Function at 0x140057b20
Capabilities:
Check if file exists
Persist via run registry key
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x10200
call fcn.14009a1c0
sub rsp, rax
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov qword [rsp + 0x10258], rbx
mov rax, qword [0x1400d2478]
xor rax, rsp
mov qword [rsp + 0x101f0], rax
mov r12, r8
mov r15, rdx
mov rbx, rcx
test rcx, rcx
je 0x14005859d
test r8, r8
je 0x14005859d
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea edi, [rcx + rcx]
mov rcx, rbx
call fcn.140067e30
mov r14, rax
test rax, rax
je 0x14005858e
mov edx, 0x25
mov rcx, rax
call fcn.140066df0
mov rbp, rax
test rax, rax
setne al
test al, al
je 0x140058540
xor esi, esi
mov word [rbp], si
add rbp, 2
lea edx, [rsi + 0x25]
mov rcx, rbp
call fcn.140066df0
mov r13, rax
test rax, rax
setne al
test r13, r13
je 0x140057bea
mov word [r13], si
add r13, 2
test al, al
je 0x140058540
mov r8d, 0x8000
lea rdx, [rsp + 0x1f0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
setne sil
test sil, sil
je 0x140057c33
mov rdx, rbp
lea rcx, [rsp + 0x1f0]
call fcn.1400668a8
test eax, eax
setne sil
test sil, sil
jne 0x140058465
mov qword [rsp + 0xc0], 7
xor ebx, ebx
mov qword [rsp + 0xb8], rbx
mov word [rsp + 0xa8], bx
lea rax, [rsp + 0x38]
test rax, rax
je 0x140057d54
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140057d54
mov dword [rsp + 0x30], 0x8000
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x38]
test edi, edi
jne 0x140057cfb
cmp eax, 0x8000
jbe 0x140057ce7
mov edi, 0xea
jmp 0x140057cfb
cmp ecx, 1
je 0x140057cfb
cmp ecx, 2
je 0x140057cfb
cmp ecx, 7
je 0x140057d04
mov edi, 0x545
cmp ecx, 7
jne 0x140057d3d
test edi, edi
jne 0x140057d3d
test eax, eax
je 0x140057d3d
mov edi, 0x545
shr eax, 1
mov dword [rsp + 0x30], eax
mov ecx, ebx
lea edx, [rax - 1]
test edx, edx
je 0x140057d3d
lea rax, [rsp + 0x1f0]
cmp bx, word [rax]
jne 0x140057d2f
cmp bx, word [rax + 2]
je 0x140057d3b
inc ecx
add rax, 2
cmp ecx, edx
jae 0x140057d3d
jmp 0x140057d24
mov edi, ebx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x140057d54
mov sil, 1
jmp 0x140058444
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbp
lea rcx, [rsp + 0x48]
call fcn.140001870
nop
lea r8, [0x1400b5138]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.14005b510
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.140001500
nop
cmp qword [rsp + 0x90], 8
jb 0x140057dcc
mov rcx, qword [rsp + 0x78]
call fcn.140065920
mov qword [rsp + 0x90], 7
mov qword [rsp + 0x88], rbx
mov word [rsp + 0x78], bx
cmp qword [rsp + 0x68], 8
jb 0x140057df7
mov rcx, qword [rsp + 0x50]
call fcn.140065920
lea rdi, [rsp + 0xa8]
cmp qword [rsp + 0xc0], 8
cmovae rdi, qword [rsp + 0xa8]
lea rax, [rsp + 0x38]
test rax, rax
je 0x140057f14
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140057f14
mov dword [rsp + 0x30], 0x8000
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x38]
test edi, edi
jne 0x140057ebb
cmp eax, 0x8000
jbe 0x140057ea7
mov edi, 0xea
jmp 0x140057ebb
cmp ecx, 1
je 0x140057ebb
cmp ecx, 2
je 0x140057ebb
cmp ecx, 7
je 0x140057ec4
mov edi, 0x545
cmp ecx, 7
jne 0x140057efd
test edi, edi
jne 0x140057efd
test eax, eax
je 0x140057efd
mov edi, 0x545
shr eax, 1
mov dword [rsp + 0x30], eax
mov ecx, ebx
lea edx, [rax - 1]
test edx, edx
je 0x140057efd
lea rax, [rsp + 0x1f0]
cmp bx, word [rax]
jne 0x140057eef
cmp bx, word [rax + 2]
je 0x140057efb
inc ecx
add rax, 2
cmp ecx, edx
jae 0x140057efd
jmp 0x140057ee4
mov edi, ebx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x140057f14
mov sil, 1
jmp 0x140058444
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x50], bx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbp
lea rcx, [rsp + 0x48]
call fcn.140001870
nop
lea r8, str.Path
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.14005b510
nop
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.140001500
nop
cmp qword [rsp + 0x90], 8
jb 0x140057f8c
mov rcx, qword [rsp + 0x78]
call fcn.140065920
mov qword [rsp + 0x90], 7
mov qword [rsp + 0x88], rbx
mov word [rsp + 0x78], bx
cmp qword [rsp + 0x68], 8
jb 0x140057fb7
mov rcx, qword [rsp + 0x50]
call fcn.140065920
lea rdi, [rsp + 0xa8]
cmp qword [rsp + 0xc0], 8
cmovae rdi, qword [rsp + 0xa8]
lea rax, [rsp + 0x38]
test rax, rax
je 0x1400580d4
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400580d4
mov dword [rsp + 0x30], 0x8000
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x38]
test edi, edi
jne 0x14005807b
cmp eax, 0x8000
jbe 0x140058067
mov edi, 0xea
jmp 0x14005807b
cmp ecx, 1
je 0x14005807b
cmp ecx, 2
je 0x14005807b
cmp ecx, 7
je 0x140058084
mov edi, 0x545
cmp ecx, 7
jne 0x1400580bd
test edi, edi
jne 0x1400580bd
test eax, eax
je 0x1400580bd
mov edi, 0x545
shr eax, 1
mov dword [rsp + 0x30], eax
mov ecx, ebx
lea edx, [rax - 1]
test edx, edx
je 0x1400580bd
lea rax, [rsp + 0x1f0]
cmp bx, word [rax]
jne 0x1400580af
cmp bx, word [rax + 2]
je 0x1400580bb
inc ecx
add rax, 2
cmp ecx, edx
jae 0x1400580bd
jmp 0x1400580a4
mov edi, ebx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x1400580d4
mov sil, 1
jmp 0x140058444
call qword [sym.imp.KERNEL32.dll_GetLastError]
test sil, sil
jne 0x140058444
cmp eax, 2
jne 0x140058444
lea rax, [rsp + 0x38]
test rax, rax
je 0x1400581f0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400581f0
mov dword [rsp + 0x30], 0x8000
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x38]
test edi, edi
jne 0x140058196
cmp eax, 0x8000
jbe 0x140058182
mov edi, 0xea
jmp 0x140058196
cmp ecx, 1
je 0x140058196
cmp ecx, 2
je 0x140058196
cmp ecx, 7
je 0x14005819f
mov edi, 0x545
cmp ecx, 7
jne 0x1400581d9
test edi, edi
jne 0x1400581d9
test eax, eax
je 0x1400581d9
mov edi, 0x545
shr eax, 1
mov dword [rsp + 0x30], eax
mov ecx, ebx
lea edx, [rax - 1]
test edx, edx
je 0x1400581d9
lea rax, [rsp + 0x1f0]
nop
cmp bx, word [rax]
jne 0x1400581cb
cmp bx, word [rax + 2]
je 0x1400581d7
inc ecx
add rax, 2
cmp ecx, edx
jae 0x1400581d9
jmp 0x1400581c0
mov edi, ebx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x1400581f0
mov sil, 1
jmp 0x140058444
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140058444
lea rax, [rsp + 0x38]
test rax, rax
je 0x140058302
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140058302
mov dword [rsp + 0x30], 0x8000
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x38]
test edi, edi
jne 0x1400582a9
cmp eax, 0x8000
jbe 0x140058295
mov edi, 0xea
jmp 0x1400582a9
cmp ecx, 1
je 0x1400582a9
cmp ecx, 2
je 0x1400582a9
cmp ecx, 7
je 0x1400582b2
mov edi, 0x545
cmp ecx, 7
jne 0x1400582eb
test edi, edi
jne 0x1400582eb
test eax, eax
je 0x1400582eb
mov edi, 0x545
shr eax, 1
mov dword [rsp + 0x30], eax
mov ecx, ebx
lea edx, [rax - 1]
test edx, edx
je 0x1400582eb
lea rax, [rsp + 0x1f0]
cmp bx, word [rax]
jne 0x1400582dd
cmp bx, word [rax + 2]
je 0x1400582e9
inc ecx
add rax, 2
cmp ecx, edx
jae 0x1400582eb
jmp 0x1400582d2
mov edi, ebx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x140058302
mov sil, 1
jmp 0x140058444
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x140058444
mov dword [rsp + 0xd0], 0x114
lea rcx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0xe0], 2
jne 0x140058444
lea rax, [rsp + 0x38]
test rax, rax
je 0x14005843d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindows_NT
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005843d
mov dword [rsp + 0x30], 0x8000
mov dword [rsp + 0x38], 1
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
xor r8d, r8d
mov rdx, rbp
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x38]
test edi, edi
jne 0x1400583e2
cmp eax, 0x8000
jbe 0x1400583ce
mov edi, 0xea
jmp 0x1400583e2
cmp ecx, 1
je 0x1400583e2
cmp ecx, 2
je 0x1400583e2
cmp ecx, 7
je 0x1400583eb
mov edi, 0x545
cmp ecx, 7
jne 0x140058429
test edi, edi
jne 0x140058429
test eax, eax
je 0x140058429
mov edi, 0x545
shr eax, 1
mov dword [rsp + 0x30], eax
mov ecx, ebx
lea edx, [rax - 1]
test edx, edx
je 0x140058429
lea rax, [rsp + 0x1f0]
nop dword [rax + rax]
cmp bx, word [rax]
jne 0x14005841b
cmp bx, word [rax + 2]
je 0x140058427
inc ecx
add rax, 2
cmp ecx, edx
jae 0x140058429
jmp 0x140058410
mov edi, ebx
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x14005843d
mov sil, 1
jmp 0x140058444
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
cmp qword [rsp + 0xc0], 8
jb 0x14005845c
mov rcx, qword [rsp + 0xa8]
call fcn.140065920
test sil, sil
je 0x140058581
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r14
repne scasw ax, word [rdi]
not rcx
lea rdx, [rcx - 1]
or rcx, 0xffffffffffffffff
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
dec rcx
add edx, ecx
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1f0]
repne scasw ax, word [rdi]
not rcx
dec rcx
add edx, ecx
lea edi, [rdx + rdx + 2]
mov esi, edi
mov ecx, edi
call fcn.1400666dc
mov rbx, rax
test rax, rax
je 0x14005852c
shr rsi, 1
mov qword [rsp + 0x28], r13
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x20], rax
mov r9, r14
lea r8, str._s_s_s
mov rdx, rsi
mov rcx, rbx
call fcn.140066ef4
mov r11d, dword [r12]
cmp r11d, edi
jb 0x140058510
test r15, r15
je 0x140058510
mov rdx, r11
shr rdx, 1
mov r8, rbx
mov rcx, r15
call fcn.140065de0
mov dword [r12], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov sil, 1
jmp 0x140058522
mov dword [r12], edi
mov ecx, 0x7a
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor sil, sil
mov rcx, rbx
call fcn.14006664c
jmp 0x140058581
mov dword [r12], edi
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor sil, sil
jmp 0x140058581
mov eax, dword [r12]
cmp eax, edi
jb 0x14005856f
test r15, r15
je 0x14005856f
mov rdx, rax
shr rdx, 1
mov r8, rbx
mov rcx, r15
call fcn.140065de0
mov dword [r12], edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov sil, 1
jmp 0x140058581
mov dword [r12], edi
mov ecx, 0x7a
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor sil, sil
mov rcx, r14
call fcn.14006664c
mov al, sil
jmp 0x1400585aa
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
jmp 0x1400585aa
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
mov rcx, qword [rsp + 0x101f0]
xor rcx, rsp
call fcn.140064b70
mov rbx, qword [rsp + 0x10258]
add rsp, 0x10200
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret