Function at 0x10005598c
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2a0
mov rax, qword [0x1000a9120]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rbp, rcx
mov r13, r8
mov r12, rdx
xor r14d, r14d
lea rcx, [rsp + 0x82]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x80], r14w
call sub.msvcrt.dll_memset
mov r15d, 0x103
lea rcx, str.vfprint.dll
mov rax, r15
mov ebx, r14d
cmp word [rcx], r14w
je 0x100055a02
add rcx, 2
sub rax, 1
jne 0x1000559f2
cmp rax, r14
jne 0x100055a11
mov ebx, 0x80070057
mov rdi, r14
jmp 0x100055a17
mov rdi, r15
sub rdi, rax
cmp ebx, r14d
mov esi, 0x104
jl 0x100055ac2
lea rcx, [rsp + 0x80]
mov edx, esi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r11d, eax
cmp r11, r14
je 0x100055a4b
cmp r11, r15
jae 0x100055a4b
lea rax, [rdi + r11]
cmp rax, r15
jb 0x100055a50
mov ebx, 0x80004005
cmp ebx, r14d
jl 0x100055ac2
mov eax, 0x5c
lea r8, str.vfprint.dll
lea rcx, [rsp + 0x80]
mov rdx, rsi
mov word [rsp + r11*2 + 0x80], ax
call fcn.10001be94
cmp eax, r14d
jl 0x100055ac2
lea rcx, [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
cmp rax, r14
je 0x100055ac2
mov rax, qword [0x1000aad98]
cmp rax, r14
jne 0x100055c9e
lea rdx, str.CreateFilterTestHook
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1000aad98], rax
cmp rax, r14
jne 0x100055c9e
lea rax, [rsp + 0x40]
lea rdx, str.SYSTEMCurrentControlSetControlPrint
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x38], r14d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, 4
lea rdi, [0x1000aab30]
cmp eax, r14d
jne 0x100055bec
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
lea rdx, str.PipelineFilterHook
xor r8d, r8d
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x34], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x100055b56
cmp dword [rsp + 0x30], ebx
jne 0x100055b56
cmp dword [rsp + 0x34], ebx
jne 0x100055b56
mov eax, dword [rsp + 0x38]
jmp 0x100055b5d
mov eax, r14d
mov dword [rsp + 0x38], eax
cmp eax, 1
jne 0x100055be1
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, str.FilterHookModuleName
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x34], 0x208
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r14d
jne 0x100055ba4
cmp dword [rsp + 0x30], 1
je 0x100055be1
lea rdx, str.FilterHook.dll
mov rcx, rdi
sub rdx, rdi
lea rax, [rsi + 0x7ffffefa]
cmp rax, r14
je 0x100055bd4
movzx eax, word [rdx + rcx]
cmp ax, r14w
je 0x100055bd4
mov word [rcx], ax
add rcx, 2
sub rsi, 1
jne 0x100055bb1
cmp rsi, r14
jne 0x100055bdd
sub rcx, 2
mov word [rcx], r14w
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x38], 1
jne 0x100055ca9
mov rax, qword [0x1000aad98]
cmp rax, r14
jne 0x100055c9e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp rax, r14
je 0x100055c2e
lea rdx, str.CreateFilterTestHook
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1000aad98], rax
jmp 0x100055c99
mov dword [rsp + 0x68], 0x68
mov dword [rsp + 0x70], ebx
mov dword [rsp + 0x74], r14d
call qword [sym.imp.KERNEL32.dll_GetLastError]
or rcx, 0xffffffffffffffff
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x48], eax
xor eax, eax
lea r9, [rsp + 0x68]
repne scasw ax, word [rdi]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x58]
not rcx
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x54], r14d
lea eax, [rcx + rcx]
lea rcx, [0x100006310]
mov dword [rsp + 0x64], 1
mov dword [rsp + 0x60], eax
mov qword [rsp + 0x20], r14
call fcn.100075550
mov rax, qword [0x1000aad98]
cmp rax, r14
je 0x100055ca9
mov r8, r13
mov rdx, r12
mov rcx, rbp
call rax
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.100057810
mov rbx, qword [rsp + 0x2f8]
add rsp, 0x2a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret