Function at 0x18009e460
Capabilities:
Get file size
Query or enumerate registry value
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x1800b88d0]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov r13d, edx
mov qword [rsp + 0x50], rcx
mov rsi, r8
lea r9, [0x180000000]
mov rdx, rcx
lea eax, [r13 + 0xa]
cmp r13d, eax
jae 0x18009e64b
lea ebx, [r13 - 0x16]
mov edi, 0xa
movabs r14, 0x3a00480053
cmp ebx, 0x12
ja case.0x18009e4d9.1
mov ecx, dword [r9 + rbx*4 + 0x9eaf4]
add rcx, r9
jmp rcx
mov byte [rbp - 0x64], 0
lea rdx, [0x1800afcb9]
mov r8d, 4
lea rcx, [rbp - 0x64]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov rdx, qword [rsp + 0x50]
lea r9, [0x180000000]
jmp case.0x18009e4d9.1
mov dword [rbp - 0x60], 0x71617020
jmp case.0x18009e4d9.1
movsd xmm0, qword [str.UMWA]
mov eax, dword [0x1800afce0]
mov qword [rbp - 0x38], r14
movsd qword [rbp - 0x32], xmm0
mov word [rbp - 0x53], 0x73
mov dword [rbp - 0x2a], eax
jmp case.0x18009e4d9.1
mov dword [rbp - 0x68], 0x69707572
jmp case.0x18009e4d9.1
mov r8d, 1
lea rdx, [0x1800afce4]
lea rcx, [rbp - 0x38]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8d, 1
mov dword [rbp - 0x26], 0x5f
lea rdx, [0x1800afce8]
lea rcx, [rbp - 0x38]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov r8d, 2
lea rdx, [0x1800afcec]
lea rcx, [rbp - 0x38]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
mov rdx, qword [rsp + 0x50]
lea r9, [0x180000000]
jmp case.0x18009e4d9.1
mov eax, dword [0x1800afcf4]
mov dword [rbp - 0x1e], eax
movzx eax, word [0x1800afcf8]
mov word [rbp - 0x1a], ax
jmp case.0x18009e4d9.1
mov r8d, 2
mov byte [rbp - 0x5c], 0
lea rdx, [0x1800afd2f]
lea rcx, [rbp - 0x5c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov rdx, qword [rsp + 0x50]
lea r9, [0x180000000]
mov byte [rbp - 0x5a], 0
jmp case.0x18009e4d9.1
movzx eax, word [0x1800afd7f]
mov word [rbp - 0x56], ax
movzx eax, byte [0x1800afd81]
mov byte [rbp - 0x54], al
mov dword [rbp - 0x5a], 0x6e617473
mov byte [rbp - 0x53], 0
jmp case.0x18009e4d9.1
mov r8d, 4
mov byte [rbp - 0x50], 0
lea rdx, str.___apprentice.c
lea rcx, [rbp - 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 1
lea rdx, [0x1800afdee]
lea rcx, [rbp - 0x4c]
jmp 0x18009e4f0
mov eax, dword [rsi]
mov dword [rdx + 0x7c], eax
inc ebx
sub rdi, 1
jne 0x18009e4c5
movzx ebx, byte [rsp + 0x40]
mov r14d, r13d
imul eax, r13d, 0x5d2
mov dword [rsp + 0x4c], eax
cmp r13d, eax
ja case.0x18009e716.0
mov r12, qword [rsp + 0x78]
mov r15d, dword [rsp + 0x4c]
mov r11d, 0x73
xor r8d, r8d
lea r10d, [r11 + 2]
cmp r14d, 0x5d40
ja 0x18009e967
je 0x18009e939
cmp r14d, 0x20
je 0x18009e917
cmp r14d, 0x12c0
je 0x18009e904
cmp r14d, 0x2560
je 0x18009e8c4
cmp r14d, 0x3800
je 0x18009e6ec
cmp r14d, 0x4aa0
jne 0x18009eacb
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, eax
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x44], eax
call fcn.1800a1280
jmp 0x18009eacb
cmp r12, 0xffffffffffffffff
jne 0x18009e8ba
mov edi, 8
nop dword [rax + rax]
cmp edi, 8
ja case.default.0x18009e716
mov eax, edi
mov ecx, dword [r9 + rax*4 + 0x9eb40]
add rcx, r9
jmp rcx
mov eax, dword [rsp + 0x70]
lea rcx, [rbp - 0x78]
mov dword [rsp + 0x38], eax
xor r9d, r9d
mov eax, dword [rsp + 0x6c]
xor edx, edx
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x5c]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
call sub.SHLWAPI.dll_SHRegGetUSValueA
mov edx, dword [rsp + 0x58]
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
lea r9, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0x150]
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHEnumValueA]
xor bl, bl
xor r8d, r8d
lea r10d, [r8 + 0x75]
lea r11d, [r8 + 0x73]
jmp case.default.0x18009e716
mov eax, dword [0x1800afe10]
lea rcx, [rbp + 0x4e]
movsd xmm0, qword [str.HELP_MULTIKEY]
xor edx, edx
mov dword [rbp + 0x48], eax
movzx eax, word [0x1800afe14]
mov dword [rsp + 0x58], r8d
mov dword [rsp + 0x5c], r8d
mov r8d, 0xf6
mov word [rbp + 0x4c], ax
movsd qword [rbp + 0x40], xmm0
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x150]
mov ecx, 2
lea rax, [rbp + 0x40]
nop
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub rcx, 1
jne 0x18009e7e0
mov ecx, dword [rax]
xor r8d, r8d
mov dword [rdx], ecx
lea r10d, [r8 + 0x75]
lea r11d, [r8 + 0x73]
jmp case.default.0x18009e716
mov word [rbp - 0x73], r10w
jmp case.default.0x18009e716
mov word [rbp - 0x75], r11w
mov word [rbp - 0x74], r10w
jmp case.default.0x18009e716
mov ecx, 0x5f
mov qword [rsp + 0x78], 0xffffffff80000001
mov word [rbp - 0x72], cx
mov dword [rbp - 0x71], 0x772e73
jmp case.default.0x18009e716
mov word [rbp - 0x78], r11w
mov eax, 0x62
mov word [rbp - 0x77], r10w
mov word [rbp - 0x76], ax
jmp case.default.0x18009e716
mov dword [rsp + 0x60], r8d
jmp case.default.0x18009e716
mov dword [rsp + 0x64], r8d
mov dword [rsp + 0x68], 0x104
mov dword [rsp + 0x6c], r8d
mov dword [rsp + 0x70], r8d
dec edi
lea r9, [0x180000000]
lea eax, [rdi + 0x76]
cmp eax, 0x75
ja 0x18009e700
mov dword [rsp + 0x48], r8d
jmp 0x18009eacb
cmp qword [rdx + 0x18], 8
mov rcx, rdx
mov byte [rbp - 0x40], 0
jb 0x18009e8d5
mov rcx, qword [rdx]
mov qword [rsp + 0x30], r8
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r12, rax
jmp 0x18009eacb
mov dword [rbp - 0x48], 0x32317063
mov dword [rbp - 0x44], 0x632e3035
jmp 0x18009eacb
mov r8d, 2
mov word [rbp - 0x4b], 0x6c
lea rdx, [0x1800afe2f]
lea rcx, [rbp - 0x4a]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x18009eacb
xor edx, edx
mov rcx, rsi
call fcn.1800559c0
mov r8d, dword [rsp + 0x44]
lea r9, [rsp + 0x48]
mov rdx, rax
mov qword [rsp + 0x20], 0
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x18009eacb
cmp r14d, 0x6fe0
je 0x18009eac2
cmp r14d, 0x8280
je 0x18009e9b4
cmp r14d, 0x9520
je 0x18009e997
cmp r14d, 0xa7c0
jne 0x18009eacb
mov al, 1
jmp 0x18009e9ef
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x68]
call qword [sym.imp.SHLWAPI.dll_PathMatchSpecA]
lea rcx, [rbp - 0x38]
call qword [sym.imp.SHLWAPI.dll_PathFindNextComponentW]
jmp 0x18009eacb
mov eax, dword [rsp + 0x44]
cmp eax, dword [rsp + 0x48]
je 0x18009eacb
mov edi, 9
cmp edi, 9
je 0x18009ea50
cmp edi, 0x558
je 0x18009ea3a
cmp edi, 0xaa7
je 0x18009ea19
cmp edi, 0xff6
jne 0x18009eaae
movzx eax, bl
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.1800a5da0
mov rbx, qword [rsp + 0x3b8]
add rsp, 0x370
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov ecx, r15d
call qword [sym.imp.SHLWAPI.dll_IsOS]
xor r8d, r8d
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 8]
call qword [sym.imp.SHLWAPI.dll_UrlCompareW]
xor bl, bl
xor r8d, r8d
jmp 0x18009eaae
mov qword [rsi + 0x10], r8
mov rax, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x18009ea4b
mov rax, qword [rsi]
mov byte [rax], 0
jmp 0x18009eaae
movups xmm0, xmmword [str.MFL_PROP_FILE_SYM_DEF]
mov eax, dword [0x1800afe78]
mov r15d, 1
movups xmm1, xmmword [0x1800afe60]
mov dword [rbp + 0x30], eax
mov eax, dword [0x1800afe98]
movups xmmword [rbp + 8], xmm0
mov dword [rbp], eax
movsd xmm0, qword [0x1800afe70]
movzx eax, word [0x1800afe9c]
movsd qword [rbp + 0x28], xmm0
movups xmm0, xmmword [str.bad_regexp__d_]
mov word [rbp + 4], ax
movups xmmword [rbp + 0x18], xmm1
movsd xmm1, qword [0x1800afe90]
movups xmmword [rbp - 0x18], xmm0
movsd qword [rbp - 8], xmm1
add edi, 0x54f
cmp edi, 0x153c
jbe 0x18009e9c7
jmp 0x18009eacb
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
imul eax, r13d, 0x95
add r14d, eax
cmp r14d, dword [rsp + 0x4c]
ja case.0x18009e716.0
mov rdx, qword [rsp + 0x50]
lea r9, [0x180000000]
jmp 0x18009e671