - 1]
call fcn.140001cb0
nop
mov rdx, rax
lea rcx, [0x14018d928]
call fcn.140001d7c
nop
mov rdx, qword [rbp - 1]
jmp 0x1400358b8
lea rdx, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
lea rcx, [rbp - 0x11]
call fcn.140001cb0
nop
mov rdx, rax
lea rcx, [0x14018d928]
call fcn.140001d7c
nop
mov rdx, qword [rbp - 0x11]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1400358d2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp qword [0x140187d58], 0xffffffff80000002
je 0x140035964
cmp byte [0x140187c22], sil
je 0x140035964
lea rcx, [rbp - 9]
call fcn.140034e5c
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [0x14018d930]
call fcn.14000d9c4
nop
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140035928
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 7]
call fcn.140034e5c
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [0x14018d928]
call fcn.14000d9c4
nop
mov rdx, qword [rbp + 7]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x140035964
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [0x140187d58]
lea rcx, [0x14018d930]
call fcn.140035a64
mov rdx, qword [0x140187d58]
lea rcx, [0x14018d928]
call fcn.140035a64
nop
mov rdx, qword [rbp - 0x29]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1400359aa
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x31]
add rdx, 0xffffffffffffffe8
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
add eax, ebx
test eax, eax
jg 0x1400359c8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r12b, r12b
je 0x140035a30
mov r9d, dword [0x14018cd80]
mov r8d, r9d
imul r8d, r9d
imul r8d, r9d
mov eax, 0x38e38e39
imul r8d
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*8]
add ecx, ecx
sub r8d, ecx
cmp r8d, 7
jne 0x140035a1f
test r9d, r9d
je 0x140035a19
mov ecx, r9d
and ecx, r13d
add esi, ecx
mov eax, r9d
cdq
sub eax, edx
sar eax, 1
mov r9d, eax
jne 0x140035a04
mov dword [0x14018cd80], esi
lea rdx, [0x14018d928]
mov rcx, r15
call fcn.140002948
jmp 0x140035a3f
lea rdx, [0x14018d930]
mov rcx, r15
call fcn.140002948
mov dword [rbp - 0x21], r13d
mov rax, r15
mov rbx, qword [rsp + 0xd8]
add rsp, 0x90
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret