Function at 0x1800236a0
Capabilities:
Get common file path
Get file size
Query or enumerate registry value
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x300]
sub rsp, 0x400
movaps xmmword [rsp + 0x3f0], xmm6
mov rax, qword [0x1800a74e0]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
imul eax, edx, 0x56a
mov r12, r9
mov r13, r8
mov dword [rsp + 0x7c], edx
mov qword [rbp - 0x38], rcx
mov esi, edx
mov dword [rbp - 0x80], eax
cmp edx, eax
ja case.0x180023bac.0
movsd xmm6, qword [0x18009f348]
lea rdx, [0x180000000]
movzx r14d, byte [rsp + 0x40]
xor ebx, ebx
mov r15, qword [rbp - 0x70]
lea r8d, [rbx + 0x6b]
nop dword [rax + rax]
cmp esi, 0x5724
ja 0x180023ac1
je case.0x180023bac.0
cmp esi, 0x11f
ja 0x180023876
je 0x18002384c
mov eax, esi
sub eax, 0x10
je 0x1800237e9
sub eax, 5
je 0x1800237d3
sub eax, 0xab
je 0x180023793
cmp eax, 0x5e
jne 0x180023e1e
mov r8, r13
mov rax, r12
sub r8, r12
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180023783
inc rax
test ecx, ecx
jne 0x180023770
mov eax, ebx
test edx, edx
sete al
mov dword [rsp + 0x48], eax
jmp 0x180023e11
cmp qword [r12 + 0x18], 8
mov rcx, r12
jb 0x1800237a2
mov rcx, qword [r12]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x80
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x58], rax
jmp 0x180023e11
mov eax, dword [r13]
cmp dword [r12], eax
cmovb eax, dword [r12]
mov dword [rsp + 0x48], eax
jmp 0x180023e1e
lea rcx, [r12 + 0x48]
mov edx, 0xf5
call fcn.18007ba00
lea r8, [r12 + 8]
mov edx, 4
xor ecx, ecx
call fcn.18002bc70
test al, al
jne 0x180023e11
mov byte [rsp + 0x48], bl
mov rax, qword [rsp + 0x48]
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.1800864a0
mov rbx, qword [rsp + 0x448]
movaps xmm6, xmmword [rsp + 0x3f0]
add rsp, 0x400
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [r12]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbp - 0x70], rax
test rax, rax
je 0x180023e33
mov r8, qword [r12]
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
jmp 0x180023e11
cmp esi, 0x4e0
je 0x180023a90
cmp esi, 0x666
je case.0x180023bac.0
cmp esi, 0x9b0
je case.0x180023bac.0
cmp esi, 0x3a80
jne 0x180023e1e
cmp qword [rsp + 0x58], 0xffffffffffffffff
jne 0x180023e1e
mov edi, 0x16
nop
cmp edi, 0x3e5
ja 0x1800239d3
je 0x1800239c6
cmp edi, 0x16
je 0x180023981
cmp edi, 0xd9
je 0x18002393a
cmp edi, 0x19c
je 0x18002392f
cmp edi, 0x25f
je 0x180023923
cmp edi, 0x322
jne 0x180023a79
xorps xmm0, xmm0
mov dword [rsp + 0x64], 0x36
xor eax, eax
mov qword [rbp - 0x60], rbx
movups xmmword [rbp + 0x20], xmm0
mov dword [rbp + 0x80], eax
movups xmmword [rbp + 0x30], xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
jmp 0x180023a79
mov r14b, 1
mov qword [rbp - 0x58], rbx
jmp 0x180023a79
mov byte [rbp + 0x9a], bl
jmp 0x180023a79
movzx eax, word [0x18009e129]
lea rdx, [0x18009e168]
mov word [rbp + 0x95], ax
lea rcx, [rbp + 0x90]
movzx eax, byte [0x18009e12b]
mov r8d, 1
mov byte [rbp + 0x97], al
mov byte [rbp + 0x98], bl
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov byte [rbp + 0x99], PathMakeUniqueName
jmp 0x180023a79
mov r8d, 3
lea rdx, [0x18009e1e0]
lea rcx, [rbp + 0x90]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r8d, 2
mov byte [rbp + 0x93], bl
lea rdx, str.p__HasFlag_wxPG_PROP_AGGREGATE_
lea rcx, [rbp + 0x93]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x95], bl
jmp 0x180023a79
mov dword [rsp + 0x68], ebx
mov dword [rsp + 0x60], ebx
jmp 0x180023a79
cmp edi, 0x4a8
je 0x180023a60
cmp edi, 0x56b
je 0x180023a2b
cmp edi, 0x62e
je 0x1800239fd
cmp edi, 0x6f1
je case.0x180023bac.0
jmp 0x180023a79
mov r9d, dword [rsp + 0x60]
lea rax, [rbp + 0xd0]
mov r8, qword [rbp - 0x60]
mov edx, dword [rsp + 0x64]
mov rcx, qword [rbp - 0x58]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathAndSubDirA]
mov byte [rsp + 0x48], bl
jmp 0x180023a79
test r15, r15
movzx eax, r14b
mov ecx, ebx
cmovne ecx, eax
movzx r14d, cl
test cl, cl
je 0x180023a79
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.WINMM.dll_mmioSendMessage]
mov edx, ILClone
mov rcx, r15
call qword [sym.imp.WINMM.dll_mmioClose]
jmp 0x180023a79
mov r8d, dword [rsp + 0x68]
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x90]
call qword [sym.imp.WINMM.dll_mmioOpenA]
mov r15, rax
add edi, 0xc3
cmp edi, 0x7b4
jb 0x1800238b0
jmp 0x180023e11
mov edx, 0xdd
xor ecx, ecx
call fcn.18001f330
mov eax, eax
xorps xmm0, xmm0
movaps xmm1, xmm6
mov byte [rsp + 0x48], 1
cvtsi2sd xmm0, rax
divsd xmm1, xmm0
movsd qword [r12 + 0x110], xmm1
jmp 0x180023e11
cmp esi, 0x12180
ja 0x180023b5f
je 0x180023b23
cmp esi, 0x5772
je 0x180023e66
cmp esi, 0x7440
je 0x180023b16
cmp esi, 0xae00
je 0x180023b0d
cmp esi, 0xe7c0
jne 0x180023e1e
mov rcx, qword [rsp + 0x58]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x50], eax
jmp 0x180023e11
mov dword [rsp + 0x78], ebx
jmp 0x180023e1e
mov qword [rbp - 0x48], rbx
mov dword [rsp + 0x54], ebx
jmp 0x180023e1e
mov edi, dword [rsp + 0x50]
xor r8d, r8d
mov edx, edi
mov rcx, r13
call fcn.1800609c0
cmp qword [r13 + 0x18], 0x10
mov rdx, r13
jb 0x180023b42
mov rdx, qword [r13]
mov rcx, qword [rsp + 0x58]
lea r9, [rsp + 0x54]
mov r8d, edi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x180023e11
cmp esi, 0x15b40
je 0x180023dea
cmp esi, 0x19500
je 0x180023b84
cmp esi, 0x1cec0
je case.0x180023bac.0
jmp 0x180023e1e
mov eax, dword [rsp + 0x50]
cmp eax, dword [rsp + 0x54]
je 0x180023dc8
mov edi, 0xb
cmp edi, 0xb
ja case.default.0x180023bac
mov eax, edi
mov ecx, dword [rdx + rax*4 + 0x23e70]
add rcx, rdx
jmp rcx
mov r8d, 3
mov word [rbp + 0xd0], bx
lea rdx, [0x18009df38]
lea rcx, [rbp + 0xd0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat]
lea rdx, [0x180000000]
mov r8d, 0x6b
jmp case.default.0x180023bac
lea r8, [rbp + 0xa0]
mov dword [rsp + 0x70], 0x104
xor edx, edx
mov ecx, 0x1f0003
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov qword [rbp - 0x78], rax
lea rdx, [0x180000000]
mov r8d, 0x6b
jmp case.default.0x180023bac
movsd xmm0, qword [0x18009e014]
movzx eax, word [0x18009e01c]
movsd qword [rbp + 0xda], xmm0
mov word [rbp + 0xe2], ax
mov dword [rbp + 0xd6], 0x200033
mov word [rbp + 0xe4], bx
jmp case.default.0x180023bac
mov r8d, 5
lea rdx, [0x18009e04e]
lea rcx, [rbp + 0xe4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
lea rdx, [0x180000000]
mov word [rbp + 0xee], bx
mov r8d, 0x6b
jmp case.default.0x180023bac
mov word [rbp + 0xbc], r8w
mov dword [rbp + 0xbe], 0x7a
jmp case.default.0x180023bac
mov r8d, 1
lea rdx, [0x18009e0c0]
lea rcx, [rbp + 0xee]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
lea rdx, [0x180000000]
mov r8d, 0x6b
jmp case.default.0x180023bac
movzx eax, byte [rsp + 0x40]
mov ecx, ebx
cmp qword [rbp - 0x78], rcx
mov dword [rsp + 0x6c], ebx
cmovne ecx, eax
mov byte [rsp + 0x40], cl
jmp case.default.0x180023bac
mov qword [r13 + 0x10], rbx
mov rax, r13
cmp qword [r13 + 0x18], 0x10
mov dword [rsp + 0x74], ebx
jb 0x180023cee
mov rax, qword [r13]
mov byte [rax], bl
jmp case.default.0x180023bac
mov qword [rbp - 0x50], 0xffffffff80000001
mov byte [rsp + 0x40], 1
jmp case.default.0x180023bac
mov edx, dword [rsp + 0x74]
lea rax, [rsp + 0x6c]
mov rcx, qword [rbp - 0x50]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x30], rax
lea r8, [rbp + 0xd0]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHLWAPI.dll_SHEnumValueW]
cmp byte [rsp + 0x40], bl
je 0x180023d49
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rsp + 0x48], bl
lea rdx, [0x180000000]
mov r8d, 0x6b
jmp case.default.0x180023bac
mov eax, dword [0x18009e0c4]
movsd xmm0, qword [str.OMPRES]
mov dword [rbp + 0xa0], eax
mov eax, dword [0x18009e0d8]
mov dword [rbp + 0xac], eax
mov eax, dword [0x18009e0e8]
mov dword [rbp + 0xb8], eax
movzx eax, word [0x18009e0ec]
movsd qword [rbp + 0xa4], xmm0
movsd xmm0, qword [str.SPDZrr]
mov word [rbp + 0xbc], ax
mov word [rbp + 0xf0], bx
movsd qword [rbp + 0xb0], xmm0
dec edi
lea eax, [rdi + 0xea]
cmp eax, 0xe9
ja 0x180023b97
lea rcx, [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_AllocateLocallyUniqueId]
mov edx, dword [rsp + 0x78]
lea r8, [rbp - 0x30]
mov rcx, qword [rbp - 0x48]
call sub.IMM32.dll_ImmGetRegisterWordStyleW
mov byte [rsp + 0x48], 1
jmp 0x180023e11
mov rcx, qword [rsp + 0x58]
mov qword [rbp - 0x40], rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x30], xmm0
mov dword [rbp + 0x10], eax
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
mov r8d, 0x6b
lea rdx, [0x180000000]
imul eax, dword [rsp + 0x7c], 0x4d
add esi, eax
cmp esi, dword [rbp - 0x80]
jbe 0x180023720
jmp case.0x180023bac.0
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9d, dword [r13]
lea rdx, str.PrinterChanged:_Id_i_Name_s_NewName_s.
mov r8d, dword [r12]
mov rcx, rax
mov rax, qword [rbp - 0x38]
mov qword [rsp + 0x20], rax
call fcn.180085950
mov rax, rbx
jmp 0x18002381a
mov rax, qword [rbp - 0x70]
jmp 0x18002381a