Function at 0x4115e0
Capabilities:
Persist via run registry key

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x4a8
mov qword [rsp + 0x4a0], rbx
mov qword [rsp + 0x498], rbp
mov qword [rsp + 0x490], rsi
mov qword [rsp + 0x488], rdi
mov rbx, rcx
mov qword [rsp + 0x30], 0xfffffffffffffffe
lea rax, [0x004ab708]
mov qword [rcx], rax
lea rax, [0x004ab700]
mov qword [rcx + 0x138], rax
lea rsi, [rcx + 0x160]
lea rax, method..1.virtual_0
mov qword [rsi], rax
lea rax, [0x004ab558]
mov qword [rcx + 0x238], rax
call fcn.004545a0
test eax, eax
je 0x4116ce
xor r8d, r8d
lea rdx, str.CInstall_::_CInstall_n
lea rcx, [rsp + 0x140]
call fcn.00486850
movabs rdx, 0x203a5952544e45
mov qword [rsp + 0x40], rdx
lea rdi, [rsp + 0x40]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x140]
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x4116a0
call fcn.004546e0
mov rcx, rax
call fcn.004545b0
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0x40]
call fcn.004548a0
mov r8, 0xffffffff80000002
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea rcx, [rsp + 0x240]
call fcn.00465d20
lea r8, str.UIUCU2
lea rdx, [rsp + 0x248]
lea rcx, [rsp + 0x240]
call fcn.00465350
test eax, eax
jne 0x411726
call fcn.004545a0
test eax, eax
je 0x411726
call fcn.004546e0
mov rcx, rax
lea rdx, str.FAILED_DeleteValue:_ValueName__UIUCU2_n
call fcn.004548a0
call fcn.004545a0
test eax, eax
je 0x41179f
xor r8d, r8d
lea rdx, str.CInstall_::_CInstall_n
lea rcx, [rsp + 0x140]
call fcn.00486850
movabs rdx, 0x20203a54495845
mov qword [rsp + 0x40], rdx
lea rdi, [rsp + 0x40]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x140]
xor ecx, ecx
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x411770
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0x40]
call fcn.004548a0
call fcn.004546e0
mov rcx, rax
call fcn.004545c0
nop
lea rdi, [rbx + 0x1868]
mov qword [rsp + 0x28], rdi
lea rcx, [rdi + 0x50]
call fcn.0049b1dc
nop
lea rcx, [rdi + 0x48]
call fcn.0049b1dc
nop
lea rcx, [rdi + 0x40]
call fcn.0049b1dc
nop
lea rcx, [rdi + 0x38]
call fcn.0049b1dc
nop
lea rcx, [rdi + 0x28]
call fcn.0049b1dc
nop
lea rcx, [rdi + 0x20]
call fcn.0049b1dc
nop
lea rcx, [rdi + 0x18]
call fcn.0049b1dc
nop
lea rcx, [rdi + 0x10]
call fcn.0049b1dc
nop
lea rcx, [rdi + 8]
call fcn.0049b1dc
nop
lea rcx, [rbx + 0x660]
call fcn.00404640
nop
lea rcx, [rbx + 0x628]
lea rax, [0x004aa638]
mov qword [rcx], rax
call fcn.0040e750
nop
lea rcx, [rbx + 0x620]
call fcn.0049b1dc
nop
lea rcx, [rbx + 0x5d8]
call fcn.0049a80c
nop
lea rcx, [rbx + 0x5d0]
call fcn.0049b1dc
nop
lea rcx, [rbx + 0x4f0]
call fcn.0049bbdc
nop
lea rcx, [rbx + 0x4d8]
call fcn.0049b1dc
nop
test rsi, rsi
je 0x411878
lea rax, [rsi + 0xd8]
jmp 0x41187a
xor eax, eax
lea rcx, [0x004a9e48]
mov qword [rax], rcx
mov rcx, rsi
call fcn.0049bbdc
nop
lea rcx, [rbx + 0x3f0]
call fcn.004441d0
nop
lea rcx, [rbx + 0x3b0]
call fcn.00444040
nop
lea rcx, [rbx + 0x138]
call fcn.004583e0
nop
lea rcx, [rbx + 0x3a8]
call fcn.00471340
nop
lea rcx, [rbx + 0x3a0]
call fcn.00440780
nop
lea rcx, [rbx + 0x358]
call fcn.00441240
nop
lea rdi, [rbx + 0x248]
mov qword [rsp + 0x20], rdi
lea rcx, [rdi + 0x108]
call fcn.0049b1dc
nop
mov rcx, rdi
call fcn.00401f90
nop
mov rcx, rbx
mov rbx, qword [rsp + 0x4a0]
mov rbp, qword [rsp + 0x498]
mov rsi, qword [rsp + 0x490]
mov rdi, qword [rsp + 0x488]
add rsp, 0x4a8
jmp fcn.00435ed0