Function at 0x1400e9ff0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x3d8
pxor xmm0, xmm0
lea r12, [rsp + 0x1c0]
mov rsi, rcx
mov rdi, rdx
movaps xmmword [rsp + 0xf0], xmm0
mov rbx, r8
movaps xmmword [rsp + 0xe0], xmm0
mov edx, 0x104
mov rcx, r12
movups xmmword [rsp + 0xfc], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1400ea150
mov qword [rbx], 0
test rsi, rsi
je 0x1400ea170
mov rdx, rsi
xor r8d, r8d
lea rcx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionTime_Zones_
call fcn.1400e4ea0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, rax
mov rdi, rax
call fcn.1402b3210
mov rsi, rax
test rax, rax
je 0x1400ea702
xor r8d, r8d
lea rdx, str.Dynamic_DST
mov rcx, rdi
call fcn.1400e4ea0
xor r9d, r9d
xor r8d, r8d
mov edx, 0xffffffff
mov rcx, rax
mov qword [rsp + 0x40], rax
call fcn.1402b3210
mov rbp, rax
test rax, rax
je 0x1400ea6fa
mov r13, qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor r8d, r8d
mov rdx, rsi
xor r15d, r15d
lea r14, [rsp + 0x88]
mov r9d, 1
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], r14
call r13
test eax, eax
je 0x1400ea180
mov rcx, rbp
call fcn.14034efb0
mov rcx, qword [rsp + 0x40]
call fcn.14034efb0
mov rcx, rsi
call fcn.14034efb0
mov rcx, rdi
call fcn.14034efb0
mov rax, qword [rbx]
test rax, rax
je 0x1400ea150
mov dword [rax], 0x77c
lea eax, [r15 - 2]
mov rcx, qword [rbx]
shl rax, 7
mov edx, dword [rcx + rax]
lea eax, [r15 - 1]
shl rax, 7
cmp edx, 0xbb6
ja 0x1400ea300
mov dword [rcx + rax], 0xbb7
jmp 0x1400ea153
xor r15d, r15d
mov eax, r15d
add rsp, 0x3d8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
test rdi, rdi
je 0x1400ea150
mov rsi, rdi
jmp 0x1400ea056
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x30], r12
lea r8, [rsp + 0x114]
mov rcx, qword [rsp + 0x88]
mov qword [rsp + 0x50], r8
mov r15, qword [sym.imp.ADVAPI32.dll_RegLoadMUIStringW]
mov r9d, 0x40
lea rdx, str.MUI_Std
mov dword [rsp + 0x7c], 0x40
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], rax
call r15
mov r8, qword [rsp + 0x50]
test eax, eax
je 0x1400ea213
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], r8
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x7c], 0x40
mov rcx, qword [rsp + 0x88]
lea rdx, [0x1403a2676]
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ea34a
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x30], r12
lea r8, [rsp + 0x168]
mov r9d, 0x40
mov qword [rsp + 0x50], r8
mov rcx, qword [rsp + 0x88]
lea rdx, str.MUI_Dlt
mov dword [rsp + 0x7c], 0x40
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], rax
call r15
mov r8, qword [rsp + 0x50]
test eax, eax
jne 0x1400ea310
mov rcx, qword [rsp + 0x88]
mov r12, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call r12
xor r8d, r8d
mov qword [rsp + 0x20], r14
mov rdx, rbp
mov r9d, 1
mov rcx, 0xffffffff80000002
call r13
test eax, eax
jne 0x1400ea358
mov r15, qword [rsp + 0x48]
mov r14, qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor r9d, r9d
xor r8d, r8d
lea rax, [rsp + 0x84]
mov dword [rsp + 0x7c], 4
mov rcx, qword [rsp + 0x88]
lea rdx, str.FirstEntry
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], r14
call r14
test eax, eax
je 0x1400ea450
xor r15d, r15d
mov rcx, qword [rsp + 0x88]
call r12
jmp 0x1400ea0f5
add edx, 1
mov dword [rcx + rax], edx
jmp 0x1400ea153
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x20], r8
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x7c], 0x40
mov rcx, qword [rsp + 0x88]
lea rdx, [0x1403a267e]
mov qword [rsp + 0x28], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400ea264
mov r12, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400ea2e4
mov qword [rsp + 0x20], r14
xor r8d, r8d
mov rdx, rsi
xor r15d, r15d
mov r9d, 1
mov rcx, 0xffffffff80000002
call r13
test eax, eax
jne 0x1400ea0f5
mov rax, qword [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x7c], 0x2c
mov rcx, qword [rsp + 0x88]
lea rdx, [0x1403a26b6]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400ea2e7
mov ecx, 1
mov edx, 0x100
call sub.msvcrt.dll_calloc
mov rcx, rax
test rax, rax
je 0x1400ea713
mov qword [rbx], rax
mov eax, dword [rsp + 0xe0]
lea rdx, [rsp + 0x110]
movdqu xmm1, xmmword [rsp + 0xec]
movdqu xmm2, xmmword [rsp + 0xfc]
mov dword [rsp + 0x110], eax
mov eax, dword [rsp + 0xe4]
movups xmmword [rsp + 0x154], xmm1
mov dword [rsp + 0x164], eax
mov eax, dword [rsp + 0xe8]
movups xmmword [rsp + 0x1a8], xmm2
mov dword [rsp + 0x1b8], eax
call fcn.1400e2ef0
test eax, eax
je 0x1400ea6de
mov r15d, 2
jmp 0x1400ea2e7
lea rax, [rsp + 0x80]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x7c], 4
mov qword [rsp + 0x28], r15
mov rcx, qword [rsp + 0x88]
lea rdx, str.LastEntry
mov qword [rsp + 0x20], rax
call r14
test eax, eax
jne 0x1400ea2e4
mov eax, dword [rsp + 0x80]
mov edx, pe_nt_image_headers64
xor r13d, r13d
lea r14, [rsp + 0xe0]
lea ecx, [rax + 2]
sub ecx, dword [rsp + 0x84]
call fcn.1400d5370
mov r15d, dword [rsp + 0x84]
lea rdx, [rsp + 0x90]
lea r8, [rsp + 0x110]
mov qword [rbx], rax
test rax, rax
je 0x1400ea6f2
mov qword [rsp + 0x58], rbp
mov rbp, qword [rsp + 0x48]
mov qword [rsp + 0x60], rdi
mov rdi, qword [rsp + 0x50]
mov qword [rsp + 0x68], rsi
mov rsi, rdx
mov qword [rsp + 0x50], r12
mov r12d, r15d
mov qword [rsp + 0x48], r8
jmp 0x1400ea662
mov r9d, r12d
lea r8, [0x1403a26b0]
mov edx, 0xb
mov rcx, rsi
call sub.msvcrt.dll_swprintf_s
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], r14
mov rcx, qword [rsp + 0x88]
mov rdx, rsi
mov dword [rsp + 0x7c], 0x2c
call rdi
test eax, eax
jne 0x1400ea690
cmp dword [rsp + 0x84], r12d
jae 0x1400ea5b0
mov rax, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xb0]
xor rax, qword [r14 + 8]
xor rdx, qword [r14]
or rax, rdx
jne 0x1400ea5b0
mov rax, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0xc0]
xor rax, qword [r14 + 0x18]
xor rdx, qword [r14 + 0x10]
or rax, rdx
jne 0x1400ea5b0
mov rax, qword [rsp + 0xd4]
mov rdx, qword [rsp + 0xcc]
xor rax, qword [r14 + 0x24]
xor rdx, qword [r14 + 0x1c]
or rax, rdx
je 0x1400ea658
mov eax, dword [rsp + 0xe0]
mov r8d, r13d
mov rcx, qword [rbx]
add r13d, 1
mov r15, r8
mov rdx, qword [rsp + 0x48]
movdqa xmm1, xmmword [rsp + 0xe0]
mov dword [rsp + 0x110], eax
mov eax, dword [rsp + 0xe4]
shl r15, 7
movdqa xmm2, xmmword [rsp + 0xf0]
add rcx, r15
movdqu xmm3, xmmword [rsp + 0xfc]
movaps xmmword [rsp + 0xb0], xmm1
movdqu xmm4, xmmword [rsp + 0xec]
mov dword [rsp + 0x164], eax
movdqu xmm5, xmmword [rsp + 0xfc]
mov eax, dword [rsp + 0xe8]
movaps xmmword [rsp + 0xc0], xmm2
movups xmmword [rsp + 0x154], xmm4
mov dword [rsp + 0x1b8], eax
movups xmmword [rsp + 0xcc], xmm3
movups xmmword [rsp + 0x1a8], xmm5
call fcn.1400e2ef0
test eax, eax
je 0x1400ea6b9
mov rax, qword [rbx]
mov dword [rax + r15], r12d
add r12d, 1
cmp qword [rbx], 0
je 0x1400ea670
cmp dword [rsp + 0x80], r12d
jae 0x1400ea508
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add r13d, 1
mov rsi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x50]
mov r15d, r13d
jmp 0x1400ea2e7
mov rcx, qword [rbx]
mov rbp, qword [rsp + 0x58]
add r13d, 1
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x50]
call fcn.14034efb0
mov qword [rbx], 0
jmp 0x1400ea688
mov rcx, qword [rbx]
mov rbp, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov r12, qword [rsp + 0x50]
call fcn.14034efb0
mov qword [rbx], 0
jmp 0x1400ea688
mov rcx, qword [rbx]
call fcn.14034efb0
mov qword [rbx], 0
jmp 0x1400ea43f
mov r13d, 1
jmp 0x1400ea688
xor r15d, r15d
jmp 0x1400ea0f5
xor eax, eax
xor ebp, ebp
xor r15d, r15d
mov qword [rsp + 0x40], rax
jmp 0x1400ea0f5
mov qword [rsp + 0x20], 0x100
lea r9, [0x1403a1d2e]
lea r8, [0x1403a1d08]
mov edx, 4
lea rcx, [0x1403a1bda]
call fcn.1400d2190
jmp 0x1400ea73b