Function at 0x140107f98
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x1c8]
sub rsp, 0x2b0
mov rax, qword [0x1403c2018]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov rsi, rcx
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x70]
call fcn.14003a220
movups xmm0, xmmword [0x14035dea0]
movdqu xmmword [rbp - 0x80], xmm0
xor r15d, r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r15w
mov dword [rsp + 0x50], r15d
cmp qword [rsi + 0x48], r15
jne 0x140108035
mov r8d, 0x4e3
mov ecx, 0x8000ffff
mov ebx, ecx
lea rdx, str.D:dbs_shodct0417_084611_0cmdwclientonedriveSetup_standalonewebclientwebclient.cpp
call fcn.140064438
jmp 0x1401083c7
lea rdx, [rbp - 0x70]
mov r14d, 0x104
mov ecx, r14d
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x140108077
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, ebx
shr eax, 0x1f
test al, al
je 0x1401083c7
mov r8d, 0x4e6
mov ecx, ebx
jmp 0x140108024
mov rdx, r14
lea rax, [rbp - 0x70]
cmp word [rax], r15w
je 0x14010808e
add rax, 2
sub rdx, 1
jne 0x14010807e
mov rax, rdx
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x80070057
mov rax, rdx
mov rcx, r14
sub rcx, rdx
neg rax
sbb rax, rax
and rax, rcx
test rdx, rdx
jne 0x1401080bd
mov r8d, 0x4e7
jmp 0x140108073
test rax, rax
jne 0x1401080d2
mov ecx, 0x80004005
mov r8d, 0x4e8
jmp 0x140108022
lea rax, [rbp - 0x70]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r15w
jne 0x1401080da
lea rdx, [rbp - 0x70]
lea rcx, [rsp + 0x60]
call fcn.14001b664
mov rcx, rsi
call fcn.140106114
mov ebx, eax
test eax, eax
jns 0x14010810d
mov r8d, 0x4eb
mov ecx, eax
jmp 0x140108024
mov dword [rsp + 0x54], setsockopt
call fcn.1400718fc
lea rbx, [rsi + 0x90]
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14010812e
mov rdx, qword [rbx]
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, str.GUID
mov rcx, qword [rsi + 0xf0]
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x14010816e
mov ecx, 0x80004005
mov r8d, 0x4ef
jmp 0x140108022
cmp dword [rsp + 0x50], 3
je 0x140108185
mov ecx, 0x80004005
mov r8d, 0x4f0
jmp 0x140108022
lea rdi, [rbp - 0x70]
xor eax, eax
mov ecx, 0x208
rep stosb byte [rdi], al
mov dword [rsp + 0x54], SHFlushSFCache
call fcn.1400718fc
cmp qword [rbx + 0x18], 8
jb 0x1401081a9
mov rbx, qword [rbx]
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, str.File
mov rdx, rbx
mov rcx, qword [rsi + 0xf0]
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x1401081ec
mov ecx, 0x80004005
mov r8d, 0x4f6
jmp 0x140108022
cmp dword [rsp + 0x50], 1
je 0x140108203
mov ecx, 0x80004005
mov r8d, 0x4f7
jmp 0x140108022
lea rcx, [rbp - 0x70]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
lea rcx, [rbp - 0x70]
cmp rax, rcx
je 0x140108221
mov r8d, 0x4fb
jmp 0x14010801d
mov rcx, r14
lea rax, [rbp - 0x70]
cmp word [rax], r15w
je 0x140108238
add rax, 2
sub rcx, 1
jne 0x140108228
mov rax, rcx
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x80070057
mov rax, rcx
sub r14, rcx
neg rax
sbb rdx, rdx
and rdx, r14
test rcx, rcx
jne 0x140108267
mov r8d, 0x4fc
jmp 0x140108073
test rdx, rdx
jne 0x14010827c
mov ecx, 0x80004005
mov r8d, 0x4fd
jmp 0x140108022
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
lea r8, [rbp - 0x70]
lea rcx, [rsp + 0x30]
call fcn.14010a988
nop
lea rcx, [rsp + 0x60]
cmp rcx, rax
je 0x1401082c2
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x1401082b4
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14001b664
nop
lea rcx, [rsp + 0x30]
call fcn.14001b814
mov rcx, qword [rsi + 0x48]
mov rax, qword [rcx]
lea r8, [rsp + 0x58]
lea rdx, [rbp - 0x80]
mov rax, qword [rax + 0x20]
call qword [str.0B__]
mov ebx, eax
test eax, eax
jns 0x1401082f7
mov r8d, 0x503
jmp 0x140108106
lea r9, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae r9, qword [rsp + 0x60]
lea r8, [rsi + 0xb0]
cmp qword [r8 + 0x18], 8
jb 0x140108319
mov r8, qword [r8]
mov rdx, qword [rsp + 0x58]
mov rcx, rsi
call fcn.1401078b8
test al, al
jne 0x140108351
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140108341
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [str.0B__]
mov ecx, 0x80004005
mov r8d, 0x50d
jmp 0x140108022
lea rcx, [rsi + 0xd0]
lea rax, [rsp + 0x60]
cmp rcx, rax
je 0x14010837d
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
call fcn.14001b664
mov rcx, qword [rsi + 0x50]
mov rdi, qword [rsp + 0x58]
cmp rcx, rdi
je 0x1401083bb
test rdi, rdi
je 0x1401083a4
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [str.0B__]
mov rcx, qword [rsi + 0x50]
mov qword [rsi + 0x50], rdi
test rcx, rcx
je 0x1401083bb
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [str.0B__]
nop
movups xmm0, xmmword [rbp - 0x80]
movdqu xmmword [rsi + 0x130], xmm0
mov edi, r15d
test ebx, ebx
cmovs edi, ebx
lea rcx, [rsp + 0x60]
call fcn.14001b814
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1401083f2
mov rdx, qword [rcx]
mov rax, qword [rdx + 0x10]
call qword [str.0B__]
nop
mov eax, edi
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.140038910
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret