Function at 0x438760
Capabilities:
Persist via run registry key

Disassembly:
sub rsp, 0x598
mov qword [rsp + 0x590], rbx
mov qword [rsp + 0x588], rsi
mov qword [rsp + 0x580], rdi
mov rbx, r8
mov rsi, rdx
mov qword [rsp + 0x60], 0xfffffffffffffffe
call fcn.004545a0
test eax, eax
je 0x43880e
mov r8, qword [rsi]
lea rdx, str.CInstallNoEnum_::_SetupForInstallMonitor_:_csTempInstallPath___s_n
lea rcx, [rsp + 0x170]
call fcn.00486850
movabs rdx, 0x203a5952544e45
mov qword [rsp + 0x70], rdx
lea rdi, [rsp + 0x70]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x170]
xor ecx, ecx
nop
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x4387e0
call fcn.004546e0
mov rcx, rax
call fcn.004545b0
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0x70]
call fcn.004548a0
mov rax, qword [0x004dfd00]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rax
mov r8d, 0x104
lea rdx, [rsp + 0x270]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0x270]
lea rcx, [rsp + 0x40]
call fcn.0049b398
mov dl, 0x5c
lea rcx, [rsp + 0x40]
call fcn.00499914
mov r8d, eax
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.0049993c
lea r8, [rsp + 0x40]
mov rdx, rsi
lea rcx, [rsp + 0x50]
call fcn.0049b804
nop
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.0049b31c
nop
lea rcx, [rsp + 0x50]
call fcn.0049b1dc
lea rdx, [0x004aa3ac]
lea rcx, [rsp + 0x30]
call fcn.0049b398
lea rdx, str.__REBOOTED_FROM_NO_ENUM_INSTALL
lea rcx, [rsp + 0x30]
call fcn.0049b4d8
lea rdx, [0x004aee1c]
lea rcx, [rsp + 0x30]
call fcn.0049b4d8
test byte [rbx + 0xbc], 2
je 0x4388e4
lea rdx, str.__UFWA
lea rcx, [rsp + 0x30]
call fcn.0049b4d8
test byte [rbx + 0xbc], 4
je 0x4388fe
lea rdx, str.__PPAI
lea rcx, [rsp + 0x30]
call fcn.0049b4d8
bt dword [rbx + 0xbc], 0xc
jae 0x438919
lea rdx, [0x004b04a0]
lea rcx, [rsp + 0x30]
call fcn.0049b4d8
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x50]
call fcn.0049b804
nop
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.0049b31c
nop
lea rcx, [rsp + 0x50]
call fcn.0049b1dc
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x38]
call fcn.004223c0
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x380]
call fcn.004646c0
mov r9, qword [rsp + 0x58]
movsxd rax, dword [r9 - 8]
mov qword [rsp + 0x20], rax
lea r8, str.CnxtCoInstallerDefer
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea rcx, [rsp + 0x380]
call fcn.00464ed0
call fcn.004545a0
test eax, eax
je 0x438a1f
xor r8d, r8d
lea rdx, str.CInstallNoEnum_::_SetupForInstallMonitor_n
lea rcx, [rsp + 0x170]
call fcn.00486850
movabs rdx, 0x20203a54495845
mov qword [rsp + 0x70], rdx
lea rdi, [rsp + 0x70]
xor eax, eax
mov rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
lea rdx, [rsp + 0x170]
xor ecx, ecx
nop
nop
movzx eax, byte [rdx + rcx]
mov byte [rdi + rcx - 1], al
inc rcx
test al, al
jne 0x4389f0
call fcn.004546e0
mov rcx, rax
lea rdx, [rsp + 0x70]
call fcn.004548a0
call fcn.004546e0
mov rcx, rax
call fcn.004545c0
nop
lea rcx, [rsp + 0x30]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x48]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x40]
call fcn.0049b1dc
nop
lea rcx, [rsp + 0x58]
call fcn.0049b1dc
mov rbx, qword [rsp + 0x590]
mov rsi, qword [rsp + 0x588]
mov rdi, qword [rsp + 0x580]
add rsp, 0x598
ret