Function at 0x100004900
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x560
mov rax, qword [0x10000f100]
xor rax, rsp
mov qword [rsp + 0x550], rax
xor edi, edi
mov r12d, edi
mov r14d, edi
mov dword [0x100010488], edi
cmp dword [0x100011408], edi
jne 0x100004995
lea r8d, [rdi + 4]
lea rdx, [0x100010ebc]
lea rcx, [0x100001768]
call fcn.1000057f4
cmp eax, edi
je 0x100004967
cmp eax, 4
jbe 0x100004995
mov esi, 0x10
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4b1
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
call fcn.100005574
mov dword [0x100010488], 0x80070714
jmp 0x100004ebb
mov r15, qword [rsp + 0x30]
mov r13d, dword [rsp + 0x38]
mov esi, 0x10
lea ebx, [rsi - 0xf]
mov ebp, edi
xor edx, edx
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x3c], edi
lea r8d, [rdx + 0x68]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x80], 0x68
cmp byte [0x100011622], dil
jne 0x100004afb
lea rdx, [rsp + 0x38]
lea rcx, [0x100001770]
mov r8d, 4
call fcn.1000057f4
cmp eax, edi
je 0x10000496c
cmp eax, 4
ja 0x10000496c
mov eax, dword [rsp + 0x38]
cmp eax, ebx
jne 0x100004a12
mov word [rsp + 0xc0], di
jmp 0x100004a37
cmp eax, 2
jne 0x100004a26
mov eax, 6
mov word [rsp + 0xc0], ax
jmp 0x100004a37
mov ecx, 3
cmp eax, ecx
jne 0x100004a3e
mov word [rsp + 0xc0], cx
mov dword [rsp + 0xbc], ebx
cmp ebp, edi
jne 0x100004b44
movzx eax, word [0x100011418]
cmp ax, di
je 0x100004ace
test bl, al
je 0x100004a5f
lea r15, [0x100001780]
jmp 0x100004a6f
test al, 2
lea rax, [0x100001788]
cmove rax, r15
mov r15, rax
lea rdx, [rsp + 0xf0]
mov r8d, 0x104
mov rcx, r15
call fcn.1000057f4
cmp eax, edi
je 0x10000496c
lea rcx, [0x100001760]
or eax, 0xffffffff
lea r8, [rsp + 0xf0]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov ecx, 0x7f
mov r9d, eax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
je 0x100004acb
cmp r13d, 0xfffffffe
je 0x100004acb
mov r13d, ebx
mov r12d, ebx
jmp 0x100004ace
mov r13d, edi
cmp r12d, edi
jne 0x100004bab
lea rdx, [rsp + 0xf0]
lea rcx, [0x100001790]
mov r8d, 0x104
call fcn.1000057f4
cmp eax, edi
je 0x10000496c
jmp 0x100004b44
lea r8, [0x100011622]
lea rax, [rsp + 0xf0]
mov edx, 0x104
sub r8, rax
lea rcx, [rsp + 0xf0]
lea rax, [rdx + 0x7ffffefa]
cmp rax, rdi
je 0x100004b39
mov al, byte [r8 + rcx]
cmp al, dil
je 0x100004b39
mov byte [rcx], al
add rcx, rbx
sub rdx, rbx
jne 0x100004b1a
cmp rdx, rdi
jne 0x100004b41
sub rcx, rbx
mov byte [rcx], dil
cmp ebp, ebx
jne 0x100004bab
lea rdx, [rsp + 0xf0]
lea rcx, [0x1000017a0]
mov r8d, 0x104
call fcn.1000057f4
cmp eax, edi
je 0x10000496c
cmp byte [0x100011622], dil
jne 0x100004d5e
lea rcx, [0x100001760]
or eax, 0xffffffff
lea r8, [rsp + 0xf0]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov ecx, 0x7f
mov r9d, eax
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
je 0x100004d5e
lea r9, [rsp + 0x3c]
lea r8, [rsp + 0x30]
lea rcx, [rsp + 0xf0]
mov edx, 0x104
call fcn.100001fb0
cmp eax, edi
je 0x100004ebb
mov ebx, dword [rsp + 0x3c]
cmp r14d, edi
jne 0x100004bfa
mov eax, 1
cmp word [0x100010490], ax
je 0x100004bfa
cmp dword [0x100011400], edi
je 0x100004bfa
cmp ebx, edi
jne 0x100004c02
mov r14d, eax
call fcn.100002650
cmp ebx, edi
je 0x100004d1f
cmp dword [0x10000f4bc], edi
je 0x100004f4d
cmp ebx, edi
je 0x100004d1f
test byte [0x100010ec4], 4
je 0x100004d1f
lea rcx, [0x100001660]
call fcn.100007dac
xor ebx, ebx
mov rdi, rax
cmp rax, rbx
je 0x100004f2d
lea rdx, [0x10000f4e0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r11, rax
cmp rax, rbx
je 0x100004eee
cmp dword [0x100011410], 0
movzx ecx, word [0x100010490]
lea rax, [0x1000105d8]
mov qword [rsp + 0x48], rax
lea rax, [0x100010670]
mov qword [rsp + 0x40], rbx
mov rbx, qword [rsp + 0x30]
mov word [rsp + 0x68], cx
movzx ecx, word [0x100011418]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x6c], ecx
je 0x100004cb5
bts ecx, 0x10
mov dword [rsp + 0x6c], ecx
mov eax, dword [0x100010ec4]
test al, 8
je 0x100004cc7
bts ecx, 0x11
mov dword [rsp + 0x6c], ecx
test sil, al
je 0x100004cd4
bts ecx, 0x12
mov dword [rsp + 0x6c], ecx
mov eax, dword [0x100011728]
test al, 0x40
je 0x100004ce6
bts ecx, 0x13
mov dword [rsp + 0x6c], ecx
test al, al
jns 0x100004cf2
bts ecx, 0x14
mov dword [rsp + 0x6c], ecx
mov eax, dword [0x100010ec8]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x70], eax
call r11
mov rcx, rdi
mov dword [0x100010488], eax
test eax, eax
js 0x100004eac
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor edi, edi
jmp 0x100004d45
mov rbx, qword [rsp + 0x30]
cmp rbx, rdi
je 0x100004eb2
lea rdx, [rsp + 0x80]
mov rcx, rbx
call fcn.100004f88
cmp eax, edi
je 0x100004eb2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, 1
add ebp, ebx
cmp ebp, 2
jb 0x1000049a9
cmp dword [0x100010440], edi
je 0x100004ea5
cmp byte [0x1000103f0], dil
je 0x100004ea5
lea rax, [rsp + 0x30]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
mov r9d, 0x2001f
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x100004ea5
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
lea rdx, [0x1000103f0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x310]
mov ebx, 0x238
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, edi
jne 0x100004e9a
lea rcx, [rsp + 0x201]
xor edx, edx
mov r8d, 0x103
mov byte [rsp + 0x200], dil
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x200]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, edi
je 0x100004e33
lea r8, [0x1000015b9]
lea rcx, [rsp + 0x200]
mov edx, 0x104
call fcn.100007fc0
lea rax, [0x100010670]
lea r9, [rsp + 0x200]
lea r8, str.rundll32.exe__sadvpack.dll_DelNodeRunDLL32___s_
lea rcx, [rsp + 0x310]
mov rdx, rbx
mov qword [rsp + 0x20], rax
call fcn.100001ac4
lea rcx, [rsp + 0x310]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea rcx, [rsp + 0x310]
lea rdx, [0x1000103f0]
inc eax
mov r9d, 1
xor r8d, r8d
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x100004ebd
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov rcx, qword [rsp + 0x550]
xor rcx, rsp
call fcn.10000c9f0
lea r11, [rsp + 0x560]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea r8, [0x10000f4e0]
xor r9d, r9d
mov edx, 0x4c9
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], esi
call fcn.100005574
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
call fcn.100007b14
mov dword [0x100010488], eax
jmp 0x100004ebb
lea r8, [0x100001660]
xor r9d, r9d
mov edx, 0x4c8
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], esi
call fcn.100005574
jmp 0x100004f15
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4c7
xor ecx, ecx
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], esi
call fcn.100005574
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [0x100010488], 0x8007042b
jmp 0x100004ebb