Function at 0x180002680
Capabilities:
Get hostname
Parse pe header
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x9a0]
sub rsp, 0xaa0
mov rax, qword [0x18002b040]
xor rax, rsp
mov qword [rbp + 0x990], rax
mov rdi, rdx
mov r14, rcx
mov qword [rsp + 0x38], rcx
mov qword [rdx + 0xc], 1
xor esi, esi
lea r13, [rdx + 0x14]
mov dword [r13], esi
lea r12, [rdx + 0x18]
mov dword [r12], esi
mov dword [rdx + 0x1c], esi
lea rcx, [rdx + 0x20]
lea rdx, [0x18001a420]
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18000280f
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18000280f
movsxd rbx, dword [rax + 0x3c]
cmp dword [rbx + rax], 0x4550
jne 0x18000280f
movzx ebx, word [rbx + rax + 0x18]
mov dword [rsp + 0x50], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov ecx, 0x20b
mov eax, dword [rsp + 0x50]
cmp bx, cx
je 0x18000274b
test eax, eax
mov r15d, esi
je 0x180002751
mov r15d, 1
test r13, r13
je 0x18000275a
mov dword [r13], r15d
test r12, r12
je 0x180002763
mov dword [r12], eax
mov dword [rbp + 0x190], ATL::CStringT<wchar_t,StrTraitMFC_DLL<wchar_t,ATL::ChTraitsCRT<wchar_t>
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp byte [rbp + 0x2aa], 1
setne sil
mov ebx, dword [rbp + 0x194]
shl ebx, 8
or ebx, dword [rbp + 0x198]
cmp ebx, 0x602
jb 0x1800027f0
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r14, rax
test rax, rax
je 0x1800027eb
lea rdx, str.RtlGetNtVersionNumbers
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800027e2
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x44]
lea rcx, [rsp + 0x40]
call rax
mov ebx, dword [rsp + 0x40]
shl ebx, 8
or ebx, dword [rsp + 0x44]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r14, qword [rsp + 0x38]
test esi, esi
je 0x180002800
cmp ebx, 0x600
jb 0x180002800
bts ebx, 0x14
mov eax, ebx
bts eax, 0x10
test r15d, r15d
cmove eax, ebx
mov dword [rdi + 0x10], eax
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x80]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x60], operator
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x180002849
lea rcx, [rdi + 0x38]
lea rdx, [rbp - 0x80]
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.acdb25.dll_class_AcLocale___cdecl_acrxProductLocale_void_]
nop
mov rcx, rax
call qword [sym.imp.AcPal.dll_public:_int___cdecl_AcLocale::operator_int_void____ptr64]
mov ebx, eax
lea rcx, [rsp + 0x38]
call qword [sym.imp.AcPal.dll_public:_void___cdecl_AcLocale::destructor_void____ptr64]
movzx eax, bl
lea rcx, [rsp + 0x58]
cmp eax, 4
je 0x1800028b4
cmp eax, 9
je 0x18000289e
lea rdx, [0x18001a440]
jmp 0x1800028bb
lea rdx, [0x18001a438]
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
mov dword [rdi + 0x1c], 1
jmp 0x1800028c1
lea rdx, [0x18001a430]
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_Ordinal_296]
nop
call qword [sym.imp.acdb25.dll_class_AcDbHostApplicationServices____ptr64___cdecl_acdbHostApplicationServices_void_]
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x180]
mov rdx, rax
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
xor r8d, r8d
lea rdx, [0x18001a448]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
lea ebx, [rax + 1]
test eax, eax
js 0x180002954
mov r8d, ebx
lea rdx, [0x18001a2f4]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
jle 0x180002954
sub eax, ebx
mov r9d, eax
mov r8d, ebx
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMouseManager::LoadState]
nop
lea rcx, [rdi + 0x28]
mov rdx, rax
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea r8, [rsp + 0x68]
mov rdx, qword [rsp + 0x48]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x180002ad6
mov dword [rsp + 0x44], 0x400
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x190]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [0x18001a450]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180002ac3
cmp dword [rsp + 0x40], 1
jne 0x180002ac3
lea rdx, [rbp + 0x190]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
mov r8d, 7
lea rdx, str.AutoCAD
lea rcx, [rbp + 0x190]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x180002a14
lea r8d, [rax + 7]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::LoadState]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
jmp 0x180002a56
mov r8d, 5
lea rdx, [0x18001a478]
lea rcx, [rbp + 0x190]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x180002a61
lea r8d, [rax + 5]
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCToolBar::LoadState]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CFileDialog::SetTemplate]
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
xor r8d, r8d
lea rdx, [0x18001a484]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CDocObjectServer::XOleObject::EnumAdvise]
test eax, eax
jle 0x180002ad6
mov r8d, eax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CStringList::InsertBefore]
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_Ordinal_1501]
nop
lea rcx, [rsp + 0x38]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
jmp 0x180002ad6
lea rdx, [0x18001a488]
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCControlRendererInfo::CMFCControlRendererInfo]
nop
lea rcx, [rsp + 0x48]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [0x18001a49c]
lea rdx, [0x18001a2f0]
cmp dword [r12], 0
cmovne rdx, rax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__3]
nop
mov ecx, 0x40
mov r9d, 0x20
mov eax, dword [r13]
cmp dword [r12], eax
cmovne r9d, ecx
lea rcx, [rdi + 0x30]
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r8, qword [rsp + 0x70]
lea rdx, [0x18001a4a0]
call qword [sym.imp.mfc140u.dll_CMFCZoomKernel::Filter]
lea rcx, [rdi + 4]
mov rdx, rdi
call fcn.180003100
mov dword [r14 + 0x20], eax
lea rcx, [rsp + 0x70]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x30]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
nop
lea rcx, [rsp + 0x58]
call qword [sym.imp.mfc140u.dll_CMFCRibbonInfo::XElementButtonGallery::XGalleryGroup::XGalleryGroup]
mov rcx, qword [rbp + 0x990]
xor rcx, rsp
call fcn.1800151d0
mov rbx, qword [rsp + 0xaf0]
add rsp, 0xaa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret