Function at 0x180002e10
Capabilities:
Get common file path
Set registry value

Disassembly:
push rbp
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x1800300a0]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rcx, qword [section..data]
lea rdx, [rsp + 0x60]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
dec eax
cmp eax, 0x103
ja 0x180003375
mov qword [rsp + 0x290], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x2a0], rdi
lea rdx, [0x18000d560]
mov qword [rsp + 0x2a8], r14
mov r9d, 0xf003f
xor r14d, r14d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov word [rbp + 0x168], r14w
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x50], r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x50]
lea rdx, str.f374d1a0_bf08_4bdc_9cb2_c15ddaeef955
mov qword [rsp + 0x40], r14
test eax, eax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
cmovne rcx, r14
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov dword [rsp + 0x28], 0xf003f
xor r8d, r8d
mov dword [rsp + 0x20], r14d
mov qword [rsp + 0x50], rcx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x180003360
lea ecx, [rax + 8]
call fcn.180003450
mov rcx, qword [rsp + 0x58]
mov rbx, rax
test rax, rax
je 0x18000335a
mov qword [rax], rcx
lea rdi, [0x18000d5c0]
mov rcx, rdi
call fcn.180003e60
mov rcx, qword [rbx]
lea r9d, [r14 + 1]
xor r8d, r8d
lea edx, [rax*2 + 2]
mov dword [rsp + 0x28], edx
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x180002f6d
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [r14 + 8]
mov rcx, rbx
call fcn.180003460
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80040201
jmp 0x180003084
lea rdx, str.InProcServer32
mov rcx, rbx
call fcn.1800024d0
mov rdi, rax
test rax, rax
je 0x180002fd1
lea rcx, [rsp + 0x60]
call fcn.180003e60
mov rcx, qword [rdi]
mov r9d, 1
xor r8d, r8d
lea edx, [rax*2 + 2]
mov dword [rsp + 0x28], edx
lea rax, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x180002ffc
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 8
mov rcx, rdi
call fcn.180003460
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 8
mov rcx, rbx
call fcn.180003460
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80040201
jmp 0x180003084
mov qword [rsp + 0x298], rsi
lea rsi, str.Both
mov rcx, rsi
call fcn.180003e60
mov rcx, qword [rdi]
mov r9d, 1
xor r8d, r8d
lea edx, [rax*2 + 2]
mov dword [rsp + 0x28], edx
lea rdx, str.ThreadingModel
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rdi]
test eax, eax
je 0x1800030b4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 8
mov rcx, rdi
call fcn.180003460
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 8
mov rcx, rbx
call fcn.180003460
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80040201
mov rsi, qword [rsp + 0x298]
mov rdi, qword [rsp + 0x2a0]
mov rbx, qword [rsp + 0x290]
mov r14, qword [rsp + 0x2a8]
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.180001220
add rsp, 0x280
pop rbp
ret
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 8
mov rcx, rdi
call fcn.180003460
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 8
mov rcx, rbx
call fcn.180003460
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x50], r14
mov r9d, 0xf003f
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.TypeLib
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x50]
lea rdx, str.2A0C94D1_40E1_439C_8FE8_24107CAB08401.1
test eax, eax
cmovne rcx, r14
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x50]
call fcn.1800024d0
mov rbx, rax
test rax, rax
je 0x1800032de
lea rdi, str.VirtualBox_Bridged_Networking_Driver_Notify_Object_v1.1_Type_Library
mov rcx, rdi
call fcn.180003e60
mov rcx, qword [rbx]
mov r9d, 1
xor r8d, r8d
lea edx, [rax*2 + 2]
mov dword [rsp + 0x28], edx
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1800032c8
lea rdx, str.0win64
mov rcx, rbx
call fcn.1800024d0
mov rdi, rax
test rax, rax
je 0x1800032c8
lea rcx, [rsp + 0x60]
call fcn.180003e60
mov rcx, qword [rdi]
mov r9d, 1
xor r8d, r8d
lea edx, [rax*2 + 2]
mov dword [rsp + 0x28], edx
lea rax, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1800032b2
lea rdx, [0x18000d790]
mov rcx, rbx
call fcn.1800024d0
mov rsi, rax
test rax, rax
je 0x1800032b2
lea r14, [0x18000d79c]
mov rcx, r14
call fcn.180003e60
mov rcx, qword [rsi]
mov r9d, 1
xor r8d, r8d
lea edx, [rax*2 + 2]
mov dword [rsp + 0x28], edx
xor edx, edx
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x18000329c
mov edx, 0x104
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x18000329c
lea rdx, [0x18000d7a0]
mov rcx, rbx
call fcn.1800024d0
mov r14, rax
test rax, rax
je 0x18000329c
lea rcx, [rsp + 0x60]
call fcn.180003e60
mov rcx, qword [r14]
mov r9d, 1
xor r8d, r8d
lea edx, [rax*2 + 2]
mov dword [rsp + 0x28], edx
lea rax, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [r14]
test eax, eax
je 0x1800032f3
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 8
mov rcx, r14
call fcn.180003460
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 8
mov rcx, rsi
call fcn.180003460
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 8
mov rcx, rdi
call fcn.180003460
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 8
mov rcx, rbx
call fcn.180003460
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80040200
jmp 0x18000307c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 8
mov rcx, r14
call fcn.180003460
mov rcx, qword [rsi]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 8
mov rcx, rsi
call fcn.180003460
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 8
mov rcx, rdi
call fcn.180003460
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, 8
mov rcx, rbx
call fcn.180003460
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x18000307c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x80040201
jmp 0x180003084
mov eax, 0x80040201
jmp 0x18000309c