Function at 0x12848180
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x340
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov qword [rsp + 0x390], rbx
mov rax, qword [0x12a52ee0]
xor rax, rsp
mov qword [rsp + 0x330], rax
mov rbx, rdx
mov r15, rcx
lea rsi, [rdx + 0x10]
mov rcx, rsi
call fcn.12803f90
cmp qword [rbx + 8], 0
je 0x128492c6
mov dword [rsp + 0x50], 1
xor r13d, r13d
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x80], r13
mov qword [rsp + 0xc0], 7
mov qword [rsp + 0xb8], r13
mov word [rsp + 0xa8], r13w
mov qword [rsp + 0xe8], 7
mov qword [rsp + 0xe0], r13
mov word [rsp + 0xd0], r13w
mov qword [rsp + 0x110], 7
mov qword [rsp + 0x108], r13
mov word [rsp + 0xf8], r13w
mov dword [rsp + 0x6c], r13d
mov dword [rsp + 0x68], r13d
mov dword [rsp + 0x7c], r13d
mov edi, dword [r15 + 4]
mov r12d, 0x1000
and edi, 3
jne 0x128489d3
mov rcx, qword [rbx + 8]
call qword [sym.imp.SHLWAPI.dll_PathIsURLW]
test eax, eax
je 0x12848376
mov dword [rsp + 0x50], r13d
mov dword [rsp + 0x6c], 0xff
mov dword [rsp + 0x20], 1
lea r9d, [r13 + 1]
lea r8, [rsp + 0x6c]
lea rdx, [rsp + 0x120]
mov rcx, qword [rbx + 8]
call qword [sym.imp.SHLWAPI.dll_UrlGetPartW]
test eax, eax
je 0x12848355
cmp qword [rsp + 0x110], 8
jb 0x128482c9
mov rcx, qword [rsp + 0xf8]
call fcn.12958250
mov qword [rsp + 0x110], 7
mov qword [rsp + 0x108], r13
mov word [rsp + 0xf8], r13w
cmp qword [rsp + 0xe8], 8
jb 0x128482fe
mov rcx, qword [rsp + 0xd0]
call fcn.12958250
mov qword [rsp + 0xe8], 7
mov qword [rsp + 0xe0], r13
mov word [rsp + 0xd0], r13w
cmp qword [rsp + 0xc0], 8
jb 0x12848333
mov rcx, qword [rsp + 0xa8]
call fcn.12958250
mov qword [rsp + 0xc0], 7
mov qword [rsp + 0xb8], r13
mov word [rsp + 0xa8], r13w
jmp 0x12849119
lea r8, [rsp + 0x120]
lea rdx, str._s_shell
lea rcx, [rsp + 0xc8]
call fcn.12804810
jmp 0x12848580
mov rcx, qword [rbx + 8]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x128483b9
mov dword [rsp + 0x50], r13d
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, str.Folder_shell
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, str.Folder_shell
lea rcx, [rsp + 0xc8]
call fcn.12803dc0
jmp 0x12848580
mov rcx, qword [rbx + 8]
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov rdx, rax
lea rcx, [0x129cba98]
call fcn.1295a6e4
test eax, eax
jne 0x128489d3
mov rcx, qword [rbx + 8]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rbp, rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x12848580
mov rdi, qword [rbx + 8]
mov qword [rsp + 0x58], r13
lea rcx, [rbx + 0xd8]
mov dword [rsp + 0x40], 0x20019
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8, rbp
mov rdx, qword [rsp + 0x70]
call fcn.12819200
mov r11, qword [rsp + 0x58]
test r11, r11
je 0x12848474
cmp word [r11], 0
cmovne rdi, r11
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x70], r13
mov r9d, 1
or r8d, 0xffffffff
mov rdx, rdi
mov rcx, rsi
call fcn.128ab3c0
mov edx, 0x20
xor r8d, r8d
mov rcx, rsi
call fcn.1282a340
cmp rax, 0xffffffffffffffff
je 0x128484dc
mov r9d, 1
lea r8, [0x129cacc8]
xor edx, edx
mov rcx, rsi
call fcn.12830f40
mov r8d, 1
lea rdx, [0x129cacc8]
mov rcx, rsi
call fcn.12803a10
nop
cmp qword [rsp + 0x110], 8
jb 0x128484f4
mov rcx, qword [rsp + 0xf8]
call fcn.12958250
mov qword [rsp + 0x110], 7
mov qword [rsp + 0x108], r13
mov word [rsp + 0xf8], r13w
cmp qword [rsp + 0xe8], 8
jb 0x12848529
mov rcx, qword [rsp + 0xd0]
call fcn.12958250
mov qword [rsp + 0xe8], 7
mov qword [rsp + 0xe0], r13
mov word [rsp + 0xd0], r13w
cmp qword [rsp + 0xc0], 8
jb 0x1284855e
mov rcx, qword [rsp + 0xa8]
call fcn.12958250
mov qword [rsp + 0xc0], 7
mov qword [rsp + 0xb8], r13
mov word [rsp + 0xa8], r13w
jmp 0x12849119
cmp qword [rsp + 0xe0], 0
jne 0x128485c4
mov rcx, qword [rbx + 8]
call qword [sym.imp.SHLWAPI.dll_PathIsUNCW]
test eax, eax
je 0x128485c4
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, str.Folder_shell
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, str.Folder_shell
lea rcx, [rsp + 0xc8]
call fcn.12803dc0
lea rdx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae rdx, qword [rsp + 0xd0]
lea r8, [rsp + 0x70]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x1284869c
cmp qword [rsp + 0x110], 8
jb 0x12848610
mov rcx, qword [rsp + 0xf8]
call fcn.12958250
mov qword [rsp + 0x110], 7
mov qword [rsp + 0x108], r13
mov word [rsp + 0xf8], r13w
cmp qword [rsp + 0xe8], 8
jb 0x12848645
mov rcx, qword [rsp + 0xd0]
call fcn.12958250
mov qword [rsp + 0xe8], 7
mov qword [rsp + 0xe0], r13
mov word [rsp + 0xd0], r13w
cmp qword [rsp + 0xc0], 8
jb 0x1284867a
mov rcx, qword [rsp + 0xa8]
call fcn.12958250
mov qword [rsp + 0xc0], 7
mov qword [rsp + 0xb8], r13
mov word [rsp + 0xa8], r13w
jmp 0x12849119
mov dword [rsp + 0x6c], 0x100
mov r8, qword [r15 + 0x10]
test r8, r8
je 0x128486c6
lea rdx, str._scommand
lea rcx, [rsp + 0x120]
call fcn.1281de20
jmp 0x128487f9
lea r9, [rsp + 0x6c]
lea r8, [rsp + 0x120]
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
je 0x1284878c
cmp qword [rsp + 0x110], 8
jb 0x12848700
mov rcx, qword [rsp + 0xf8]
call fcn.12958250
mov qword [rsp + 0x110], 7
mov qword [rsp + 0x108], r13
mov word [rsp + 0xf8], r13w
cmp qword [rsp + 0xe8], 8
jb 0x12848735
mov rcx, qword [rsp + 0xd0]
call fcn.12958250
mov qword [rsp + 0xe8], 7
mov qword [rsp + 0xe0], r13
mov word [rsp + 0xd0], r13w
cmp qword [rsp + 0xc0], 8
jb 0x1284876a
mov rcx, qword [rsp + 0xa8]
call fcn.12958250
mov qword [rsp + 0xc0], 7
mov qword [rsp + 0xb8], r13
mov word [rsp + 0xa8], r13w
jmp 0x12849119
cmp word [rsp + 0x120], 0
je 0x128487cb
lea rdi, [rsp + 0x120]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov rax, qword [str.command]
mov qword [rdi - 2], rax
mov rax, qword [0x129cba08]
mov qword [rdi + 6], rax
movzx eax, word [0x129cba10]
mov word [rdi + 0xe], ax
jmp 0x128487f9
mov rcx, r13
lea rdx, [0x12800000]
nop word [rax + rax]
movzx eax, word [rcx + rdx + 0x1cb9e0]
mov word [rsp + rcx + 0x120], ax
add rcx, 2
test ax, ax
jne 0x128487e0
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x120]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x128488c0
cmp qword [rsp + 0x110], 8
jb 0x12848834
mov rcx, qword [rsp + 0xf8]
call fcn.12958250
mov qword [rsp + 0x110], 7
mov qword [rsp + 0x108], r13
mov word [rsp + 0xf8], r13w
cmp qword [rsp + 0xe8], 8
jb 0x12848869
mov rcx, qword [rsp + 0xd0]
call fcn.12958250
mov qword [rsp + 0xe8], 7
mov qword [rsp + 0xe0], r13
mov word [rsp + 0xd0], r13w
cmp qword [rsp + 0xc0], 8
jb 0x1284889e
mov rcx, qword [rsp + 0xa8]
call fcn.12958250
mov qword [rsp + 0xc0], 7
mov qword [rsp + 0xb8], r13
mov word [rsp + 0xa8], r13w
jmp 0x12849119
mov qword [rsp + 0x58], r13
lea rcx, [rbx + 0xd8]
mov qword [rsp + 0x30], r13
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
mov rdx, qword [rsp + 0x80]
call fcn.12819150
mov rdx, qword [rsp + 0x58]
test rdx, rdx
je 0x1284892f
cmp word [rdx], 0
je 0x1284892f
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0xa0]
call fcn.12803dc0
jmp 0x12848b51
cmp qword [rsp + 0x110], 8
jb 0x12848947
mov rcx, qword [rsp + 0xf8]
call fcn.12958250
mov qword [rsp + 0x110], 7
mov qword [rsp + 0x108], r13
mov word [rsp + 0xf8], r13w
cmp qword [rsp + 0xe8], 8
jb 0x1284897c
mov rcx, qword [rsp + 0xd0]
call fcn.12958250
mov qword [rsp + 0xe8], 7
mov qword [rsp + 0xe0], r13
mov word [rsp + 0xd0], r13w
cmp qword [rsp + 0xc0], 8
jb 0x128489b1
mov rcx, qword [rsp + 0xa8]
call fcn.12958250
mov qword [rsp + 0xc0], 7
mov qword [rsp + 0xb8], r13
mov word [rsp + 0xa8], r13w
jmp 0x12849119
mov dword [rsp + 0x50], r13d
mov qword [rsp + 0x58], r13
lea rcx, [rsp + 0x90]
lea rdx, [0x12800000]
mov eax, dword [rdx + 0x1df968]
mov dword [rcx], eax
mov eax, dword [rdx + 0x1df96c]
mov dword [rcx + 4], eax
mov eax, dword [rdx + 0x1df970]
mov dword [rcx + 8], eax
mov eax, dword [rdx + 0x1df974]
mov dword [rcx + 0xc], eax
lea r8, [rsp + 0x58]
lea rdx, [0x129df958]
lea rcx, [rsp + 0x90]
call qword [sym.imp.SHLWAPI.dll_AssocCreate]
test eax, eax
jne 0x1284907a
mov r8, r13
mov r13, qword [r15 + 0x10]
xor r14d, r14d
mov rbp, r14
test edi, edi
je 0x12848a58
cmp edi, 3
jne 0x12848a4d
mov rbp, qword [r15 + 0x50]
jmp 0x12848a65
cmp edi, 1
jne 0x12848a65
mov r8, qword [r15 + 0x48]
jmp 0x12848a65
mov rcx, qword [rbx + 8]
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov r8, rax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r14
mov r9, rbp
mov edx, 0x420
call qword [rax + 0x18]
mov edi, eax
test eax, eax
jne 0x12848b3b
mov rax, qword [rbx + 0xc8]
cmp rax, r12
je 0x12848ac2
cmp rax, r12
jb 0x12848aad
or r8, 0xffffffffffffffff
mov rdx, r12
lea rcx, [rbx + 0xb0]
call fcn.128033a0
jmp 0x12848ac2
xor r8d, r8d
mov rdx, r12
sub rdx, rax
lea rcx, [rbx + 0xb0]
call fcn.12803b90
cmp qword [rbx + 0xd0], 8
jb 0x12848ad5
mov rbp, qword [rbx + 0xb8]
jmp 0x12848adc
lea rbp, [rbx + 0xb8]
mov rax, qword [rbx + 0xc8]
mov dword [rsp + 0x78], eax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbp
mov r9, r13
mov edx, 0x420
mov r8d, 1
call qword [rax + 0x20]
mov edi, eax
test eax, eax
jne 0x12848b3b
mov r8d, dword [rsp + 0x78]
mov rdx, rbp
lea rcx, [rsp + 0xa0]
call fcn.12803dc0
mov edx, dword [rsp + 0x78]
lea rcx, [rsp + 0xa0]
call fcn.1280d350
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
test edi, edi
jne 0x12849077
xor r13d, r13d
lea rbp, [rbx + 0xb0]
mov rax, qword [rbp + 0x18]
cmp rax, r12
je 0x12848b88
cmp rax, r12
jb 0x12848b77
or r8, 0xffffffffffffffff
mov rdx, r12
mov rcx, rbp
call fcn.128033a0
jmp 0x12848b88
xor r8d, r8d
mov rdx, r12
sub rdx, rax
mov rcx, rbp
call fcn.12803b90
cmp qword [rbp + 0x20], 8
jb 0x12848b95
mov rbp, qword [rbp + 8]
jmp 0x12848b99
add rbp, 8
mov rcx, qword [rbx + 8]
mov rdx, rbp
movzx eax, word [rcx]
mov word [rdx], ax
add rcx, 2
add rdx, 2
test ax, ax
jne 0x12848ba0
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathIsURLW]
test eax, eax
jne 0x12848c1f
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathUnquoteSpacesW]
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x12848c1f
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathIsFileSpecW]
test eax, eax
je 0x12848c1f
mov word [rsp + 0x120], r13w
lea rdx, [rsp + 0x120]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rdx, [rsp + 0x120]
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r13
lea rdx, [rsp + 0x58]
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_PathFindOnPathW]
mov edx, 0x20
mov rcx, rbp
call fcn.1295be3c
test rax, rax
setne r14b
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, str.__1_
repne scasw ax, word [rdi]
not rcx
lea rdx, [rcx - 1]
or rcx, 0xffffffffffffffff
lea r8, str.__s_
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
mov qword [rsp + 0x28], 0xffffffffffffffff
mov qword [rsp + 0x20], r8
lea r9, [rcx - 1]
lea r8, str.__1_
lea rcx, [rsp + 0xa0]
call fcn.128334d0
lea r13, [0x129cb9b4]
test r14b, r14b
lea r8, str.__s_
cmovne r13, r8
test r13, r13
je 0x12848cef
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x129cb9ac]
repne scasw ax, word [rdi]
not rcx
lea rdx, [rcx - 1]
or rcx, 0xffffffffffffffff
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
mov qword [rsp + 0x28], 0xffffffffffffffff
mov qword [rsp + 0x20], r13
lea r9, [rcx - 1]
lea r8, [0x129cb9ac]
lea rcx, [rsp + 0xa0]
call fcn.128334d0
lea r8, str.__s_
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, str.__L_
repne scasw ax, word [rdi]
not rcx
lea rdx, [rcx - 1]
or rcx, 0xffffffffffffffff
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
mov qword [rsp + 0x28], 0xffffffffffffffff
mov qword [rsp + 0x20], r8
lea r9, [rcx - 1]
lea r8, str.__L_
lea rcx, [rsp + 0xa0]
call fcn.128334d0
test r13, r13
je 0x12848d88
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x129cb994]
repne scasw ax, word [rdi]
not rcx
lea rdx, [rcx - 1]
or rcx, 0xffffffffffffffff
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
mov qword [rsp + 0x28], 0xffffffffffffffff
mov qword [rsp + 0x20], r13
lea r9, [rcx - 1]
lea r8, [0x129cb994]
lea rcx, [rsp + 0xa0]
call fcn.128334d0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, str.__l_
repne scasw ax, word [rdi]
not rcx
lea rdx, [rcx - 1]
or rcx, 0xffffffffffffffff
lea r8, str.__s_
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
mov qword [rsp + 0x28], 0xffffffffffffffff
mov qword [rsp + 0x20], r8
lea r9, [rcx - 1]
lea r8, str.__l_
lea rcx, [rsp + 0xa0]
call fcn.128334d0
test r13, r13
je 0x12848e28
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x129cb980]
repne scasw ax, word [rdi]
not rcx
lea rdx, [rcx - 1]
or rcx, 0xffffffffffffffff
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
mov qword [rsp + 0x28], 0xffffffffffffffff
mov qword [rsp + 0x20], r13
lea r9, [rcx - 1]
lea r8, [0x129cb980]
lea rcx, [rsp + 0xa0]
call fcn.128334d0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, str._idlist__I_
repne scasw ax, word [rdi]
not rcx
lea rdx, [rcx - 1]
or rcx, 0xffffffffffffffff
lea r13, [0x129b25a8]
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
mov qword [rsp + 0x28], 0xffffffffffffffff
mov qword [rsp + 0x20], r13
lea r9, [rcx - 1]
lea r8, str._idlist__I_
lea rcx, [rsp + 0xa0]
call fcn.128334d0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, str._idlist__i_
repne scasw ax, word [rdi]
not rcx
lea rdx, [rcx - 1]
or rcx, 0xffffffffffffffff
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
mov qword [rsp + 0x28], 0xffffffffffffffff
mov qword [rsp + 0x20], r13
lea r9, [rcx - 1]
lea r8, str._idlist__i_
lea rcx, [rsp + 0xa0]
call fcn.128334d0
mov r9d, 2
xor r8d, r8d
lea rdx, [0x129cb9b4]
lea rcx, [rsp + 0xa0]
call fcn.12807830
cmp rax, 0xffffffffffffffff
jne 0x12848f1b
lea rax, str.___s_
lea rdx, [0x129b2508]
test r14b, r14b
cmovne rdx, rax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0xa0]
call fcn.12803a10
cmp dword [rsp + 0x50], 0
jne 0x12848f75
mov r8, qword [r15 + 0x20]
test r8, r8
je 0x12848f75
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x129cb938]
repne scasw ax, word [rdi]
not rcx
lea rdx, [rcx - 1]
or rcx, 0xffffffffffffffff
mov rdi, r8
repne scasw ax, word [rdi]
not rcx
mov qword [rsp + 0x28], 1
mov qword [rsp + 0x20], r8
lea r9, [rcx - 1]
lea r8, [0x129cb938]
lea rcx, [rsp + 0xa0]
call fcn.128334d0
lea rdx, [rsp + 0xa8]
cmp qword [rsp + 0xc0], 8
cmovae rdx, qword [rsp + 0xa8]
mov r9d, 1
mov r8d, dword [rsp + 0xb8]
lea rcx, [rsp + 0xf0]
call fcn.128ab3c0
lea rdx, [rsp + 0xf8]
cmp qword [rsp + 0x110], 8
cmovae rdx, qword [rsp + 0xf8]
mov r8, rbp
mov rcx, rsi
call fcn.12804810
nop
cmp qword [rsp + 0x110], 8
jb 0x12848fe8
mov rcx, qword [rsp + 0xf8]
call fcn.12958250
mov qword [rsp + 0x110], 7
xor r13d, r13d
mov qword [rsp + 0x108], r13
mov word [rsp + 0xf8], r13w
cmp qword [rsp + 0xe8], 8
jb 0x12849020
mov rcx, qword [rsp + 0xd0]
call fcn.12958250
mov qword [rsp + 0xe8], 7
mov qword [rsp + 0xe0], r13
mov word [rsp + 0xd0], r13w
cmp qword [rsp + 0xc0], 8
jb 0x12849055
mov rcx, qword [rsp + 0xa8]
call fcn.12958250
mov qword [rsp + 0xc0], 7
mov qword [rsp + 0xb8], r13
mov word [rsp + 0xa8], r13w
jmp 0x12849119
xor r13d, r13d
cmp qword [rsp + 0x110], 8
jb 0x12849092
mov rcx, qword [rsp + 0xf8]
call fcn.12958250
mov qword [rsp + 0x110], 7
mov qword [rsp + 0x108], r13
mov word [rsp + 0xf8], r13w
cmp qword [rsp + 0xe8], 8
jb 0x128490c7
mov rcx, qword [rsp + 0xd0]
call fcn.12958250
mov qword [rsp + 0xe8], 7
mov qword [rsp + 0xe0], r13
mov word [rsp + 0xd0], r13w
cmp qword [rsp + 0xc0], 8
jb 0x128490fc
mov rcx, qword [rsp + 0xa8]
call fcn.12958250
mov qword [rsp + 0xc0], 7
mov qword [rsp + 0xb8], r13
mov word [rsp + 0xa8], r13w
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x12849129
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x1284913c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp qword [rbx + 0x28], 0
je 0x128492c1
cmp qword [rsi + 0x20], 8
jb 0x12849154
mov r14, qword [rsi + 8]
jmp 0x12849158
lea r14, [rsi + 8]
mov qword [rsp + 0x58], r13
mov dword [rsp + 0x68], r13d
xor r9d, r9d
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x58]
mov rcx, r14
call fcn.1283e080
mov rdi, rax
lea rbp, [rbx + 0x88]
mov r13, qword [rsp + 0x58]
mov r8, r13
mov rdx, rax
mov rcx, rbp
call fcn.1281aff0
cmp qword [rbp + 0x20], 8
jb 0x128491a1
mov rcx, qword [rbp + 8]
jmp 0x128491a5
lea rcx, [rbp + 8]
call qword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
je 0x12849263
mov rax, qword [rbx]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 0
add rbx, 0xb0
mov rax, qword [rbx + 0x18]
cmp rax, r12
jb 0x128491e5
or r8, 0xffffffffffffffff
mov rdx, r12
mov rcx, rbx
call fcn.128033a0
jmp 0x128491f6
xor r8d, r8d
sub r12, rax
mov rdx, r12
mov rcx, rbx
call fcn.12803b90
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbp
mov rcx, rbx
call fcn.12803c90
cmp qword [rbx + 0x20], 8
jb 0x12849215
mov rcx, qword [rbx + 8]
jmp 0x12849219
lea rcx, [rbx + 8]
lea rdx, [rsp + 0x58]
call qword [sym.imp.SHLWAPI.dll_PathFindOnPathW]
test eax, eax
je 0x12849263
or rdx, 0xffffffffffffffff
mov rcx, rbx
call fcn.1280d350
sub r13, rdi
sar r13, 1
sub rdi, r14
sar rdi, 1
mov qword [rsp + 0x28], 0xffffffffffffffff
mov qword [rsp + 0x20], 0
mov r9, rbx
mov r8, r13
mov rdx, rdi
mov rcx, rsi
call fcn.12819e00
cmp dword [rsp + 0x50], 0
je 0x128492bc
mov rax, qword [r15 + 0x20]
test rax, rax
je 0x128492b7
cmp word [rax], 0
je 0x128492b2
mov r8d, 1
lea rdx, [0x129bce5c]
mov rcx, rsi
call fcn.12803a10
mov rdx, qword [r15 + 0x20]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rsi
call fcn.12803a10
mov rax, rsi
jmp 0x128492c9
mov rax, rsi
jmp 0x128492c9
mov rax, rsi
jmp 0x128492c9
mov rax, rsi
jmp 0x128492c9
mov rax, rsi
jmp 0x128492c9
mov rax, rsi
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.12959850
mov rbx, qword [rsp + 0x390]
add rsp, 0x340
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret