Function at 0x477c70
Capabilities:
Check os version
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
sub rsp, 0x978
mov qword [rsp + 0xe0], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov qword [rax - 8], rsi
mov qword [rax - 0x10], rdi
mov qword [rax - 0x18], r12
mov qword [rax - 0x20], r13
mov qword [rax - 0x28], r14
mov qword [rax - 0x30], r15
mov rax, qword [0x00522be8]
xor rax, rsp
mov qword [rsp + 0x930], rax
mov r14d, edx
mov r13, rcx
xor ebp, ebp
mov qword [rcx + 0x18], rbp
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x48], rbp
mov qword [rcx + 0x40], rbp
mov dword [rcx + 0x20], ebp
mov dword [rcx + 0x24], ebp
mov dword [rcx + 0x28], ebp
xor r9d, r9d
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x60]
call fcn.004905c0
nop
lea r8, [rsp + 0x48]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x477d21
lea rcx, [rsp + 0x60]
call fcn.00490620
jmp 0x478677
mov dword [rsp + 0x40], 0x100
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x430]
call fcn.004a8900
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x430]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, str.SynTpEnh
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x477d8e
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x60]
call fcn.00490620
jmp 0x478677
mov word [rsp + 0x230], 0
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x232]
call fcn.004a8900
mov dword [rsp + 0x44], 0x200
mov qword [rsp + 0x28], rbp
lea rax, [rsp + 0x430]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x230]
lea rdx, str.SynTPEnh
lea rcx, [rsp + 0x68]
call fcn.0049d3d0
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x230]
repne scasw ax, word [rdi]
not rcx
mov word [rsp + rcx*2 + 0x216], ax
mov word [rsp + 0x210], ax
mov dword [rsp + 0xf0], 0x114
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x47866d
mov eax, dword [rsp + 0x100]
cmp eax, 2
jne 0x477eab
mov rdx, rbp
lea rdi, [0x00400000]
nop
movzx eax, word [rdx + rdi + 0xf2288]
mov word [rsp + rdx + 0x210], ax
add rdx, 2
test ax, ax
jne 0x477e50
lea rdi, [rsp + 0x230]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov rax, qword [str.tp4table.dat]
mov qword [rdi - 2], rax
mov rax, qword [0x004f2028]
mov qword [rdi + 6], rax
mov rax, qword [0x004f2030]
mov qword [rdi + 0xe], rax
movzx eax, word [0x004f2038]
mov word [rdi + 0x16], ax
jmp 0x477f19
cmp eax, 1
jne 0x477f19
mov rcx, rbp
lea rdi, [0x00400000]
nop
nop
movzx eax, word [rcx + rdi + 0xf2280]
mov word [rsp + rcx + 0x210], ax
add rcx, 2
test ax, ax
jne 0x477ec0
lea rdi, [rsp + 0x230]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov rax, qword [str.tp4scrol.dat]
mov qword [rdi - 2], rax
mov rax, qword [0x004f2008]
mov qword [rdi + 6], rax
mov rax, qword [0x004f2010]
mov qword [rdi + 0xe], rax
movzx eax, word [0x004f2018]
mov word [rdi + 0x16], ax
mov eax, dword [rsp + 0xf4]
cmp eax, 4
ja 0x477f38
cmp eax, 4
jne 0x477f34
cmp dword [rsp + 0xf8], 0
ja 0x477f38
mov edi, ebp
jmp 0x477f3d
mov edi, 1
lea rdx, [0x004f227c]
lea rcx, [rsp + 0x230]
call fcn.004ac4c0
mov r15, rax
test rax, rax
je 0x478661
movsxd rbx, edi
mov qword [rsp + 0x50], rbx
mov r8, rax
mov edx, 0x400
lea rcx, [rsp + 0x530]
call fcn.004acc70
test rax, rax
je 0x47838a
movzx ecx, word [rsp + 0x530]
cmp cx, 0x3b
je 0x478344
cmp cx, 0x23
je 0x478344
cmp cx, 0x5b
je 0x47838a
mov esi, ebp
mov rdx, rbp
lea rax, [rsp + 0x530]
lea rdi, [rsp + 0x530]
test cx, cx
je 0x478344
movzx ecx, word [rax]
cmp cx, 0x2c
je 0x477fdc
cmp cx, 0xa
je 0x477fdc
add rax, 2
jmp 0x477ffd
mov word [rax], 0
mov qword [rsp + rdx*8 + 0x90], rdi
add esi, 1
add rdx, 1
cmp rdx, 9
je 0x478003
add rax, 2
mov rdi, rax
cmp word [rax], 0
jne 0x477fc7
cmp esi, 9
jl 0x478344
mov rcx, qword [rsp + 0xd0]
call fcn.004aa050
mov r12d, eax
test r14d, r14d
je 0x47802b
test al, 8
je 0x478344
jmp 0x478033
test al, 4
je 0x478344
lea rdx, [0x004ec910]
mov rdi, qword [rsp + 0x90]
mov rcx, rdi
call fcn.004aae90
test eax, eax
je 0x4780c6
lea rdx, [rsp + 0x210]
mov rcx, rdi
call fcn.004aae90
test eax, eax
jne 0x478344
lea rdx, [0x004ec910]
mov rdi, qword [rsp + 0x98]
mov rcx, rdi
call fcn.004aae90
test eax, eax
je 0x4780c6
mov rcx, rdi
call fcn.004aa050
mov ecx, dword [rsp + 0x100]
cmp ecx, 1
jne 0x4780b4
test rbx, rbx
je 0x4780a9
cmp eax, 0x62
jne 0x478344
jmp 0x4780c6
cmp eax, 0x5f
jne 0x478344
jmp 0x4780c6
cmp ecx, 2
jne 0x4780c6
cmp dword [rsp + 0xf4], eax
jne 0x478344
lea rdx, str.Standard
mov rdi, qword [rsp + 0xc0]
mov rcx, rdi
call fcn.004aae90
test eax, eax
jne 0x4780e9
xor di, di
jmp 0x478211
lea rdx, str.StandardP
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x478106
mov di, 0xb
jmp 0x478211
lea rdx, str.WheelVkey
mov rcx, rdi
call fcn.004aae90
test eax, eax
jne 0x478122
mov di, 1
jmp 0x478211
lea rdx, str.WheelStd
mov rcx, rdi
call fcn.004aae90
test eax, eax
jne 0x47813e
mov di, 2
jmp 0x478211
lea rdx, str.TwoParents
mov rcx, rdi
call fcn.004aae90
test eax, eax
jne 0x47815a
mov di, 3
jmp 0x478211
lea rdx, str.TwoParentsP
mov rcx, rdi
call fcn.004aae90
test eax, eax
jne 0x478176
mov di, 0xa
jmp 0x478211
lea rdx, str.VkKeys
mov rcx, rdi
call fcn.004aae90
test eax, eax
jne 0x478192
mov di, 5
jmp 0x478211
lea rdx, str.Fine
mov rcx, rdi
call fcn.004aae90
test eax, eax
jne 0x4781ab
mov di, 4
jmp 0x478211
lea rdx, str.None
mov rcx, rdi
call fcn.004aae90
test eax, eax
jne 0x4781c4
mov di, 6
jmp 0x478211
lea rdx, str.Wheel
mov rcx, rdi
call fcn.004aae90
test eax, eax
jne 0x4781dd
mov di, 7
jmp 0x478211
lea rdx, str.WheelP
mov rcx, rdi
call fcn.004aae90
test eax, eax
jne 0x4781f6
mov di, 8
jmp 0x478211
lea rdx, [0x004f2188]
mov rcx, rdi
call fcn.004aae90
test eax, eax
jne 0x478344
mov di, 0xd
mov rcx, qword [rsp + 0xc8]
call fcn.004aa050
movsxd rbp, eax
cmp ebp, 1
ja 0x478342
add dword [r13 + rbp*4 + 0x24], 1
mov ecx, 0x40c
call fcn.004ad5b0
mov rbx, rax
test rax, rax
je 0x47837b
mov rdx, qword [rsp + 0xa0]
lea rsi, [rax + 0x304]
mov rax, rsi
sub rax, rdx
nop
nop
movzx ecx, word [rdx]
mov word [rdx + rax], cx
add rdx, 2
test cx, cx
jne 0x478260
mov rcx, qword [rsp + 0xa8]
mov rdx, rbx
sub rdx, rcx
nop
movzx eax, word [rcx]
mov word [rcx + rdx + 4], ax
add rcx, 2
test ax, ax
jne 0x478280
mov rcx, qword [rsp + 0xb0]
mov rdx, rbx
sub rdx, rcx
nop
movzx eax, word [rcx]
mov word [rcx + rdx + 0x104], ax
add rcx, 2
test ax, ax
jne 0x4782a0
mov rcx, qword [rsp + 0xb8]
mov rdx, rbx
sub rdx, rcx
nop
nop
nop
nop
movzx eax, word [rcx]
mov word [rcx + rdx + 0x204], ax
add rcx, 2
test ax, ax
jne 0x4782d0
mov word [rbx + 0x404], di
mov dword [rbx], ebp
mov dword [rbx + 0x408], r12d
lea rdi, [0x004ec910]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x47830d
mov dword [r13 + 0x20], 1
mov ecx, 0x10
call fcn.004ad5b0
test rax, rax
je 0x478363
mov qword [rax + 8], rbx
xor ebp, ebp
mov qword [rax], rbp
mov rcx, qword [r13 + 0x18]
test rcx, rcx
je 0x478333
mov qword [rcx], rax
jmp 0x478337
mov qword [r13 + 0x10], rax
mov qword [r13 + 0x18], rax
mov rbx, qword [rsp + 0x50]
jmp 0x478344
xor ebp, ebp
mov r8, r15
mov edx, 0x400
lea rcx, [rsp + 0x530]
call fcn.004acc70
test rax, rax
je 0x47838a
jmp 0x477f83
mov rcx, rbx
call fcn.004ab2d0
nop
lea rcx, [rsp + 0x60]
call fcn.00490620
jmp 0x478677
lea rcx, [rsp + 0x60]
call fcn.00490620
jmp 0x478677
mov qword [r13 + 0x48], rbp
mov qword [r13 + 0x40], rbp
mov r8, r15
mov edx, 0x400
lea rcx, [rsp + 0x530]
call fcn.004acc70
test rax, rax
je 0x478658
movzx edx, word [rsp + 0x530]
cmp dx, 0x3b
je 0x478618
cmp dx, 0x23
je 0x478618
mov edi, ebp
mov rcx, rbp
lea rax, [rsp + 0x530]
lea rsi, [rsp + 0x530]
test dx, dx
je 0x478618
nop
nop
movzx edx, word [rax]
cmp dx, 0x2c
je 0x478405
cmp dx, 0xa
je 0x478405
add rax, 2
jmp 0x478426
mov word [rax], 0
mov qword [rsp + rcx*8 + 0x90], rsi
add edi, 1
add rcx, 1
cmp rcx, 5
je 0x47842c
add rax, 2
mov rsi, rax
cmp word [rax], 0
jne 0x4783f0
cmp edi, 5
jl 0x478618
lea rdi, [0x004ec910]
mov rax, qword [rsp + 0x90]
mov rsi, rax
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x4784c9
lea rdx, [rsp + 0x210]
mov rcx, rax
call fcn.004aae90
test eax, eax
jne 0x478618
lea rdx, [0x004ec910]
mov rdi, qword [rsp + 0x98]
mov rcx, rdi
call fcn.004aae90
test eax, eax
je 0x4784c9
mov rcx, rdi
call fcn.004aa050
mov ecx, dword [rsp + 0x100]
cmp ecx, 1
jne 0x4784b7
test rbx, rbx
je 0x4784ac
cmp eax, 0x62
jne 0x478618
jmp 0x4784c9
cmp eax, 0x5f
jne 0x478618
jmp 0x4784c9
cmp ecx, 2
jne 0x4784c9
cmp dword [rsp + 0xf4], eax
jne 0x478618
mov ecx, 0x214
call fcn.004ad5b0
mov rdi, rax
test rax, rax
je 0x47864c
lea rdx, str.smooth
mov rsi, qword [rsp + 0xb0]
mov rcx, rsi
call fcn.004aae90
test eax, eax
jne 0x478500
lea r8d, [rax + 1]
jmp 0x478515
lea rdx, str.standard
mov rcx, rsi
call fcn.004aae90
mov r8d, 2
mov rcx, qword [rsp + 0xa0]
mov rdx, rdi
sub rdx, rcx
nop
nop
nop
nop
movzx eax, word [rcx]
mov word [rcx + rdx], ax
add rcx, 2
test ax, ax
jne 0x478530
mov rcx, qword [rsp + 0xa8]
lea rdx, [rdi + 0x100]
sub rdx, rcx
nop
nop
nop
nop
movzx eax, word [rcx]
mov word [rcx + rdx], ax
add rcx, 2
test ax, ax
jne 0x478560
mov dword [rdi + 0x210], r8d
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x3c], ebp
mov eax, ebp
mov dword [rsp + 0x34], ebp
cmp word [rdi + 0x100], 0x2a
je 0x4785c8
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
lea r8, [rsp + 0x34]
lea rdx, str._d._d._d._d
lea rcx, [rdi + 0x100]
call fcn.004aaa80
mov eax, dword [rsp + 0x34]
mov dword [rdi + 0x200], eax
mov eax, dword [rsp + 0x3c]
mov dword [rdi + 0x204], eax
mov eax, dword [rsp + 0x38]
mov dword [rdi + 0x208], eax
mov eax, dword [rsp + 0x30]
mov dword [rdi + 0x20c], eax
mov ecx, 0x10
call fcn.004ad5b0
test rax, rax
je 0x478637
mov qword [rax + 8], rdi
mov qword [rax], rbp
mov rcx, qword [r13 + 0x48]
test rcx, rcx
je 0x478610
mov qword [rcx], rax
jmp 0x478614
mov qword [r13 + 0x40], rax
mov qword [r13 + 0x48], rax
mov r8, r15
mov edx, 0x400
lea rcx, [rsp + 0x530]
call fcn.004acc70
test rax, rax
je 0x478658
jmp 0x4783b0
mov rcx, rdi
call fcn.004ab2d0
nop
lea rcx, [rsp + 0x60]
call fcn.00490620
jmp 0x478677
lea rcx, [rsp + 0x60]
call fcn.00490620
jmp 0x478677
mov rcx, r15
call fcn.004ac1b0
nop
lea rcx, [rsp + 0x60]
call fcn.00490620
jmp 0x478677
lea rcx, [rsp + 0x60]
call fcn.00490620
mov rcx, qword [rsp + 0x930]
xor rcx, rsp
call fcn.004a7100
mov rbx, qword [rsp + 0x990]
mov rbp, qword [rsp + 0x998]
mov rsi, qword [rsp + 0x970]
mov rdi, qword [rsp + 0x968]
mov r12, qword [rsp + 0x960]
mov r13, qword [rsp + 0x958]
mov r14, qword [rsp + 0x950]
mov r15, qword [rsp + 0x948]
add rsp, 0x978
ret