Function at 0x180028370
Capabilities:
Get common file path
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x1d0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov r12, rdx
mov rbx, rcx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x60], rdx
xor esi, esi
mov qword [rsp + 0x58], rsi
test rcx, rcx
jne 0x1800283b9
xor eax, eax
jmp 0x1800287e5
mov r8, rdx
lea rdx, str.Undelete_RecoverFile:_Recovering_file__d._n
call fcn.180016b80
mov rcx, qword [rbx + 0x24]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, qword [rbx + 0x2c]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rax, qword [rbx + 0x44]
test rax, rax
je 0x1800287c3
cmp r12, qword [rbx + 0x210]
jae 0x1800287c3
mov r14, r12
imul r14, r14, 0x93
lea r13, [rax + r14]
mov qword [rsp + 0x50], r13
mov rcx, qword [r13 + 8]
cmp rcx, 0x100000
jae 0x180028732
call fcn.18002e088
mov rdi, rax
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x180028445
mov rax, qword [rbx + 0x44]
mov rcx, qword [rax + r14 + 8]
inc rcx
call fcn.18002e088
mov rdi, rax
mov qword [rsp + 0x58], rax
jmp 0x18002845d
cmp qword [0x18004c318], 1
jne 0x180028487
mov qword [0x18004c318], rsi
test rdi, rdi
je 0x180028480
mov rcx, rdi
call fcn.18002e404
mov qword [rsp + 0x58], rsi
xor eax, eax
jmp 0x1800287e5
test rdi, rdi
je 0x180028717
movzx ecx, word [r13 + 0x85]
and ecx, 0xfff
imul rcx, rcx, 0x126
mov rax, qword [rbx + 0x2b5]
mov r8, qword [rcx + rax + 0xc]
test r8, r8
je 0x1800284c9
lea rax, [rsp + 0x60]
test rax, rax
je 0x1800284c9
lea rax, [r8 + 0x7f]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x60]
mov rcx, r8
call fcn.180001d60
mov qword [rbx + 0x2d9], rsi
mov qword [rbx + 0x34], r8
movzx eax, word [r13 + 0x85]
shr ax, 0xc
and ax, 7
cmp ax, 2
jne 0x180028552
mov eax, dword [r13 + 0x87]
test r8, r8
je 0x180028513
cmp eax, dword [r8 + 0x83]
jae 0x180028513
mov dword [r8 + 0x87], eax
lea rdx, str.Undelete_RecoverFile:_Calling_NTFS_RecoverFile_to_recover_file._n
mov rcx, rbx
call fcn.180016b80
mov rdx, r12
imul rdx, rdx, 0x93
mov r8, qword [rbx + 0x44]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
lea r9, [rbx + 0x2d9]
mov r8, qword [rdx + r8 + 0x38]
mov rdx, r13
mov rcx, rbx
call fcn.180015730
jmp 0x1800285bc
cmp ax, 1
jne 0x180028588
mov rax, r12
imul rax, rax, 0x93
mov r8, qword [rbx + 0x44]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
lea r9, [rbx + 0x2d9]
mov r8, qword [rax + r8 + 0x38]
mov rdx, r13
mov rcx, rbx
call fcn.1800050e0
jmp 0x1800285bc
test ax, ax
jne 0x1800285bc
mov rax, r12
imul rax, rax, 0x93
mov r8, qword [rbx + 0x44]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rdi
lea r9, [rbx + 0x2d9]
mov r8, qword [rax + r8 + 0x38]
mov rdx, r13
mov rcx, rbx
call fcn.18002cc60
nop
movabs rax, 0x77656976657270
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0xf013f
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x180042c80]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x180028618
lea rcx, str.Could_not_create_the_registry_key.
call fcn.18002e474
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x20106
xor r8d, r8d
lea rdx, str.SOFTWARESystweakPhotos_RecoveryBLOB
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea r11, [rsp + 0x50]
mov qword [rsp + 0x20], r11
mov r9d, 0x20106
xor r8d, r8d
lea rdx, str.SOFTWARESystweakPhotos_RecoveryBLOB
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1800286d6
lea rcx, str.Key_location_open_successful__n
call fcn.18002e474
imul r12, r12, 0x93
mov rax, qword [rbx + 0x44]
mov ecx, dword [r12 + rax + 8]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rdi
mov r9d, 3
xor r8d, r8d
lea rdx, [rsp + 0x90]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1800286bd
lea rcx, str.Error_Writing_Value_n
call fcn.18002e474
jmp 0x1800286c9
lea rcx, str.SUCCESS____n
call fcn.18002e474
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x180028702
lea rcx, str.Unsuccessful_in_opening_key___n
call fcn.18002e474
lea rcx, str.Cannot_find_key_value_in_registry__n
call fcn.18002e474
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.Error:__u
call fcn.18002e474
jmp 0x180028710
mov qword [rbx + 0x2d9], rsi
test rdi, rdi
je 0x180028729
mov rcx, rdi
call fcn.18002e404
mov qword [rsp + 0x58], rsi
jmp 0x18002872d
jmp 0x1800287c1
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x1a]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea rdi, [rsp + 0xb0]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasb al, byte [rdi]
mov rax, qword [str.SystweakPhotos_Recoverypreview.txt]
mov qword [rdi - 1], rax
mov rax, qword [0x180042dc8]
mov qword [rdi + 7], rax
mov rax, qword [0x180042dd0]
mov qword [rdi + 0xf], rax
mov rax, qword [0x180042dd8]
mov qword [rdi + 0x17], rax
mov eax, dword [0x180042de0]
mov dword [rdi + 0x1f], eax
movzx eax, word [0x180042de4]
mov word [rdi + 0x23], ax
lea rcx, [rsp + 0xb0]
call fcn.18002e444
lea r8, [rsp + 0xb0]
mov rdx, r12
mov rcx, rbx
call sym.PRDLL.dll_Undelete_RecoverFile
jmp 0x1800287de
lea rdx, str.Undelete_RecoverFile:_Files_or_strings_or_both_are_NULL._n
mov rcx, rbx
call fcn.180016b80
mov dword [rbx], 0x2000000b
xor eax, eax
jmp 0x1800287e5
mov qword [0x18004c318], rsi
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.18002d590
mov rbx, qword [rsp + 0x210]
add rsp, 0x1d0
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret