Function at 0x10005c534
Capabilities:
Get common file path
Persist via run registry key
Set current directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1500
call fcn.1000801f0
sub rsp, rax
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x14f0], rax
mov r12, qword [rcx + 0x30]
xor ebx, ebx
mov r13d, r9d
mov r14d, edx
mov rbp, rcx
mov esi, ebx
cmp edx, 3
je 0x10005c59d
mov rcx, qword [rcx + 0x38]
cmp rcx, rbx
je 0x10005c59d
call fcn.100053454
cmp eax, ebx
je 0x10005c59d
mov rcx, rbp
call fcn.10005c3c8
cmp eax, ebx
mov esi, eax
jl 0x10005ce6b
cmp r12, rbx
jne 0x10005c5ac
mov eax, 0x80004003
jmp 0x10005ce6b
mov rcx, r12
call fcn.100053454
cmp eax, ebx
jne 0x10005c5c2
mov eax, 0x80070002
jmp 0x10005ce6b
mov eax, dword [rbp + 0x58]
mov r15d, 1
cmp eax, r15d
je 0x10005ca53
jle 0x10005ca49
cmp eax, 4
jle 0x10005c984
cmp eax, 5
je 0x10005c7e1
cmp eax, 6
jne 0x10005ca49
mov edi, 0x104
lea rcx, [rsp + 0x290]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, ebx
je 0x10005c63a
lea r8, [0x10002bac0]
lea rcx, [rsp + 0x290]
mov rdx, rdi
call fcn.100039ee4
cmp eax, ebx
jl 0x10005c63a
lea rcx, [rsp + 0x290]
call fcn.100053454
cmp eax, ebx
jne 0x10005c689
lea rcx, [rsp + 0x290]
mov edx, 0x103
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, ebx
je 0x10005c7c6
lea r8, [0x10002bac0]
lea rcx, [rsp + 0x290]
mov rdx, rdi
call fcn.100039ee4
cmp eax, ebx
jl 0x10005c7c6
lea rcx, [rsp + 0x290]
call fcn.100053454
cmp eax, ebx
je 0x10005c7c6
mov ecx, 0x2c
mov eax, 0x22c
cmp r13d, ebx
cmovne ecx, eax
cmp qword [rbp + 0x28], rbx
lea rax, [0x1000062c0]
cmovne rax, qword [rbp + 0x28]
mov dword [rsp + 0x30], ecx
lea r9, [rsp + 0x290]
mov qword [rsp + 0x28], rax
lea r8, [0x10002bc90]
lea rcx, [rsp + 0x10e0]
mov edx, 0x208
mov qword [rsp + 0x20], r12
call fcn.10003a080
lea rdx, [rsp + 0xed0]
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rax, [rsp + 0x4a0]
lea rcx, [rsp + 0x4a0]
sub r12, rax
lea rax, [rdi + 0x7ffffefa]
cmp rax, rbx
je 0x10005c71d
movzx eax, word [rcx + r12]
cmp ax, bx
je 0x10005c71d
mov word [rcx], ax
add rcx, 2
sub rdi, r15
jne 0x10005c6fb
cmp rdi, rbx
jne 0x10005c726
sub rcx, 2
mov word [rcx], bx
lea rcx, [rsp + 0x4a0]
mov edx, 0x5c
call qword [sym.imp.msvcrt.dll_wcsrchr]
cmp rax, rbx
je 0x10005c744
mov word [rax], bx
lea rcx, [rsp + 0x4a0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov r8d, dword [rbp + 0x70]
lea rdx, [rsp + 0x10e0]
lea rcx, [rsp + 0x290]
mov r9d, 0xffff
call fcn.100056190
cmp eax, ebx
je 0x10005c779
mov esi, ebx
jmp 0x10005c797
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x57
cmp eax, ebx
cmove eax, ecx
movzx esi, ax
or esi, 0x80070000
cmp eax, ebx
cmovle esi, eax
lea rcx, [rsp + 0xed0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
cmp esi, ebx
jl 0x10005ce4b
call fcn.100053c90
cmp eax, ebx
je 0x10005ce4b
lea r8, [0x10002bcf0]
jmp 0x10005c967
lea rdx, [0x10002bbd0]
mov ecx, 2
mov esi, 0x80070002
call fcn.1000527a0
jmp 0x10005ce4b
mov edi, 0x104
lea rcx, [rsp + 0x80]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, ebx
je 0x10005c811
lea r8, [0x10002bac0]
lea rcx, [rsp + 0x80]
mov rdx, rdi
call fcn.100039ee4
lea rcx, [rsp + 0x80]
call fcn.100053454
cmp eax, ebx
jne 0x10005c865
lea rcx, [rsp + 0x80]
mov edx, 0x103
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, ebx
je 0x10005c850
lea r8, [0x10002bac0]
lea rcx, [rsp + 0x80]
mov rdx, rdi
call fcn.100039ee4
lea rcx, [rsp + 0x80]
call fcn.100053454
cmp eax, ebx
je 0x10005c7c6
lea rdi, [rsp + 0x80]
lea rax, [rsp + 0x6b0]
mov r13d, 0x208
sub rdi, rax
mov rdx, r13
lea rcx, [rsp + 0x6b0]
lea rax, [rdx + 0x7ffffdf6]
cmp rax, rbx
je 0x10005c8aa
movzx eax, word [rcx + rdi]
cmp ax, bx
je 0x10005c8aa
mov word [rcx], ax
add rcx, 2
sub rdx, r15
jne 0x10005c889
cmp rdx, rbx
jne 0x10005c8b3
sub rcx, 2
mov word [rcx], bx
mov rdx, r13
lea r8, [0x10002bae0]
lea rcx, [rsp + 0x6b0]
cmp r14d, 3
je 0x10005c8d5
lea r8, [0x10002bb40]
call fcn.100039ee4
lea rcx, [rsp + 0x6b0]
mov r8, r12
mov rdx, r13
call fcn.100039ee4
mov r8, qword [rbp + 0x28]
cmp r8, rbx
je 0x10005c906
lea rcx, [rsp + 0x6b0]
mov rdx, r13
call fcn.100039ee4
mov r8d, dword [rbp + 0x70]
lea rdx, [rsp + 0x6b0]
lea rcx, [rsp + 0x80]
mov r9d, 0xffff
call fcn.100056190
cmp eax, ebx
je 0x10005c92d
mov esi, ebx
jmp 0x10005c953
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x57
cmp eax, ebx
cmove eax, ecx
movzx esi, ax
or esi, 0x80070000
cmp eax, ebx
cmovle esi, eax
cmp esi, ebx
jl 0x10005ce4b
call fcn.100053c90
cmp eax, ebx
je 0x10005ce4b
lea r8, [0x10002bba8]
xor r9d, r9d
lea rcx, [0x100086f40]
lea edx, [r9 + 8]
call fcn.100053d64
mov esi, 0xd2af9
jmp 0x10005ce4b
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbx
mov dword [rsp + 0x78], 0x2a
mov dword [rsp + 0x58], ebx
mov dword [rsp + 0x5c], ebx
mov dword [rsp + 0x60], ebx
call fcn.100053c90
mov dword [0x10008714c], r15d
lea r8, [0x10002bc28]
mov dword [0x100087144], eax
mov rax, qword [rbp + 0xc0]
mov qword [rsp + 0x68], rax
cmp r14d, 3
je 0x10005c9d1
mov r8, qword [rbp + 0x28]
lea rcx, [rsp + 0x58]
mov r9d, r13d
mov rdx, r12
call fcn.10006fd44
cmp eax, ebx
mov esi, eax
jge 0x10005ca2c
cmp byte [rbp + 0x94], bl
je 0x10005ca0e
or dword [0x1000888f0], 4
lea rdx, [0x10002bc40]
mov r8, r12
mov ecx, 2
call fcn.1000527f4
mov esi, ebx
jmp 0x10005ca2c
mov dword [0x1000888f8], eax
mov rax, qword [rbp + 0xc0]
mov ecx, dword [rax + 0x64]
mov eax, dword [0x100086174]
add ecx, eax
mov dword [0x1000888f4], ecx
mov rcx, qword [rsp + 0x70]
cmp rcx, rbx
je 0x10005ce4b
call fcn.10007faa2
mov qword [rsp + 0x70], rbx
jmp 0x10005ce4b
mov esi, 0x80004005
jmp 0x10005ce4b
lea rax, [rsp + 0xac0]
mov rdi, r12
mov r14d, r15d
mov edx, 0x207
lea rcx, [rsp + 0xac0]
sub rdi, rax
lea rax, [rdx + 0x7ffffdf7]
cmp rax, rbx
je 0x10005ca92
movzx eax, word [rcx + rdi]
cmp ax, bx
je 0x10005ca92
mov word [rcx], ax
add rcx, 2
sub rdx, r15
jne 0x10005ca71
cmp rdx, rbx
jne 0x10005ca9b
sub rcx, 2
mov word [rcx], bx
mov r13d, 0x208
lea r8, [0x10002b8c8]
lea rcx, [rsp + 0xac0]
mov rdx, r13
call fcn.100039ee4
mov r8, qword [rbp + 0x28]
cmp r8, rbx
je 0x10005cad4
lea rcx, [rsp + 0xac0]
mov rdx, r13
call fcn.100039ee4
mov rcx, qword [rbp + 0xc0]
xor edx, edx
call fcn.100061aa4
mov rcx, rax
cmp rax, 0x186a0
jae 0x10005cafb
mov eax, 0xd1b71759
mul ecx
mov ecx, edx
shr ecx, 0xd
jmp 0x10005cb0b
mov eax, 0x4f8b588f
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0x10
mov r13d, 0x64
cmp ecx, r13d
jbe 0x10005cb28
mov eax, 0xcccccccd
mul ecx
shr edx, 3
mov dword [0x100088900], edx
jmp 0x10005cb38
mov eax, 0x14
cmp ecx, eax
cmovb ecx, eax
mov dword [0x100088900], ecx
lea rdx, [0x10002a650]
mov rcx, r12
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
je 0x10005cb6a
mov ecx, r13d
mov dword [0x1000888fc], r15d
mov edi, 0x1f4
call fcn.100051b44
mov r14d, dword [0x1000861e0]
jmp 0x10005cb8a
mov ecx, dword [0x100088900]
mov dword [0x1000888fc], ebx
mov edi, 0x1388
call fcn.100051b44
mov ecx, 0x26ec
call fcn.100051cd0
mov rcx, qword [0x1000888e8]
lea r9, [0x100058a74]
mov r8d, edi
mov edx, 0x2f00
call qword [sym.imp.USER32.dll_SetTimer]
mov rcx, r12
cmp r14d, ebx
je 0x10005cbf3
mov r8d, dword [rbp + 0x70]
lea rdx, [rsp + 0xac0]
mov r9d, 0xffff
call fcn.100056190
cmp eax, ebx
je 0x10005cbd0
mov esi, ebx
jmp 0x10005cd06
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x57
cmp eax, ebx
cmove eax, ecx
movzx esi, ax
or esi, 0x80070000
cmp eax, ebx
cmovle esi, eax
jmp 0x10005cd06
lea rdx, [0x10002a650]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
je 0x10005ccf2
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x50]
lea rdx, [0x100025960]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], ebx
mov qword [rsp + 0x50], rbx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x10005ccdf
lea rax, [rsp + 0x80]
cmp rax, rbx
je 0x10005ccd4
mov edi, 0x104
lea rcx, [rsp + 0x80]
mov edx, edi
call fcn.100053eb0
cmp eax, ebx
je 0x10005ccd4
lea r8, [0x10002b8d0]
lea rcx, [rsp + 0x80]
mov rdx, rdi
call fcn.100039ee4
cmp eax, ebx
jl 0x10005ccd4
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x80]
repne scasw ax, word [rdi]
lea rdx, [0x10002b8f0]
mov r9d, r15d
not rcx
xor r8d, r8d
sub rcx, r15
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x10002b910]
mov ecx, 4
call fcn.1000527f4
jmp 0x10005cd06
lea rdx, [0x10002b950]
mov r8, r12
mov ecx, 2
call fcn.1000527f4
mov ecx, r13d
cmp dword [0x1000888fc], ebx
jne 0x10005cd17
mov ecx, dword [0x100088900]
call fcn.100051c48
mov rcx, qword [0x1000888e8]
mov edx, 0x2f00
call qword [sym.imp.USER32.dll_KillTimer]
cmp esi, ebx
jge 0x10005cd57
cmp byte [rbp + 0x94], bl
je 0x10005cd57
or dword [0x1000888f0], r15d
lea rdx, [0x10002b9c0]
mov r8, r12
mov ecx, 2
call fcn.1000527f4
mov esi, ebx
mov edi, 0xd2af9
cmp dword [rbp + 0x90], ebx
je 0x10005cdbf
cmp esi, 0x80070bc2
je 0x10005cdd0
cmp esi, 0x8007f901
jne 0x10005cd78
mov esi, ebx
jmp 0x10005cdec
cmp esi, 0x8007f02a
jne 0x10005cd87
mov esi, 0xc00d2afb
jmp 0x10005cdec
cmp esi, ebx
jl 0x10005cd9f
call fcn.100053c90
mov dword [0x10008714c], r15d
mov dword [0x100087144], eax
jmp 0x10005cdec
mov rax, qword [rbp + 0xc0]
mov dword [0x1000888f8], esi
mov ecx, dword [rax + 0x64]
mov eax, dword [0x100086174]
add ecx, eax
mov dword [0x1000888f4], ecx
jmp 0x10005cdec
cmp esi, ebx
jl 0x10005cdec
call fcn.100053c90
cmp dword [0x100087144], eax
jae 0x10005cdec
xor r9d, r9d
lea r8, [0x10002ba10]
lea rcx, [0x100086f40]
lea edx, [r9 + 8]
call fcn.100053d64
mov esi, edi
mov edx, esi
mov rcx, r12
call fcn.100058908
cmp eax, ebx
jne 0x10005ce12
or dword [0x1000888f0], 2
lea rdx, [0x10002ba30]
mov ecx, 2
call fcn.1000527f4
lea rdx, [0x10002ba88]
mov rcx, r12
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
jne 0x10005ce3c
lea rdx, [0x10002baa0]
mov rcx, r12
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
je 0x10005ce4b
cmp esi, ebx
jl 0x10005ce45
cmp esi, edi
setne bl
mov dword [0x1000861e0], ebx
lea rdx, [0x10002bd08]
mov r8d, esi
mov ecx, 4
call fcn.1000527f4
xor edx, edx
mov rcx, rbp
call fcn.10005b218
mov eax, esi
mov rcx, qword [rsp + 0x14f0]
xor rcx, rsp
call fcn.10007fa70
mov rbx, qword [rsp + 0x1548]
add rsp, 0x1500
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret