Function at 0x1800fde00
Capabilities:
Get file size
Query or enumerate registry value
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x538]
sub rsp, 0x600
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
movaps xmmword [rax - 0x88], xmm10
movaps xmmword [rax - 0x98], xmm11
mov rax, qword [0x18017d2b8]
xor rax, rsp
mov qword [rbp + 0x490], rax
mov rax, qword [rsp + 0x60]
mov esi, r8d
mov r9, qword [rsp + 0x60]
xor ebx, ebx
movsd xmm11, qword [0x180159948]
mov r10, rdx
mov qword [rbp - 0x50], rdx
mov r14d, esi
mov rdx, qword [rsp + 0x60]
lea r15d, [rsi + 0x320]
mov dword [rsp + 0x70], r8d
mov r8, rcx
mov qword [rbp - 0x58], rax
mov eax, dword [rsp + 0x74]
mov qword [rsp + 0x78], rcx
lea ecx, [rbx + 0x75]
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x68], rdx
mov dword [rsp + 0x58], eax
cmp esi, r15d
jae 0x1800fe323
movzx eax, byte [rsp + 0x40]
movsd xmm7, qword [0x18015dba8]
movsd xmm6, qword [0x18015be88]
mov byte [rsp + 0x40], al
movzx esi, byte [rsp + 0x40]
nop
cmp r14d, 0x10b
ja 0x1800fe291
je 0x1800fe284
mov eax, r14d
sub eax, 0x50
je 0x1800fe26f
sub eax, 0x50
je 0x1800fe24c
sub eax, 0x1b
je 0x1800fe23f
sub eax, 0x35
je 0x1800fe1f4
cmp eax, 0x10
jne 0x1800fe1d4
cmp qword [r8 + 0x18], 8
mov rcx, r8
jb 0x1800fdf20
mov rcx, qword [r8]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x48], rax
mov r11b, 1
mov byte [rsp + 0x40], r11b
mov r9, rax
cmp rax, 0xffffffffffffffff
jne 0x1800fe303
mov edi, 0xc2
nop word [rax + rax]
cmp edi, 0x44402
ja 0x1800fe0b5
je 0x1800fe0a9
cmp edi, 0x22262
ja 0x1800fe062
je 0x1800fe02b
cmp edi, 0xc2
je 0x1800fe1ae
cmp edi, 0x892a
je 0x1800fe022
cmp edi, 0x11192
je 0x1800fdfdc
cmp edi, 0x199fa
jne 0x1800fe1ae
mov r8d, 2
mov byte [rbp + 0x67], 0
lea rdx, [0x180157563]
lea rcx, [rbp + 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp 0x1800fe1ae
mov r8d, 1
lea rdx, [0x180157497]
lea rcx, [rbp + 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
movzx eax, word [0x1801574b6]
mov word [rbp + 0x61], ax
movzx eax, byte [0x1801574b8]
mov byte [rbp + 0x63], al
movzx eax, word [0x1801574ec]
mov word [rbp + 0x64], ax
movzx eax, byte [0x1801574ee]
mov byte [rbp + 0x66], al
jmp 0x1800fe1ae
mov byte [rbp + 0x60], 0
jmp 0x1800fe1ae
mov r8d, 2
lea rdx, [0x18015753e]
lea rcx, [rbp + 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x18], rax
mov sil, 1
movups xmmword [rbp - 0x38], xmm0
mov dword [rbp - 0x10], eax
movups xmmword [rbp - 0x28], xmm0
jmp 0x1800fe1ae
cmp edi, 0x2aaca
je 0x1800fe09d
cmp edi, 0x33332
je 0x1800fe091
cmp edi, 0x3bb9a
jne 0x1800fe1ae
mov dword [rbp - 0x40], 0x1e
mov dword [rbp - 0x3c], 0xa
jmp 0x1800fe1ae
mov dword [rbp - 0x44], 0x14
jmp 0x1800fe1ae
mov dword [rbp - 0x48], 0xa
jmp 0x1800fe1ae
mov dword [rbp - 0x38], 0x190
jmp 0x1800fe1ae
cmp edi, 0x6ee0a
ja 0x1800fe10b
je 0x1800fe102
cmp edi, 0x4cc6a
je 0x1800fe0f3
cmp edi, 0x5dd3a
je 0x1800fe0e4
cmp edi, 0x665a2
jne 0x1800fe1ae
mov byte [rbp - 0x2e], 0
jmp 0x1800fe1ae
mov word [rbp - 0x31], 1
mov byte [rbp - 0x2f], 0
jmp 0x1800fe1ae
mov word [rbp - 0x34], 0
mov byte [rbp - 0x32], 0
jmp 0x1800fe1ae
mov byte [rbp - 0x2d], 2
jmp 0x1800fe1ae
cmp edi, 0x77672
je 0x1800fe179
cmp edi, 0x7feda
je 0x1800fe173
cmp edi, 0x88742
jne 0x1800fe1ae
mov rax, qword [rbp - 0x68]
mov rcx, qword [rbp + 0x490]
xor rcx, rsp
call fcn.180110960
lea r11, [rsp + 0x600]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov byte [rbp - 0x68], 0
jmp 0x1800fe1ae
lea rcx, [rbp - 0x48]
call qword [sym.imp.GDI32.dll_CreateFontIndirectA]
test rax, rax
jne 0x1800fe18d
xor sil, sil
jmp 0x1800fe19b
test sil, sil
je 0x1800fe19b
mov rcx, rax
call qword [sym.imp.GDI32.dll_DeleteObject]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, 0x4000000
call qword [sym.imp.SHELL32.dll_SHChangeNotify]
add edi, 0x8868
cmp edi, 0x90ee8
jbe 0x1800fdf70
mov rdx, qword [rsp + 0x68]
mov ecx, 0x75
mov r8, qword [rsp + 0x78]
mov r9, qword [rsp + 0x48]
movzx r11d, byte [rsp + 0x40]
add r14d, 0x50
cmp r14d, r15d
jb 0x1800fded0
mov r10, qword [rbp - 0x50]
mov esi, dword [rsp + 0x70]
jmp 0x1800fe32e
movsd xmm0, qword [rsp + 0x60]
lea rax, [rbp - 0x70]
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x78]
mov dword [rsp + 0x28], reloc.SHELL32.dll_SHTestTokenMembership
lea rdx, str.eraP2s
mov qword [rsp + 0x20], r8
lea rcx, [rsp + 0x50]
lea r8, str.theta
movsd qword [rsp + 0x50], xmm11
movsd qword [rbp - 0x70], xmm7
movsd qword [rbp - 0x78], xmm0
call fcn.1800fe9c0
jmp 0x1800fe1c0
test r8, r8
jne 0x1800fe1d4
mov rax, rbx
jmp 0x1800fe12b
lea rax, [rsp + 0x60]
mov r8d, ecx
lea rcx, [rbp + 0x18]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x80]
lea rdx, [rbp - 0x60]
call fcn.1800b7920
jmp 0x1800fe1c0
movaps xmm0, xmmword [0x180171b50]
movups xmmword [rbp + 0x18], xmm0
movsd qword [rbp + 0x28], xmm6
jmp 0x1800fe1d4
mov rdx, r8
mov qword [rsp + 0x68], rdx
jmp 0x1800fe1d4
mov eax, r14d
sub eax, 0x114
je 0x1800fe317
sub eax, 0x3c
je 0x1800fe2fa
sub eax, 0xb
je 0x1800fe2c6
cmp eax, 0x45
jne 0x1800fe1d4
xor edx, edx
mov dword [rsp + 0x74], ebx
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x58], eax
jmp 0x1800fe1c0
mov rax, qword [rdx + 0x20]
test rax, rax
je 0x1800fe1d4
nop dword [rax]
nop word [rax + rax]
mov qword [rsp + 0x68], rax
mov rax, qword [rax + 0x20]
test rax, rax
jne 0x1800fe2e0
mov rdx, qword [rsp + 0x68]
xor ebx, ebx
jmp 0x1800fe1d4
mov qword [rbp - 0x58], rbx
jmp 0x1800fe1d4
mov rdx, qword [rsp + 0x68]
mov ecx, 0x75
mov r8, qword [rsp + 0x78]
jmp 0x1800fe1da
mov dword [rbp - 0x68], 0xffffffd2
jmp case.0x1800fe3b5.2
movzx r11d, byte [rsp + 0x40]
mov byte [rsp + 0x40], r11b
lea edi, [rsi - 0xa]
mov dword [rsp + 0x50], edi
cmp esi, edi
jbe case.0x1800fe3b5.2
movsd xmm6, qword [rbp - 0x60]
lea edi, [rsi - 0x50]
movsd xmm7, qword [rbp - 0x80]
lea rcx, [0x180000000]
movsd xmm8, qword [0x18015a658]
mov edx, 0x72
movsd xmm9, qword [0x1801599f8]
movsd xmm10, qword [0x18015c378]
mov r14d, dword [rbp - 0x70]
mov r13, qword [rbp - 0x80]
mov r12d, dword [rbp - 0x70]
mov r15, qword [rbp - 0x80]
mov eax, dword [rsp + 0x50]
mov dword [rbp - 0x78], edi
nop dword [rax + rax]
cmp edi, 0xb0
ja case.default.0x1800fe3b5
movzx eax, byte [rcx + rdi + 0xfe8a0]
mov ecx, dword [rcx + rax*4 + 0xfe874]
lea rax, [0x180000000]
add rcx, rax
jmp rcx
mov rcx, qword [rbp - 0x58]
lea rdx, [rbp - 8]
call sub.IMM32.dll_ImmGetCompositionWindow
movzx r11d, byte [rsp + 0x40]
mov dword [rbp - 0x70], eax
jmp 0x1800fe832
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx r11d, byte [rsp + 0x40]
jmp 0x1800fe832
mov ecx, dword [rsp + 0x58]
mov rdx, qword [r10 + 0x10]
cmp rcx, rdx
ja 0x1800fe40d
mov qword [r10 + 0x10], rcx
mov rax, r10
cmp qword [r10 + 0x18], 0x10
jb 0x1800fe404
mov rax, qword [r10]
mov byte [rax + rcx], 0
jmp 0x1800fe837
mov r8, qword [r10 + 0x18]
mov rsi, rcx
mov rax, r8
sub rsi, rdx
sub rax, rdx
cmp rsi, rax
ja 0x1800fe459
mov qword [r10 + 0x10], rcx
mov rax, r10
cmp r8, 0x10
jb 0x1800fe432
mov rax, qword [r10]
lea rdi, [rax + rdx]
mov r8, rsi
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
movzx r11d, byte [rsp + 0x40]
mov byte [rsi + rdi], 0
mov edi, dword [rbp - 0x78]
mov esi, dword [rsp + 0x70]
jmp 0x1800fe832
mov r9, rsi
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov rdx, rsi
mov rcx, r10
call fcn.180006150
movzx r11d, byte [rsp + 0x40]
mov esi, dword [rsp + 0x70]
jmp 0x1800fe832
xor eax, eax
xorps xmm0, xmm0
xor edx, edx
mov qword [rbp + 8], rax
mov rcx, r10
mov dword [rbp + 0x10], eax
movups xmmword [rbp - 8], xmm0
call fcn.180007720
mov r8d, dword [rsp + 0x58]
lea r9, [rsp + 0x74]
mov rcx, qword [rsp + 0x48]
mov rdx, rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
movzx r11d, byte [rsp + 0x40]
jmp 0x1800fe832
cmp dword [rbp - 0x70], 0
mov ecx, ebx
movzx eax, r11b
cmovne ecx, eax
movzx r11d, cl
mov byte [rsp + 0x40], cl
jmp case.0x1800fe3b5.4
lea rax, [rbp - 0x80]
movsd qword [rsp + 0x60], xmm11
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x60]
mov dword [rsp + 0x28], reloc.SHELL32.dll_SHTestTokenMembership
lea rdx, str.eraP2s
mov qword [rsp + 0x20], r8
lea rcx, [rsp + 0x60]
lea r8, [0x18014e804]
movsd qword [rbp - 0x80], xmm8
movsd qword [rbp - 0x60], xmm7
call fcn.1800fe9c0
lea rax, [rbp - 0x80]
movsd qword [rsp + 0x60], xmm9
mov qword [rsp + 0x30], rax
lea r9, [rbp - 0x60]
mov rax, qword [rsp + 0x78]
lea r8, [0x18014ffd4]
mov dword [rsp + 0x28], reloc.SHELL32.dll_SHTestTokenMembership
lea rdx, str.eraP2s
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rax
movsd qword [rbp - 0x80], xmm10
movsd qword [rbp - 0x60], xmm6
call fcn.1800fe9c0
movzx r11d, byte [rsp + 0x40]
jmp 0x1800fe832
mov eax, dword [rsp + 0x58]
cmp eax, dword [rsp + 0x74]
je 0x1800fe816
mov edi, 0x18
cmp edi, 0x18
ja case.default.0x1800fe5a2
lea r8, [0x180000000]
mov eax, edi
mov ecx, dword [r8 + rax*4 + 0xfe954]
add rcx, r8
jmp rcx
lea r9, [rbp + 0x60]
mov dword [rsp + 0x20], r14d
lea r8, [rbp + 0x48]
mov rcx, r13
lea rdx, [rbp + 0x30]
call qword [sym.imp.SHLWAPI.dll_SHRegGetPathA]
mov r9d, 0x104
lea r8, [rbp + 0x380]
mov edx, r12d
mov rcx, r15
call sub.IMM32.dll_ImmGetGuideLineA
lea rcx, [rbp + 0x170]
call qword [sym.imp.SHLWAPI.dll_PathMakePrettyW]
mov edx, 0x72
jmp case.default.0x1800fe5a2
mov eax, 0x7472
mov word [rbp + 0x34], ax
jmp case.default.0x1800fe5a2
mov eax, 0x7665
mov dword [rbp + 0x3c], 0x20656369
mov word [rbp + 0x3a], ax
jmp case.default.0x1800fe5a2
mov eax, 0x73
mov word [rbp + 0x41], ax
mov eax, 0x20
mov word [rbp + 0x42], ax
mov eax, 0x4e
mov word [rbp + 0x43], ax
mov eax, 0x55
mov word [rbp + 0x44], ax
jmp case.default.0x1800fe5a2
mov byte [rbp - 0x68], 0
jmp case.default.0x1800fe5a2
mov dword [rbp + 0x178], 0x72006f
jmp case.default.0x1800fe5a2
mov eax, 0x4c4c
mov byte [rbp + 0x47], 0
mov word [rbp + 0x45], ax
mov eax, 0x52
mov word [rbp + 0x48], ax
jmp case.default.0x1800fe5a2
mov qword [r10 + 0x10], rbx
mov r12d, 3
cmp qword [r10 + 0x18], 0x10
mov rax, r10
jb 0x1800fe683
mov rax, qword [r10]
mov byte [rax], 0
jmp case.default.0x1800fe5a2
mov dword [rbp + 0x1a4], 0x3e
mov r13, 0xffffffff80000001
jmp case.default.0x1800fe5a2
mov dword [rbp + 0x194], 0x3c0072
jmp case.default.0x1800fe5a2
mov eax, 0x6956
mov word [rbp + 0x32], ax
jmp case.default.0x1800fe5a2
mov eax, 0x6f
mov word [rbp + 0x1a0], ax
jmp case.default.0x1800fe5a2
mov r14d, ebx
jmp case.default.0x1800fe5a2
mov dword [rbp + 0x17c], 0x43003e
mov dword [rbp + 0x180], 0x580053
mov dword [rbp + 0x184], 0x200053
jmp case.default.0x1800fe5a2
mov eax, 0x5c
mov dword [rbp + 0x188], 0x3a0045
mov word [rbp + 0x18c], ax
mov eax, 0x6f
mov word [rbp + 0x192], ax
mov dword [rbp + 0x18e], 0x720072
jmp case.default.0x1800fe5a2
mov word [rbp + 0x1a2], dx
jmp case.default.0x1800fe5a2
mov eax, 0x70
mov word [rbp + 0x30], ax
mov word [rbp + 0x31], ax
jmp case.default.0x1800fe5a2
mov eax, 0x2f
mov word [rbp + 0x198], ax
jmp case.default.0x1800fe5a2
mov r15, rbx
jmp case.default.0x1800fe5a2
mov dword [rbp + 0x19a], 0x720065
mov word [rbp + 0x19e], dx
jmp case.default.0x1800fe5a2
mov eax, 0x69
mov word [rbp + 0x40], ax
jmp case.default.0x1800fe5a2
mov r8d, 1
lea rdx, [0x18014dbc0]
lea rcx, [rbp + 0x48]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
movsd xmm0, qword [str.ina::run]
mov eax, 0x74
mov word [rbp + 0x4a], ax
mov edx, 0x72
movzx eax, byte [0x180157588]
mov byte [rbp + 0x53], al
movsd qword [rbp + 0x4b], xmm0
jmp case.default.0x1800fe5a2
mov eax, 0x3c
mov dword [rbp + 0x172], 0x720065
mov word [rbp + 0x170], ax
mov word [rbp + 0x176], dx
jmp case.default.0x1800fe5a2
mov eax, 0x75
mov word [rbp + 0x36], ax
mov eax, 0x61
mov word [rbp + 0x37], ax
mov eax, 0x446c
mov word [rbp + 0x38], ax
mov r10, qword [rbp - 0x50]
dec edi
lea eax, [rdi + 0x51]
cmp eax, 0x50
ja 0x1800fe585
mov edi, dword [rbp - 0x78]
movzx r11d, byte [rsp + 0x40]
test r11b, r11b
je 0x1800fe82e
mov rcx, qword [rbp - 0x58]
lea rdx, [rbp - 8]
call sub.IMM32.dll_ImmSetCompositionWindow
movzx r11d, byte [rsp + 0x40]
mov byte [rbp - 0x68], 1
mov r9, qword [rsp + 0x48]
mov edx, 0x72
mov eax, dword [rsp + 0x50]
lea rcx, [0x180000000]
dec esi
dec edi
mov dword [rsp + 0x70], esi
mov dword [rbp - 0x78], edi
cmp esi, eax
jbe case.0x1800fe3b5.2
mov r10, qword [rbp - 0x50]
mov r8, qword [rsp + 0x78]
jmp 0x1800fe390
mov rax, qword [rsp + 0x68]
jmp 0x1800fe12b