Function at 0x140008260
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5c0]
sub rsp, 0x6c0
mov rax, qword [0x140022218]
xor rax, rsp
mov qword [rbp + 0x5b0], rax
mov rbx, r8
mov qword [rsp + 0x38], rdx
lea r14, str.LogPath
lea r9, [rsp + 0x40]
xor esi, esi
mov edi, 0x104
mov r8, r14
mov rdx, rcx
mov r15, rcx
mov word [rsp + 0x40], si
mov dword [rsp + 0x20], edi
call fcn.140004ac0
test al, al
jne 0x1400082de
lea rdx, [r15 + 2]
lea r9, [rsp + 0x40]
mov r8, r14
mov rcx, r15
mov dword [rsp + 0x20], edi
call fcn.140004ac0
mov rcx, rdi
lea rax, [rsp + 0x40]
nop word [rax + rax]
lea r13, [0x14001c2c0]
mov r12d, 0x7ffffffe
lea r10, str..log
cmp word [rax], si
je 0x140008317
add rax, 2
dec rcx
jne 0x1400082f0
jmp 0x14000842f
test rcx, rcx
je 0x14000842f
mov rax, rdi
sub rax, rcx
je 0x14000842f
cmp word [rsp + rax*2 + 0x3e], 0x5c
jne 0x14000842f
lea r8, [r15 + 2]
mov rcx, rdi
lea rax, [rsp + 0x40]
cmp word [rax], si
je 0x140008354
add rax, 2
dec rcx
jne 0x140008344
jmp 0x1400083bd
test rcx, rcx
je 0x1400083bd
mov rax, rdi
mov rdx, rdi
mov r9, r13
sub rax, rcx
sub rdx, rax
test r8, r8
cmovne r9, r8
lea rcx, [rsp + rax*2 + 0x40]
cmp rdx, 1
jbe 0x1400083bd
test rdx, rdx
je 0x1400083b6
mov r8, r12
sub r8, rdx
sub r9, rcx
nop dword [rax + rax]
lea rax, [rdx + r8]
test rax, rax
je 0x1400083b1
movzx eax, word [rcx + r9]
test ax, ax
je 0x1400083b1
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140008390
jmp 0x1400083b6
test rdx, rdx
jne 0x1400083ba
sub rcx, 2
mov word [rcx], si
mov rcx, rdi
lea rax, [rsp + 0x40]
cmp word [rax], si
je 0x1400083d5
add rax, 2
dec rcx
jne 0x1400083c5
jmp 0x14000842f
test rcx, rcx
je 0x14000842f
mov rax, rdi
mov rdx, rdi
sub rax, rcx
sub rdx, rax
lea rcx, [rsp + rax*2 + 0x40]
cmp rdx, 1
jbe 0x14000842f
test rdx, rdx
je 0x140008428
mov r8, r12
mov r9, r10
sub r8, rdx
sub r9, rcx
lea rax, [rdx + r8]
test rax, rax
je 0x140008423
movzx eax, word [rcx + r9]
test ax, ax
je 0x140008423
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140008402
jmp 0x140008428
test rdx, rdx
jne 0x14000842c
sub rcx, 2
mov word [rcx], si
cmp word [rsp + 0x40], si
jne 0x14000852d
lea r8, [r15 + 2]
mov rcx, rdi
lea rax, [rsp + 0x40]
cmp word [rax], si
je 0x140008456
add rax, 2
dec rcx
jne 0x140008446
jmp 0x1400084bd
test rcx, rcx
je 0x1400084bd
mov rax, rdi
mov rdx, rdi
mov r9, r13
sub rax, rcx
sub rdx, rax
test r8, r8
cmovne r9, r8
lea rcx, [rsp + rax*2 + 0x40]
cmp rdx, 1
jbe 0x1400084bd
test rdx, rdx
je 0x1400084b6
mov r8, r12
sub r8, rdx
sub r9, rcx
nop word [rax + rax]
lea rax, [rdx + r8]
test rax, rax
je 0x1400084b1
movzx eax, word [rcx + r9]
test ax, ax
je 0x1400084b1
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140008490
jmp 0x1400084b6
test rdx, rdx
jne 0x1400084ba
sub rcx, 2
mov word [rcx], si
mov rcx, rdi
lea rax, [rsp + 0x40]
cmp word [rax], si
je 0x1400084d5
add rax, 2
dec rcx
jne 0x1400084c5
jmp 0x14000852d
test rcx, rcx
je 0x14000852d
mov rax, rdi
mov rdx, rdi
sub rax, rcx
sub rdx, rax
lea rcx, [rsp + rax*2 + 0x40]
cmp rdx, 1
jbe 0x14000852d
test rdx, rdx
je 0x140008526
mov r8, r12
sub r8, rdx
sub r10, rcx
nop
lea rax, [rdx + r8]
test rax, rax
je 0x140008521
movzx eax, word [rcx + r10]
test ax, ax
je 0x140008521
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140008500
jmp 0x140008526
test rdx, rdx
jne 0x14000852a
sub rcx, 2
mov word [rcx], si
cmp word [rsp + 0x40], 0x2e
jne 0x140008544
cmp word [rsp + 0x42], 0x5c
jne 0x140008544
lea rsi, [rsp + 0x44]
jmp 0x140008561
lea rcx, [rsp + 0x40]
mov edx, 0x5c
call fcn.14000d6c4
test rax, rax
jne 0x1400087d3
lea rsi, [rsp + 0x40]
xor eax, eax
lea rdx, [0x14001c404]
lea rcx, [rbp + 0x150]
mov word [rbp + 0x290], ax
call fcn.1400081f0
mov r11d, 0xa0
mov ecx, r11d
lea rax, [rbp + 0x150]
nop dword [rax]
cmp word [rax], 0
je 0x140008607
add rax, 2
dec rcx
jne 0x140008590
xor r12d, r12d
mov rcx, qword [r15 + 0x100]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x290]
lea rdx, [rbp + 0x150]
xor r8d, r8d
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x34], 0x206
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140008676
cmp dword [rsp + 0x30], 1
jne 0x140008676
mov eax, dword [rsp + 0x34]
shr eax, 1
inc eax
mov word [rbp + rax*2 + 0x290], r12w
jmp 0x14000867e
test rcx, rcx
je 0x14000859f
mov rax, r11
sub rax, rcx
sub r11, rax
lea rcx, [rbp + rax*2 + 0x150]
cmp r11, 1
jbe 0x14000859f
test r11, r11
je 0x140008666
sub r12, r11
sub r14, rcx
lea rax, [r11 + r12]
test rax, rax
je 0x140008661
movzx eax, word [rcx + r14]
test ax, ax
je 0x140008661
mov word [rcx], ax
add rcx, 2
dec r11
jne 0x140008632
sub rcx, 2
xor r12d, r12d
mov word [rcx], r12w
jmp 0x1400085a2
test r11, r11
jne 0x14000866a
sub rcx, 2
xor r12d, r12d
mov word [rcx], r12w
jmp 0x1400085a2
mov word [rbp + 0x290], r12w
lea rcx, [rbp + 0x290]
mov edx, 0x5c
call fcn.14000d6c4
mov r9, qword [rsp + 0x38]
test rax, rax
jne 0x1400086f1
test r9, r9
mov r8, r13
lea rax, [rbp + 0x290]
cmovne r8, r9
mov rdx, rdi
lea rcx, [rbp + 0x290]
sub r8, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x1400086e4
movzx eax, word [rcx + r8]
test ax, ax
je 0x1400086e4
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x1400086c0
jmp 0x1400086e9
test rdx, rdx
jne 0x1400086ed
sub rcx, 2
mov word [rcx], r12w
mov rcx, rdi
lea rax, [rbp + 0x290]
nop dword [rax + rax]
cmp word [rax], 0
je 0x140008711
add rax, 2
dec rcx
jne 0x140008700
jmp 0x140008775
test rcx, rcx
je 0x140008775
mov rax, rdi
sub rax, rcx
je 0x140008775
cmp word [rbp + rax*2 + 0x28e], 0x5c
je 0x140008775
test r9, r9
lea rax, [rbp + 0x290]
mov rdx, rdi
cmovne r13, r9
lea rcx, [rbp + 0x290]
sub r13, rax
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x140008768
movzx eax, word [rcx + r13]
test ax, ax
je 0x140008768
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140008744
jmp 0x14000876d
test rdx, rdx
jne 0x140008771
sub rcx, 2
mov word [rcx], r12w
test rbx, rbx
je 0x1400087c1
lea r8, [rbp + 0x290]
mov rdx, rdi
mov rcx, rbx
sub r8, rbx
nop word [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x1400087b4
movzx eax, word [rcx + r8]
test ax, ax
je 0x1400087b4
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140008790
jmp 0x1400087b9
test rdx, rdx
jne 0x1400087bd
sub rcx, 2
mov word [rcx], r12w
mov r8, rsi
mov rdx, rdi
mov rcx, rbx
call fcn.140004220
xor esi, esi
jmp 0x1400087e0
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140009000
cmp word [rbx], 0x7e
jne 0x1400088cf
mov r9d, 1
lea rdx, [rbp + 0x290]
xor ecx, ecx
lea r8d, [r9 + 4]
mov word [rbp + 0x290], si
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x140008860
lea r8, [0x14001cc14]
lea rax, [rbp + 0x290]
mov edx, 0x190
sub r8, rax
lea rcx, [rbp + 0x290]
nop dword [rax + rax]
lea rax, [rdx + 0x7ffffe6e]
test rax, rax
je 0x140008854
movzx eax, word [rcx + r8]
test ax, ax
je 0x140008854
mov word [rcx], ax
add rcx, 2
dec rdx
jne 0x140008830
jmp 0x140008859
test rdx, rdx
jne 0x14000885d
sub rcx, 2
mov word [rcx], si
lea r8, [0x14001ca64]
lea rcx, [rbp + 0x290]
mov edx, 0x320
call fcn.140009340
lea r8, [rbx + 2]
lea rcx, [rbp + 0x290]
mov edx, 0x320
call fcn.140009340
lea rcx, [rbp + 0x290]
sub rcx, rbx
nop word [rax + rax]
lea rax, [rdi + 0x7ffffefa]
test rax, rax
je 0x1400088c3
movzx eax, word [rbx + rcx]
test ax, ax
je 0x1400088c3
mov word [rbx], ax
add rbx, 2
dec rdi
jne 0x1400088a0
jmp 0x1400088c8
test rdi, rdi
jne 0x1400088cc
sub rbx, 2
mov word [rbx], si
mov al, 1
mov rcx, qword [rbp + 0x5b0]
xor rcx, rsp
call fcn.14000c410
mov rbx, qword [rsp + 0x708]
add rsp, 0x6c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret