Function at 0x140014ba0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x11d0]
mov eax, 0x12d0
call fcn.14013d720
sub rsp, rax
mov rax, qword [0x14024f280]
xor rax, rsp
mov qword [rbp + 0x11c0], rax
mov r15, rcx
cmp dword [rcx + 0xc], 6
jb 0x140014c1d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.BCD00000000
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140014c55
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [r15 + 0x158], 0
mov rcx, qword [rbp + 0x11c0]
xor rcx, rsp
call fcn.14013cd20
lea r11, [rsp + 0x12d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
cmp eax, 5
je 0x140014c1d
cmp eax, 0x20
je 0x140014c1d
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x101
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinPE
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140014c1d
mov byte [r15 + 0x158], 1
mov dword [rsp + 0x38], 0x1000
mov dword [rbp - 0x58], 1
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x58]
xor r8d, r8d
lea rdx, str.InstRoot
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xorps xmm0, xmm0
test ebx, ebx
jne 0x140015008
mov eax, dword [rsp + 0x38]
shr rax, 1
xor r13d, r13d
mov word [rbp + rax*2 + 0x1be], r13w
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
lea rax, [rbp + 0x1c0]
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], r13w
jne 0x140014d20
lea rdx, [rbp + 0x1c0]
lea rcx, [rsp + 0x68]
call fcn.140009260
nop
lea rcx, [rsp + 0x68]
call fcn.140012c90
lea rcx, [rsp + 0x68]
cmp rcx, rax
je 0x140014d6b
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140014d5e
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.140009480
lea rsi, [rsp + 0x68]
mov r8, qword [rsp + 0x68]
cmp qword [rbp - 0x80], 7
cmova rsi, r8
lea rcx, [rsp + 0x68]
cmova rcx, r8
mov rax, qword [rsp + 0x78]
lea r14, [rcx + rax*2]
lea rdi, [rsp + 0x68]
cmova rdi, r8
cmp rdi, r14
je 0x140014db6
sub rsi, rdi
movzx ecx, word [rdi]
call fcn.140154b40
mov word [rsi + rdi], ax
add rdi, 2
cmp rdi, r14
jne 0x140014da1
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
movdqa xmm1, xmmword [0x14022f270]
movdqu xmmword [rsp + 0x58], xmm1
mov word [rsp + 0x48], r13w
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x24]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140014e10
lea rax, [rbp - 0x50]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140014df5
mov r8, rbx
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x48]
call fcn.140009480
lea rdi, [rsp + 0x48]
mov r8, qword [rsp + 0x48]
cmp qword [rsp + 0x60], 7
cmova rdi, r8
lea rcx, [rsp + 0x48]
cmova rcx, r8
mov rax, qword [rsp + 0x58]
lea rsi, [rcx + rax*2]
lea rbx, [rsp + 0x48]
cmova rbx, r8
cmp rbx, rsi
je 0x140014e5c
sub rdi, rbx
movzx ecx, word [rbx]
call fcn.140154b40
mov word [rdi + rbx], ax
add rbx, 2
cmp rbx, rsi
jne 0x140014e47
lea rcx, [rsp + 0x48]
call fcn.140012c90
lea rcx, [rsp + 0x48]
cmp rcx, rax
je 0x140014e8b
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140014e7e
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140009480
lea r11, [rsp + 0x68]
mov rbx, qword [rsp + 0x68]
mov r14, qword [rbp - 0x80]
cmp r14, 7
cmova r11, rbx
lea r12, [rsp + 0x48]
mov rsi, qword [rsp + 0x48]
mov r9, qword [rsp + 0x60]
cmp r9, 7
cmova r12, rsi
mov rdi, qword [rsp + 0x78]
mov rax, qword [rsp + 0x58]
cmp rdi, rax
ja 0x140014f64
sub rax, rdi
test rdi, rdi
je 0x140014f6c
inc rax
lea rax, [r12 + rax*2]
mov qword [rsp + 0x30], rax
mov rcx, r12
movzx r10d, word [r11]
nop word [rax + rax]
sub rax, rcx
sar rax, 1
mov rdx, r13
je 0x140014f17
cmp word [rcx], r10w
je 0x140014f14
cmp rax, 1
je 0x140014f17
dec rax
add rcx, 2
cmp word [rcx], r10w
jne 0x140014f01
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x140014f5f
mov r8, rdi
mov rdx, r11
test rdi, rdi
je 0x140014f44
mov r9, rcx
sub r9, r11
movzx eax, word [r9 + rdx]
cmp ax, word [rdx]
jne 0x140014f54
add rdx, 2
sub r8, 1
jne 0x140014f30
sub rcx, r12
mov r9, qword [rsp + 0x60]
cmp rcx, 2
jb 0x140014f6c
jmp 0x140014f64
add rcx, 2
mov rax, qword [rsp + 0x30]
jmp 0x140014ef0
mov r9, qword [rsp + 0x60]
mov byte [r15 + 0x158], 0
cmp r9, 7
jbe 0x140014fb0
lea rdx, [r9*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140014f9f
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015166
mov rcx, rsi
call fcn.14013cd40
mov r14, qword [rbp - 0x80]
mov rbx, qword [rsp + 0x68]
movdqa xmm0, xmmword [0x14022f270]
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], r13w
cmp r14, 7
jbe 0x140014c25
lea rdx, [r14*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140014ffb
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001515a
mov rcx, rbx
call fcn.14013cd40
jmp 0x140014c25
movups xmmword [rbp - 0x78], xmm0
movdqa xmm1, xmmword [0x14022f270]
movdqu xmmword [rbp - 0x68], xmm1
xor r13d, r13d
mov word [rbp - 0x78], r13w
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r13 + 0x24]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14001506a
lea rax, [rbp - 0x50]
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140015050
mov r8, rbx
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x78]
call fcn.140009480
lea rdi, [rbp - 0x78]
mov r8, qword [rbp - 0x78]
cmp qword [rbp - 0x60], 7
cmova rdi, r8
lea rcx, [rbp - 0x78]
cmova rcx, r8
mov rax, qword [rbp - 0x68]
lea rsi, [rcx + rax*2]
lea rbx, [rbp - 0x78]
cmova rbx, r8
cmp rbx, rsi
je 0x1400150b5
sub rdi, rbx
nop dword [rax + rax]
movzx ecx, word [rbx]
call fcn.140154b40
mov word [rbx + rdi], ax
add rbx, 2
cmp rbx, rsi
jne 0x1400150a0
lea rcx, [rbp - 0x78]
call fcn.140012c90
lea rcx, [rbp - 0x78]
cmp rcx, rax
je 0x1400150e1
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x1400150d5
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.140009480
lea rcx, [rbp - 0x78]
mov rbx, qword [rbp - 0x78]
mov rdi, qword [rbp - 0x60]
cmp rdi, 7
cmova rcx, rbx
mov qword [rsp + 0x20], 2
lea r9, [0x14021d8dc]
xor r8d, r8d
mov rdx, qword [rbp - 0x68]
call fcn.14000bb70
test rax, rax
je 0x14001511e
mov byte [r15 + 0x158], 0
cmp rdi, 7
jbe 0x140014c25
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140014ffb
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140015160
jmp 0x140014ffb
call fcn.14014c4cc
int3
call fcn.14014c4cc
nop
call fcn.14014c4cc
int3