Function at 0x1400297fc
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x238]
sub rsp, 0x310
mov rax, qword [0x1400592a0]
xor rax, rsp
mov qword [rbp + 0x200], rax
mov rdx, qword [rcx + 0x50]
xor r15d, r15d
mov qword [rsp + 0x58], rcx
mov r14, rcx
mov edi, 1
mov r13d, r15d
mov ebx, r15d
test rdx, rdx
je 0x140029f71
or rcx, 0xffffffffffffffff
mov rax, rcx
inc rax
cmp word [rdx + rax*2], r15w
jne 0x14002985d
mov r8d, 0x3a
lea rsi, [rax + 1]
lea eax, [r8 - 0x38]
cmp r8w, word [rdx + 2]
jne 0x140029bdb
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.1400014a0
mov r8, qword [r14 + 0x50]
mov r12, rax
cmp word [r8], 0x52
je 0x1400298a8
cmp word [r8], 0x72
jne 0x140029bcd
test r12, r12
je 0x140029f71
add r8, 4
mov rdx, rsi
mov rcx, r12
call fcn.140010dd0
mov r14d, 0x2c
mov rcx, r12
mov edx, r14d
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
mov r15, rax
xor eax, eax
test r15, r15
je 0x140029bcd
mov edx, r14d
mov qword [rsp + 0x60], rax
lea rcx, [r15 + 2]
mov word [r15], ax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
mov rsi, rax
xor eax, eax
test rsi, rsi
je 0x14002993b
mov word [rsi], ax
mov edx, r14d
add rsi, 2
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
xor ecx, ecx
test rax, rax
je 0x14002993b
mov word [rax], cx
lea rcx, [rax + 2]
call fcn.14001eb30
mov r13, rax
mov rdx, 0xffffffff80000000
mov rcx, r12
call fcn.14001e558
lea rcx, [rsp + 0x60]
mov r9d, edi
mov qword [rsp + 0x20], rcx
lea rdx, [r15 + 2]
mov rcx, rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
xor r15d, r15d
test eax, eax
jne 0x140029bc3
mov rcx, qword [rsp + 0x60]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x50]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x50], edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rdx, rsi
mov dword [rsp + 0x58], 0x80
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140029bb2
cmp dword [rsp + 0x50], edi
jne 0x140029bb2
mov dword [rsp + 0x40], r15d
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x44], r15d
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x4c], r15d
lea r15d, [rax + 0x2e]
mov edx, r15d
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
je 0x140029ac7
add ebx, edi
lea rcx, [rax + 2]
mov edx, r15d
mov esi, ebx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x1400299fb
sub esi, edi
je 0x140029aaa
sub esi, edi
je 0x140029a83
cmp esi, edi
je 0x140029a4c
xor r15d, r15d
test ebx, ebx
je 0x140029aca
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wtoi]
nop dword [rax + rax]
mov dword [rsp + 0x48], eax
jmp 0x140029b72
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x44]
lea rax, [rsp + 0x48]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, str._lu._lu._lu._lu
lea rcx, [rsp + 0x70]
call fcn.1400025b4
xor r15d, r15d
jmp 0x140029b72
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
lea rdx, str._lu._lu._lu
lea rcx, [rsp + 0x70]
call fcn.1400025b4
jmp 0x140029a7b
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x40]
lea rdx, str._lu._lu
lea rcx, [rsp + 0x70]
call fcn.1400025b4
jmp 0x140029a7b
xor r15d, r15d
lea rcx, [rsp + 0x70]
jmp 0x140029ad7
add ebx, edi
lea rcx, [rax + 2]
mov edx, r14d
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x140029ad1
lea rcx, [rsp + 0x70]
sub ebx, edi
je 0x140029b5c
sub ebx, edi
je 0x140029b3a
cmp ebx, edi
je 0x140029b0e
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wtoi]
nop dword [rax + rax]
mov dword [rsp + 0x40], eax
jmp 0x140029b72
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x44]
lea rax, [rsp + 0x48]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, str._lu__lu__lu__lu
call fcn.1400025b4
jmp 0x140029b72
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
lea rdx, str._lu__lu__lu
call fcn.1400025b4
jmp 0x140029b72
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x40]
lea rdx, str._lu__lu
call fcn.1400025b4
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x44]
mov edx, dword [rsp + 0x4c]
shl eax, 0x10
add ecx, eax
mov eax, dword [rsp + 0x48]
shl eax, 0x10
add edx, eax
mov ebx, ecx
and rbx, 0xffffffffffff0000
movzx eax, cx
or rbx, rax
mov eax, edx
shr rax, 0x10
shl rbx, 0x10
or rbx, rax
movzx eax, dx
shl rbx, 0x10
or rbx, rax
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
cmp r13, rbx
mov edi, r15d
setbe dil
test r12, r12
je 0x140029f71
jmp 0x140029f69
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.1400014a0
mov r12, rax
test rax, rax
je 0x140029f71
mov r8, qword [r14 + 0x50]
mov rdx, rsi
mov rcx, rax
mov dword [rsp + 0x4c], r15d
mov dword [rsp + 0x50], r15d
call fcn.140010dd0
mov edx, 0x3a
mov rcx, r12
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x140029c33
mov word [rax], r15w
add rsi, 2
mov rcx, r12
call fcn.14001eb30
mov r13, rax
test rsi, rsi
je 0x140029c61
lea rdx, [0x14004df48]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x140029f69
xor edx, edx
lea rcx, [rbp - 0x10]
call fcn.14001b20c
mov esi, 0x104
test eax, eax
je 0x140029cb0
lea rcx, [rbp - 0x10]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
nop dword [rax + rax]
lea r8, [0x140049468]
mov edx, esi
lea rcx, [rbp - 0x10]
call fcn.140010d0c
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x140029cb0
test al, 0x10
je 0x140029cfe
mov edx, esi
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x140029f48
lea r8, str.msdxm.ocx
mov rdx, rsi
lea rcx, [rbp - 0x10]
call fcn.140010d0c
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x140029f48
test al, 0x10
jne 0x140029f48
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x4c]
lea rcx, [rbp - 0x10]
call fcn.14001aeb8
test eax, eax
js 0x140029f48
mov edx, dword [rsp + 0x50]
lea r8, str._lu._lu._lu._lu
mov r9d, dword [rsp + 0x4c]
movzx ecx, dx
mov dword [rsp + 0x30], ecx
lea rcx, [rbp - 0x10]
shr edx, 0x10
mov dword [rsp + 0x28], edx
mov edx, 0x103
movzx eax, r9w
shr r9d, 0x10
mov dword [rsp + 0x20], eax
call fcn.140010e44
mov dword [rsp + 0x40], r15d
lea rcx, [rbp - 0x10]
mov dword [rsp + 0x44], r15d
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x4c], r15d
mov r15d, 0x2e
mov edx, r15d
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
je 0x140029e54
add ebx, edi
lea rcx, [rax + 2]
mov edx, r15d
mov esi, ebx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x140029d87
mov r14, qword [rsp + 0x58]
sub esi, edi
je 0x140029e38
sub esi, edi
je 0x140029e12
cmp esi, edi
je 0x140029ddc
xor r15d, r15d
test ebx, ebx
je 0x140029e57
lea rcx, [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wtoi]
nop dword [rax + rax]
mov dword [rsp + 0x48], eax
jmp 0x140029f08
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x44]
lea rax, [rsp + 0x48]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, str._lu._lu._lu._lu
lea rcx, [rbp - 0x10]
call fcn.1400025b4
xor r15d, r15d
jmp 0x140029f08
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
lea rdx, str._lu._lu._lu
lea rcx, [rbp - 0x10]
call fcn.1400025b4
jmp 0x140029e0a
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x40]
lea rdx, str._lu._lu
lea rcx, [rbp - 0x10]
call fcn.1400025b4
jmp 0x140029e0a
xor r15d, r15d
mov r14d, 0x2c
lea rcx, [rbp - 0x10]
jmp 0x140029e69
add ebx, edi
lea rcx, [rax + 2]
mov edx, r14d
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_wcschr]
nop dword [rax + rax]
test rax, rax
jne 0x140029e63
lea rcx, [rbp - 0x10]
sub ebx, edi
je 0x140029eed
sub ebx, edi
je 0x140029ecb
cmp ebx, edi
je 0x140029e9f
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wtoi]
nop dword [rax + rax]
mov dword [rsp + 0x40], eax
jmp 0x140029f03
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x44]
lea rax, [rsp + 0x48]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea rdx, str._lu__lu__lu__lu
call fcn.1400025b4
jmp 0x140029f03
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x44]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
lea rdx, str._lu__lu__lu
call fcn.1400025b4
jmp 0x140029f03
lea r9, [rsp + 0x44]
lea r8, [rsp + 0x40]
lea rdx, str._lu__lu
call fcn.1400025b4
mov r14, qword [rsp + 0x58]
mov eax, dword [rsp + 0x40]
mov ecx, dword [rsp + 0x44]
mov edx, dword [rsp + 0x4c]
shl eax, 0x10
add ecx, eax
mov eax, dword [rsp + 0x48]
shl eax, 0x10
add edx, eax
mov ebx, ecx
and rbx, 0xffffffffffff0000
movzx eax, cx
or rbx, rax
mov eax, edx
shr rax, 0x10
shl rbx, 0x10
or rbx, rax
movzx eax, dx
shl rbx, 0x10
or rbx, rax
cmp rbx, r13
jae 0x140029f69
mov rcx, qword [r14 + 0x78]
mov edi, r15d
test rcx, rcx
je 0x140029f69
mov rcx, qword [rcx + 0x38]
call fcn.14001eb30
cmp rax, r13
setae dil
mov rcx, r12
call fcn.140001454
mov eax, edi
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.1400017f0
lea r11, [rsp + 0x310]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret