Function at 0x14001ae50
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5c0]
sub rsp, 0x6c0
mov rax, qword [0x14002f198]
xor rax, rsp
mov qword [rbp + 0x5b0], rax
mov rbx, r8
mov qword [rsp + 0x38], rdx
lea r14, str.LogPath
lea r9, [rsp + 0x40]
xor esi, esi
mov edi, 0x104
mov r8, r14
mov rdx, rcx
mov r15, rcx
mov word [rsp + 0x40], si
mov dword [rsp + 0x20], edi
call fcn.140017bf0
test al, al
jne 0x14001aece
lea rdx, [r15 + 2]
lea r9, [rsp + 0x40]
mov r8, r14
mov rcx, r15
mov dword [rsp + 0x20], edi
call fcn.140017bf0
mov rcx, rdi
lea rax, [rsp + 0x40]
nop word [rax + rax]
lea r13, [0x14002b7e4]
mov r12d, 0x7ffffffe
lea r10, str..log
cmp word [rax], si
je 0x14001af07
add rax, 2
dec rcx
jne 0x14001aee0
jmp 0x14001b01f
test rcx, rcx
je 0x14001b01f
mov rax, rdi
sub rax, rcx
je 0x14001b01f
cmp word [rsp + rax*2 + 0x3e], 0x5c
jne 0x14001b01f
lea r8, [r15 + 2]
mov rcx, rdi
lea rax, [rsp + 0x40]
cmp word [rax], si
je 0x14001af44
add rax, 2
dec rcx
jne 0x14001af34
jmp 0x14001afad
test rcx, rcx
je 0x14001afad
mov rax, rdi
mov rdx, rdi
mov r9, r13
sub rax, rcx
sub rdx, rax
test r8, r8
cmovne r9, r8
lea rcx, [rsp + rax*2 + 0x40]
cmp rdx, 1
jbe 0x14001afad
test rdx, rdx
je 0x14001afa6
mov r8, r12
sub r8, rdx
sub r9, rcx
nop dword [rax + rax]
lea rax, [rdx + r8]
test rax, rax
je 0x14001afa1
movzx eax, word [rcx + r9]
test ax, ax
je 0x14001afa1
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x14001af80
jmp 0x14001afa6
test rdx, rdx
jne 0x14001afaa
sub rcx, 2
mov word [rcx], si
mov rcx, rdi
lea rax, [rsp + 0x40]
cmp word [rax], si
je 0x14001afc5
add rax, 2
dec rcx
jne 0x14001afb5
jmp 0x14001b01f
test rcx, rcx
je 0x14001b01f
mov rax, rdi
mov rdx, rdi
sub rax, rcx
sub rdx, rax
lea rcx, [rsp + rax*2 + 0x40]
cmp rdx, 1
jbe 0x14001b01f
test rdx, rdx
je 0x14001b018
mov r8, r12
mov r9, r10
sub r8, rdx
sub r9, rcx
lea rax, [rdx + r8]
test rax, rax
je 0x14001b013
movzx eax, word [rcx + r9]
test ax, ax
je 0x14001b013
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x14001aff2
jmp 0x14001b018
test rdx, rdx
jne 0x14001b01c
sub rcx, 2
mov word [rcx], si
cmp word [rsp + 0x40], si
jne 0x14001b11d
lea r8, [r15 + 2]
mov rcx, rdi
lea rax, [rsp + 0x40]
cmp word [rax], si
je 0x14001b046
add rax, 2
dec rcx
jne 0x14001b036
jmp 0x14001b0ad
test rcx, rcx
je 0x14001b0ad
mov rax, rdi
mov rdx, rdi
mov r9, r13
sub rax, rcx
sub rdx, rax
test r8, r8
cmovne r9, r8
lea rcx, [rsp + rax*2 + 0x40]
cmp rdx, 1
jbe 0x14001b0ad
test rdx, rdx
je 0x14001b0a6
mov r8, r12
sub r8, rdx
sub r9, rcx
nop word [rax + rax]
lea rax, [rdx + r8]
test rax, rax
je 0x14001b0a1
movzx eax, word [rcx + r9]
test ax, ax
je 0x14001b0a1
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x14001b080
jmp 0x14001b0a6
test rdx, rdx
jne 0x14001b0aa
sub rcx, 2
mov word [rcx], si
mov rcx, rdi
lea rax, [rsp + 0x40]
cmp word [rax], si
je 0x14001b0c5
add rax, 2
dec rcx
jne 0x14001b0b5
jmp 0x14001b11d
test rcx, rcx
je 0x14001b11d
mov rax, rdi
mov rdx, rdi
sub rax, rcx
sub rdx, rax
lea rcx, [rsp + rax*2 + 0x40]
cmp rdx, 1
jbe 0x14001b11d
test rdx, rdx
je 0x14001b116
mov r8, r12
sub r8, rdx
sub r10, rcx
nop
lea rax, [rdx + r8]
test rax, rax
je 0x14001b111
movzx eax, word [rcx + r10]
test ax, ax
je 0x14001b111
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x14001b0f0
jmp 0x14001b116
test rdx, rdx
jne 0x14001b11a
sub rcx, 2
mov word [rcx], si
cmp word [rsp + 0x40], 0x2e
jne 0x14001b134
cmp word [rsp + 0x42], 0x5c
jne 0x14001b134
lea rsi, [rsp + 0x44]
jmp 0x14001b151
lea rcx, [rsp + 0x40]
mov edx, reloc.msi.dll_MsiOpenProductW
call fcn.14001db70
test rax, rax
jne 0x14001b3c3
lea rsi, [rsp + 0x40]
xor eax, eax
lea rdx, [0x14002b924]
lea rcx, [rbp + 0x150]
mov word [rbp + 0x290], ax
call fcn.14001ade0
mov r11d, 0xa0
mov ecx, r11d
lea rax, [rbp + 0x150]
nop dword [rax]
cmp word [rax], 0
je 0x14001b1f7
add rax, 2
dec rcx
jne 0x14001b180
xor r12d, r12d
mov rcx, qword [r15 + 0x100]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x290]
lea rdx, [rbp + 0x150]
xor r8d, r8d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x34], 0x206
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001b266
cmp dword [rsp + 0x30], 1
jne 0x14001b266
mov eax, dword [rsp + 0x34]
shr eax, 1
inc eax
mov word [rbp + rax*2 + 0x290], r12w
jmp 0x14001b26e
test rcx, rcx
je 0x14001b18f
mov rax, r11
sub rax, rcx
sub r11, rax
lea rcx, [rbp + rax*2 + 0x150]
cmp r11, 1
jbe 0x14001b18f
test r11, r11
je 0x14001b256
sub r12, r11
sub r14, rcx
lea rax, [r11 + r12]
test rax, rax
je 0x14001b251
movzx eax, word [rcx + r14]
test ax, ax
je 0x14001b251
mov word [rcx], ax
add rcx, 2
dec r11
jne 0x14001b222
sub rcx, 2
xor r12d, r12d
mov word [rcx], r12w
jmp 0x14001b192
test r11, r11
jne 0x14001b25a
sub rcx, 2
xor r12d, r12d
mov word [rcx], r12w
jmp 0x14001b192
mov word [rbp + 0x290], r12w
lea rcx, [rbp + 0x290]
mov edx, reloc.msi.dll_MsiOpenProductW
call fcn.14001db70
mov r9, qword [rsp + 0x38]
test rax, rax
jne 0x14001b2e1
test r9, r9
mov r8, r13
lea rax, [rbp + 0x290]
cmovne r8, r9
mov rdx, rdi
lea rcx, [rbp + 0x290]
sub r8, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x14001b2d4
movzx eax, word [rcx + r8]
test ax, ax
je 0x14001b2d4
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x14001b2b0
jmp 0x14001b2d9
test rdx, rdx
jne 0x14001b2dd
sub rcx, 2
mov word [rcx], r12w
mov rcx, rdi
lea rax, [rbp + 0x290]
nop dword [rax + rax]
cmp word [rax], 0
je 0x14001b301
add rax, 2
dec rcx
jne 0x14001b2f0
jmp 0x14001b365
test rcx, rcx
je 0x14001b365
mov rax, rdi
sub rax, rcx
je 0x14001b365
cmp word [rbp + rax*2 + 0x28e], 0x5c
je 0x14001b365
test r9, r9
lea rax, [rbp + 0x290]
mov rdx, rdi
cmovne r13, r9
lea rcx, [rbp + 0x290]
sub r13, rax
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x14001b358
movzx eax, word [rcx + r13]
test ax, ax
je 0x14001b358
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x14001b334
jmp 0x14001b35d
test rdx, rdx
jne 0x14001b361
sub rcx, 2
mov word [rcx], r12w
test rbx, rbx
je 0x14001b3b1
lea r8, [rbp + 0x290]
mov rdx, rdi
mov rcx, rbx
sub r8, rbx
nop word [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x14001b3a4
movzx eax, word [rcx + r8]
test ax, ax
je 0x14001b3a4
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x14001b380
jmp 0x14001b3a9
test rdx, rdx
jne 0x14001b3ad
sub rcx, 2
mov word [rcx], r12w
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call fcn.140017350
xor esi, esi
jmp 0x14001b3d0
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14001bbe0
cmp word [rbx], 0x7e
jne 0x14001b4af
mov r9d, 1
lea rdx, [rbp + 0x290]
xor ecx, ecx
lea r8d, [r9 + 4]
mov word [rbp + 0x290], si
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x14001b450
lea r8, [0x14002c134]
lea rax, [rbp + 0x290]
mov edx, 0x190
sub r8, rax
lea rcx, [rbp + 0x290]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffe6e]
test rax, rax
je 0x14001b444
movzx eax, word [rcx + r8]
test ax, ax
je 0x14001b444
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x14001b420
jmp 0x14001b449
test rdx, rdx
jne 0x14001b44d
sub rcx, 2
mov word [rcx], si
lea rdx, [0x14002bf84]
lea rcx, [rbp + 0x290]
call fcn.14001bf20
lea rdx, [rbx + 2]
lea rcx, [rbp + 0x290]
call fcn.14001bf20
lea rcx, [rbp + 0x290]
sub rcx, rbx
nop dword [rax]
lea rax, [rdi + 0x7ffffefa]
test rax, rax
je 0x14001b4a3
movzx eax, word [rbx + rcx]
test ax, ax
je 0x14001b4a3
mov word [rbx], ax
add rbx, 2
dec rdi
jne 0x14001b480
jmp 0x14001b4a8
test rdi, rdi
jne 0x14001b4ac
sub rbx, 2
mov word [rbx], si
mov al, 1
mov rcx, qword [rbp + 0x5b0]
xor rcx, rsp
call fcn.14001cea0
mov rbx, qword [rsp + 0x708]
add rsp, 0x6c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret