Function at 0x180007cd0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov r11, rsp
push rbp
push rbx
push rdi
lea rbp, [r11 - 0x2b8]
sub rsp, 0x3a0
mov rax, qword [0x18003f390]
xor rax, rsp
mov qword [rbp + 0x280], rax
mov qword [r11 + 0x10], rsi
mov qword [r11 - 0x28], r13
mov r13, rdx
mov rdx, rcx
mov rsi, rcx
lea rcx, [rbp + 0x50]
mov rbx, r8
mov byte [rsp + 0x40], 0
call fcn.180007180
lea rdx, str.LogPath
lea rcx, [rbp + 0x50]
xor r9d, r9d
xor r8d, r8d
call fcn.1800054e0
mov rcx, qword [rsi + 0x80]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x34]
lea rdx, [rbp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x34], 0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0x103
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180007d85
cmp dword [rsp + 0x34], 1
jne 0x180007d85
mov eax, dword [rsp + 0x30]
inc eax
mov byte [rsp + rax + 0x40], 0
jmp 0x180007e07
lea rdx, [rsi + 1]
lea rcx, [rbp + 0x50]
mov byte [rsp + 0x40], 0
call fcn.180007180
lea rdx, str.LogPath
lea rcx, [rbp + 0x50]
xor r9d, r9d
xor r8d, r8d
call fcn.1800054e0
mov rcx, qword [rsi + 0x80]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x30]
lea rdx, [rbp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], 0x103
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180007e02
cmp dword [rsp + 0x30], 1
jne 0x180007e02
mov eax, dword [rsp + 0x34]
inc eax
mov byte [rsp + rax + 0x40], 0
jmp 0x180007e07
mov byte [rsp + 0x40], 0
mov edi, 0x104
lea rax, [rsp + 0x40]
mov ecx, edi
cmp byte [rax], 0
je 0x180007e22
inc rax
dec rcx
jne 0x180007e13
jmp 0x180007e61
test rcx, rcx
je 0x180007e61
mov rax, rdi
sub rax, rcx
je 0x180007e61
cmp byte [rsp + rax + 0x3f], 0x5c
jne 0x180007e61
lea rdx, [rsi + 1]
lea rcx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
call fcn.180005710
lea rdx, str..log
lea rcx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
call fcn.180005710
cmp byte [rsp + 0x40], 0
jne 0x180007e93
lea rdx, [rsi + 1]
lea rcx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
call fcn.180005710
lea rdx, str..log
lea rcx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
call fcn.180005710
cmp byte [rsp + 0x40], 0x2e
mov qword [rsp + 0x398], r12
jne 0x180007eb0
cmp byte [rsp + 0x41], 0x5c
jne 0x180007eb0
lea r12, [rsp + 0x42]
jmp 0x180007ecd
lea rcx, [rsp + 0x40]
mov edx, 0x5c
call fcn.18001564c
test rax, rax
jne 0x1800080a0
lea r12, [rsp + 0x40]
lea rdx, [0x180032070]
lea rcx, [rbp + 0x50]
mov byte [rbp + 0xf0], 0
call fcn.180007180
lea rdx, str.LogPath
lea rcx, [rbp + 0x50]
xor r9d, r9d
xor r8d, r8d
call fcn.1800054e0
mov rcx, qword [rsi + 0x80]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0xf0]
lea r9, [rsp + 0x30]
lea rdx, [rbp + 0x50]
xor r8d, r8d
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], 0x103
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180007f54
cmp dword [rsp + 0x30], 1
jne 0x180007f54
mov eax, dword [rsp + 0x34]
inc eax
mov byte [rbp + rax + 0xf0], 0
jmp 0x180007f5b
mov byte [rbp + 0xf0], 0
lea rcx, [rbp + 0xf0]
mov edx, 0x5c
call fcn.18001564c
lea r9, [0x180031722]
test rax, rax
jne 0x180007fcc
test r13, r13
mov r8, r9
lea rax, [rbp + 0xf0]
cmovne r8, r13
mov rdx, rdi
lea rcx, [rbp + 0xf0]
sub r8, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x180007fc1
movzx eax, byte [r8 + rcx]
test al, al
je 0x180007fc1
mov byte [rcx], al
inc rcx
dec rdx
jne 0x180007fa0
jmp 0x180007fc6
test rdx, rdx
jne 0x180007fc9
dec rcx
mov byte [rcx], 0
mov rcx, rdi
lea rax, [rbp + 0xf0]
cmp byte [rax], 0
je 0x180007fe5
inc rax
dec rcx
jne 0x180007fd6
jmp 0x18000804c
test rcx, rcx
je 0x18000804c
mov rax, rdi
sub rax, rcx
je 0x18000804c
cmp byte [rbp + rax + 0xef], 0x5c
je 0x18000804c
test r13, r13
lea rax, [rbp + 0xf0]
mov rdx, rdi
cmovne r9, r13
lea rcx, [rbp + 0xf0]
sub r9, rax
nop word [rax + rax]
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x180008041
movzx eax, byte [r9 + rcx]
test al, al
je 0x180008041
mov byte [rcx], al
inc rcx
dec rdx
jne 0x180008020
jmp 0x180008046
test rdx, rdx
jne 0x180008049
dec rcx
mov byte [rcx], 0
test rbx, rbx
je 0x18000808d
lea r8, [rbp + 0xf0]
mov rdx, rdi
mov rcx, rbx
sub r8, rbx
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x180008082
movzx eax, byte [r8 + rcx]
test al, al
je 0x180008082
mov byte [rcx], al
inc rcx
dec rdx
jne 0x180008061
jmp 0x180008087
test rdx, rdx
jne 0x18000808a
dec rcx
mov byte [rcx], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov rcx, rbx
call fcn.180005710
jmp 0x1800080df
test rbx, rbx
je 0x1800080df
lea r8, [rsp + 0x40]
mov rdx, rdi
mov rcx, rbx
sub r8, rbx
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x1800080d4
movzx eax, byte [r8 + rcx]
test al, al
je 0x1800080d4
mov byte [rcx], al
inc rcx
dec rdx
jne 0x1800080b3
jmp 0x1800080d9
test rdx, rdx
jne 0x1800080dc
dec rcx
mov byte [rcx], 0
cmp byte [rbx], 0x7e
mov r13, qword [rsp + 0x390]
mov r12, qword [rsp + 0x398]
mov rsi, qword [rsp + 0x3c8]
jne 0x18000828f
mov r9d, 1
lea rdx, [rbp + 0xf0]
xor ecx, ecx
lea r8d, [r9 + 4]
mov byte [rbp + 0xf0], 0
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov edx, 0x190
test eax, eax
jne 0x180008170
lea r9, [0x1800320ac]
lea rax, [rbp + 0xf0]
mov r8d, edx
sub r9, rax
lea rcx, [rbp + 0xf0]
lea rax, [r8 + 0x7ffffe6e]
test rax, rax
je 0x180008165
movzx eax, byte [r9 + rcx]
test al, al
je 0x180008165
mov byte [rcx], al
inc rcx
dec r8
jne 0x180008144
jmp 0x18000816a
test r8, r8
jne 0x18000816d
dec rcx
mov byte [rcx], 0
mov rcx, rdx
lea rax, [rbp + 0xf0]
nop word [rax + rax]
cmp byte [rax], 0
je 0x18000818f
inc rax
dec rcx
jne 0x180008180
jmp 0x1800081ea
test rcx, rcx
je 0x1800081ea
mov r8, rdx
sub r8, rcx
mov rcx, rdx
sub rcx, r8
lea rax, [rbp + r8 + 0xf0]
je 0x1800081e4
lea r10, [0x1800320a8]
lea r8, [rcx + r8 + 0x7ffffe6f]
sub r10, rax
nop dword [rax]
test r8, r8
je 0x1800081df
movzx r9d, byte [r10 + rax]
test r9b, r9b
je 0x1800081df
mov byte [rax], r9b
inc rax
dec r8
dec rcx
jne 0x1800081c0
jmp 0x1800081e4
test rcx, rcx
jne 0x1800081e7
dec rax
mov byte [rax], 0
mov rcx, rdx
lea rax, [rbp + 0xf0]
cmp byte [rax], 0
je 0x180008203
inc rax
dec rcx
jne 0x1800081f4
jmp 0x18000825a
test rcx, rcx
je 0x18000825a
mov r8, rdx
lea r9, [rbx + 1]
sub r8, rcx
sub rdx, r8
lea rax, [rbp + r8 + 0xf0]
je 0x180008254
lea rcx, [rdx + r8 + 0x7ffffe6f]
sub r9, rax
nop word [rax + rax]
test rcx, rcx
je 0x18000824f
movzx r8d, byte [r9 + rax]
test r8b, r8b
je 0x18000824f
mov byte [rax], r8b
inc rax
dec rcx
dec rdx
jne 0x180008230
jmp 0x180008254
test rdx, rdx
jne 0x180008257
dec rax
mov byte [rax], 0
lea rcx, [rbp + 0xf0]
sub rcx, rbx
lea rax, [rdi + 0x7ffffefa]
test rax, rax
je 0x180008284
movzx eax, byte [rbx + rcx]
test al, al
je 0x180008284
mov byte [rbx], al
inc rbx
dec rdi
jne 0x180008264
jmp 0x180008289
test rdi, rdi
jne 0x18000828c
dec rbx
mov byte [rbx], 0
mov al, 1
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.180014930
add rsp, 0x3a0
pop rdi
pop rbx
pop rbp
ret