Function at 0x100b250
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get installed programs
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x8a0
mov rax, qword [0x0101c380]
xor rax, rsp
mov qword [rsp + 0x890], rax
lea r15, [rcx + 0x44]
mov rbx, rcx
mov edi, 0x104
mov rcx, r15
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rdx, [rbx + 0x148]
mov r8d, edi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rsp + 0x40]
xor r14d, r14d
lea rdi, [0x01006530]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov rdx, rdi
mov rsi, r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, r14d
jne 0x100b2fa
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x48]
call fcn.0100d56c
mov rsi, qword [rsp + 0x48]
jmp 0x100b2fd
mov eax, r14d
mov r12d, 1
lea rdx, [0x010064c0]
cmp eax, r14d
je 0x100b46a
cmp rsi, r14
je 0x100b46a
lea r13d, [r12 + 0x5b]
mov rcx, r14
mov al, byte [rcx + rdi]
mov byte [rsp + rcx + 0x160], al
add rcx, r12
cmp al, r14b
jne 0x100b324
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x160]
repne scasb al, byte [rdi]
sub rdi, r12
xor ecx, ecx
mov al, byte [rdx + rcx]
mov byte [rdi + rcx], al
add rcx, r12
test al, al
jne 0x100b34b
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x160]
repne scasb al, byte [rdi]
sub rdi, r12
xor ecx, ecx
mov al, byte [rsi + rcx + 8]
mov byte [rdi + rcx], al
add rcx, r12
test al, al
jne 0x100b36d
lea rax, [rsp + 0x40]
lea rdx, [rsp + 0x160]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, r14d
jne 0x100b3c9
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x380]
lea rcx, [0x01006800]
mov r8d, 0x104
call fcn.0100d6ec
jmp 0x100b3cc
mov eax, r14d
cmp eax, r14d
je 0x100b40d
lea rcx, [rbx + 0x148]
mov edx, r13d
call fcn.01014e78
lea rcx, [rsp + 0x380]
mov edx, r13d
mov rdi, rax
call fcn.01014e78
cmp rax, r14
je 0x100b40d
cmp rdi, r14
je 0x100b40d
mov rdx, rax
mov rcx, rdi
call fcn.0101402c
cmp eax, r14d
je 0x100b428
mov rsi, qword [rsi]
cmp rsi, r14
je 0x100b46a
lea rdi, [0x01006530]
lea rdx, [0x010064c0]
jmp 0x100b321
mov edx, 0x408
mov rcx, r12
call fcn.01012368
lea rcx, [rsp + 0x160]
lea rdx, [rsp + 0x160]
mov rdi, rax
sub rax, rcx
mov cl, byte [rdx]
mov byte [rax + rdx + 8], cl
add rdx, r12
cmp cl, r14b
jne 0x100b44b
mov rax, qword [rbx + 0x490]
mov qword [rdi], rax
mov qword [rbx + 0x490], rdi
mov rcx, rbx
call fcn.0100aa2c
cmp qword [rbx + 0x458], r14
jne 0x100b4e1
mov rax, qword [rbx]
mov rsi, r14
mov rcx, qword [rax + 0x30]
cmp qword [rcx], r14
je 0x100b4e1
mov rdx, r14
mov rax, qword [rbx]
mov rcx, qword [rax + 0x30]
mov rdi, qword [rdx + rcx]
mov edx, 0x408
mov rcx, r12
call fcn.01012368
mov r11, rax
sub rax, rdi
mov cl, byte [rdi]
inc rdi
mov byte [rax + rdi + 7], cl
cmp cl, r14b
jne 0x100b4ab
mov rax, qword [rbx + 0x458]
inc rsi
mov qword [r11], rax
mov qword [rbx + 0x458], r11
mov rax, qword [rbx]
mov rcx, qword [rax + 0x30]
mov rdx, rsi
shl rdx, 3
cmp qword [rdx + rcx], r14
jne 0x100b48d
mov rax, qword [rbx]
mov rsi, r14
mov rcx, qword [rax + 0x28]
cmp qword [rcx], r14
je 0x100b547
mov rdx, r14
mov rax, qword [rbx]
mov rcx, qword [rax + 0x28]
mov rdi, qword [rdx + rcx]
mov edx, 0x408
mov rcx, r12
call fcn.01012368
mov r11, rax
sub rax, rdi
mov cl, byte [rdi]
inc rdi
mov byte [rax + rdi + 7], cl
cmp cl, r14b
jne 0x100b511
mov rax, qword [rbx + 0x478]
inc rsi
mov qword [r11], rax
mov qword [rbx + 0x478], r11
mov rax, qword [rbx]
mov rcx, qword [rax + 0x28]
mov rdx, rsi
shl rdx, 3
cmp qword [rdx + rcx], r14
jne 0x100b4f3
mov r13d, r14d
lea r9, [0x010068a0]
mov rax, qword [rbx]
cmp r13d, r14d
jne 0x100b55f
mov r14, qword [rax + 0x20]
jmp 0x100b570
cmp r13d, 1
jne 0x100ba7f
mov r14, qword [rax + 0x140]
test r14, r14
je 0x100ba74
xor r12d, r12d
cmp qword [r12 + r14], 0
je 0x100ba74
mov rax, qword [rbx]
lea rsi, [rsp + 0x50]
mov rcx, qword [rax + 0x20]
sub rsi, r15
cmp dword [rbx + 8], 7
mov rbp, qword [r12 + rcx]
mov rcx, r15
jl 0x100b6e2
mov al, byte [rcx]
mov byte [rsi + rcx], al
inc rcx
test al, al
jne 0x100b5a7
or rdx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, rdx
lea r8, [0x010064c0]
repne scasb al, byte [rdi]
xor ecx, ecx
mov al, byte [r8 + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100b5cc
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, rdx
repne scasb al, byte [rdi]
xor ecx, ecx
mov al, byte [r9 + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100b5e9
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, rdx
repne scasb al, byte [rdi]
xor ecx, ecx
mov al, byte [r8 + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100b606
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, rdx
repne scasb al, byte [rdi]
xor ecx, ecx
mov al, byte [rcx + rbp]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100b623
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100ba27
mov rcx, r15
mov al, byte [rcx]
mov byte [rsi + rcx], al
inc rcx
test al, al
jne 0x100b648
or rsi, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, rsi
lea rdx, [0x010064c0]
repne scasb al, byte [rdi]
xor ecx, ecx
mov al, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100b66d
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, rsi
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [0x01006890]
mov al, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100b690
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, rsi
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [0x010064c0]
mov al, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100b6b3
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, rsi
repne scasb al, byte [rdi]
xor ecx, ecx
mov al, byte [rcx + rbp]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100b6cf
jmp 0x100ba17
mov al, byte [rcx]
mov byte [rsi + rcx], al
inc rcx
test al, al
jne 0x100b6e2
or r8, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, r8
lea r9, [0x010064c0]
repne scasb al, byte [rdi]
xor ecx, ecx
mov al, byte [r9 + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100b707
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, r8
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [0x01006888]
mov al, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100b72b
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, r8
repne scasb al, byte [rdi]
xor ecx, ecx
mov al, byte [r9 + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100b747
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, r8
repne scasb al, byte [rdi]
xor ecx, ecx
mov al, byte [rcx + rbp]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100b764
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100ba27
mov rcx, r15
mov al, byte [rcx]
mov byte [rsi + rcx], al
inc rcx
test al, al
jne 0x100b789
or rdx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, rdx
lea r8, [0x010064c0]
repne scasb al, byte [rdi]
xor ecx, ecx
mov al, byte [r8 + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100b7ae
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, rdx
repne scasb al, byte [rdi]
xor ecx, ecx
lea r8, [0x01006890]
mov al, byte [r8 + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100b7d2
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, rdx
repne scasb al, byte [rdi]
xor ecx, ecx
lea r8, [0x010064c0]
mov al, byte [r8 + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100b7f6
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, rdx
repne scasb al, byte [rdi]
xor ecx, ecx
mov al, byte [rcx + rbp]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100b813
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100ba27
mov rcx, r15
mov al, byte [rcx]
mov byte [rsi + rcx], al
inc rcx
test al, al
jne 0x100b838
or rdx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, rdx
lea r8, [0x010064c0]
repne scasb al, byte [rdi]
xor ecx, ecx
mov al, byte [r8 + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100b85d
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, rdx
repne scasb al, byte [rdi]
xor ecx, ecx
lea r9, [0x010068a0]
mov al, byte [r9 + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100b881
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, rdx
repne scasb al, byte [rdi]
xor ecx, ecx
mov al, byte [r8 + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100b89e
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, rdx
repne scasb al, byte [rdi]
xor ecx, ecx
mov al, byte [rcx + rbp]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100b8bb
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100ba27
mov rcx, r15
mov al, byte [rcx]
mov byte [rsi + rcx], al
inc rcx
test al, al
jne 0x100b8e0
or r8, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, r8
lea r9, [0x010064c0]
repne scasb al, byte [rdi]
xor ecx, ecx
mov al, byte [r9 + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100b905
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, r8
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [0x010068b8]
mov al, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100b929
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, r8
repne scasb al, byte [rdi]
xor ecx, ecx
mov al, byte [r9 + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100b945
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, r8
repne scasb al, byte [rdi]
xor ecx, ecx
mov al, byte [rcx + rbp]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100b962
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x100ba27
mov rcx, r15
mov al, byte [rcx]
mov byte [rsi + rcx], al
inc rcx
test al, al
jne 0x100b987
or rsi, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, rsi
lea r8, [0x010064c0]
repne scasb al, byte [rdi]
xor ecx, ecx
mov al, byte [r8 + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100b9ac
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, rsi
repne scasb al, byte [rdi]
xor ecx, ecx
lea rdx, [0x010068c8]
mov al, byte [rdx + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100b9d0
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, rsi
repne scasb al, byte [rdi]
xor ecx, ecx
mov al, byte [r8 + rcx]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100b9ec
xor eax, eax
lea rdi, [rsp + 0x50]
mov rcx, rsi
repne scasb al, byte [rdi]
xor ecx, ecx
mov al, byte [rcx + rbp]
inc rcx
mov byte [rdi + rcx - 2], al
test al, al
jne 0x100ba09
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x100ba64
mov edx, 0x408
mov ecx, 1
call fcn.01012368
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x50]
mov rdi, rax
sub rax, rcx
mov cl, byte [rdx]
inc rdx
mov byte [rax + rdx + 7], cl
test cl, cl
jne 0x100ba46
mov rax, qword [rbx + 0x488]
mov qword [rdi], rax
mov qword [rbx + 0x488], rdi
add r12, 8
lea r9, [0x010068a0]
jmp 0x100b57c
inc r13d
xor r14d, r14d
jmp 0x100b551
mov rcx, qword [rax + 0x38]
mov rsi, r14
cmp qword [rcx], r14
je 0x100baff
mov rdx, r14
mov rax, qword [rbx]
mov rcx, qword [rax + 0x38]
mov rdi, qword [rdx + rcx]
cmp byte [rdi], 0x2d
jne 0x100baa6
cmp dword [rbx + 8], 7
jge 0x100bae8
jmp 0x100bab1
cmp byte [rdi], 0x2b
jne 0x100bab4
cmp dword [rbx + 8], 7
jl 0x100bae8
inc rdi
mov edx, 0x408
mov ecx, 1
call fcn.01012368
mov r11, rax
sub rax, rdi
mov cl, byte [rdi]
inc rdi
mov byte [rax + rdi + 7], cl
cmp cl, r14b
jne 0x100bac9
mov rax, qword [rbx + 0x490]
mov qword [r11], rax
mov qword [rbx + 0x490], r11
mov rax, qword [rbx]
inc rsi
mov rcx, qword [rax + 0x38]
mov rdx, rsi
shl rdx, 3
cmp qword [rdx + rcx], r14
jne 0x100ba8e
cmp dword [rbx + 0x6b4], r14d
je 0x100bb43
mov edx, 0x408
mov ecx, 1
call fcn.01012368
lea rdx, [rbx + 0x5b0]
mov rdi, rax
sub rax, rdx
mov cl, byte [rdx]
inc rdx
mov byte [rax + rdx + 7], cl
cmp cl, r14b
jne 0x100bb24
mov rax, qword [rbx + 0x490]
mov qword [rdi], rax
mov qword [rbx + 0x490], rdi
cmp dword [rbx + 8], 7
jl 0x100bb82
mov rcx, rbx
call fcn.0100943c
cmp dword [rbx + 0x38], r14d
jne 0x100bb5f
mov rcx, rbx
call fcn.01009648
cmp dword [rbx + 8], 8
je 0x100bb75
cmp dword [rbx + 8], 0xa
je 0x100bb75
cmp dword [rbx + 8], 0xb
jne 0x100bdd9
mov rcx, rbx
call fcn.01009874
jmp 0x100bdd9
mov rsi, qword [rbx + 0x478]
jmp 0x100bbc0
lea rcx, [rsi + 8]
mov rdx, rbx
call fcn.01009e14
lea rdx, [rsi + 8]
lea rcx, [0x01006900]
mov r8, rbx
call fcn.01009d00
lea rdx, [rsi + 8]
lea rcx, [0x01006920]
mov r8, rbx
call fcn.01009d00
mov rsi, qword [rsi]
cmp rsi, r14
jne 0x100bb8b
mov rcx, rbx
call fcn.0100a00c
lea rax, [rsp + 0x40]
lea rdx, [0x010069b0]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
mov rsi, r14
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, r14d
jne 0x100bd9e
mov r12, qword [rsp + 0x40]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x490]
mov r13d, 0x400
mov rcx, r12
xor edx, edx
mov qword [rsp + 0x28], r14
mov edi, r14d
mov ebp, r14d
mov dword [rsp + 0x48], r13d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov r15d, 0x103
cmp eax, r15d
je 0x100bcc1
mov edi, 1
mov edx, 0x408
mov rcx, rdi
call fcn.01012368
lea rcx, [rsp + 0x490]
lea rdx, [rsp + 0x490]
mov r11, rax
sub rax, rcx
mov cl, byte [rdx]
inc rdx
mov byte [rax + rdx + 7], cl
cmp cl, r14b
jne 0x100bc75
mov qword [rsp + 0x38], r14
mov qword [r11], rsi
mov qword [rsp + 0x30], r14
inc ebp
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x490]
mov rcx, r12
mov edx, ebp
mov qword [rsp + 0x28], r14
mov rsi, r11
mov dword [rsp + 0x48], r13d
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
cmp eax, r15d
jne 0x100bc52
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, r14d
je 0x100bd9e
mov rax, qword [rbx]
lea rdx, [rsp + 0x270]
mov rcx, qword [rax + 0x50]
mov al, byte [rcx]
inc rcx
mov byte [rdx], al
inc rdx
cmp al, r14b
jne 0x100bce4
mov r12, rsi
cmp rsi, r14
je 0x100bd9e
lea r13, [0x010069b0]
lea rcx, [rsp + 0x270]
lea rbp, [r12 + 8]
call fcn.010148fc
mov rcx, rbp
mov rdi, rax
call fcn.010148fc
mov rdx, rdi
mov rcx, rax
call fcn.01014b34
cmp rax, r14
je 0x100bd7d
mov ecx, 0x2c08
call fcn.010123b8
mov rdx, r13
mov rdi, rax
sub rax, r13
mov cl, byte [rdx]
inc rdx
mov byte [rax + rdx + 7], cl
cmp cl, r14b
jne 0x100bd46
mov rcx, rdi
sub rcx, rbp
mov al, byte [rbp]
inc rbp
mov byte [rcx + rbp + 0x2807], al
cmp al, r14b
jne 0x100bd5a
mov rax, qword [rbx + 0x498]
mov qword [rdi], rax
mov qword [rbx + 0x498], rdi
mov r12, qword [r12]
cmp r12, r14
jne 0x100bd06
cmp rsi, r14
je 0x100bd9e
mov rdi, qword [rsi]
mov rcx, rsi
call fcn.0101226c
mov rsi, rdi
cmp rdi, r14
jne 0x100bd8b
cmp dword [rbx + 8], 5
jne 0x100bdb3
lea rcx, [0x01006938]
mov rdx, rbx
call fcn.0100a5a0
lea rcx, [0x01006948]
mov rdx, rbx
call fcn.0100a5a0
lea rcx, [0x01006928]
mov rdx, rbx
call fcn.0100a5a0
mov rcx, rbx
call fcn.0100a73c
xor eax, eax
mov rcx, qword [rsp + 0x890]
xor rcx, rsp
call fcn.0100f170
lea r11, [rsp + 0x8a0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret