Function at 0x10000191c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov r11, rsp
push rbx
push rsi
sub rsp, 0x48
and qword [r11 + 0x20], 0
and qword [r11 - 0x28], 0
and qword [r11 - 0x20], 0
lea rax, [r11 + 0x20]
mov esi, 1
lea rdx, [0x1000012a0]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov r9d, esi
mov qword [r11 - 0x38], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x100001986
lea r8, [rsp + 0x60]
lea rdx, [0x100001300]
call fcn.100002608
mov rcx, qword [rsp + 0x78]
test eax, eax
jne 0x100001986
mov r8d, dword [rsp + 0x60]
jmp 0x100001989
xor r8d, r8d
mov eax, r8d
movzx edx, r8b
shr r8d, 8
and eax, 0xffff0000
test edx, edx
mov dword [0x100004740], eax
mov dword [0x100004710], eax
movzx eax, r8b
jne 0x1000019b4
mov edx, 2
jmp 0x1000019b7
shr edx, 4
test r8b, r8b
jne 0x1000019c3
mov eax, 5
jmp 0x1000019c6
shr eax, 4
cmp edx, 7
mov r8d, 6
cmova edx, r8d
cmp eax, 7
cmova eax, r8d
test rcx, rcx
mov dword [0x100004738], edx
mov dword [0x100004708], eax
je 0x100001a0b
lea r8, [rsp + 0x60]
lea rdx, [0x100001318]
call fcn.100002608
mov rcx, qword [rsp + 0x78]
test eax, eax
jne 0x100001a0b
mov eax, dword [rsp + 0x60]
jmp 0x100001a0e
or eax, 0xffffffff
test rcx, rcx
mov dword [0x10000473c], eax
mov dword [0x10000470c], eax
je 0x100001a4a
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x38]
lea rdx, [0x100001328]
mov qword [rsp + 0x20], rax
call fcn.100002520
test eax, eax
jne 0x100001a4a
mov rbx, qword [rsp + 0x38]
jmp 0x100001a4c
xor ebx, ebx
and qword [0x100004748], 0
and qword [0x100004718], 0
test rbx, rbx
je 0x100001ab0
cmp word [rbx], 0
je 0x100001a9e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rdx, [rbx + rcx*2]
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharPrevW]
cmp word [rax], 0x5c
je 0x100001abf
cmp word [rax], 0x2f
je 0x100001abf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100001a9e
test al, 0x10
jne 0x100001abf
mov rcx, qword [0x100004770]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [0x1000046f8]
call fcn.100001dcc
mov rbx, rax
test rbx, rbx
je 0x100001af0
and qword [0x100004748], 0
and qword [0x100004718], 0
mov edx, esi
mov rcx, rbx
call fcn.100001c64
mov rcx, qword [0x100004770]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x100001b15
lea r8, [rsp + 0x60]
lea rdx, [0x100001338]
call fcn.100002608
test eax, eax
jne 0x100001b15
mov eax, dword [rsp + 0x60]
jmp 0x100001b17
xor eax, eax
movzx ecx, ax
mov edx, 0x1400000
test ecx, ecx
je 0x100001b28
shl ecx, 0x14
jmp 0x100001b2a
mov ecx, edx
mov eax, 0x500000
mov r9d, esi
mov dword [0x100004754], 0x80000
cmp ecx, eax
cmovb ecx, eax
lea eax, [rcx + 0x80000]
cmp eax, ecx
lea rax, [rsp + 0x30]
cmovb ecx, edx
lea rdx, [0x100001358]
xor r8d, r8d
mov dword [0x100004750], ecx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x30]
and dword [0x100004760], 0
test rcx, rcx
je 0x100001bb2
lea r8, [rsp + 0x60]
lea rdx, [0x100001398]
call fcn.100002608
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x100001bb2
mov eax, dword [0x100004760]
test byte [rsp + 0x60], sil
cmovne eax, esi
mov dword [0x100004760], eax
mov rdx, qword [rsp + 0x78]
test rdx, rdx
je 0x100001bca
mov rcx, rdx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x100001bd5
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
add rsp, 0x48
pop rsi
pop rbx
ret