Function at 0x180001590
Capabilities:
Create process on windows
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x160
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor r12d, r12d
mov ebp, ecx
lea rcx, [rsp + 0x41]
mov ebx, r12d
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x40], bl
mov esi, r12d
call sub.MSVCR90.dll_memset
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x180008b10]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
jne 0x18000165b
lea rcx, [0x180008b10]
xor edx, edx
mov r8d, 0x104
call sub.MSVCR90.dll_memset
lea rcx, [0x180008b10]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x180008b10]
repne scasb al, byte [rdi]
movzx eax, word [0x180006384]
or rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [0x180008b10]
repne scasb al, byte [rdi]
mov rax, qword [str.insvc32.exe]
mov qword [rdi - 1], rax
mov eax, dword [0x180006390]
mov dword [rdi + 7], eax
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x180008c20]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
jne 0x1800016e0
lea rcx, [0x180008c20]
xor edx, edx
mov r8d, 0x104
call sub.MSVCR90.dll_memset
lea rcx, [0x180008c20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x180008c20]
repne scasb al, byte [rdi]
movzx eax, word [0x180006384]
or rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [0x180008c20]
repne scasb al, byte [rdi]
mov rax, qword [str.maxsvc32.dll]
mov qword [rdi - 1], rax
mov eax, dword [0x1800063a0]
mov dword [rdi + 7], eax
movzx eax, byte [0x1800063a4]
mov byte [rdi + 0xb], al
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x180008d30]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
jne 0x18000175b
lea rcx, [0x180008d30]
xor edx, edx
mov r8d, 0x104
call sub.MSVCR90.dll_memset
lea rcx, [0x180008d30]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x180008d30]
repne scasb al, byte [rdi]
movzx eax, word [0x180006384]
or rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [0x180008d30]
repne scasb al, byte [rdi]
mov rax, qword [str.wscript.exe]
mov qword [rdi - 1], rax
mov eax, dword [0x1800063b0]
mov dword [rdi + 7], eax
mov ecx, dword [0x180008abc]
call fcn.1800013e0
test eax, eax
jne 0x1800017eb
lea edx, [rax + 1]
lea rcx, str.wscript.exe
call fcn.180001470
test eax, eax
jne 0x1800017aa
lea r8, [0x180008d30]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 0x64
nop
mov ecx, 0x64
dec edi
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.wscript.exe
mov edx, 1
call fcn.180001470
test eax, eax
jne 0x1800017db
test edi, edi
jg 0x1800017b0
jmp 0x180001919
mov ecx, 0x32c8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1800018d8
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [0x180008978], r12d
mov edi, 0x64
mov ecx, 0x64
dec edi
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.z.exe
mov edx, 1
call fcn.180001470
test eax, eax
jne 0x18000182a
test edi, edi
jg 0x180001802
jmp 0x180001887
mov eax, dword [0x180008abc]
mov ecx, 0x32c8
mov dword [0x180008978], eax
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1800087f8]
lea rax, [rsp + 0x30]
lea rdx, [0x1800080cc]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [0x180008a94], 0x63
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0x63
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, 1
cmp ebp, 6
jne 0x1800018d0
test ebx, ebx
jne 0x1800018d0
mov rcx, qword [0x1800087f8]
lea rax, [rsp + 0x30]
lea r9d, [rbp - 2]
lea rdx, [0x1800080cc]
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov qword [rsp + 0x20], rax
mov dword [0x180008a94], r12d
mov dword [rsp + 0x30], r12d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor eax, eax
jmp 0x180001a06
cmp dword [0x180008a94], esi
jne 0x180001919
mov rcx, qword [0x1800087f8]
lea rax, [rsp + 0x30]
lea rdx, [0x1800080cc]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [0x180008a94], 0x58
mov dword [rsp + 0x30], 0x58
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov r8d, dword [0x180008abc]
lea r9, [0x180008c20]
lea rdx, str._d__s
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCR90.dll_sprintf]
lea r9, [rsp + 0x40]
lea r8, [0x180008b10]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edi, 0x64
nop
mov ecx, 0x64
dec edi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x1800087f8]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
lea rdx, [0x1800080cc]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r12d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [rsp + 0x30]
mov dword [0x180008a94], edx
cmp edx, 1
je 0x1800019bd
test edi, edi
jg 0x180001960
jmp 0x180001a04
mov esi, 1
cmp ebx, esi
jne 0x180001a04
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea r9, [0x180008980]
lea r8, str.cmd.exe
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp ebp, 6
jne 0x180001a04
lea rcx, str.Themes
call fcn.180001320
mov eax, esi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180004b30
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret