Function at 0x18002a460
Capabilities:
Get common file path
Get file size
Query or enumerate registry value
Read file on windows
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x18003ca28]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
imul r13d, r8d, 0x6ae
mov r11, rcx
mov qword [rbp - 0x78], rcx
xor r9d, r9d
movzx ecx, byte [rsp + 0x41]
mov r10, rdx
mov dword [rsp + 0x4c], r8d
mov r12d, r8d
mov qword [rsp + 0x70], rdx
mov byte [rsp + 0x40], cl
cmp r8d, r13d
ja 0x18002a642
mov r15, qword [rsp + 0x78]
movabs rdx, 0x6f0076006e0069
movzx edi, byte [rsp + 0x41]
movzx esi, byte [rsp + 0x41]
movzx r14d, byte [rsp + 0x41]
imul ebx, r8d, 0x72
mov dword [rsp + 0x44], ebx
mov eax, dword [rsp + 0x44]
mov rbx, qword [rsp + 0x78]
cmp r12d, 0x420d
ja 0x18002a732
je 0x18002a726
cmp r12d, 0x96f
ja 0x18002a573
je 0x18002a567
mov eax, r12d
sub eax, 0x15
je 0x18002a54b
sub eax, 0x10
je 0x18002a53f
cmp eax, 0x7d
mov eax, dword [rsp + 0x44]
jne 0x18002a631
mov qword [rbp + 0x178], rdx
mov word [rbp + 0x180], r9w
jmp 0x18002a631
mov eax, dword [rsp + 0x44]
mov r15, r9
jmp 0x18002a631
cmp dword [0x18003cb1c], 0
mov eax, dword [rsp + 0x44]
jle 0x18002a631
dec dword [0x18003cb1c]
jmp 0x18002a631
mov byte [0x18003900c], 0x2d
jmp 0x18002a631
cmp r12d, 0x109f
je 0x18002a6e5
cmp r12d, 0x2119
je 0x18002a6d5
cmp r12d, 0x3193
jne 0x18002a631
cmp qword [r11 + 0x18], 0x10
mov r9, r11
jb 0x18002a5a7
mov r9, qword [r11]
cmp r15, qword [r11 + 0x10]
jae 0x18002a62e
mov r8d, 0x47
mov eax, r8d
sub eax, 0x47
je 0x18002a5fd
sub eax, 1
je 0x18002a5e8
cmp eax, 1
jne 0x18002a60c
movzx eax, dil
movzx ecx, sil
movzx ecx, byte [rcx + rbx]
add cl, byte [rax + rbx]
movzx eax, cl
movzx ecx, byte [rax + rbx]
xor byte [r9 + r15], cl
inc r15
jmp 0x18002a60c
movzx edx, sil
movzx ecx, dil
movzx eax, byte [rdx + rbx]
mov byte [rcx + rbx], al
mov byte [rdx + rbx], r14b
jmp 0x18002a60c
inc dil
movzx eax, dil
movzx r14d, byte [rax + rbx]
add sil, r14b
inc r8d
cmp r8d, 0x4a
jb 0x18002a5b7
cmp r15, qword [r11 + 0x10]
jb 0x18002a5b1
mov eax, dword [rsp + 0x44]
movzx ecx, byte [rsp + 0x40]
movabs rdx, 0x6f0076006e0069
xor r9d, r9d
add r12d, eax
cmp r12d, r13d
jbe 0x18002a4f3
mov r8d, dword [rsp + 0x4c]
movzx ebx, byte [rsp + 0x41]
lea edx, [r8 + 0x591]
mov dword [rsp + 0x44], edx
cmp r8d, edx
jae case.0x18002ac66.14
mov r14, qword [rsp + 0x78]
lea rdi, [0x180000000]
movzx r12d, byte [rsp + 0x41]
mov r13d, dword [rsp + 0x6c]
mov r15, qword [rsp + 0x78]
nop word [rax + rax]
cmp r8d, 0x33b
ja 0x18002abf2
je 0x18002ab4b
cmp r8d, 0x1bf
ja 0x18002ab09
je 0x18002aaff
mov eax, r8d
sub eax, 0xa2
je 0x18002aab1
sub eax, 0x5f
je 0x18002a87c
cmp eax, 0x5f
jne 0x18002aedb
mov dword [rsp + 0x68], r9d
mov dword [rsp + 0x60], r9d
jmp 0x18002aedb
movzx esi, byte [rbp + 0x151]
lea rbx, [rbp + 0x50]
jmp 0x18002a631
cmp qword [r10 + 0x18], 0x10
mov rdx, r10
jb 0x18002a6f2
mov rdx, qword [r10]
mov eax, dword [r10 + 0x10]
lea r9, [rbp + 0x50]
lea r8, [rsp + 0x50]
mov dword [rsp + 0x50], eax
mov ecx, 0x44
call fcn.1800225b0
mov eax, dword [rsp + 0x44]
mov r10, qword [rsp + 0x70]
mov r11, qword [rbp - 0x78]
movzx edi, byte [rbp + 0x150]
jmp 0x18002a61f
mov byte [rbp + 0x150], dil
jmp 0x18002a631
cmp r12d, 0xd90e
ja 0x18002a7d4
je 0x18002a7c7
cmp r12d, 0x48c6
je 0x18002a79c
cmp r12d, 0x5287
je 0x18002a790
cmp r12d, 0x90ea
jne 0x18002a631
mov r8d, 2
lea rdx, [0x180035098]
lea rcx, [rbp + 0x186]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov eax, dword [rsp + 0x44]
mov r10, qword [rsp + 0x70]
mov r11, qword [rbp - 0x78]
jmp 0x18002a61f
mov byte [rbp + 0x151], sil
jmp 0x18002a631
mov eax, dword [0x180034fc4]
mov dword [rbp + 0x180], eax
movzx eax, word [0x180034fc8]
mov word [rbp + 0x184], ax
mov eax, dword [rsp + 0x44]
mov word [rbp + 0x186], r9w
jmp 0x18002a631
mov word [rbp + 0x18a], r9w
jmp 0x18002a631
cmp r12d, 0x12132
je 0x18002a851
cmp r12d, 0x16956
je 0x18002a83a
cmp r12d, 0x1b17a
jne 0x18002a631
mov r8d, 1
lea rdx, [0x180034fe4]
lea rcx, [rbp + 0x194]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
mov eax, dword [rsp + 0x44]
xor r9d, r9d
mov r10, qword [rsp + 0x70]
mov cl, 1
mov r11, qword [rbp - 0x78]
movabs rdx, 0x6f0076006e0069
mov word [rbp + 0x196], r9w
mov byte [rsp + 0x40], cl
jmp 0x18002a631
mov dword [rbp + 0x190], 0x70006d
mov word [rbp + 0x194], r9w
jmp 0x18002a631
mov eax, dword [0x180034f56]
mov dword [rbp + 0x18a], eax
movzx eax, word [0x180034f5a]
mov word [rbp + 0x18e], ax
mov eax, dword [rsp + 0x44]
mov word [rbp + 0x190], r9w
jmp 0x18002a631
cmp qword [rbp - 0x80], 0xffffffffffffffff
jne 0x18002aedb
mov esi, 9
nop dword [rax]
cmp esi, 9
ja case.default.0x18002a8a5
mov eax, esi
mov ecx, dword [rdi + rax*4 + 0x2aefc]
add rcx, rdi
jmp rcx
movzx eax, word [0x1800350dc]
lea rdx, [0x1800350e0]
mov word [rbp + 0x169], ax
lea rcx, [rbp + 0x160]
movzx eax, byte [0x1800350de]
mov r8d, 1
mov byte [rbp + 0x16b], al
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov eax, dword [str.e_ms_]
mov dword [rbp + 0x16c], eax
movzx eax, word [0x1800350e8]
mov word [rbp + 0x170], ax
jmp case.default.0x18002a8a5
mov r8d, 4
lea rdx, [0x1800350ec]
lea rcx, [rbp + 0x160]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov eax, 0x64
mov word [rbp + 0x163], ax
jmp case.default.0x18002a8a5
test r14, r14
movzx eax, r12b
mov ecx, r9d
cmovne ecx, eax
movzx r12d, cl
test cl, cl
je case.default.0x18002a8a5
mov edi, 0x5e
mov eax, edi
sub eax, 0x5c
je 0x18002a96e
sub eax, 1
je 0x18002a95a
cmp eax, 1
jne 0x18002a9b9
mov r15, r9
jmp 0x18002a9b9
xor r8d, r8d
mov rdx, r15
mov rcx, r14
call qword [sym.imp.WINMM.dll_mmioRead]
mov r13d, eax
jmp 0x18002a9b6
cmp r13d, 0xffffffff
jne 0x18002a986
lea edx, [r13 + 0x11]
mov rcx, r14
call qword [sym.imp.WINMM.dll_mmioClose]
xor r12b, r12b
jmp 0x18002a9b6
test r12b, r12b
je 0x18002a9b9
xor r8d, r8d
mov rdx, r15
mov rcx, r14
call qword [sym.imp.WINMM.dll_mmioWrite]
mov edx, 0x10
mov rcx, r14
call qword [sym.imp.WINMM.dll_mmioFlush]
mov edx, 0x10
mov rcx, r14
call qword [sym.imp.WINMM.dll_mmioClose]
xor r9d, r9d
dec edi
cmp edi, 0x5b
ja 0x18002a944
lea rdi, [0x180000000]
jmp case.default.0x18002a8a5
mov dword [rbp - 0x54], r9d
mov dword [rbp - 0x58], r9d
jmp case.default.0x18002a8a5
movzx eax, word [0x1800350f0]
mov dword [rbp + 0x164], 0x323574
mov word [rbp + 0x167], ax
movzx eax, byte [0x1800350f2]
mov byte [rbp + 0x169], al
jmp case.default.0x18002a8a5
mov r8d, dword [rbp - 0x4c]
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x160]
call qword [sym.imp.WINMM.dll_mmioOpenA]
mov r9d, dword [rbp - 0x50]
mov r14, rax
mov r8d, dword [rbp - 0x58]
mov edx, dword [rbp - 0x54]
mov rcx, qword [rbp - 0x30]
mov dword [rsp + 0x20], 0xa
call qword [sym.imp.GDI32.dll_SetRectRgn]
jmp case.default.0x18002a8a5
mov r8d, 7
lea rdx, str.MY.res
lea rcx, [rbp + 0x171]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov r12b, 1
jmp case.default.0x18002a8a5
xorps xmm0, xmm0
mov dword [rbp - 0x50], 0xa
xor eax, eax
mov dword [rbp - 0x4c], r9d
movups xmmword [rbp - 0x20], xmm0
mov dword [rbp + 0x40], eax
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
jmp case.default.0x18002a8a5
mov qword [rbp - 0x30], r9
dec esi
mov r9d, 0
lea eax, [rsi + 0x34]
cmp eax, 0x33
ja 0x18002a890
mov edx, dword [rsp + 0x44]
mov r8d, dword [rsp + 0x4c]
movzx ecx, byte [rsp + 0x40]
jmp 0x18002aedb
cmp qword [r11 + 0x18], 8
mov rcx, r11
jb 0x18002aabe
mov rcx, qword [r11]
mov qword [rsp + 0x30], r9
mov edx, 0x80000000
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov edx, dword [rsp + 0x44]
xor r9d, r9d
mov r8d, dword [rsp + 0x4c]
movzx ecx, byte [rsp + 0x40]
mov qword [rbp - 0x80], rax
jmp 0x18002aedb
mov dword [rsp + 0x64], r9d
jmp 0x18002aedb
mov eax, r8d
sub eax, 0x21e
je 0x18002ab25
cmp eax, 0x5f
jne 0x18002aedb
mov dword [rbp - 0x5c], r9d
jmp 0x18002aedb
mov rcx, qword [rbp - 0x80]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [rsp + 0x44]
xor r9d, r9d
mov r8d, dword [rsp + 0x4c]
movzx ecx, byte [rsp + 0x40]
mov dword [rsp + 0x58], eax
jmp 0x18002aedb
mov ecx, dword [rsp + 0x58]
mov rdx, qword [r10 + 0x10]
cmp rcx, rdx
ja 0x18002ab7f
mov qword [r10 + 0x10], rcx
mov rax, r10
cmp qword [r10 + 0x18], 0x10
jb 0x18002ab69
mov rax, qword [r10]
mov edx, dword [rsp + 0x44]
mov byte [rax + rcx], 0
movzx ecx, byte [rsp + 0x40]
mov dword [rbp - 0x60], r9d
jmp 0x18002aedb
mov r8, qword [r10 + 0x18]
mov rsi, rcx
mov rax, r8
sub rsi, rdx
sub rax, rdx
cmp rsi, rax
ja 0x18002abc2
mov qword [r10 + 0x10], rcx
mov rax, r10
cmp r8, 0x10
jb 0x18002aba4
mov rax, qword [r10]
lea rdi, [rax + rdx]
mov r8, rsi
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov byte [rdi + rsi], 0
lea rdi, [0x180000000]
jmp 0x18002abd8
mov r9, rsi
mov byte [rsp + 0x20], 0
xor r8d, r8d
mov rdx, rsi
mov rcx, r10
call fcn.180002a70
mov r8d, dword [rsp + 0x4c]
xor r9d, r9d
mov edx, dword [rsp + 0x44]
movzx ecx, byte [rsp + 0x40]
mov dword [rbp - 0x60], r9d
jmp 0x18002aedb
cmp r8d, 0x4b7
ja 0x18002ae98
je 0x18002ae5a
mov eax, r8d
sub eax, 0x39a
je 0x18002ade3
sub eax, 0x5f
je 0x18002adc3
cmp eax, 0x5f
jne 0x18002aedb
movzx eax, byte [rsp + 0x40]
mov ecx, r9d
cmp dword [rsp + 0x6c], 0
cmove ecx, eax
mov eax, dword [rsp + 0x58]
mov byte [rsp + 0x40], cl
cmp eax, dword [rsp + 0x60]
je 0x18002aedb
mov edi, r9d
lea rsi, [0x180000000]
cmp edi, 0xe
ja case.0x18002ac66.9
mov eax, edi
mov ecx, dword [rsi + rax*4 + 0x2af24]
add rcx, rsi
jmp rcx
xor bl, bl
jmp case.0x18002ac66.9
mov dword [rbp - 0x68], 0x32
jmp case.0x18002ac66.9
mov qword [r10 + 0x10], r9
mov rax, r10
cmp qword [r10 + 0x18], 0x10
jb 0x18002ac8c
mov rax, qword [r10]
mov byte [rax], 0
mov qword [rbp - 0x38], r9
jmp case.0x18002ac66.9
mov dword [rbp - 0x70], 0x10
mov dword [rsp + 0x5c], r9d
mov qword [rsp + 0x78], r9
jmp case.0x18002ac66.9
mov byte [rsp + 0x41], 1
jmp case.0x18002ac66.9
mov r9d, dword [rsp + 0x5c]
lea rax, [rbp + 0x1a0]
mov r8, qword [rbp - 0x38]
mov edx, dword [rsp + 0x50]
mov rcx, qword [rbp - 0x28]
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor r9d, r9d
mov dword [rbp - 0x48], eax
movzx eax, byte [rsp + 0x41]
mov ecx, r9d
cmp qword [rbp - 0x40], rcx
cmovne ecx, eax
mov byte [rsp + 0x41], cl
jmp case.0x18002ac66.9
mov byte [rsp + 0x48], 1
jmp case.0x18002ac66.9
mov qword [rbp - 0x28], r9
mov dword [rbp - 0x6c], 0x32
mov dword [rsp + 0x50], 0x36
jmp case.0x18002ac66.9
cmp byte [rsp + 0x48], 0
je case.0x18002ac66.9
mov r8d, dword [rsp + 0x5c]
lea r9, [rbp + 0x1a0]
mov rdx, qword [rbp - 0x38]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_SHSetFolderPathW]
jmp 0x18002ad8e
movzx eax, byte [rsp + 0x48]
mov ecx, r9d
cmp dword [rbp - 0x48], 0
cmove ecx, eax
mov byte [rsp + 0x48], cl
jmp case.0x18002ac66.9
mov rax, qword [rsp + 0x78]
mov r9d, dword [rbp - 0x70]
mov r8d, dword [rbp - 0x64]
mov edx, dword [rbp - 0x6c]
mov ecx, dword [rbp - 0x68]
mov qword [rsp + 0x20], rax
call qword [sym.imp.GDI32.dll_CreateBitmap]
mov qword [rbp - 0x40], rax
jmp 0x18002ad8e
mov dword [rbp - 0x64], 1
jmp case.0x18002ac66.9
cmp byte [rsp + 0x41], 0
je case.0x18002ac66.9
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.GDI32.dll_DeleteObject]
xor r9d, r9d
mov r10, qword [rsp + 0x70]
inc edi
lea eax, [rdi + 0xcb]
cmp eax, 0xda
jb 0x18002ac51
mov edx, dword [rsp + 0x44]
lea rdi, [0x180000000]
mov r8d, dword [rsp + 0x4c]
movzx ecx, byte [rsp + 0x40]
jmp 0x18002aedb
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [rsp + 0x44]
xor r9d, r9d
mov r8d, dword [rsp + 0x4c]
movzx ecx, byte [rsp + 0x40]
jmp 0x18002aedb
cmp qword [r10 + 0x18], 0x10
mov rdx, r10
jb 0x18002adf0
mov rdx, qword [r10]
mov r8d, dword [rsp + 0x58]
mov rcx, qword [rbp - 0x80]
mov qword [rsp + 0x20], r9
lea r9, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rbp - 0x60]
lea r8, [rsp + 0x68]
mov dword [rsp + 0x38], eax
lea rcx, [rbp + 0x178]
mov eax, dword [rbp - 0x5c]
xor r9d, r9d
mov qword [rsp + 0x30], 0
xor edx, edx
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
call sub.SHLWAPI.dll_SHRegGetUSValueW
mov edx, dword [rsp + 0x44]
xor r9d, r9d
mov r8d, dword [rsp + 0x4c]
movzx ecx, byte [rsp + 0x40]
mov dword [rsp + 0x6c], eax
jmp 0x18002aedb
test cl, cl
je 0x18002aedb
mov eax, dword [rsp + 0x64]
lea rcx, [rbp + 0x178]
mov r8d, dword [rsp + 0x68]
xor r9d, r9d
mov dword [rsp + 0x28], 1
xor edx, edx
mov dword [rsp + 0x20], eax
call qword [sym.imp.SHLWAPI.dll_SHRegSetUSValueW]
mov edx, dword [rsp + 0x44]
xor r9d, r9d
mov r8d, dword [rsp + 0x4c]
movzx ecx, byte [rsp + 0x40]
jmp 0x18002aedb
mov eax, r8d
sub eax, 0x516
je 0x18002aedb
sub eax, 0x5f
je 0x18002aed9
cmp eax, 0x5f
jne 0x18002aedb
movzx eax, bl
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.18002d670
mov rbx, qword [rsp + 0x510]
add rsp, 0x4c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov bl, 1
add r8d, 0x5f
mov dword [rsp + 0x4c], r8d
cmp r8d, edx
jae case.0x18002ac66.14
mov r10, qword [rsp + 0x70]
mov r11, qword [rbp - 0x78]
jmp 0x18002a680
xor al, al
jmp 0x18002aeaf