Function at 0x1400a6d70
Capabilities:
Check if file exists
Get disk information
Query or enumerate registry value

Disassembly:
push rbx
push rbp
sub rsp, 0x58
mov rax, qword [0x1403a8088]
xor rax, rsp
mov qword [rsp + 0x48], rax
movabs rax, 0x5c003a0058
mov word [str.X:windows_system32_ntdll.dll], dx
mov qword [rsp + 0x40], rax
movzx ebx, dx
mov rax, qword [0x140443d80]
mov rbp, rcx
mov word [str.X:windows_system32winload.exe], dx
mov word [str.X:windows_system32winload.EFI], dx
mov word [str.X:windows_system32_ntoskrnl.exe], dx
mov word [rsp + 0x40], dx
cmp dx, word [rax + 0x30]
je 0x1400a70ae
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x1400a70ae
lea rcx, str.X:windows_system32configSYSTEM
mov word [str.X:windows_system32configSYSTEM], bx
mov word [str.X:windows_system32configSOFTWARE], bx
mov word [str.X:windows_system32configDEFAULT], bx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400a70ae
lea rcx, str.X:windows_system32configSOFTWARE
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400a70ae
lea rcx, str.X:windows_system32configDEFAULT
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400a70ae
lea rcx, str.X:windows_system32_ntdll.dll
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400a70ae
lea rcx, str.X:windows_system32winload.exe
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400a70ae
lea rcx, str.X:windows_system32winload.EFI
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400a70ae
lea rcx, str.X:windows_system32_ntoskrnl.exe
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400a70ae
lea rdx, [0x140338f88]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rdx, [0x140338f70]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rdx, [0x140338f58]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea r8, str.X:windows_system32configSYSTEM
mov rcx, 0xffffffff80000002
lea rdx, [0x140338ff0]
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
test eax, eax
jne 0x1400a70ae
lea r8, str.X:windows_system32configSOFTWARE
mov rcx, 0xffffffff80000002
lea rdx, [0x140338fd8]
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
test eax, eax
jne 0x1400a70ae
lea r8, str.X:windows_system32configDEFAULT
mov rcx, 0xffffffff80000002
lea rdx, [0x140338fc0]
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
test eax, eax
jne 0x1400a70ae
mov qword [rsp + 0x80], rsi
lea rax, [rsp + 0x38]
xor esi, esi
mov qword [rsp + 0x50], rdi
lea rdx, str.PESOFTWAREMicrosoftWindows_NTCurrentVersion
mov qword [rsp + 0x38], rsi
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x30], esi
mov edi, esi
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 1]
lea r8d, [rsi + 4]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400a701b
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400a7030
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
lea rdx, [0x140338fa8]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400a701b
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400a701b
add eax, 4
mov ecx, eax
mov dword [rsp + 0x30], eax
call fcn.14012a2dc
mov rdi, rax
test rax, rax
je 0x1400a701b
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov rcx, rax
call fcn.14027b2c0
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [0x14044b740]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, [0x140338fa8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400a7010
cmp dword [rsp + 0x30], esi
ja 0x1400a701b
mov rcx, rdi
call fcn.14012a2d4
mov rdi, rsi
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400a7030
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], rsi
lea rdx, str.PESYSTEM
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rdx, str.PESOFTWARE
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rdx, str.PEDEFAULT
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
movzx ecx, bx
call fcn.14004f590
mov esi, eax
test eax, eax
js 0x1400a70a1
mov ecx, eax
call fcn.14004f310
test rax, rax
jle 0x1400a70a1
mov r8, rax
mov edx, esi
mov rcx, rbp
call fcn.1400a6820
mov r8, rdi
movzx edx, bx
mov rcx, rbp
call fcn.1400a6a70
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14012a2b0
add rsp, 0x58
pop rbp
pop rbx
ret