Function at 0x1000044b0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x1b0
mov rax, qword [0x100007110]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
xor ebx, ebx
mov bpl, dl
mov rdi, rcx
lea r14, [0x100000000]
cmp dl, bl
je 0x1000044f2
mov sil, bl
jmp 0x1000045e1
lea rcx, [rsp + 0x58]
lea rdx, [0x100001c38]
mov r8d, 0x29
call sub.msvcrt.dll_memcpy
mov eax, dword [r14 + 0x1c64]
lea r11, [rsp + 0x50]
mov dword [r11], eax
movzx eax, word [r14 + 0x1c68]
lea rdx, [rsp + 0x58]
mov word [r11 + 4], ax
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov sil, 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x1000045da
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x30], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x1000045cf
cmp dword [rsp + 0x34], 4
jne 0x1000045cf
cmp dword [rsp + 0x30], 4
jne 0x1000045cf
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x1000045cf
cmp dword [rsp + 0x38], 4
sete sil
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp sil, bl
sete sil
mov rcx, rdi
call fcn.100004130
mov r11d, eax
sub r11d, 1
je 0x1000047eb
sub r11d, 1
je 0x100004785
sub r11d, 1
je 0x100004761
sub r11d, 1
je 0x100004731
sub r11d, 1
je 0x100004656
sub r11d, 1
je 0x100004640
cmp r11d, 1
jne 0x100004795
movabs rax, 0x1000300000083
cmp qword [rdi + 8], rax
setbe al
jmp 0x100004812
movabs rax, 0x3000100000000
cmp qword [rdi + 8], rax
setb al
jmp 0x100004812
call qword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
cmp eax, 0x411
jne 0x100004795
mov rcx, qword [rdi + 8]
movabs rax, 0x3000200000900
cmp rcx, rax
jne 0x100004701
mov edi, 0x104
lea rcx, [rsp + 0x90]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, ebx
jbe 0x100004795
mov rax, qword [r14 + 0x1e10]
lea rcx, [rsp + 0x40]
mov qword [rcx], rax
mov eax, dword [r14 + 0x1e18]
mov dword [rcx + 8], eax
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea r8, [rsp + 0x40]
movsxd rcx, eax
sub rdi, rcx
lea rcx, [rsp + 0x90]
mov rdx, rdi
call fcn.100003054
cmp eax, ebx
jl 0x100004795
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x90]
call fcn.1000034e0
cmp al, bl
jne 0x100004795
jmp 0x10000474b
movabs rax, 0x4000200000000
cmp rcx, rax
jb 0x100004727
movabs rax, 0x400020000270f
cmp rcx, rax
ja 0x100004727
mov al, bpl
jmp 0x100004812
call fcn.100004330
jmp 0x100004812
mov rcx, qword [rdi + 0x18]
cmp rcx, rbx
je 0x100004752
lea rdx, [0x100001e00]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
cmp eax, ebx
jne 0x100004752
mov al, 1
jmp 0x100004812
movabs rax, 0x1000200000068
jmp 0x10000464a
mov rcx, qword [rdi + 0x20]
lea rdx, [0x100001d78]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
cmp eax, ebx
je 0x10000474b
movabs rax, 0x1000000000001
jmp 0x100004634
movabs rax, 0x3000500000000
cmp qword [rdi + 8], rax
jb 0x100004799
xor al, al
jmp 0x100004812
movabs rcx, 0x2000000000000
mov al, bl
cmp qword [rdi + 8], rcx
jb 0x1000047e4
cmp sil, bl
je 0x1000047e4
lea rcx, [0x100001da0]
call fcn.1000040f4
cmp al, bl
jne 0x1000047e2
lea rcx, [0x100001dc0]
call fcn.1000040f4
cmp al, bl
jne 0x1000047e2
lea rcx, [0x100001de0]
call fcn.1000040f4
cmp al, bl
mov al, bl
je 0x1000047e4
mov al, 1
cmp al, bl
sete al
jmp 0x100004812
movabs rax, 0x5000100000000
cmp qword [rdi + 8], rax
jb 0x10000480b
movabs rax, 0x5000100000041
cmp qword [rdi + 8], rax
jne 0x100004810
mov ebx, 1
mov al, bl
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.100004df0
lea r11, [rsp + 0x1b0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret