Function at 0x469420
Capabilities:
Check os version
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
sub rsp, 0x978
mov qword [rsp + 0xe0], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov qword [rax - 8], rsi
mov qword [rax - 0x10], rdi
mov qword [rax - 0x18], r12
mov qword [rax - 0x20], r13
mov qword [rax - 0x28], r14
mov qword [rax - 0x30], r15
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0x930], rax
mov r14d, edx
mov r13, rcx
xor ebp, ebp
mov qword [rcx + 0x18], rbp
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x48], rbp
mov qword [rcx + 0x40], rbp
mov dword [rcx + 0x20], ebp
mov dword [rcx + 0x24], ebp
mov dword [rcx + 0x28], ebp
xor r9d, r9d
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x60]
call fcn.00481980
nop
lea r8, [rsp + 0x48]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x4694d1
lea rcx, [rsp + 0x60]
call fcn.004819e0
jmp 0x469e27
mov dword [rsp + 0x40], 0x100
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x430]
call fcn.00491ae0
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], rdx
lea rax, [rsp + 0x430]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
xor r8d, r8d
lea rdx, str.SynTpEnh
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x46953e
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x60]
call fcn.004819e0
jmp 0x469e27
mov word [rsp + 0x230], 0
xor edx, edx
mov r8d, 0x1fe
lea rcx, [rsp + 0x232]
call fcn.00491ae0
mov dword [rsp + 0x44], 0x200
mov qword [rsp + 0x28], rbp
lea rax, [rsp + 0x430]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x230]
lea rdx, str.SynTPEnh
lea rcx, [rsp + 0x68]
call fcn.00488500
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x230]
repne scasw ax, word [rdi]
not rcx
mov word [rsp + rcx*2 + 0x216], ax
mov word [rsp + 0x210], ax
mov dword [rsp + 0xf0], 0x114
lea rcx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x469e1d
mov eax, dword [rsp + 0x100]
cmp eax, 2
jne 0x46965b
mov rdx, rbp
lea rdi, [0x00400000]
nop
movzx eax, word [rdx + rdi + 0xda588]
mov word [rsp + rdx + 0x210], ax
add rdx, 2
test ax, ax
jne 0x469600
lea rdi, [rsp + 0x230]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov rax, qword [str.tp4table.dat]
mov qword [rdi - 2], rax
mov rax, qword [0x004da320]
mov qword [rdi + 6], rax
mov rax, qword [0x004da328]
mov qword [rdi + 0xe], rax
movzx eax, word [0x004da330]
mov word [rdi + 0x16], ax
jmp 0x4696c9
cmp eax, 1
jne 0x4696c9
mov rcx, rbp
lea rdi, [0x00400000]
nop
nop
movzx eax, word [rcx + rdi + 0xda580]
mov word [rsp + rcx + 0x210], ax
add rcx, 2
test ax, ax
jne 0x469670
lea rdi, [rsp + 0x230]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov rax, qword [str.tp4scrol.dat]
mov qword [rdi - 2], rax
mov rax, qword [0x004da300]
mov qword [rdi + 6], rax
mov rax, qword [0x004da308]
mov qword [rdi + 0xe], rax
movzx eax, word [0x004da310]
mov word [rdi + 0x16], ax
mov eax, dword [rsp + 0xf4]
cmp eax, 4
ja 0x4696e8
cmp eax, 4
jne 0x4696e4
cmp dword [rsp + 0xf8], 0
ja 0x4696e8
mov edi, ebp
jmp 0x4696ed
mov edi, 1
lea rdx, [0x004da57c]
lea rcx, [rsp + 0x230]
call fcn.00495ef0
mov r15, rax
test rax, rax
je 0x469e11
movsxd rbx, edi
mov qword [rsp + 0x50], rbx
mov r8, rax
mov edx, 0x400
lea rcx, [rsp + 0x530]
call fcn.00496710
test rax, rax
je 0x469b3a
movzx ecx, word [rsp + 0x530]
cmp cx, 0x3b
je 0x469af4
cmp cx, 0x23
je 0x469af4
cmp cx, 0x5b
je 0x469b3a
mov esi, ebp
mov rdx, rbp
lea rax, [rsp + 0x530]
lea rdi, [rsp + 0x530]
test cx, cx
je 0x469af4
movzx ecx, word [rax]
cmp cx, 0x2c
je 0x46978c
cmp cx, 0xa
je 0x46978c
add rax, 2
jmp 0x4697ad
mov word [rax], 0
mov qword [rsp + rdx*8 + 0x90], rdi
add esi, 1
add rdx, 1
cmp rdx, 9
je 0x4697b3
add rax, 2
mov rdi, rax
cmp word [rax], 0
jne 0x469777
cmp esi, 9
jl 0x469af4
mov rcx, qword [rsp + 0xd0]
call fcn.00492c30
mov r12d, eax
test r14d, r14d
je 0x4697db
test al, 8
je 0x469af4
jmp 0x4697e3
test al, 4
je 0x469af4
lea rdx, [0x004d5398]
mov rdi, qword [rsp + 0x90]
mov rcx, rdi
call fcn.00494b50
test eax, eax
je 0x469876
lea rdx, [rsp + 0x210]
mov rcx, rdi
call fcn.00494b50
test eax, eax
jne 0x469af4
lea rdx, [0x004d5398]
mov rdi, qword [rsp + 0x98]
mov rcx, rdi
call fcn.00494b50
test eax, eax
je 0x469876
mov rcx, rdi
call fcn.00492c30
mov ecx, dword [rsp + 0x100]
cmp ecx, 1
jne 0x469864
test rbx, rbx
je 0x469859
cmp eax, 0x62
jne 0x469af4
jmp 0x469876
cmp eax, 0x5f
jne 0x469af4
jmp 0x469876
cmp ecx, 2
jne 0x469876
cmp dword [rsp + 0xf4], eax
jne 0x469af4
lea rdx, str.Standard
mov rdi, qword [rsp + 0xc0]
mov rcx, rdi
call fcn.00494b50
test eax, eax
jne 0x469899
xor di, di
jmp 0x4699c1
lea rdx, str.StandardP
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4698b6
mov di, 0xb
jmp 0x4699c1
lea rdx, str.WheelVkey
mov rcx, rdi
call fcn.00494b50
test eax, eax
jne 0x4698d2
mov di, 1
jmp 0x4699c1
lea rdx, str.WheelStd
mov rcx, rdi
call fcn.00494b50
test eax, eax
jne 0x4698ee
mov di, 2
jmp 0x4699c1
lea rdx, str.TwoParents
mov rcx, rdi
call fcn.00494b50
test eax, eax
jne 0x46990a
mov di, 3
jmp 0x4699c1
lea rdx, str.TwoParentsP
mov rcx, rdi
call fcn.00494b50
test eax, eax
jne 0x469926
mov di, 0xa
jmp 0x4699c1
lea rdx, str.VkKeys
mov rcx, rdi
call fcn.00494b50
test eax, eax
jne 0x469942
mov di, 5
jmp 0x4699c1
lea rdx, str.Fine
mov rcx, rdi
call fcn.00494b50
test eax, eax
jne 0x46995b
mov di, 4
jmp 0x4699c1
lea rdx, str.None
mov rcx, rdi
call fcn.00494b50
test eax, eax
jne 0x469974
mov di, 6
jmp 0x4699c1
lea rdx, str.Wheel
mov rcx, rdi
call fcn.00494b50
test eax, eax
jne 0x46998d
mov di, 7
jmp 0x4699c1
lea rdx, str.WheelP
mov rcx, rdi
call fcn.00494b50
test eax, eax
jne 0x4699a6
mov di, 8
jmp 0x4699c1
lea rdx, [0x004da488]
mov rcx, rdi
call fcn.00494b50
test eax, eax
jne 0x469af4
mov di, 0xd
mov rcx, qword [rsp + 0xc8]
call fcn.00492c30
movsxd rbp, eax
cmp ebp, 1
ja 0x469af2
add dword [r13 + rbp*4 + 0x24], 1
mov ecx, 0x40c
call fcn.00496a20
mov rbx, rax
test rax, rax
je 0x469b2b
mov rdx, qword [rsp + 0xa0]
lea rsi, [rax + 0x304]
mov rax, rsi
sub rax, rdx
nop
nop
movzx ecx, word [rdx]
mov word [rdx + rax], cx
add rdx, 2
test cx, cx
jne 0x469a10
mov rcx, qword [rsp + 0xa8]
mov rdx, rbx
sub rdx, rcx
nop
movzx eax, word [rcx]
mov word [rcx + rdx + 4], ax
add rcx, 2
test ax, ax
jne 0x469a30
mov rcx, qword [rsp + 0xb0]
mov rdx, rbx
sub rdx, rcx
nop
movzx eax, word [rcx]
mov word [rcx + rdx + 0x104], ax
add rcx, 2
test ax, ax
jne 0x469a50
mov rcx, qword [rsp + 0xb8]
mov rdx, rbx
sub rdx, rcx
nop
nop
nop
nop
movzx eax, word [rcx]
mov word [rcx + rdx + 0x204], ax
add rcx, 2
test ax, ax
jne 0x469a80
mov word [rbx + 0x404], di
mov dword [rbx], ebp
mov dword [rbx + 0x408], r12d
lea rdi, [0x004d5398]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x469abd
mov dword [r13 + 0x20], 1
mov ecx, 0x10
call fcn.00496a20
test rax, rax
je 0x469b13
mov qword [rax + 8], rbx
xor ebp, ebp
mov qword [rax], rbp
mov rcx, qword [r13 + 0x18]
test rcx, rcx
je 0x469ae3
mov qword [rcx], rax
jmp 0x469ae7
mov qword [r13 + 0x10], rax
mov qword [r13 + 0x18], rax
mov rbx, qword [rsp + 0x50]
jmp 0x469af4
xor ebp, ebp
mov r8, r15
mov edx, 0x400
lea rcx, [rsp + 0x530]
call fcn.00496710
test rax, rax
je 0x469b3a
jmp 0x469733
mov rcx, rbx
call fcn.00494180
nop
lea rcx, [rsp + 0x60]
call fcn.004819e0
jmp 0x469e27
lea rcx, [rsp + 0x60]
call fcn.004819e0
jmp 0x469e27
mov qword [r13 + 0x48], rbp
mov qword [r13 + 0x40], rbp
mov r8, r15
mov edx, 0x400
lea rcx, [rsp + 0x530]
call fcn.00496710
test rax, rax
je 0x469e08
movzx edx, word [rsp + 0x530]
cmp dx, 0x3b
je 0x469dc8
cmp dx, 0x23
je 0x469dc8
mov edi, ebp
mov rcx, rbp
lea rax, [rsp + 0x530]
lea rsi, [rsp + 0x530]
test dx, dx
je 0x469dc8
nop
nop
movzx edx, word [rax]
cmp dx, 0x2c
je 0x469bb5
cmp dx, 0xa
je 0x469bb5
add rax, 2
jmp 0x469bd6
mov word [rax], 0
mov qword [rsp + rcx*8 + 0x90], rsi
add edi, 1
add rcx, 1
cmp rcx, 5
je 0x469bdc
add rax, 2
mov rsi, rax
cmp word [rax], 0
jne 0x469ba0
cmp edi, 5
jl 0x469dc8
lea rdi, [0x004d5398]
mov rax, qword [rsp + 0x90]
mov rsi, rax
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x469c79
lea rdx, [rsp + 0x210]
mov rcx, rax
call fcn.00494b50
test eax, eax
jne 0x469dc8
lea rdx, [0x004d5398]
mov rdi, qword [rsp + 0x98]
mov rcx, rdi
call fcn.00494b50
test eax, eax
je 0x469c79
mov rcx, rdi
call fcn.00492c30
mov ecx, dword [rsp + 0x100]
cmp ecx, 1
jne 0x469c67
test rbx, rbx
je 0x469c5c
cmp eax, 0x62
jne 0x469dc8
jmp 0x469c79
cmp eax, 0x5f
jne 0x469dc8
jmp 0x469c79
cmp ecx, 2
jne 0x469c79
cmp dword [rsp + 0xf4], eax
jne 0x469dc8
mov ecx, 0x214
call fcn.00496a20
mov rdi, rax
test rax, rax
je 0x469dfc
lea rdx, str.smooth
mov rsi, qword [rsp + 0xb0]
mov rcx, rsi
call fcn.00494b50
test eax, eax
jne 0x469cb0
lea r8d, [rax + 1]
jmp 0x469cc5
lea rdx, str.standard
mov rcx, rsi
call fcn.00494b50
mov r8d, 2
mov rcx, qword [rsp + 0xa0]
mov rdx, rdi
sub rdx, rcx
nop
nop
nop
nop
movzx eax, word [rcx]
mov word [rcx + rdx], ax
add rcx, 2
test ax, ax
jne 0x469ce0
mov rcx, qword [rsp + 0xa8]
lea rdx, [rdi + 0x100]
sub rdx, rcx
nop
nop
nop
nop
movzx eax, word [rcx]
mov word [rcx + rdx], ax
add rcx, 2
test ax, ax
jne 0x469d10
mov dword [rdi + 0x210], r8d
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x3c], ebp
mov eax, ebp
mov dword [rsp + 0x34], ebp
cmp word [rdi + 0x100], 0x2a
je 0x469d78
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x3c]
lea r8, [rsp + 0x34]
lea rdx, str._d._d._d._d
lea rcx, [rdi + 0x100]
call fcn.00493c10
mov eax, dword [rsp + 0x34]
mov dword [rdi + 0x200], eax
mov eax, dword [rsp + 0x3c]
mov dword [rdi + 0x204], eax
mov eax, dword [rsp + 0x38]
mov dword [rdi + 0x208], eax
mov eax, dword [rsp + 0x30]
mov dword [rdi + 0x20c], eax
mov ecx, 0x10
call fcn.00496a20
test rax, rax
je 0x469de7
mov qword [rax + 8], rdi
mov qword [rax], rbp
mov rcx, qword [r13 + 0x48]
test rcx, rcx
je 0x469dc0
mov qword [rcx], rax
jmp 0x469dc4
mov qword [r13 + 0x40], rax
mov qword [r13 + 0x48], rax
mov r8, r15
mov edx, 0x400
lea rcx, [rsp + 0x530]
call fcn.00496710
test rax, rax
je 0x469e08
jmp 0x469b60
mov rcx, rdi
call fcn.00494180
nop
lea rcx, [rsp + 0x60]
call fcn.004819e0
jmp 0x469e27
lea rcx, [rsp + 0x60]
call fcn.004819e0
jmp 0x469e27
mov rcx, r15
call fcn.00495be0
nop
lea rcx, [rsp + 0x60]
call fcn.004819e0
jmp 0x469e27
lea rcx, [rsp + 0x60]
call fcn.004819e0
mov rcx, qword [rsp + 0x930]
xor rcx, rsp
call fcn.004902e0
mov rbx, qword [rsp + 0x990]
mov rbp, qword [rsp + 0x998]
mov rsi, qword [rsp + 0x970]
mov rdi, qword [rsp + 0x968]
mov r12, qword [rsp + 0x960]
mov r13, qword [rsp + 0x958]
mov r14, qword [rsp + 0x950]
mov r15, qword [rsp + 0x948]
add rsp, 0x978
ret