Function at 0x100061ddc
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2f0
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov rdi, qword [rcx + 0x50]
xor r15d, r15d
mov r14, rcx
mov ebx, 1
mov r12, r15
mov r13, r15
cmp rdi, r15
je 0x100062157
or r8, 0xffffffffffffffff
lea eax, [rbx + 0x39]
mov rcx, r8
cmp ax, word [rdi + 2]
jne 0x100061f96
xor eax, eax
repne scasw ax, word [rdi]
lea eax, [rbx + 1]
not rcx
sub rcx, rbx
lea rdi, [rbx + rcx]
mul rdi
cmovo rax, r8
mov rcx, rax
call fcn.10007fa96
mov r8, qword [r14 + 0x50]
mov rsi, rax
movzx eax, word [r8]
cmp eax, 0x52
je 0x100061e79
cmp eax, 0x72
jne 0x10006214a
cmp rsi, r15
je 0x100062157
add r8, 4
mov rdx, rdi
mov rcx, rsi
call fcn.100039df8
mov r14d, 0x2c
mov rcx, rsi
mov edx, r14d
call qword [sym.imp.msvcrt.dll_wcschr]
mov rbp, rax
cmp rax, r15
je 0x10006214a
lea rcx, [rax + 2]
mov edx, r14d
mov qword [rsp + 0x48], r15
mov word [rax], r15w
call qword [sym.imp.msvcrt.dll_wcschr]
mov rdi, rax
cmp rax, r15
je 0x100061ef6
add rdi, 2
mov edx, r14d
mov word [rax], r15w
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, r15
je 0x100061ef6
lea rcx, [rax + 2]
mov word [rax], r15w
call fcn.100052d68
mov r12, rax
mov rdx, 0xffffffff80000000
mov rcx, rsi
call fcn.1000578c4
lea rcx, [rsp + 0x48]
lea rdx, [rbp + 2]
mov qword [rsp + 0x20], rcx
mov r9d, ebx
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r15d
jne 0x100061f86
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x260]
xor r8d, r8d
mov rdx, rdi
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x44], 0x80
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r15d
jne 0x100061f7b
cmp dword [rsp + 0x40], ebx
jne 0x100061f7b
lea rcx, [rsp + 0x260]
call fcn.100052d68
mov r13, rax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, r15d
cmp r12, r13
setbe al
mov ebx, eax
jmp 0x10006214a
xor eax, eax
repne scasw ax, word [rdi]
mov eax, 2
not rcx
sub rcx, rbx
lea rdi, [rbx + rcx]
mul rdi
cmovo rax, r8
mov rcx, rax
call fcn.10007fa96
mov rsi, rax
cmp rax, r15
je 0x100062157
mov r8, qword [r14 + 0x50]
mov rdx, rdi
mov rcx, rax
mov ebp, r15d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x44], r15d
call fcn.100039df8
mov edx, 0x3a
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_wcschr]
mov rdi, rax
cmp rax, r15
je 0x100061fff
mov word [rax], r15w
add rdi, 2
mov rcx, rsi
call fcn.100052d68
mov r15, rax
test rdi, rdi
je 0x100062027
lea rdx, [0x10002c908]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
je 0x100062147
lea rax, [rsp + 0x50]
mov edi, 0x104
test rax, rax
je 0x100062073
lea rcx, [rsp + 0x50]
xor edx, edx
call fcn.100053eb0
test eax, eax
je 0x100062073
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea r8, [0x100027008]
lea rcx, [rsp + 0x50]
mov rdx, rdi
call fcn.100039ee4
lea rcx, [rsp + 0x50]
call fcn.100053454
test eax, eax
jne 0x1000620aa
lea rcx, [rsp + 0x50]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x10006211d
lea r8, [0x100029b90]
lea rcx, [rsp + 0x50]
mov rdx, rdi
call fcn.100039ee4
lea rcx, [rsp + 0x50]
call fcn.100053454
test eax, eax
je 0x10006211d
lea rax, [rsp + 0x50]
test rax, rax
je 0x1000620d3
lea r8, [rsp + 0x44]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.100054598
mov ebp, dword [rsp + 0x40]
mov r12d, dword [rsp + 0x44]
jmp 0x1000620d8
mov eax, 0x80004005
test eax, eax
js 0x10006211d
movzx ecx, r12w
movzx eax, bp
shr ebp, 0x10
mov dword [rsp + 0x30], ecx
shr r12d, 0x10
lea r8, [0x1000296c8]
lea rcx, [rsp + 0x50]
mov r9d, ebp
mov edx, 0x103
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], eax
call fcn.10003a080
lea rcx, [rsp + 0x50]
call fcn.100052d68
mov r13, rax
xor eax, eax
cmp r13, r15
setae al
mov ebx, eax
test eax, eax
jne 0x100062147
mov rcx, qword [r14 + 0x78]
test rcx, rcx
je 0x100062147
mov rcx, qword [rcx + 0x38]
call fcn.100052d68
xor ecx, ecx
cmp rax, r15
setae cl
mov ebx, ecx
xor r15d, r15d
cmp rsi, r15
je 0x100062157
mov rcx, rsi
call fcn.10007faa2
mov eax, ebx
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret