Function at 0x14003a7d8
Capabilities:
Check os version
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xb0
mov qword [rbp + 0x27], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r15b, dl
mov r14, rcx
mov qword [rbp + 0x2f], rcx
xor r12d, r12d
mov dword [rbp - 0x11], r12d
mov eax, dword [0x1401aaf78]
lea r13, [0x1401a09a8]
lea edi, [r12 + 1]
test dil, al
jne 0x14003a85e
or eax, edi
mov dword [0x1401aaf78], eax
mov rcx, r13
mov rax, qword [0x1401a09a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401aaf80], rax
lea rcx, [0x14010a7cc]
call fcn.1400bd6d0
nop
mov eax, dword [0x1401aaf78]
test al, 2
jne 0x14003a896
or eax, 2
mov dword [0x1401aaf78], eax
mov rcx, r13
mov rax, qword [0x1401a09a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401aaf70], rax
lea rcx, [0x14010a79c]
call fcn.1400bd6d0
nop
mov eax, dword [0x1401aaf78]
test al, 4
jne 0x14003a8ce
or eax, 4
mov dword [0x1401aaf78], eax
mov rcx, r13
mov rax, qword [0x1401a09a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401aaf68], rax
lea rcx, [0x14010a76c]
call fcn.1400bd6d0
nop
mov eax, dword [0x1401aaf78]
test al, 8
jne 0x14003a900
or eax, 8
mov dword [0x1401aaf78], eax
mov rcx, r13
mov rax, qword [0x1401a09a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1401aaf88], rax
lea rcx, [0x14010a73c]
call fcn.1400bd6d0
nop
mov rax, qword [0x1401aaf70]
cmp dword [rax - 0x10], r12d
je 0x14003a959
mov ecx, r12d
mov rax, qword [0x1401aa1c8]
test rax, rax
setne cl
test ecx, ecx
jne 0x14003a92c
mov ecx, 0x80004005
call fcn.140001874
int3
mov rcx, qword [0x1401aaf88]
sub rax, rcx
movzx edx, word [rcx]
cmp dx, word [rcx + rax]
jne 0x14003a94d
add rcx, 2
test dx, dx
jne 0x14003a936
mov eax, r12d
jmp 0x14003a951
sbb eax, eax
or eax, edi
test eax, eax
je 0x14003b21d
lea rdx, [0x1401aa1c8]
lea rcx, [0x1401aaf88]
call fcn.140001ff8
lea rcx, [0x1401aaf80]
call fcn.140001e88
lea rcx, [0x1401aaf70]
call fcn.140001e88
lea rcx, [0x1401aaf68]
call fcn.140001e88
mov esi, r12d
mov rcx, r13
mov rax, qword [0x1401a09a8]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x21], rbx
mov rcx, r13
mov rax, qword [0x1401a09a8]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x19], rax
lea rax, [rbp - 0x31]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.Volatile_Environment
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r13d, 0x82
test eax, eax
jne 0x14003ac0e
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rbp - 0x31]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003abfe
mov dword [rbp - 0x39], 0x104
mov ecx, edi
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r13d
or eax, ecx
jge 0x14003aa4f
mov edx, r13d
lea rcx, [rbp - 0x21]
call fcn.1400021d0
mov rbx, qword [rbp - 0x21]
lea rax, [rbp - 0x39]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x29]
xor r8d, r8d
lea rdx, str.AppData
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003aaa5
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400bdc3c
test eax, eax
js 0x14003aa9a
cmp eax, dword [rbx - 0xc]
jg 0x14003aa9a
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r12w
jmp 0x14003aab2
mov ecx, 0x80070057
call fcn.140001874
int3
lea rcx, [rbp - 0x21]
call fcn.140001e88
mov rbx, qword [rbp - 0x21]
mov dword [rbp - 0x39], 0x104
mov rax, qword [0x1401aaf80]
mov edx, edi
sub edx, dword [rax - 8]
mov ecx, dword [rax - 0xc]
sub ecx, r13d
or ecx, edx
jge 0x14003aae5
mov edx, r13d
lea rcx, [0x1401aaf80]
call fcn.1400021d0
mov rax, qword [0x1401aaf80]
lea rcx, [rbp - 0x39]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x29]
xor r8d, r8d
lea rdx, str.Local_AppData
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003ab51
mov rcx, qword [0x1401aaf80]
movsxd rdx, dword [rcx - 0xc]
call fcn.1400bdc3c
mov rcx, rax
test eax, eax
js 0x14003ab46
mov rax, qword [0x1401aaf80]
cmp ecx, dword [rax - 0xc]
jg 0x14003ab46
mov dword [rax - 0x10], ecx
movsxd rcx, ecx
mov rax, qword [0x1401aaf80]
mov word [rax + rcx*2], r12w
jmp 0x14003ab5d
mov ecx, 0x80070057
call fcn.140001874
int3
lea rcx, [0x1401aaf80]
call fcn.140001e88
mov dword [rbp - 0x39], 0x104
mov rax, qword [rbp - 0x19]
mov ecx, edi
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, r13d
or eax, ecx
jge 0x14003ab83
mov edx, r13d
lea rcx, [rbp - 0x19]
call fcn.1400021d0
lea rax, [rbp - 0x39]
mov qword [rsp + 0x28], rax
mov rdi, qword [rbp - 0x19]
mov qword [rsp + 0x20], rdi
lea r9, [rbp - 0x29]
xor r8d, r8d
lea rdx, str.A520A1A4_1780_4FF6_BD18_167343C5AF16
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003abdd
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.1400bdc3c
test eax, eax
js 0x14003abd2
cmp eax, dword [rdi - 0xc]
jg 0x14003abd2
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], r12w
jmp 0x14003abed
mov ecx, 0x80070057
call fcn.140001874
int3
lea rdx, [0x1401aaf80]
lea rcx, [rbp - 0x19]
call fcn.140001ff8
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, 1
jmp 0x14003ac0e
lea rdx, [0x1401aaf80]
lea rcx, [rbp - 0x19]
call fcn.140001ff8
call fcn.14003a5a8
or r13, 0xffffffffffffffff
test al, al
je 0x14003af18
lea rax, [rbp - 0x31]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerMain
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003ad0e
mov dword [rbp - 0x39], 0x104
lea ecx, [rax + 1]
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov edx, 0x82
sub eax, edx
or eax, ecx
jge 0x14003ac75
lea rcx, [rbp - 0x21]
call fcn.1400021d0
mov rbx, qword [rbp - 0x21]
lea rax, [rbp - 0x39]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x29]
xor r8d, r8d
lea rdx, str.Isolation
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003acf5
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400bdc3c
test eax, eax
js 0x14003acea
cmp eax, dword [rbx - 0xc]
jg 0x14003acea
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r12w
mov dil, r12b
cmp dword [rbx - 0x10], r12d
jl 0x14003acf5
lea rdx, str.PMIL
mov rcx, rbx
call fcn.1400bde0c
test rax, rax
je 0x14003acf5
sub rax, rbx
sar rax, 1
test eax, eax
jne 0x14003acf5
lea esi, [rax + 1]
jmp 0x14003acf5
mov ecx, 0x80070057
call fcn.140001874
int3
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test dil, dil
jne 0x14003ad0e
mov edi, 1
jmp 0x14003aed3
lea rax, [rbp - 0x31]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftInternet_ExplorerAdvancedOptionsCRYPTOPROTECTEDMODESECURITY
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003aecc
mov eax, dword [0x1401a8d80]
mov ecx, eax
imul ecx, eax
imul ecx, eax
mov eax, 0x38e38e39
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*8]
add eax, eax
sub ecx, eax
cmp ecx, 7
jne 0x14003ad73
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x1401a8d80], eax
mov dword [rbp - 0x39], 0x104
mov edi, 1
mov ecx, edi
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
mov edx, 0x82
sub eax, edx
or eax, ecx
jge 0x14003ad9f
lea rcx, [rbp - 0x21]
call fcn.1400021d0
mov rbx, qword [rbp - 0x21]
lea rax, [rbp - 0x39]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x29]
xor r8d, r8d
lea rdx, str.DefaultValue
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.1400bdc3c
test eax, eax
js 0x14003aec1
cmp eax, dword [rbx - 0xc]
jg 0x14003aec1
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], r12w
mov r8d, dword [0x1401a8d80]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0xd
sub ecx, edx
cmp ecx, 0xb
jne 0x14003ae53
mov eax, 0x51eb851f
imul r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x64
sub r8d, edx
add r8d, 0x141
movsxd rcx, r8d
mov eax, 4
mul rcx
cmovo rax, r13
mov rcx, rax
call fcn.1400bc638
mov rcx, rax
call fcn.1400be0fc
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbx - 0x10], r12d
jl 0x14003ae82
lea rdx, str.PMIL
mov rcx, rbx
call fcn.1400bde0c
test rax, rax
je 0x14003ae82
sub rax, rbx
sar rax, 1
test eax, eax
cmove esi, edi
mov r8d, dword [0x1401a8d80]
mov ecx, r8d
imul ecx, r8d
mov eax, 0x30c30c31
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x15
sub ecx, edx
cmp ecx, 0xb
jne 0x14003aeda
mov ecx, 4
call fcn.1400bd778
mov r8d, dword [0x1401a8d80]
mov dword [rax], r8d
jmp 0x14003aeda
mov ecx, 0x80070057
call fcn.140001874
int3
mov edi, 1
mov esi, edi
mov r8d, dword [0x1401a8d80]
lea ecx, [r8 + 1]
imul ecx, r8d
mov eax, 0xb21642c9
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x17
sub ecx, edx
cmp ecx, 4
jne 0x14003af1a
call fcn.1400bd978
mov ecx, dword [0x1401a8d80]
cmp ecx, eax
jne 0x14003af1a
sub ecx, edi
mov dword [0x1401a8d80], ecx
jmp 0x14003af1a
mov esi, edi
mov rbx, 0xffffffff80000002
cmp qword [0x1401a3d48], rbx
je 0x14003af84
test esi, esi
je 0x14003afac
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x14003af84
cmp byte [0x1401a8ea4], r12b
jne 0x14003af84
lea rdx, str.Software_
lea rcx, [rbp - 9]
call fcn.140001f2c
nop
mov rdx, rax
lea rcx, [0x1401aaf70]
call fcn.140001ff8
nop
mov rdx, qword [rbp - 9]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14003af97
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x14003af97
lea rdx, [0x1401aa1c8]
lea rcx, [0x1401aaf70]
call fcn.140001ff8
lea rdx, [rbp - 0x19]
lea rcx, [0x1401aaf80]
call fcn.140001ff8
jmp 0x14003b067
call fcn.14003a6a8
test al, al
jne 0x14003afce
mov r8d, 0x1e
lea rdx, str.Packageswindows_ie_ac_001AC
lea rcx, [0x1401aaf80]
call fcn.14000e294
lea rdx, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
lea rcx, [rbp + 7]
call fcn.140001f2c
nop
mov rdx, rax
lea rcx, [0x1401aaf70]
call fcn.140001ff8
nop
mov rdx, qword [rbp + 7]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14003b00f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov r8d, dword [0x1401a8d80]
lea r9d, [r8 + 1]
lea ecx, [r8 + 2]
imul ecx, r9d
imul ecx, r8d
mov eax, 0x78787879
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x11
sub ecx, edx
cmp ecx, 3
jne 0x14003b067
test r8d, r8d
je 0x14003b05d
dec r8d
je 0x14003b054
mov dword [0x1401a8d80], r9d
jmp 0x14003b067
mov dword [0x1401a8d80], r12d
jmp 0x14003b067
mov dword [0x1401a8d80], 2
mov rcx, qword [0x1401aaf70]
cmp dword [rcx - 0x10], r12d
jl 0x14003b0a8
lea rdx, str.windows_ie_ac_001
call fcn.1400bde0c
test rax, rax
je 0x14003b0a8
sub rax, qword [0x1401aaf70]
sar rax, 1
test eax, eax
jle 0x14003b0a8
lea rdx, [0x1401aa1c8]
lea rcx, [0x1401aaf68]
call fcn.140001ff8
jmp 0x14003b123
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp al, 6
jae 0x14003b0e2
cmp byte [0x1401a8ea4], r12b
jne 0x14003b0e2
lea rdx, str.Software_
lea rcx, [rbp + 0x1f]
call fcn.140001f2c
nop
mov rdx, rax
lea rcx, [0x1401aaf68]
call fcn.140001ff8
nop
mov rdx, qword [rbp + 0x1f]
jmp 0x14003b107
lea rdx, str.SoftwareClassesLocal_SettingsSoftwareMicrosoftWindowsCurrentVersionAppContainerStoragewindows_ie_ac_001Software_
lea rcx, [rbp + 0x17]
call fcn.140001f2c
nop
mov rdx, rax
lea rcx, [0x1401aaf68]
call fcn.140001ff8
nop
mov rdx, qword [rbp + 0x17]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14003b123
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp qword [0x1401a3d48], rbx
je 0x14003b1b5
cmp byte [0x1401a3c12], r12b
je 0x14003b1b5
lea rcx, [rbp - 1]
call fcn.14003a450
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401aaf70]
call fcn.14000e294
nop
mov rdx, qword [rbp - 1]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14003b177
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [rbp + 0xf]
call fcn.14003a450
nop
mov rdx, qword [rax]
mov r8d, dword [rdx - 0x10]
lea rcx, [0x1401aaf68]
call fcn.14000e294
nop
mov rdx, qword [rbp + 0xf]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14003b1b5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [0x1401a3d48]
lea rcx, [0x1401aaf70]
call fcn.14003b29c
mov rdx, qword [0x1401a3d48]
lea rcx, [0x1401aaf68]
call fcn.14003b29c
nop
mov rdx, qword [rbp - 0x19]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14003b1fd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x21]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
add eax, r13d
test eax, eax
jg 0x14003b21d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test r15b, r15b
je 0x14003b265
call fcn.14003a368
test al, al
jne 0x14003b254
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
lea rdx, [0x1401aaf68]
mov rcx, r14
call fcn.140002bac
jmp 0x14003b274
lea rdx, [0x1401aaf70]
mov rcx, r14
call fcn.140002bac
mov dword [rbp - 0x11], edi
mov rax, r14
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret