Function at 0x1400805ec
Capabilities:
Create process on windows
Get common file path

Disassembly:
push r12
mov eax, 0x5590
call fcn.1400fe810
sub rsp, rax
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x55a8], rbx
mov qword [rsp + 0x55b0], rsi
mov qword [rsp + 0x55b8], rdi
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x5580], rax
mov sil, dl
mov dil, cl
mov r8b, 1
mov r12d, 0x800
mov rdx, r12
lea rcx, [rsp + 0x180]
call fcn.140050ffc
mov rdx, r12
lea rcx, [rsp + 0x180]
call fcn.1400504dc
mov r8, r12
lea rdx, str.Settings.reg
lea rcx, [rsp + 0x180]
call fcn.140065d80
mov r8, r12
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x1180]
call fcn.140065d00
xor ebx, ebx
cmp dil, bl
je 0x1400806ac
lea r8d, [rbx + 1]
lea rdx, str.ExportedSettings
lea rcx, [0x140109540]
call fcn.14009b8a0
jmp 0x140080703
mov byte [rsp + 0x20], bl
mov r9b, 1
mov r8, r12
lea rdx, [rsp + 0x180]
lea rcx, str.Settings.reg
call fcn.140051104
lea rcx, [rsp + 0x180]
call fcn.14004258c
cmp al, bl
jne 0x140080703
cmp sil, bl
je 0x1400806e7
xor al, al
jmp 0x1400809f7
mov rcx, rbx
movzx eax, word [rsp + rcx + 0x1180]
mov word [rsp + rcx + 0x180], ax
add rcx, 2
cmp ax, bx
jne 0x1400806ea
cmp sil, bl
jne 0x140080748
mov al, dil
neg al
sbb ecx, ecx
add ecx, 0x5b5
call fcn.14005fad8
mov rdx, rax
mov byte [rsp + 0x20], dil
lea r9, str..reg
lea r8, [rsp + 0x180]
mov rcx, qword [0x140158350]
call fcn.14007afac
cmp al, bl
jne 0x140080748
xor al, al
jmp 0x1400809f7
cmp dil, bl
jne 0x140080861
lea rcx, [rsp + 0xc0]
call fcn.140066320
nop
mov byte [rsp + 0x38], bl
mov byte [rsp + 0x30], bl
mov byte [rsp + 0x28], bl
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x180]
call fcn.140043670
cmp al, bl
jne 0x1400807a7
mov rcx, qword [rsp + 0xc0]
cmp rcx, rbx
je 0x1400807a0
call fcn.1400ea2a8
xor al, al
jmp 0x1400809f7
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xc0]
call fcn.140066200
cmp al, bl
je 0x140080825
mov rcx, qword [rsp + 0x40]
cmp word [rcx], 0x5b
jne 0x140080823
mov r8d, 0x22
lea rdx, str._HKEY_CURRENT_USERSoftwareWinRAR
call fcn.140068d60
cmp eax, ebx
je 0x1400807f7
mov rcx, qword [rsp + 0xc0]
cmp rcx, rbx
je 0x1400807f0
call fcn.1400ea2a8
xor al, al
jmp 0x1400809f7
mov rax, qword [rsp + 0x40]
cmp word [rax + 0x44], 0x5c
je 0x140080823
cmp word [rax + 0x44], 0x5d
je 0x140080823
mov rcx, qword [rsp + 0xc0]
cmp rcx, rbx
je 0x14008081c
call fcn.1400ea2a8
xor al, al
jmp 0x1400809f7
jmp 0x1400807a7
lea rcx, [0x140109540]
call fcn.14009bfd4
nop
mov rcx, qword [rsp + 0xc0]
cmp rcx, rbx
je 0x140080861
call fcn.1400ea2a8
jmp 0x140080861
lea rax, [rsp + 0x3380]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea edx, [r9 + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov r9, r12
lea r8, [rsp + 0x3380]
lea rdx, str.regedit.exe
lea rcx, [rsp + 0x3380]
call fcn.140050528
lea rax, str._e___s__HKEY_CURRENT_USERSoftwareWinRAR
lea r8, [0x14010f958]
cmp dil, bl
cmovne r8, rax
lea r9, [rsp + 0x180]
mov edx, 0x900
lea rcx, [rsp + 0x2180]
call fcn.1400e0c0c
mov r12d, 0x70
mov r8, r12
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.1400eada0
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x54], 0x40
mov rax, qword [0x140158350]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x3380]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x2180]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x80], 1
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, ebx
setne r12b
cmp r12b, bl
je 0x14008095b
mov edx, 0x1388
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dil, bl
je 0x140080973
lea rdx, str.ExportedSettings
lea rcx, [0x140109540]
call fcn.14009b414
cmp r12b, bl
je 0x1400809d5
cmp dil, bl
jne 0x140080982
call fcn.1400802c8
neg dil
sbb ecx, ecx
add ecx, 0x461
call fcn.14005fad8
mov r8, rax
lea r9, [rsp + 0x180]
mov edx, 0x900
lea rcx, [rsp + 0x4380]
call fcn.1400e0c0c
mov ecx, 0x2fb
call fcn.14005fad8
mov r8, rax
xor r9d, r9d
lea rdx, [rsp + 0x4380]
mov rcx, qword [0x140158350]
call fcn.1400b6df8
jmp 0x1400809f4
cmp sil, bl
jne 0x1400809f4
mov ecx, 0x201
call fcn.14005fad8
mov rcx, rax
lea rdx, [rsp + 0x2180]
call fcn.1400c5814
mov al, r12b
mov rcx, qword [rsp + 0x5580]
xor rcx, rsp
call fcn.1400e9d80
lea r11, [rsp + 0x5590]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret