Function at 0x140045af0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x770]
sub rsp, 0x870
mov rsi, rcx
xor r13d, r13d
mov qword [rbp + 0x7c0], r13
mov rax, rcx
cmp qword [rcx + 0x18], 8
jb 0x140045b29
mov rax, qword [rcx]
mov qword [rcx + 0x10], r13
mov word [rax], r13w
lea rdx, str.JaqKKLKJSDKTn9NPjHsGku6Tny6RJL6TSDpRjHcSkm6NJLrSoarRj1IJXuMOcLbSSL_RrabSkuMRau6T
lea rcx, [rsp + 0x50]
call fcn.140054f30
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.140048220
cmp qword [rax + 0x18], 8
jb 0x140045b5a
mov rax, qword [rax]
lea rcx, [rbp + 0x7c0]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140045bc1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140045bbc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140045e97
call fcn.140011b00
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r13w
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140045c12
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140045c0d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140045e9d
call fcn.140011b00
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x70]
call fcn.140014220
mov dword [rbp + 0x7b0], 0x400
mov rcx, qword [rbp + 0x7c0]
test rcx, rcx
je 0x140045e70
lea rax, [rbp + 0x7b0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x7b8]
xor r8d, r8d
lea rdx, str.TEMP
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140045e63
lea rax, [rsp + 0x70]
mov rdi, 0xffffffffffffffff
mov rbx, rdi
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140045c82
mov r12, qword [rsi + 0x18]
cmp rbx, r12
ja 0x140045cc2
mov r14, rsi
cmp r12, 8
jb 0x140045ca1
mov r14, qword [rsi]
mov qword [rsi + 0x10], rbx
add rbx, rbx
mov r8, rbx
lea rdx, [rsp + 0x70]
mov rcx, r14
call fcn.140013b70
mov word [rbx + r14], r13w
jmp 0x140045dd1
movabs r15, 0x7ffffffffffffffe
cmp rbx, r15
ja 0x140045ea3
mov rcx, rbx
or rcx, 7
cmp rcx, r15
jbe 0x140045cea
mov rcx, 0xfffffffffffffffe
jmp 0x140045d35
mov rdx, r12
shr rdx, 1
mov rax, r15
sub rax, rdx
cmp r12, rax
jbe 0x140045d04
mov rcx, 0xfffffffffffffffe
jmp 0x140045d35
lea rax, [rdx + r12]
mov r15, rcx
cmp rcx, rax
cmovb r15, rax
lea rcx, [r15 + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140045e91
add rcx, rcx
cmp rcx, 0x1000
jb 0x140045d61
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140045e91
mov rcx, rax
call fcn.140011b08
test rax, rax
je 0x140045e8b
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140045d73
test rcx, rcx
je 0x140045d70
call fcn.140011b08
mov r14, rax
jmp 0x140045d73
mov r14, r13
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], r15
add rbx, rbx
mov r8, rbx
lea rdx, [rsp + 0x70]
mov rcx, r14
call fcn.140013b70
mov word [rbx + r14], r13w
cmp r12, 8
jb 0x140045dce
lea rdx, [r12*2 + 2]
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x140045dc9
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140045e8b
mov rcx, r8
call fcn.140011b00
mov qword [rsi], r14
mov r9, qword [0x1400b2eb8]
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [r9 + rax*2], 0
jne 0x140045de0
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140045df8
mov rcx, qword [rsi]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, qword [rsi + 0x10]
call fcn.140006050
mov rbx, rax
cmp rax, rdi
je 0x140045e63
mov edx, 0x400
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x140045e63
lea rax, [rsp + 0x70]
mov rcx, rdi
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140045e30
mov rax, qword [0x1400b2eb8]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140045e41
mov r8, rdi
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x70]
mov rdx, rbx
mov rcx, rsi
call fcn.140005d40
mov rcx, qword [rbp + 0x7c0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x8c8]
add rsp, 0x870
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140018100
int3
call fcn.140001814
nop
call fcn.140018100
nop
call fcn.140018100
int3
call fcn.14000235c
int3