Function at 0x140080598
Capabilities:
Create process on windows
Get common file path

Disassembly:
push r12
mov eax, 0x5590
call fcn.1400fe810
sub rsp, rax
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x55a8], rbx
mov qword [rsp + 0x55b0], rsi
mov qword [rsp + 0x55b8], rdi
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x5580], rax
mov sil, dl
mov dil, cl
mov r8b, 1
mov r12d, 0x800
mov rdx, r12
lea rcx, [rsp + 0x180]
call fcn.140050ff4
mov rdx, r12
lea rcx, [rsp + 0x180]
call fcn.1400504d4
mov r8, r12
lea rdx, str.Settings.reg
lea rcx, [rsp + 0x180]
call fcn.140065dac
mov r8, r12
lea rdx, [rsp + 0x180]
lea rcx, [rsp + 0x1180]
call fcn.140065d2c
xor ebx, ebx
cmp dil, bl
je 0x140080658
lea r8d, [rbx + 1]
lea rdx, str.ExportedSettings
lea rcx, [0x1401096a0]
call fcn.14009b808
jmp 0x1400806af
mov byte [rsp + 0x20], bl
mov r9b, 1
mov r8, r12
lea rdx, [rsp + 0x180]
lea rcx, str.Settings.reg
call fcn.1400510fc
lea rcx, [rsp + 0x180]
call fcn.140042584
cmp al, bl
jne 0x1400806af
cmp sil, bl
je 0x140080693
xor al, al
jmp 0x1400809a4
mov rcx, rbx
movzx eax, word [rsp + rcx + 0x1180]
mov word [rsp + rcx + 0x180], ax
add rcx, 2
cmp ax, bx
jne 0x140080696
cmp sil, bl
jne 0x1400806f4
mov al, dil
neg al
sbb ecx, ecx
add ecx, 0x5b5
call fcn.14005fad0
mov rdx, rax
mov byte [rsp + 0x20], dil
lea r9, str..reg
lea r8, [rsp + 0x180]
mov rcx, qword [0x140158330]
call fcn.14007af54
cmp al, bl
jne 0x1400806f4
xor al, al
jmp 0x1400809a4
cmp dil, bl
jne 0x14008080d
lea rcx, [rsp + 0xc0]
call fcn.14006634c
nop
mov byte [rsp + 0x38], bl
mov byte [rsp + 0x30], bl
mov byte [rsp + 0x28], bl
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x180]
call fcn.140043668
cmp al, bl
jne 0x140080753
mov rcx, qword [rsp + 0xc0]
cmp rcx, rbx
je 0x14008074c
call fcn.1400e9aa4
xor al, al
jmp 0x1400809a4
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xc0]
call fcn.14006622c
cmp al, bl
je 0x1400807d1
mov rcx, qword [rsp + 0x40]
cmp word [rcx], 0x5b
jne 0x1400807cf
mov r8d, 0x22
lea rdx, str._HKEY_CURRENT_USERSoftwareWinRAR
call fcn.140068cd4
cmp eax, ebx
je 0x1400807a3
mov rcx, qword [rsp + 0xc0]
cmp rcx, rbx
je 0x14008079c
call fcn.1400e9aa4
xor al, al
jmp 0x1400809a4
mov rax, qword [rsp + 0x40]
cmp word [rax + 0x44], 0x5c
je 0x1400807cf
cmp word [rax + 0x44], 0x5d
je 0x1400807cf
mov rcx, qword [rsp + 0xc0]
cmp rcx, rbx
je 0x1400807c8
call fcn.1400e9aa4
xor al, al
jmp 0x1400809a4
jmp 0x140080753
lea rcx, [0x1401096a0]
call fcn.14009bf3c
nop
mov rcx, qword [rsp + 0xc0]
cmp rcx, rbx
je 0x14008080d
call fcn.1400e9aa4
jmp 0x14008080d
lea rax, [rsp + 0x3380]
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea edx, [r9 + 0x23]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov r9, r12
lea r8, [rsp + 0x3380]
lea rdx, str.regedit.exe
lea rcx, [rsp + 0x3380]
call fcn.140050520
lea rax, str._e___s__HKEY_CURRENT_USERSoftwareWinRAR
lea r8, [0x14010f948]
cmp dil, bl
cmovne r8, rax
lea r9, [rsp + 0x180]
mov edx, 0x900
lea rcx, [rsp + 0x2180]
call fcn.140057264
mov r12d, 0x70
mov r8, r12
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.1400ea880
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x54], 0x40
mov rax, qword [0x140158330]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x3380]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x2180]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x80], 1
lea rcx, [rsp + 0x50]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, ebx
setne r12b
cmp r12b, bl
je 0x140080907
mov edx, 0x1388
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dil, bl
je 0x14008091f
lea rdx, str.ExportedSettings
lea rcx, [0x1401096a0]
call fcn.14009b37c
cmp r12b, bl
je 0x140080982
cmp dil, bl
jne 0x14008092e
call fcn.140080274
neg dil
sbb ecx, ecx
add ecx, 0x461
call fcn.14005fad0
mov r8, rax
lea r9, [rsp + 0x180]
mov edx, 0x900
lea rcx, [rsp + 0x4380]
call fcn.140057264
mov ecx, 0x2fb
call fcn.14005fad0
mov r8, rax
xor r9d, r9d
lea rdx, [rsp + 0x4380]
mov rcx, qword [0x140158330]
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x1400809a1
cmp sil, bl
jne 0x1400809a1
mov ecx, 0x201
call fcn.14005fad0
mov rcx, rax
lea rdx, [rsp + 0x2180]
call fcn.1400c5808
mov al, r12b
mov rcx, qword [rsp + 0x5580]
xor rcx, rsp
call fcn.1400e9d00
lea r11, [rsp + 0x5590]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret