Function at 0x18001cc24
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
lea rdx, str.RegistryMachineSoftwareMicrosoftWindows_NTCurrentVersionWindows
xor r15d, r15d
lea rcx, [rbp - 0x40]
xor edi, edi
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
and qword [rbp - 0x28], rdi
lea rax, [rbp - 0x40]
and qword [rbp + 0x48], rdi
lea r8, [rbp - 0x30]
xorps xmm0, xmm0
mov qword [rbp - 0x20], rax
mov edx, 0x20019
mov dword [rbp - 0x30], 0x30
lea rcx, [rbp + 0x48]
mov dword [rbp - 0x18], 0x40
movdqu xmmword [rbp - 0x10], xmm0
mov dword [rbp + 0x40], 0x104
call qword [sym.imp.ntdll.dll_NtOpenKey]
lea esi, [rdi + 8]
mov r13d, 0xc0000017
mov ebx, eax
test eax, eax
js 0x18001cd0c
lea rdx, str.NaturalInputHandler
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
test rdi, rdi
jne 0x180040bc8
mov r8d, dword [rbp + 0x40]
mov edx, esi
mov rcx, qword [0x1800a9f20]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
test rax, rax
mov rdi, rax
cmove ebx, r13d
test ebx, ebx
js 0x18001cd04
mov rcx, qword [rbp + 0x48]
lea rax, [rbp + 0x40]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x40]
mov eax, dword [rbp + 0x40]
mov r9, rdi
mov r8d, 2
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
mov ebx, eax
cmp ebx, 0x80000005
je 0x18001ccb1
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x18001cd1b
call qword [sym.imp.ntdll.dll_NtClose]
test ebx, ebx
js 0x18001cdf9
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
mov r14d, eax
mov eax, 0xc000003a
test r14d, r14d
cmove ebx, eax
test ebx, ebx
js 0x18001cdf9
mov eax, dword [rdi + 8]
lea r12d, [r14 + 1]
mov rcx, qword [0x1800a9f20]
mov edx, esi
shr eax, 1
add r12d, eax
mov r8d, r12d
add r8, r8
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rsi, rax
test rax, rax
je 0x18001cdf9
mov edx, r14d
mov rcx, rax
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemDirectoryW]
cmp r14d, eax
mov ecx, 0xc0000420
cmovbe ebx, ecx
test ebx, ebx
js 0x18001cde7
lea ecx, [r14 - 1]
mov eax, 0x5c
mov word [rsi + rcx*2], ax
lea r8, [rdi + 0xc]
sub r12d, r14d
lea rcx, [rsi + r14*2]
mov edx, r12d
call fcn.18001d138
test eax, eax
cmovs ebx, r13d
test ebx, ebx
js 0x18001cde7
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
mov rbx, rax
test rax, rax
je 0x18001cde7
lea rdx, str.DefaultInputHandler
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
mov r15, rax
test rax, rax
je 0x180040be0
mov rcx, qword [0x1800a9f20]
mov r8, rsi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
test rdi, rdi
je 0x18001ce10
mov rcx, qword [0x1800a9f20]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov rax, r15
mov rbx, qword [rsp + 0xc0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [0x1800a9f20]
mov r8, rdi
xor edx, edx
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop
jmp 0x18001ccba
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop
jmp 0x18001cde7