Function at 0x140019b90
Capabilities:
Check if file exists
Get common file path
Get file attributes
Persist via run registry key
Set current directory
Set registry value
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r14
lea rbp, [rsp - 0x600]
sub rsp, 0x700
mov rax, qword [0x1400502a8]
xor rax, rsp
mov qword [rbp + 0x5f0], rax
mov r14d, r8d
mov dword [rsp + 0x38], r8d
mov r12d, edx
mov dword [rsp + 0x34], edx
mov rdi, rcx
mov ebx, 0x80070002
call fcn.140017448
xor ecx, ecx
test eax, eax
je 0x14001a054
mov esi, ecx
lea rdx, str._Registering_DLL:__S._r_n
mov ebx, ecx
mov r8, rdi
mov ecx, 4
call fcn.140016868
mov eax, 1
inc eax
mov dword [rsp + 0x48], eax
test r14d, r14d
je 0x140019e73
mov edx, 0x208
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor r14d, r14d
test eax, eax
je 0x14001a031
lea r8, str._regsvr32.exe
mov edx, 0x208
lea rcx, [rbp - 0x30]
call fcn.140001584
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140019c54
test al, 0x10
lea eax, [r14 + 1]
je 0x140019c57
mov eax, r14d
test eax, eax
je 0x140019e43
test rdi, rdi
je 0x140019c8d
mov edx, 0x5c
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov edx, 0x3c
lea rcx, [rsp + 0x50]
lea r8, [rax + 2]
test rax, rax
jne 0x140019c88
mov r8, rdi
call fcn.140001470
lea rax, str.__s__
test r12d, r12d
lea r8, str.__s__u__
mov esi, 0x208
cmovne r8, rax
lea rcx, [rbp - 0x30]
mov edx, esi
call fcn.140001584
mov r8, rdi
lea rcx, [rbp - 0x30]
mov edx, esi
call fcn.140001584
lea r8, [0x14004311c]
mov edx, esi
lea rcx, [rbp - 0x30]
call fcn.140001584
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], r14
mov esi, 3
mov qword [rsp + 0x20], rax
mov r9d, esi
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x140019d32
lea rax, [rsp + 0x40]
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r14d, eax
test eax, eax
jne 0x140019dab
xor r14d, r14d
mov rcx, qword [rsp + 0x40]
lea r8, [rbp - 0x30]
call fcn.14001a4b4
mov rsi, rax
test rax, rax
je 0x140019d93
lea rax, [rbp - 0x30]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], r14w
jne 0x140019d50
lea eax, [rcx*2 + 2]
mov r9d, 1
mov rcx, qword [rsp + 0x40]
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov rdx, rsi
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rsi
mov r14d, eax
call qword [sym.imp.msvcrt.dll_free]
jmp 0x140019d99
mov r14d, 0x80004005
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test r14d, r14d
je 0x140019dd7
movzx esi, r14w
lea r8, [rsp + 0x50]
or esi, 0x80070000
lea rdx, str.ERROR:_Could_not_store_delayed_action_for_component__S:_0x_x._r_n
test r14d, r14d
mov ecx, 2
cmovle esi, r14d
mov r9d, esi
call fcn.140016868
jmp 0x140019e33
mov rcx, qword [0x140050310]
or rsi, 0xffffffffffffffff
cmp rcx, rsi
jne 0x140019dfd
lea edx, [rsi + 5]
call fcn.140016148
mov rcx, qword [0x140050310]
xor eax, eax
cmp rcx, rsi
je 0x140019e27
cmp dword [0x1400516e0], 4
jl 0x140019e27
lea r9, [rsp + 0x30]
mov dword [rsp + 0x30], eax
mov r8d, reloc.ATL.DLL_AtlInternalQueryInterface
mov qword [rsp + 0x20], rax
lea rdx, str.__Delayed_action_until_reboot._r_n
call qword [sym.imp.KERNEL32.dll_WriteFile]
or dword [0x140050558], 1
mov esi, 0xd2af9
not esi
xor r14d, r14d
shr esi, 0x1f
test esi, esi
jne 0x14001a028
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
mov r8, rdi
or ebx, 0x80070000
lea rdx, str.ERROR:_Failed_delaying_dll_registration_for_file__S:_0x_x._r_n
test eax, eax
mov ecx, 2
cmovle ebx, eax
mov r9d, ebx
call fcn.140016868
jmp 0x14001a008
xor r12d, r12d
xor ecx, ecx
mov dword [rsp + 0x30], r12d
call qword [sym.imp.ole32.dll_OleInitialize]
mov ebx, eax
test eax, eax
js 0x14001a041
lea rdx, [rbp - 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x140019ee4
mov r8, rdi
lea rcx, [rbp + 0x3e0]
mov edx, 0x103
call fcn.140001470
lea edx, [r12 + 0x5c]
lea rcx, [rbp + 0x3e0]
call qword [sym.imp.msvcrt.dll_wcsrchr]
test rax, rax
je 0x140019ee4
lea rcx, [rbp + 0x3e0]
mov word [rax], r12w
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [rsp + 0x30], 1
or rcx, 0xffffffffffffffff
mov r14, rcx
inc r14
cmp word [rdi + r14*2], r12w
jne 0x140019eeb
add r14, 5
mov eax, 2
mul r14
cmovo rax, rcx
mov rcx, rax
call fcn.14003c310
mov r12, rax
test rax, rax
je 0x140019fac
test rdi, rdi
je 0x140019f2c
mov r8, r14
mov rdx, rax
mov rcx, rdi
call fcn.140016b08
xor edx, edx
mov rcx, r12
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov r14, rax
cmp rax, 0x20
jbe 0x140019f86
cmp dword [rsp + 0x34], 0
lea rax, str.DllRegisterServer
lea rdx, str.DllUnregisterServer
mov rcx, r14
cmovne rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140019f7b
call qword [0x14003f118]
mov ebx, eax
xor eax, eax
test ebx, ebx
mov esi, eax
setns sil
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x140019fa4
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov ecx, 0x57
cmove eax, ecx
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov rcx, r12
call fcn.14003c2b8
xor r14d, r14d
cmp dword [rsp + 0x30], r14d
je 0x140019fc0
lea rcx, [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
call qword [sym.imp.ole32.dll_OleUninitialize]
test esi, esi
jne 0x14001a038
test ebx, ebx
jne 0x140019fec
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmove ebx, eax
mov r9d, ebx
lea rdx, str.ERROR:_Dll_Registration:_Failed_for_file__S:_0x_x._r_n
mov r8, rdi
mov ecx, 2
call fcn.140016868
mov r12d, dword [rsp + 0x34]
cmp dword [rsp + 0x38], r14d
mov eax, r14d
sete al
mov r14d, eax
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x48]
cmp eax, 2
jge 0x14001a086
jmp 0x140019bff
lea rdx, str.____Delayed_Dll_Registration:_Succeeded_for_file__S._r_n
jmp 0x14001a079
mov ebx, 0x80004005
jmp 0x14001a086
lea rdx, str.____Dll_Registration:_Succeeded_for_file__S._r_n
jmp 0x14001a079
mov r8d, ebx
lea rdx, str.ERROR:_OLE_Initialization_failed:_0x_x._r_n
xor ecx, ecx
call fcn.140016868
jmp 0x14001a086
test r12d, r12d
je 0x14001a072
mov r9d, ebx
lea rdx, str.ERROR:_Dll_Registration:_Could_not_find_file__S:_0x_x._r_n
mov r8, rdi
mov ecx, 2
call fcn.140016868
jmp 0x14001a086
lea rdx, str.Dll_UnRegistration:_Could_not_find_file__S._r_n
mov r8, rdi
mov ecx, 4
call fcn.140016868
mov eax, ebx
mov rcx, qword [rbp + 0x5f0]
xor rcx, rsp
call fcn.14003c6c0
mov rbx, qword [rsp + 0x740]
add rsp, 0x700
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret