Function at 0x140002100
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 0x19e8
call fcn.1400364d0
sub rsp, rax
mov qword [rsp + 0x1878], 0xfffffffffffffffe
mov rax, qword [0x1400472d0]
xor rax, rsp
mov qword [rsp + 0x19d8], rax
lea rax, [rsp + 0x298]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARECanonCBTSETUP
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400025b9
mov dword [rsp + 0x290], 0x114
lea rax, [rsp + 0x290]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3c0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x160]
xor r8d, r8d
lea rdx, str.Path
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x164], eax
cmp dword [rsp + 0x164], 0
jne 0x14000227d
lea rdx, [rsp + 0x3c0]
lea rcx, [rsp + 0xbc8]
call fcn.140007fb0
mov qword [rsp + 0x1880], rax
mov rax, qword [rsp + 0x1880]
mov qword [rsp + 0x1098], rax
mov rcx, qword [rsp + 0x19f0]
add rcx, 0x80
mov r9, qword [0x14003a848]
xor r8d, r8d
mov rdx, qword [rsp + 0x1098]
call fcn.1400091c0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xbc8]
call fcn.1400099b0
mov r8, qword [rsp + 0x19f0]
add r8, 0x80
lea rdx, str.__CBT_installation_path:
lea rcx, [rsp + 0xbf0]
call fcn.14000dd40
mov qword [rsp + 0x1888], rax
mov rax, qword [rsp + 0x1888]
mov qword [rsp + 0x1890], rax
mov rcx, qword [rsp + 0x1890]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xbf0]
call fcn.1400099b0
mov dword [rsp + 0x290], 0x114
lea rax, [rsp + 0x290]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x170]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x160]
xor r8d, r8d
lea rdx, str.Dependent_files
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x164], eax
cmp dword [rsp + 0x164], 0
jne 0x1400025ab
lea rax, [rsp + 0x170]
mov qword [rsp + 0x760], rax
mov eax, dword [rsp + 0x290]
mov qword [rsp + 0x768], rax
cmp qword [rsp + 0x768], 0
jbe 0x1400025ab
lea rax, [rsp + 0x10a0]
mov qword [rsp + 0x10a8], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xc20]
call fcn.1400099b0
mov rcx, qword [rsp + 0x760]
call fcn.140018050
mov qword [rsp + 0x10b0], rax
mov r8, qword [rsp + 0x10b0]
mov rdx, qword [rsp + 0x760]
lea rcx, [rsp + 0xc20]
call fcn.14000aae0
lea rax, [rsp + 0xc20]
mov qword [rsp + 0x10b8], rax
mov rax, qword [rsp + 0x10b8]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x10c0], rax
cmp qword [rsp + 0x10c0], 0
jne 0x140002395
mov dword [rsp + 0x1898], 1
jmp 0x1400023a0
mov dword [rsp + 0x1898], 0
movzx eax, byte [rsp + 0x1898]
mov byte [rsp + 0xc18], al
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xc20]
call fcn.1400099b0
movzx eax, byte [rsp + 0xc18]
test eax, eax
je 0x1400023d2
jmp 0x1400025ab
lea rax, [rsp + 0x10c8]
mov qword [rsp + 0x10d0], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xc48]
call fcn.1400099b0
mov rcx, qword [rsp + 0x760]
call fcn.140018050
mov qword [rsp + 0x10d8], rax
mov r8, qword [rsp + 0x10d8]
mov rdx, qword [rsp + 0x760]
lea rcx, [rsp + 0xc48]
call fcn.14000aae0
nop
mov rcx, qword [rsp + 0x19f0]
add rcx, 0xd0
lea rdx, [rsp + 0xc48]
call fcn.140008630
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xc48]
call fcn.1400099b0
lea rax, [rsp + 0x1130]
mov qword [rsp + 0x1138], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xc70]
call fcn.1400099b0
mov rcx, qword [rsp + 0x760]
call fcn.140018050
mov qword [rsp + 0x1140], rax
mov r8, qword [rsp + 0x1140]
mov rdx, qword [rsp + 0x760]
lea rcx, [rsp + 0xc70]
call fcn.14000aae0
lea rax, [rsp + 0xc70]
mov qword [rsp + 0x1148], rax
mov rax, qword [rsp + 0x1148]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x1150], rax
mov rcx, qword [rsp + 0x1150]
mov rax, qword [rsp + 0x768]
sub rax, rcx
sub rax, 1
mov qword [rsp + 0x768], rax
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xc70]
call fcn.1400099b0
lea rax, [rsp + 0x1158]
mov qword [rsp + 0x1160], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xc98]
call fcn.1400099b0
mov rcx, qword [rsp + 0x760]
call fcn.140018050
mov qword [rsp + 0x1168], rax
mov r8, qword [rsp + 0x1168]
mov rdx, qword [rsp + 0x760]
lea rcx, [rsp + 0xc98]
call fcn.14000aae0
lea rax, [rsp + 0xc98]
mov qword [rsp + 0x1170], rax
mov rax, qword [rsp + 0x1170]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x1178], rax
mov rcx, qword [rsp + 0x760]
mov rax, qword [rsp + 0x1178]
lea rax, [rcx + rax + 1]
mov qword [rsp + 0x760], rax
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xc98]
call fcn.1400099b0
jmp 0x1400022f6
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x298]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARECanonCBTSETUPCBTUser
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400026d7
mov dword [rsp + 0x4e0], 0
jmp 0x140002609
mov eax, dword [rsp + 0x4e0]
add eax, 1
mov dword [rsp + 0x4e0], eax
xor eax, eax
cmp eax, 1
je 0x1400026d7
mov dword [rsp + 0x290], 0x104
mov dword [rsp + 0x3b0], 0x104
lea rax, [rsp + 0x3b0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x160]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x290]
lea r8, [rsp + 0x50]
mov edx, dword [rsp + 0x4e0]
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [rsp + 0x164], eax
cmp dword [rsp + 0x164], 0
jne 0x140002696
movsx eax, byte [rsp + 0x50]
test eax, eax
jne 0x140002698
jmp 0x1400026d7
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xcc0]
call fcn.140007fb0
nop
lea rdx, [rsp + 0xcc0]
lea rcx, [0x140058c00]
call fcn.140008630
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xcc0]
call fcn.1400099b0
jmp 0x1400025f8
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsp + 0x19f0]
cmp qword [rax + 0x98], 0
jne 0x140002704
mov dword [rsp + 0x189c], 1
jmp 0x14000270f
mov dword [rsp + 0x189c], 0
movzx eax, byte [rsp + 0x189c]
test eax, eax
je 0x1400027f3
mov edx, 0x400
lea rcx, [rsp + 0x770]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rdx, [rsp + 0x770]
lea rcx, [rsp + 0xce8]
call fcn.140007fb0
mov qword [rsp + 0x18a0], rax
mov rax, qword [rsp + 0x18a0]
mov qword [rsp + 0x1208], rax
mov rcx, qword [rsp + 0x19f0]
add rcx, 0x80
mov r9, qword [0x14003a848]
xor r8d, r8d
mov rdx, qword [rsp + 0x1208]
call fcn.1400091c0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xce8]
call fcn.1400099b0
mov r8, qword [rsp + 0x19f0]
add r8, 0x80
lea rdx, str.__CBT_installation_path:
lea rcx, [rsp + 0xd10]
call fcn.14000dd40
mov qword [rsp + 0x18a8], rax
mov rax, qword [rsp + 0x18a8]
mov qword [rsp + 0x18b0], rax
mov rcx, qword [rsp + 0x18b0]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xd10]
call fcn.1400099b0
mov rax, qword [rsp + 0x19f0]
add rax, 0xd0
mov qword [rsp + 0x1210], rax
mov rax, qword [rsp + 0x1210]
mov rcx, qword [rsp + 0x1210]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rax + 0x20]
sub rax, rcx
cqo
mov ecx, 0x28
idiv rcx
test rax, rax
jne 0x140002840
mov dword [rsp + 0x18b8], 1
jmp 0x14000284b
mov dword [rsp + 0x18b8], 0
movzx eax, byte [rsp + 0x18b8]
test eax, eax
je 0x140002bb1
lea rdx, str.NBCBT95.dll_NBPORT95.exe_NBLOCALT.dll_NBPORTNT.exe_NBCBTNT.dll_NBCBTSPT.dat_AUPORT.exe
lea rcx, [rsp + 0xb70]
call fcn.140007fb0
nop
lea rax, [rsp + 0x1230]
mov qword [rsp + 0x1238], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xb98]
call fcn.1400099b0
nop
xor eax, eax
cmp eax, 1
je 0x140002b8c
lea rcx, [0x14003aa5c]
call fcn.140018050
mov qword [rsp + 0x1240], rax
mov r9, qword [rsp + 0x1240]
xor r8d, r8d
lea rdx, [0x14003aa5c]
lea rcx, [rsp + 0xb70]
call fcn.1400095e0
mov qword [rsp + 0xbc0], rax
mov rax, qword [0x14003a848]
cmp qword [rsp + 0xbc0], rax
jne 0x14000290e
mov r9, qword [0x14003a848]
xor r8d, r8d
lea rdx, [rsp + 0xb70]
lea rcx, [rsp + 0xb98]
call fcn.1400091c0
jmp 0x140002a0e
cmp qword [rsp + 0xbc0], 0
jbe 0x140002988
mov r9, qword [rsp + 0xbc0]
xor r8d, r8d
lea rdx, [rsp + 0xd38]
lea rcx, [rsp + 0xb70]
call fcn.1400081c0
mov qword [rsp + 0x18c0], rax
mov rax, qword [rsp + 0x18c0]
mov qword [rsp + 0x1248], rax
mov r9, qword [0x14003a848]
xor r8d, r8d
mov rdx, qword [rsp + 0x1248]
lea rcx, [rsp + 0xb98]
call fcn.1400091c0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xd38]
call fcn.1400099b0
jmp 0x140002a0e
mov rax, qword [rsp + 0xb88]
mov qword [rsp + 0x1250], rax
mov r9, qword [rsp + 0x1250]
sub r9, 1
mov r8d, 1
lea rdx, [rsp + 0xd60]
lea rcx, [rsp + 0xb70]
call fcn.1400081c0
mov qword [rsp + 0x18c8], rax
mov rax, qword [rsp + 0x18c8]
mov qword [rsp + 0x1258], rax
mov r9, qword [0x14003a848]
xor r8d, r8d
mov rdx, qword [rsp + 0x1258]
lea rcx, [rsp + 0xb70]
call fcn.1400091c0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xd60]
call fcn.1400099b0
jmp 0x140002893
cmp qword [rsp + 0xbb0], 0
jne 0x140002a26
mov dword [rsp + 0x18d0], 1
jmp 0x140002a31
mov dword [rsp + 0x18d0], 0
movzx eax, byte [rsp + 0x18d0]
test eax, eax
jne 0x140002a80
lea rcx, [0x14003aa5c]
call fcn.140018050
mov qword [rsp + 0x1260], rax
mov rax, qword [rsp + 0x1260]
mov qword [rsp + 0x20], rax
lea r9, [0x14003aa5c]
mov r8, qword [rsp + 0xbb0]
xor edx, edx
lea rcx, [rsp + 0xb98]
call fcn.140009870
test eax, eax
jne 0x140002a85
jmp 0x140002b8c
lea rdx, [rsp + 0xb98]
lea rcx, [0x140058bd0]
call fcn.140008630
mov rax, qword [rsp + 0xbb0]
mov qword [rsp + 0x12c8], rax
cmp qword [rsp + 0xbb8], 0x10
jb 0x140002ac6
mov rax, qword [rsp + 0xba0]
mov qword [rsp + 0x18d8], rax
jmp 0x140002ad6
lea rax, [rsp + 0xba0]
mov qword [rsp + 0x18d8], rax
mov r9, qword [rsp + 0x12c8]
xor r8d, r8d
mov rdx, qword [rsp + 0x18d8]
lea rcx, [rsp + 0xb70]
call fcn.1400095e0
mov qword [rsp + 0x12d0], rax
mov rax, qword [rsp + 0xbb0]
mov qword [rsp + 0x12d8], rax
mov rax, qword [rsp + 0x12d8]
mov r8, qword [rsp + 0x12d0]
add r8, rax
mov r9, qword [0x14003a848]
lea rdx, [rsp + 0xd88]
lea rcx, [rsp + 0xb70]
call fcn.1400081c0
mov qword [rsp + 0x18e0], rax
mov rax, qword [rsp + 0x18e0]
mov qword [rsp + 0x12e0], rax
mov r9, qword [0x14003a848]
xor r8d, r8d
mov rdx, qword [rsp + 0x12e0]
lea rcx, [rsp + 0xb70]
call fcn.1400091c0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xd88]
call fcn.1400099b0
jmp 0x140002893
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xb98]
call fcn.1400099b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xb70]
call fcn.1400099b0
lea rax, [rsp + 0x298]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARECanonDIASSETUP
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140002fc4
mov dword [rsp + 0x290], 0x114
lea rax, [rsp + 0x290]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x610]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x160]
xor r8d, r8d
lea rdx, str.Path
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x164], eax
cmp dword [rsp + 0x164], 0
jne 0x140002d86
lea rdx, [rsp + 0x610]
lea rcx, [rsp + 0xdb0]
call fcn.140007fb0
mov qword [rsp + 0x18e8], rax
mov rax, qword [rsp + 0x18e8]
mov qword [rsp + 0x18f0], rax
lea r8, [0x14003a89c]
mov rdx, qword [rsp + 0x18f0]
lea rcx, [rsp + 0xdd8]
call fcn.14000de50
mov qword [rsp + 0x18f8], rax
mov rax, qword [rsp + 0x18f8]
mov qword [rsp + 0x1900], rax
lea r8, str.CnxDias.exe
mov rdx, qword [rsp + 0x1900]
lea rcx, [rsp + 0xe00]
call fcn.14000de50
mov qword [rsp + 0x1908], rax
mov rax, qword [rsp + 0x1908]
mov qword [rsp + 0x1300], rax
mov rcx, qword [rsp + 0x19f0]
add rcx, 0x30
mov r9, qword [0x14003a848]
xor r8d, r8d
mov rdx, qword [rsp + 0x1300]
call fcn.1400091c0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xe00]
call fcn.1400099b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xdd8]
call fcn.1400099b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xdb0]
call fcn.1400099b0
mov r8, qword [rsp + 0x19f0]
add r8, 0x30
lea rdx, str.__Dias_installation_path:
lea rcx, [rsp + 0xe28]
call fcn.14000dd40
mov qword [rsp + 0x1910], rax
mov rax, qword [rsp + 0x1910]
mov qword [rsp + 0x1918], rax
mov rcx, qword [rsp + 0x1918]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xe28]
call fcn.1400099b0
mov dword [rsp + 0x290], 0x114
lea rax, [rsp + 0x290]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x160]
xor r8d, r8d
lea rdx, str.AppPath
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x164], eax
cmp dword [rsp + 0x164], 0
jne 0x140002e9b
lea rdx, [rsp + 0x4f0]
lea rcx, [rsp + 0xe50]
call fcn.140007fb0
mov qword [rsp + 0x1920], rax
mov rax, qword [rsp + 0x1920]
mov qword [rsp + 0x1320], rax
mov rcx, qword [rsp + 0x19f0]
add rcx, 0x58
mov r9, qword [0x14003a848]
xor r8d, r8d
mov rdx, qword [rsp + 0x1320]
call fcn.1400091c0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xe50]
call fcn.1400099b0
mov r8, qword [rsp + 0x19f0]
add r8, 0x58
lea rdx, str.__Dias_data_path:
lea rcx, [rsp + 0xe78]
call fcn.14000dd40
mov qword [rsp + 0x1928], rax
mov rax, qword [rsp + 0x1928]
mov qword [rsp + 0x1930], rax
mov rcx, qword [rsp + 0x1930]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xe78]
call fcn.1400099b0
mov dword [rsp + 0x290], 0x114
lea rax, [rsp + 0x290]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x160]
xor r8d, r8d
lea rdx, str.BuildNumber
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x164], eax
cmp dword [rsp + 0x164], 0
jne 0x140002fb6
lea rdx, [rsp + 0x4f0]
lea rcx, [rsp + 0xea0]
call fcn.140007fb0
mov qword [rsp + 0x1938], rax
mov rax, qword [rsp + 0x1938]
mov qword [rsp + 0x1340], rax
mov rcx, qword [rsp + 0x19f0]
add rcx, 0xa8
mov r9, qword [0x14003a848]
xor r8d, r8d
mov rdx, qword [rsp + 0x1340]
call fcn.1400091c0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xea0]
call fcn.1400099b0
mov r8, qword [rsp + 0x19f0]
add r8, 0xa8
lea rdx, str.__Dias_build_ver:
lea rcx, [rsp + 0xec8]
call fcn.14000dd40
mov qword [rsp + 0x1940], rax
mov rax, qword [rsp + 0x1940]
mov qword [rsp + 0x1948], rax
mov rcx, qword [rsp + 0x1948]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xec8]
call fcn.1400099b0
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsp + 0x19f0]
cmp qword [rax + 0x48], 0
jne 0x140002fe0
mov dword [rsp + 0x1950], 1
jmp 0x140002feb
mov dword [rsp + 0x1950], 0
movzx eax, byte [rsp + 0x1950]
test eax, eax
je 0x1400031fd
mov dword [rsp + 0x290], 0x114
lea rax, [rsp + 0x298]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x164], eax
cmp dword [rsp + 0x164], 0
jne 0x1400031f6
lea rax, [rsp + 0x290]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x160]
xor r8d, r8d
lea rdx, str.ProgramFilesDir
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x164], eax
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x164], 0
jne 0x1400031ed
lea rdx, [rsp + 0x4f0]
lea rcx, [rsp + 0xef0]
call fcn.140007fb0
mov qword [rsp + 0x1958], rax
mov rax, qword [rsp + 0x1958]
mov qword [rsp + 0x1960], rax
lea r8, str.CanonDIAS_
mov rdx, qword [rsp + 0x1960]
lea rcx, [rsp + 0xf18]
call fcn.14000de50
mov qword [rsp + 0x1968], rax
mov rax, qword [rsp + 0x1968]
mov qword [rsp + 0x1970], rax
lea r8, str.CnxDias.exe
mov rdx, qword [rsp + 0x1970]
lea rcx, [rsp + 0xf40]
call fcn.14000de50
mov qword [rsp + 0x1978], rax
mov rax, qword [rsp + 0x1978]
mov qword [rsp + 0x1360], rax
mov rcx, qword [rsp + 0x19f0]
add rcx, 0x30
mov r9, qword [0x14003a848]
xor r8d, r8d
mov rdx, qword [rsp + 0x1360]
call fcn.1400091c0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xf40]
call fcn.1400099b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xf18]
call fcn.1400099b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xef0]
call fcn.1400099b0
mov r8, qword [rsp + 0x19f0]
add r8, 0x30
lea rdx, str.__Dias_installation_path:
lea rcx, [rsp + 0xf68]
call fcn.14000dd40
mov qword [rsp + 0x1980], rax
mov rax, qword [rsp + 0x1980]
mov qword [rsp + 0x1988], rax
mov rcx, qword [rsp + 0x1988]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xf68]
call fcn.1400099b0
jmp 0x1400031f4
xor al, al
jmp 0x14000360c
jmp 0x1400031fd
xor al, al
jmp 0x14000360c
mov rax, qword [rsp + 0x19f0]
cmp qword [rax + 0x70], 0
jne 0x140003219
mov dword [rsp + 0x1990], 1
jmp 0x140003224
mov dword [rsp + 0x1990], 0
movzx eax, byte [rsp + 0x1990]
test eax, eax
je 0x1400033ef
mov dword [rsp + 0x290], 0x114
lea rax, [rsp + 0x298]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x164], eax
cmp dword [rsp + 0x164], 0
jne 0x1400033e8
lea rax, [rsp + 0x290]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x610]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x160]
xor r8d, r8d
lea rdx, str.Common_AppData
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x164], eax
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x164], 0
jne 0x1400033df
lea rdx, [rsp + 0x610]
lea rcx, [rsp + 0xf90]
call fcn.140007fb0
mov qword [rsp + 0x1998], rax
mov rax, qword [rsp + 0x1998]
mov qword [rsp + 0x19a0], rax
lea r8, str.Canon
mov rdx, qword [rsp + 0x19a0]
lea rcx, [rsp + 0xfb8]
call fcn.14000de50
mov qword [rsp + 0x19a8], rax
mov rax, qword [rsp + 0x19a8]
mov qword [rsp + 0x13a0], rax
mov rcx, qword [rsp + 0x19f0]
add rcx, 0x58
mov r9, qword [0x14003a848]
xor r8d, r8d
mov rdx, qword [rsp + 0x13a0]
call fcn.1400091c0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xfb8]
call fcn.1400099b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xf90]
call fcn.1400099b0
mov r8, qword [rsp + 0x19f0]
add r8, 0x58
lea rdx, str.__Dias_data_path:
lea rcx, [rsp + 0xfe0]
call fcn.14000dd40
mov qword [rsp + 0x19b0], rax
mov rax, qword [rsp + 0x19b0]
mov qword [rsp + 0x19b8], rax
mov rcx, qword [rsp + 0x19b8]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xfe0]
call fcn.1400099b0
jmp 0x1400033e6
xor al, al
jmp 0x14000360c
jmp 0x1400033ef
xor al, al
jmp 0x14000360c
lea rax, [rsp + 0x738]
mov qword [rsp + 0x1418], rax
lea rax, [rsp + 0x1408]
mov qword [rsp + 0x1410], rax
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x1418]
call fcn.1400099b0
nop
mov dword [rsp + 0x730], 2
lea r8, str.DIASLog
lea rdx, [0x140058b58]
lea rcx, [rsp + 0x1008]
call fcn.14000de50
mov qword [rsp + 0x19c0], rax
mov rax, qword [rsp + 0x19c0]
mov qword [rsp + 0x1420], rax
mov r9, qword [0x14003a848]
xor r8d, r8d
mov rdx, qword [rsp + 0x1420]
lea rcx, [rsp + 0x738]
call fcn.1400091c0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x1008]
call fcn.1400099b0
lea rdx, [rsp + 0x730]
lea rcx, [0x140058c30]
call fcn.140008960
mov dword [rsp + 0x730], 1
lea r8, str.DIASCfg
lea rdx, [0x140058b58]
lea rcx, [rsp + 0x1030]
call fcn.14000de50
mov qword [rsp + 0x19c8], rax
mov rax, qword [rsp + 0x19c8]
mov qword [rsp + 0x1530], rax
mov r9, qword [0x14003a848]
xor r8d, r8d
mov rdx, qword [rsp + 0x1530]
lea rcx, [rsp + 0x738]
call fcn.1400091c0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x1030]
call fcn.1400099b0
lea rdx, [rsp + 0x730]
lea rcx, [0x140058c30]
call fcn.140008960
mov dword [rsp + 0x730], 1
lea r8, [0x14003a8e0]
lea rdx, [0x140058b58]
lea rcx, [rsp + 0x1058]
call fcn.14000de50
mov qword [rsp + 0x19d0], rax
mov rax, qword [rsp + 0x19d0]
mov qword [rsp + 0x1648], rax
mov r9, qword [0x14003a848]
xor r8d, r8d
mov rdx, qword [rsp + 0x1648]
lea rcx, [rsp + 0x738]
call fcn.1400091c0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x1058]
call fcn.1400099b0
lea rdx, [rsp + 0x730]
lea rcx, [0x140058c30]
call fcn.140008960
mov dword [rsp + 0x730], 1
mov r9, qword [0x14003a848]
xor r8d, r8d
lea rdx, [0x140058b58]
lea rcx, [rsp + 0x738]
call fcn.1400091c0
lea rdx, [rsp + 0x730]
lea rcx, [0x140058c30]
call fcn.140008960
mov byte [rsp + 0x1080], 1
lea rcx, [rsp + 0x738]
xor r8d, r8d
mov dl, 1
call fcn.1400099b0
mov al, byte [rsp + 0x1080]
mov rcx, qword [rsp + 0x19d8]
xor rcx, rsp
call fcn.1400189a0
add rsp, 0x19e8
ret