Function at 0x140019bdc
Capabilities:
Check if file exists
Get common file path
Get file attributes
Persist via run registry key
Set current directory
Set registry value
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x600]
sub rsp, 0x700
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x5f0], rax
mov r14d, r8d
mov dword [rsp + 0x38], r8d
mov r12d, edx
mov dword [rsp + 0x34], edx
mov rdi, rcx
mov ebx, 0x80070002
call fcn.140017488
xor ecx, ecx
test eax, eax
je 0x14001a0a0
mov esi, ecx
lea rdx, str._Registering_DLL:__S._r_n
mov ebx, ecx
mov r8, rdi
mov ecx, 4
call fcn.1400168a8
mov eax, 1
inc eax
mov dword [rsp + 0x48], eax
test r14d, r14d
je 0x140019ebf
mov edx, 0x208
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor r14d, r14d
test eax, eax
je 0x14001a07d
lea r8, str._regsvr32.exe
mov edx, 0x208
lea rcx, [rbp - 0x30]
call fcn.140001584
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140019ca0
test al, 0x10
lea eax, [r14 + 1]
je 0x140019ca3
mov eax, r14d
test eax, eax
je 0x140019e8f
test rdi, rdi
je 0x140019cd9
mov edx, 0x5c
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov edx, 0x3c
lea rcx, [rsp + 0x50]
lea r8, [rax + 2]
test rax, rax
jne 0x140019cd4
mov r8, rdi
call fcn.140001470
lea rax, str.__s__
test r12d, r12d
lea r8, str.__s__u__
mov esi, 0x208
cmovne r8, rax
lea rcx, [rbp - 0x30]
mov edx, esi
call fcn.140001584
mov r8, rdi
lea rcx, [rbp - 0x30]
mov edx, esi
call fcn.140001584
lea r8, [0x14004311c]
mov edx, esi
lea rcx, [rbp - 0x30]
call fcn.140001584
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r14
mov esi, 3
mov qword [rsp + 0x20], rax
mov r9d, esi
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140019d7e
lea rax, [rsp + 0x40]
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r14d, eax
test eax, eax
jne 0x140019df7
xor r14d, r14d
mov rcx, qword [rsp + 0x40]
lea r8, [rbp - 0x30]
call fcn.14001a508
mov rsi, rax
test rax, rax
je 0x140019ddf
lea rax, [rbp - 0x30]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], r14w
jne 0x140019d9c
lea eax, [rcx*2 + 2]
mov r9d, 1
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rsi
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
mov r14d, eax
call qword [sym.imp.msvcrt.dll_free]
jmp 0x140019de5
mov r14d, 0x80004005
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test r14d, r14d
je 0x140019e23
movzx esi, r14w
lea r8, [rsp + 0x50]
or esi, 0x80070000
lea rdx, str.ERROR:_Could_not_store_delayed_action_for_component__S:_0x_x._r_n
test r14d, r14d
mov ecx, 2
cmovle esi, r14d
mov r9d, esi
call fcn.1400168a8
jmp 0x140019e7f
mov rcx, qword [0x140050310]
or rsi, 0xffffffffffffffff
cmp rcx, rsi
jne 0x140019e49
lea edx, [rsi + 5]
call fcn.140016188
mov rcx, qword [0x140050310]
xor eax, eax
cmp rcx, rsi
je 0x140019e73
cmp dword [0x1400516e0], 4
jl 0x140019e73
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], eax
mov r8d, reloc.ATL.DLL_AtlInternalQueryInterface
mov qword [rsp + 0x20], rax
lea rdx, str.__Delayed_action_until_reboot._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
or dword [0x140050558], 1
mov esi, 0xd2af9
not esi
xor r14d, r14d
shr esi, 0x1f
test esi, esi
jne 0x14001a074
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
mov r8, rdi
or ebx, 0x80070000
lea rdx, str.ERROR:_Failed_delaying_dll_registration_for_file__S:_0x_x._r_n
test eax, eax
mov ecx, 2
cmovle ebx, eax
mov r9d, ebx
call fcn.1400168a8
jmp 0x14001a054
xor r12d, r12d
xor ecx, ecx
mov dword [rsp + 0x30], r12d
call qword [sym.imp.ole32.dll_OleInitialize]
mov ebx, eax
test eax, eax
js 0x14001a08d
lea rdx, [rbp - 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x140019f30
mov r8, rdi
lea rcx, [rbp + 0x3e0]
mov edx, 0x103
call fcn.140001470
lea edx, [r12 + 0x5c]
lea rcx, [rbp + 0x3e0]
call qword [sym.imp.msvcrt.dll_wcsrchr]
test rax, rax
je 0x140019f30
lea rcx, [rbp + 0x3e0]
mov word [rax], r12w
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [rsp + 0x30], 1
or rcx, 0xffffffffffffffff
mov r14, rcx
inc r14
cmp word [rdi + r14*2], r12w
jne 0x140019f37
add r14, 5
mov eax, 2
mul r14
cmovo rax, rcx
mov rcx, rax
call fcn.14003c460
mov r12, rax
test rax, rax
je 0x140019ff8
test rdi, rdi
je 0x140019f78
mov r8, r14
mov rdx, rax
mov rcx, rdi
call fcn.140016b48
xor edx, edx
mov rcx, r12
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r14, rax
cmp rax, 0x20
jbe 0x140019fd2
cmp dword [rsp + 0x34], 0
lea rax, str.DllRegisterServer
lea rdx, str.DllUnregisterServer
mov rcx, r14
cmovne rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140019fc7
call qword [0x14003f118]
mov ebx, eax
xor eax, eax
test ebx, ebx
mov esi, eax
setns sil
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140019ff0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 0x57
cmove eax, ecx
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, r12
call fcn.14003c408
xor r14d, r14d
cmp dword [rsp + 0x30], r14d
je 0x14001a00c
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
call qword [sym.imp.ole32.dll_OleUninitialize]
test esi, esi
jne 0x14001a084
test ebx, ebx
jne 0x14001a038
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmove ebx, eax
mov r9d, ebx
lea rdx, str.ERROR:_Dll_Registration:_Failed_for_file__S:_0x_x._r_n
mov r8, rdi
mov ecx, 2
call fcn.1400168a8
mov r12d, dword [rsp + 0x34]
cmp dword [rsp + 0x38], r14d
mov eax, r14d
sete al
mov r14d, eax
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x48]
cmp eax, 2
jge 0x14001a0d2
jmp 0x140019c4b
lea rdx, str.____Delayed_Dll_Registration:_Succeeded_for_file__S._r_n
jmp 0x14001a0c5
mov ebx, 0x80004005
jmp 0x14001a0d2
lea rdx, str.____Dll_Registration:_Succeeded_for_file__S._r_n
jmp 0x14001a0c5
mov r8d, ebx
lea rdx, str.ERROR:_OLE_Initialization_failed:_0x_x._r_n
xor ecx, ecx
call fcn.1400168a8
jmp 0x14001a0d2
test r12d, r12d
je 0x14001a0be
mov r9d, ebx
lea rdx, str.ERROR:_Dll_Registration:_Could_not_find_file__S:_0x_x._r_n
mov r8, rdi
mov ecx, 2
call fcn.1400168a8
jmp 0x14001a0d2
lea rdx, str.Dll_UnRegistration:_Could_not_find_file__S._r_n
mov r8, rdi
mov ecx, 4
call fcn.1400168a8
mov eax, ebx
mov rcx, qword [rbp + 0x5f0]
xor rcx, rsp
call fcn.14003c810
mov rbx, qword [rsp + 0x740]
add rsp, 0x700
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret