Function at 0x140011140
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x370]
sub rsp, 0x470
mov rax, qword [0x1400213f8]
xor rax, rsp
mov qword [rbp + 0x360], rax
mov edx, 0x104
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
jne 0x1400111a8
mov ecx, 0x709
call fcn.140003f10
lea r8, str.C:Windows
mov edx, 0x104
lea rcx, [rbp + 0x150]
call fcn.1400021e0
lea rax, str.System32_notepad.exe
mov edx, 0x104
lea r9, [rbp + 0x150]
mov qword [rsp + 0x20], rax
lea r8, [0x140018d40]
lea rcx, [0x1400232b8]
call fcn.1400021e0
lea r9, [0x1400232b8]
mov edx, 0x104
lea r8, [0x140019900]
lea rcx, [0x1400230b0]
call fcn.1400021e0
lea rax, [rsp + 0x38]
mov r9d, keybd_event
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SOFTWAREOpenVPN
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edi, edi
test eax, eax
je 0x14001122e
mov ecx, 0x70b
mov qword [rsp + 0x38], rdi
call fcn.140003f10
mov rcx, qword [rsp + 0x38]
mov rbx, 0xffffffffffffffff
test rcx, rcx
je 0x1400112c0
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x208
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x40]
xor r8d, r8d
lea rdx, [0x140018fbc]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400112af
cmp dword [rsp + 0x34], 1
jne 0x1400112af
mov eax, dword [rsp + 0x30]
shr eax, 1
je 0x140011290
dec eax
mov word [rsp + rax*2 + 0x40], di
jmp 0x140011299
mov word [rsp + 0x40], di
test eax, eax
je 0x1400112af
lea rcx, [rsp + 0x40]
mov rax, rbx
inc rax
cmp word [rcx + rax*2], di
jne 0x1400112a1
test rax, rax
jne 0x1400112dd
cmp qword [rsp + 0x38], rdi
je 0x1400112c0
mov ecx, 0x70c
call fcn.140003f10
lea r9, str.C:Program_FilesOpenVPN_
mov edx, 0x104
lea r8, [0x140019900]
lea rcx, [rsp + 0x40]
call fcn.1400021e0
lea rax, [rsp + 0x40]
cmp word [rax + rbx*2 + 2], di
lea rbx, [rbx + 1]
jne 0x1400112e2
cmp word [rsp + rbx*2 + 0x3e], 0x5c
je 0x140011312
lea rcx, [rsp + 0x40]
sub rcx, 2
nop
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x140011300
mov eax, dword [0x14001b5a4]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x38]
lea rbx, [0x140022400]
lea rsi, [0x1400227ec]
test rcx, rcx
je 0x140011380
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x208
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
lea rdx, str.config_dir
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140011380
cmp dword [rsp + 0x34], 1
jne 0x140011380
mov eax, dword [rsp + 0x30]
shr eax, 1
je 0x140011375
dec eax
mov word [rbx + rax*2 + 0x3ec], di
jmp 0x140011399
mov word [0x1400227ec], di
test eax, eax
jne 0x140011399
lea r9, [rsp + 0x40]
mov edx, 0x104
lea r8, str._sconfig
mov rcx, rsi
call fcn.1400021e0
mov rcx, qword [rsp + 0x38]
lea rsi, [0x140022a74]
test rcx, rcx
je 0x140011400
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x202
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
lea rdx, str.ovpn_admin_group
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140011400
cmp dword [rsp + 0x34], 1
jne 0x140011400
mov eax, dword [rsp + 0x30]
shr eax, 1
je 0x1400113f5
dec eax
mov word [rbx + rax*2 + 0x674], di
jmp 0x140011416
mov word [0x140022a74], di
test eax, eax
jne 0x140011416
mov r8d, 0x100
lea rdx, str.OpenVPN_Administrators
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov rcx, qword [rsp + 0x38]
lea rsi, [0x1400225e4]
test rcx, rcx
je 0x14001147d
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x208
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
lea rdx, str.exe_path
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14001147d
cmp dword [rsp + 0x34], 1
jne 0x14001147d
mov eax, dword [rsp + 0x30]
shr eax, 1
je 0x140011472
dec eax
mov word [rbx + rax*2 + 0x1e4], di
jmp 0x140011496
mov word [0x1400225e4], di
test eax, eax
jne 0x140011496
lea r9, [rsp + 0x40]
mov edx, 0x104
lea r8, str._sbinopenvpn.exe
mov rcx, rsi
call fcn.1400021e0
mov rcx, qword [rsp + 0x38]
lea rsi, [0x1400229f4]
test rcx, rcx
je 0x1400114fd
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x80
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
lea rdx, str.priority
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400114fd
cmp dword [rsp + 0x34], 1
jne 0x1400114fd
mov eax, dword [rsp + 0x30]
shr eax, 1
je 0x1400114f2
dec eax
mov word [rbx + rax*2 + 0x5f4], di
jmp 0x140011513
mov word [0x1400229f4], di
test eax, eax
jne 0x140011513
mov r8d, 0x3f
lea rdx, str.NORMAL_PRIORITY_CLASS
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140011567
lea rax, [rsp + 0x34]
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [0x140022c78]
xor r8d, r8d
lea rdx, str.disable_save_passwords
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x30], 4
jne 0x140011562
test eax, eax
jne 0x140011562
mov rcx, qword [rsp + 0x38]
jmp 0x14001156d
mov rcx, qword [rsp + 0x38]
mov dword [0x140022c78], edi
test rcx, rcx
je 0x140011578
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.140016590
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret