Function at 0x1800212f0
Capabilities:
Check if file exists
Get file attributes
Print debug messages
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x280]
sub rsp, 0x380
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x3d0], rbx
mov rax, qword [0x1800b37f0]
xor rax, rsp
mov qword [rbp + 0x270], rax
mov r14, rdx
mov rbx, rcx
xor edi, edi
mov r13d, edi
mov r15d, edi
mov r12d, edi
mov qword [rsp + 0x38], rdi
lea rdx, str.58968145_CF05_4341_995F_2EE093F6ABA3
call fcn.18003ce08
test eax, eax
jne 0x18002135d
mov esi, 1
mov r15d, esi
jmp 0x180021377
lea rdx, str.88D969E5_F192_11D4_A65F_0040963251E5
mov rcx, rbx
call fcn.18003ce08
mov esi, 1
test eax, eax
cmove r12d, esi
mov qword [rbp + 0x50], 7
mov qword [rbp + 0x48], rdi
mov word [rbp + 0x38], di
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rbp + 0x38]
call fcn.180007540
nop
lea r8, [rbp + 0x38]
lea rdx, str.CLSID_
lea rcx, [rbp - 0x18]
call fcn.18000c220
nop
lea rdx, [rbp - 0x18]
cmp qword [rbp], 8
cmovae rdx, qword [rbp - 0x18]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180021bb8
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x180021bb8
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
mov qword [rsp + 0x38], rbx
lea r8, str.InProcServer32
lea rdx, [rbp - 0x18]
lea rcx, [rbp - 0x40]
call fcn.18000c070
mov rdi, rax
lea rax, [rbp - 0x18]
cmp rax, rdi
je 0x18002148b
cmp qword [rbp], 8
jb 0x18002143a
mov rcx, qword [rbp - 0x18]
call fcn.18003ad20
mov qword [rbp], 7
mov qword [rbp - 8], rbx
mov word [rbp - 0x18], bx
cmp qword [rdi + 0x18], 8
jae 0x180021469
mov r8, qword [rdi + 0x10]
inc r8
add r8, r8
mov rdx, rdi
lea rcx, [rbp - 0x18]
call fcn.18003ad40
jmp 0x180021473
mov rax, qword [rdi]
mov qword [rbp - 0x18], rax
mov qword [rdi], rbx
mov rax, qword [rdi + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rdi + 0x18]
mov qword [rbp], rax
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rbx
cmp qword [rbp - 0x28], 8
jb 0x18002149b
mov rcx, qword [rbp - 0x40]
call fcn.18003ad20
lea rdx, [rbp - 0x18]
cmp qword [rbp], 8
cmovae rdx, qword [rbp - 0x18]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, esi
xor r8d, r8d
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x180021b11
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x180021b11
mov qword [rbp - 0x78], 7
mov qword [rbp - 0x80], rbx
mov word [rsp + 0x70], bx
mov word [rbp + 0x60], bx
xor edx, edx
mov r8d, 0x206
lea rcx, [rbp + 0x62]
call fcn.18003d9a0
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], rbx
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x60]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rbp + 0x60]
lea rcx, [rsp + 0x70]
call fcn.180007540
mov r11, qword [rbp - 0x80]
test r11, r11
jne 0x180021590
cmp qword [rbp - 0x78], 8
jb 0x18002157a
mov rcx, qword [rsp + 0x70]
call fcn.18003ad20
mov qword [rbp - 0x78], 7
mov qword [rbp - 0x80], rbx
mov word [rsp + 0x70], bx
jmp 0x180021c44
mov eax, 0x25
mov word [rsp + 0x30], ax
test r11, r11
je 0x18002174e
cmp r11, 1
jb 0x18002174e
lea r9, [rsp + 0x70]
mov r10, qword [rsp + 0x70]
mov rbx, qword [rbp - 0x78]
cmp rbx, 8
cmovae r9, r10
nop word [rax + rax]
mov rax, r11
mov rdx, r9
test r11, r11
je 0x18002174c
cmp word [rdx], 0x25
je 0x1800215ee
add rdx, 2
dec rax
jmp 0x1800215d9
test rdx, rdx
je 0x18002174c
mov rcx, rsi
lea rdi, [rsp + 0x30]
mov r8, rdx
movzx eax, word [rdi]
cmp word [r8], ax
jne 0x18002161a
add r8, 2
add rdi, 2
dec rcx
je 0x180021643
jmp 0x180021602
mov ecx, esi
cmp word [r8], ax
mov rax, 0xffffffffffffffff
cmovb ecx, eax
test ecx, ecx
je 0x180021643
mov rcx, rdx
sub rcx, r9
sar rcx, 1
sub rax, rcx
add r11, rax
lea r9, [rdx + 2]
jmp 0x1800215d0
lea rax, [rsp + 0x70]
cmp rbx, 8
cmovae rax, r10
sub rdx, rax
sar rdx, 1
cmp rdx, 0xffffffffffffffff
je 0x18002174c
lea r8, [rsp + 0x70]
lea rdx, str._DOCPROPERTY___IsRegister___Transformation_before_
lea rcx, [rbp - 0x40]
call fcn.18000c220
nop
lea r8, [0x180089724]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.18000c1b0
nop
cmp qword [rbp - 0x28], 8
jb 0x18002169b
mov rcx, qword [rbp - 0x40]
call fcn.18003ad20
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp qword [rsp + 0x60], 8
jb 0x1800216c4
mov rcx, qword [rsp + 0x48]
call fcn.18003ad20
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rcx, qword [rsp + 0x70]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
mov eax, 2
mul rdi
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.180039d94
mov rbx, rax
test rax, rax
je 0x18002174c
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rcx, qword [rsp + 0x70]
mov r8d, edi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x180021744
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.180007540
mov rcx, rbx
call fcn.18003ad28
xor ebx, ebx
lea r8, [rsp + 0x70]
lea rdx, str._DOCPROPERTY___IsRegister_
lea rcx, [rbp - 0x40]
call fcn.18000c220
nop
lea r8, [0x180089724]
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.18000c1b0
nop
cmp qword [rbp - 0x28], 8
jb 0x180021788
mov rcx, qword [rbp - 0x40]
call fcn.18003ad20
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
test r15d, r15d
jne 0x18002181a
test r12d, r12d
jne 0x18002181a
cmp qword [rbp - 0x78], 8
jb 0x1800217bd
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1800217d0
jmp 0x1800217c2
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
mov r13d, esi
jne 0x1800217d3
mov r13d, ebx
cmp qword [rbp - 0x50], 8
jb 0x1800217e3
mov rcx, qword [rbp - 0x68]
call fcn.18003ad20
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], rbx
mov word [rbp - 0x68], bx
cmp qword [rbp - 0x78], 8
jb 0x180021804
mov rcx, qword [rsp + 0x70]
call fcn.18003ad20
mov qword [rbp - 0x78], 7
mov qword [rbp - 0x80], rbx
mov word [rsp + 0x70], bx
jmp 0x180021c44
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rbx
mov word [rsp + 0x48], bx
test r14, r14
jne 0x1800218cf
lea rdx, [0x1800900a8]
lea rcx, [rbp - 0x40]
call fcn.180003550
mov rdi, rax
lea rax, [rsp + 0x48]
cmp rax, rdi
je 0x1800218bd
cmp qword [rsp + 0x60], 8
jb 0x180021865
mov rcx, qword [rsp + 0x48]
call fcn.18003ad20
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rbx
mov word [rsp + 0x48], bx
cmp qword [rdi + 0x18], 8
jae 0x180021898
mov r8, qword [rdi + 0x10]
inc r8
add r8, r8
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.18003ad40
jmp 0x1800218a3
mov rax, qword [rdi]
mov qword [rsp + 0x48], rax
mov qword [rdi], rbx
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x58], rax
mov rax, qword [rdi + 0x18]
mov qword [rsp + 0x60], rax
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rbx
cmp qword [rbp - 0x28], 8
jb 0x1800218ef
mov rcx, qword [rbp - 0x40]
call fcn.18003ad20
jmp 0x1800218ef
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r14
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, r14
lea rcx, [rsp + 0x48]
call fcn.180007540
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x180021926
lea rax, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rax, qword [rsp + 0x48]
cmp word [rax + rcx*2 - 2], 0x5c
je 0x180021926
mov r8, rsi
lea rdx, [0x1800895dc]
lea rcx, [rsp + 0x48]
call fcn.1800096d0
test r15d, r15d
je 0x18002193a
mov r8d, VariantTimeToDosDateTime
lea rdx, [0x1800900d0]
jmp 0x18002194c
test r12d, r12d
je 0x180021956
mov r8d, 0xa
lea rdx, [0x180090108]
lea rcx, [rsp + 0x48]
call fcn.1800096d0
lea r8, [rsp + 0x48]
lea rdx, str._DOCPROPERTY___IsRegister__RealPath
lea rcx, [rbp + 0x10]
call fcn.18000c220
nop
lea r8, [0x180089724]
mov rdx, rax
lea rcx, [rbp - 0x40]
call fcn.18000c1b0
mov rdi, rax
lea rax, [rbp - 0x68]
cmp rax, rdi
je 0x1800219ec
cmp qword [rbp - 0x50], 8
jb 0x18002199b
mov rcx, qword [rbp - 0x68]
call fcn.18003ad20
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], rbx
mov word [rbp - 0x68], bx
cmp qword [rdi + 0x18], 8
jae 0x1800219ca
mov r8, qword [rdi + 0x10]
inc r8
add r8, r8
mov rdx, rdi
lea rcx, [rbp - 0x68]
call fcn.18003ad40
jmp 0x1800219d4
mov rax, qword [rdi]
mov qword [rbp - 0x68], rax
mov qword [rdi], rbx
mov rax, qword [rdi + 0x10]
mov qword [rbp - 0x58], rax
mov rax, qword [rdi + 0x18]
mov qword [rbp - 0x50], rax
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], rbx
cmp qword [rbp - 0x28], 8
jb 0x1800219fc
mov rcx, qword [rbp - 0x40]
call fcn.18003ad20
mov qword [rbp - 0x28], 7
mov qword [rbp - 0x30], rbx
mov word [rbp - 0x40], bx
cmp qword [rbp + 0x28], 8
jb 0x180021a1c
mov rcx, qword [rbp + 0x10]
call fcn.18003ad20
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rcx, qword [rsp + 0x70]
call fcn.18003ce08
test eax, eax
jne 0x180021ac9
mov r13d, esi
cmp qword [rsp + 0x60], 8
jb 0x180021a6f
mov rcx, qword [rsp + 0x48]
call fcn.18003ad20
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rbx
mov word [rsp + 0x48], bx
cmp qword [rbp - 0x50], 8
jb 0x180021a92
mov rcx, qword [rbp - 0x68]
call fcn.18003ad20
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], rbx
mov word [rbp - 0x68], bx
cmp qword [rbp - 0x78], 8
jb 0x180021ab3
mov rcx, qword [rsp + 0x70]
call fcn.18003ad20
mov qword [rbp - 0x78], 7
mov qword [rbp - 0x80], rbx
mov word [rsp + 0x70], bx
jmp 0x180021c44
cmp qword [rsp + 0x60], 8
jb 0x180021adc
mov rcx, qword [rsp + 0x48]
call fcn.18003ad20
nop
cmp qword [rbp - 0x50], 8
jb 0x180021aec
mov rcx, qword [rbp - 0x68]
call fcn.18003ad20
mov qword [rbp - 0x50], 7
mov qword [rbp - 0x58], rbx
mov word [rbp - 0x68], bx
cmp qword [rbp - 0x78], 8
jb 0x180021c44
mov rcx, qword [rsp + 0x70]
jmp 0x180021c3e
movsxd rdx, eax
lea rcx, [rbp + 0x10]
call fcn.180002070
nop
mov r8, rax
lea rdx, str._DOCPROPERTY__X2__IsRegister__lRet_
lea rcx, [rbp - 0x40]
call fcn.18001ebc0
nop
lea r8, [0x180097a78]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.18000c1b0
nop
cmp qword [rbp - 0x28], 8
jb 0x180021b57
mov rcx, qword [rbp - 0x40]
call fcn.18003ad20
mov qword [rbp - 0x28], 7
mov qword [rbp - 0x30], rbx
mov word [rbp - 0x40], bx
cmp qword [rbp + 0x28], 8
jb 0x180021b77
mov rcx, qword [rbp + 0x10]
call fcn.18003ad20
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp qword [rsp + 0x60], 8
jb 0x180021ba0
mov rcx, qword [rsp + 0x48]
call fcn.18003ad20
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rbx
mov word [rsp + 0x48], bx
jmp 0x180021c44
movsxd rdx, eax
lea rcx, [rbp + 0x10]
call fcn.180002070
nop
mov r8, rax
lea rdx, str._DOCPROPERTY___IsRegister__X1_lRet_
lea rcx, [rbp - 0x40]
call fcn.18001ebc0
nop
lea r8, [0x180097a78]
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.18000c1b0
nop
cmp qword [rbp - 0x28], 8
jb 0x180021bfd
mov rcx, qword [rbp - 0x40]
call fcn.18003ad20
mov qword [rbp - 0x28], 7
xor eax, eax
mov qword [rbp - 0x30], rax
mov word [rbp - 0x40], ax
cmp qword [rbp + 0x28], 8
jb 0x180021c1f
mov rcx, qword [rbp + 0x10]
call fcn.18003ad20
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rcx, qword [rbp - 0x68]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp qword [rbp - 0x50], 8
jb 0x180021c44
mov rcx, qword [rbp - 0x68]
call fcn.18003ad20
nop
cmp qword [rbp], 8
jb 0x180021c55
mov rcx, qword [rbp - 0x18]
call fcn.18003ad20
nop
cmp qword [rbp + 0x50], 8
jb 0x180021c65
mov rcx, qword [rbp + 0x38]
call fcn.18003ad20
mov eax, r13d
mov rcx, qword [rbp + 0x270]
xor rcx, rsp
call fcn.18003aad0
mov rbx, qword [rsp + 0x3d0]
add rsp, 0x380
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret