Function at 0x1400020f0
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
mov eax, 0x19e8
call fcn.140021b70
sub rsp, rax
mov qword [rsp + 0x1878], 0xfffffffffffffffe
mov rax, qword [0x14002e260]
xor rax, rsp
mov qword [rsp + 0x19d8], rax
lea rax, [rsp + 0x298]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARECanonCBTSETUP
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400025a9
mov dword [rsp + 0x290], 0x114
lea rax, [rsp + 0x290]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x3c0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x160]
xor r8d, r8d
lea rdx, str.Path
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x164], eax
cmp dword [rsp + 0x164], 0
jne 0x14000226d
lea rdx, [rsp + 0x3c0]
lea rcx, [rsp + 0xbc8]
call fcn.140007f70
mov qword [rsp + 0x1880], rax
mov rax, qword [rsp + 0x1880]
mov qword [rsp + 0x1098], rax
mov rcx, qword [rsp + 0x19f0]
add rcx, 0x80
mov r9, qword [0x1400256b8]
xor r8d, r8d
mov rdx, qword [rsp + 0x1098]
call fcn.140009120
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xbc8]
call fcn.140009910
mov r8, qword [rsp + 0x19f0]
add r8, 0x80
lea rdx, str.__CBT_installation_path:
lea rcx, [rsp + 0xbf0]
call fcn.14000d8b0
mov qword [rsp + 0x1888], rax
mov rax, qword [rsp + 0x1888]
mov qword [rsp + 0x1890], rax
mov rcx, qword [rsp + 0x1890]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xbf0]
call fcn.140009910
mov dword [rsp + 0x290], 0x114
lea rax, [rsp + 0x290]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x170]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x160]
xor r8d, r8d
lea rdx, str.Dependent_files
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x164], eax
cmp dword [rsp + 0x164], 0
jne 0x14000259b
lea rax, [rsp + 0x170]
mov qword [rsp + 0x760], rax
mov eax, dword [rsp + 0x290]
mov qword [rsp + 0x768], rax
cmp qword [rsp + 0x768], 0
jbe 0x14000259b
lea rax, [rsp + 0x10a0]
mov qword [rsp + 0x10a8], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xc20]
call fcn.140009910
mov rcx, qword [rsp + 0x760]
call fcn.140015f90
mov qword [rsp + 0x10b0], rax
mov r8, qword [rsp + 0x10b0]
mov rdx, qword [rsp + 0x760]
lea rcx, [rsp + 0xc20]
call fcn.14000a940
lea rax, [rsp + 0xc20]
mov qword [rsp + 0x10b8], rax
mov rax, qword [rsp + 0x10b8]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x10c0], rax
cmp qword [rsp + 0x10c0], 0
jne 0x140002385
mov dword [rsp + 0x1898], 1
jmp 0x140002390
mov dword [rsp + 0x1898], 0
movzx eax, byte [rsp + 0x1898]
mov byte [rsp + 0xc18], al
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xc20]
call fcn.140009910
movzx eax, byte [rsp + 0xc18]
test eax, eax
je 0x1400023c2
jmp 0x14000259b
lea rax, [rsp + 0x10c8]
mov qword [rsp + 0x10d0], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xc48]
call fcn.140009910
mov rcx, qword [rsp + 0x760]
call fcn.140015f90
mov qword [rsp + 0x10d8], rax
mov r8, qword [rsp + 0x10d8]
mov rdx, qword [rsp + 0x760]
lea rcx, [rsp + 0xc48]
call fcn.14000a940
nop
mov rcx, qword [rsp + 0x19f0]
add rcx, 0xd0
lea rdx, [rsp + 0xc48]
call fcn.1400085f0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xc48]
call fcn.140009910
lea rax, [rsp + 0x1130]
mov qword [rsp + 0x1138], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xc70]
call fcn.140009910
mov rcx, qword [rsp + 0x760]
call fcn.140015f90
mov qword [rsp + 0x1140], rax
mov r8, qword [rsp + 0x1140]
mov rdx, qword [rsp + 0x760]
lea rcx, [rsp + 0xc70]
call fcn.14000a940
lea rax, [rsp + 0xc70]
mov qword [rsp + 0x1148], rax
mov rax, qword [rsp + 0x1148]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x1150], rax
mov rcx, qword [rsp + 0x1150]
mov rax, qword [rsp + 0x768]
sub rax, rcx
sub rax, 1
mov qword [rsp + 0x768], rax
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xc70]
call fcn.140009910
lea rax, [rsp + 0x1158]
mov qword [rsp + 0x1160], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xc98]
call fcn.140009910
mov rcx, qword [rsp + 0x760]
call fcn.140015f90
mov qword [rsp + 0x1168], rax
mov r8, qword [rsp + 0x1168]
mov rdx, qword [rsp + 0x760]
lea rcx, [rsp + 0xc98]
call fcn.14000a940
lea rax, [rsp + 0xc98]
mov qword [rsp + 0x1170], rax
mov rax, qword [rsp + 0x1170]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x1178], rax
mov rcx, qword [rsp + 0x760]
mov rax, qword [rsp + 0x1178]
lea rax, [rcx + rax + 1]
mov qword [rsp + 0x760], rax
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xc98]
call fcn.140009910
jmp 0x1400022e6
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x298]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARECanonCBTSETUPCBTUser
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400026c7
mov dword [rsp + 0x4e0], 0
jmp 0x1400025f9
mov eax, dword [rsp + 0x4e0]
add eax, 1
mov dword [rsp + 0x4e0], eax
xor eax, eax
cmp eax, 1
je 0x1400026c7
mov dword [rsp + 0x290], 0x104
mov dword [rsp + 0x3b0], 0x104
lea rax, [rsp + 0x3b0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x160]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x290]
lea r8, [rsp + 0x50]
mov edx, dword [rsp + 0x4e0]
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [rsp + 0x164], eax
cmp dword [rsp + 0x164], 0
jne 0x140002686
movsx eax, byte [rsp + 0x50]
test eax, eax
jne 0x140002688
jmp 0x1400026c7
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0xcc0]
call fcn.140007f70
nop
lea rdx, [rsp + 0xcc0]
lea rcx, [0x14003fb20]
call fcn.1400085f0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xcc0]
call fcn.140009910
jmp 0x1400025e8
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsp + 0x19f0]
cmp qword [rax + 0x98], 0
jne 0x1400026f4
mov dword [rsp + 0x189c], 1
jmp 0x1400026ff
mov dword [rsp + 0x189c], 0
movzx eax, byte [rsp + 0x189c]
test eax, eax
je 0x1400027e3
mov edx, 0x400
lea rcx, [rsp + 0x770]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea rdx, [rsp + 0x770]
lea rcx, [rsp + 0xce8]
call fcn.140007f70
mov qword [rsp + 0x18a0], rax
mov rax, qword [rsp + 0x18a0]
mov qword [rsp + 0x1208], rax
mov rcx, qword [rsp + 0x19f0]
add rcx, 0x80
mov r9, qword [0x1400256b8]
xor r8d, r8d
mov rdx, qword [rsp + 0x1208]
call fcn.140009120
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xce8]
call fcn.140009910
mov r8, qword [rsp + 0x19f0]
add r8, 0x80
lea rdx, str.__CBT_installation_path:
lea rcx, [rsp + 0xd10]
call fcn.14000d8b0
mov qword [rsp + 0x18a8], rax
mov rax, qword [rsp + 0x18a8]
mov qword [rsp + 0x18b0], rax
mov rcx, qword [rsp + 0x18b0]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xd10]
call fcn.140009910
mov rax, qword [rsp + 0x19f0]
add rax, 0xd0
mov qword [rsp + 0x1210], rax
mov rax, qword [rsp + 0x1210]
mov rcx, qword [rsp + 0x1210]
mov rcx, qword [rcx + 0x18]
mov rax, qword [rax + 0x20]
sub rax, rcx
cqo
mov ecx, 0x28
idiv rcx
test rax, rax
jne 0x140002830
mov dword [rsp + 0x18b8], 1
jmp 0x14000283b
mov dword [rsp + 0x18b8], 0
movzx eax, byte [rsp + 0x18b8]
test eax, eax
je 0x140002ba1
lea rdx, str.NBCBT95.dll_NBPORT95.exe_NBLOCALT.dll_NBPORTNT.exe_NBCBTNT.dll_NBCBTSPT.dat_AUPORT.exe
lea rcx, [rsp + 0xb70]
call fcn.140007f70
nop
lea rax, [rsp + 0x1230]
mov qword [rsp + 0x1238], rax
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xb98]
call fcn.140009910
nop
xor eax, eax
cmp eax, 1
je 0x140002b7c
lea rcx, [0x1400258cc]
call fcn.140015f90
mov qword [rsp + 0x1240], rax
mov r9, qword [rsp + 0x1240]
xor r8d, r8d
lea rdx, [0x1400258cc]
lea rcx, [rsp + 0xb70]
call fcn.140009540
mov qword [rsp + 0xbc0], rax
mov rax, qword [0x1400256b8]
cmp qword [rsp + 0xbc0], rax
jne 0x1400028fe
mov r9, qword [0x1400256b8]
xor r8d, r8d
lea rdx, [rsp + 0xb70]
lea rcx, [rsp + 0xb98]
call fcn.140009120
jmp 0x1400029fe
cmp qword [rsp + 0xbc0], 0
jbe 0x140002978
mov r9, qword [rsp + 0xbc0]
xor r8d, r8d
lea rdx, [rsp + 0xd38]
lea rcx, [rsp + 0xb70]
call fcn.140008180
mov qword [rsp + 0x18c0], rax
mov rax, qword [rsp + 0x18c0]
mov qword [rsp + 0x1248], rax
mov r9, qword [0x1400256b8]
xor r8d, r8d
mov rdx, qword [rsp + 0x1248]
lea rcx, [rsp + 0xb98]
call fcn.140009120
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xd38]
call fcn.140009910
jmp 0x1400029fe
mov rax, qword [rsp + 0xb88]
mov qword [rsp + 0x1250], rax
mov r9, qword [rsp + 0x1250]
sub r9, 1
mov r8d, 1
lea rdx, [rsp + 0xd60]
lea rcx, [rsp + 0xb70]
call fcn.140008180
mov qword [rsp + 0x18c8], rax
mov rax, qword [rsp + 0x18c8]
mov qword [rsp + 0x1258], rax
mov r9, qword [0x1400256b8]
xor r8d, r8d
mov rdx, qword [rsp + 0x1258]
lea rcx, [rsp + 0xb70]
call fcn.140009120
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xd60]
call fcn.140009910
jmp 0x140002883
cmp qword [rsp + 0xbb0], 0
jne 0x140002a16
mov dword [rsp + 0x18d0], 1
jmp 0x140002a21
mov dword [rsp + 0x18d0], 0
movzx eax, byte [rsp + 0x18d0]
test eax, eax
jne 0x140002a70
lea rcx, [0x1400258cc]
call fcn.140015f90
mov qword [rsp + 0x1260], rax
mov rax, qword [rsp + 0x1260]
mov qword [rsp + 0x20], rax
lea r9, [0x1400258cc]
mov r8, qword [rsp + 0xbb0]
xor edx, edx
lea rcx, [rsp + 0xb98]
call fcn.1400097d0
test eax, eax
jne 0x140002a75
jmp 0x140002b7c
lea rdx, [rsp + 0xb98]
lea rcx, [0x14003faf0]
call fcn.1400085f0
mov rax, qword [rsp + 0xbb0]
mov qword [rsp + 0x12c8], rax
cmp qword [rsp + 0xbb8], 0x10
jb 0x140002ab6
mov rax, qword [rsp + 0xba0]
mov qword [rsp + 0x18d8], rax
jmp 0x140002ac6
lea rax, [rsp + 0xba0]
mov qword [rsp + 0x18d8], rax
mov r9, qword [rsp + 0x12c8]
xor r8d, r8d
mov rdx, qword [rsp + 0x18d8]
lea rcx, [rsp + 0xb70]
call fcn.140009540
mov qword [rsp + 0x12d0], rax
mov rax, qword [rsp + 0xbb0]
mov qword [rsp + 0x12d8], rax
mov rax, qword [rsp + 0x12d8]
mov r8, qword [rsp + 0x12d0]
add r8, rax
mov r9, qword [0x1400256b8]
lea rdx, [rsp + 0xd88]
lea rcx, [rsp + 0xb70]
call fcn.140008180
mov qword [rsp + 0x18e0], rax
mov rax, qword [rsp + 0x18e0]
mov qword [rsp + 0x12e0], rax
mov r9, qword [0x1400256b8]
xor r8d, r8d
mov rdx, qword [rsp + 0x12e0]
lea rcx, [rsp + 0xb70]
call fcn.140009120
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xd88]
call fcn.140009910
jmp 0x140002883
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xb98]
call fcn.140009910
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xb70]
call fcn.140009910
lea rax, [rsp + 0x298]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWARECanonDIASSETUP
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140002fb4
mov dword [rsp + 0x290], 0x114
lea rax, [rsp + 0x290]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x610]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x160]
xor r8d, r8d
lea rdx, str.Path
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x164], eax
cmp dword [rsp + 0x164], 0
jne 0x140002d76
lea rdx, [rsp + 0x610]
lea rcx, [rsp + 0xdb0]
call fcn.140007f70
mov qword [rsp + 0x18e8], rax
mov rax, qword [rsp + 0x18e8]
mov qword [rsp + 0x18f0], rax
lea r8, [0x14002570c]
mov rdx, qword [rsp + 0x18f0]
lea rcx, [rsp + 0xdd8]
call fcn.14000d9c0
mov qword [rsp + 0x18f8], rax
mov rax, qword [rsp + 0x18f8]
mov qword [rsp + 0x1900], rax
lea r8, str.CnxDias.exe
mov rdx, qword [rsp + 0x1900]
lea rcx, [rsp + 0xe00]
call fcn.14000d9c0
mov qword [rsp + 0x1908], rax
mov rax, qword [rsp + 0x1908]
mov qword [rsp + 0x1300], rax
mov rcx, qword [rsp + 0x19f0]
add rcx, 0x30
mov r9, qword [0x1400256b8]
xor r8d, r8d
mov rdx, qword [rsp + 0x1300]
call fcn.140009120
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xe00]
call fcn.140009910
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xdd8]
call fcn.140009910
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xdb0]
call fcn.140009910
mov r8, qword [rsp + 0x19f0]
add r8, 0x30
lea rdx, str.__Dias_installation_path:
lea rcx, [rsp + 0xe28]
call fcn.14000d8b0
mov qword [rsp + 0x1910], rax
mov rax, qword [rsp + 0x1910]
mov qword [rsp + 0x1918], rax
mov rcx, qword [rsp + 0x1918]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xe28]
call fcn.140009910
mov dword [rsp + 0x290], 0x114
lea rax, [rsp + 0x290]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x160]
xor r8d, r8d
lea rdx, str.AppPath
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x164], eax
cmp dword [rsp + 0x164], 0
jne 0x140002e8b
lea rdx, [rsp + 0x4f0]
lea rcx, [rsp + 0xe50]
call fcn.140007f70
mov qword [rsp + 0x1920], rax
mov rax, qword [rsp + 0x1920]
mov qword [rsp + 0x1320], rax
mov rcx, qword [rsp + 0x19f0]
add rcx, 0x58
mov r9, qword [0x1400256b8]
xor r8d, r8d
mov rdx, qword [rsp + 0x1320]
call fcn.140009120
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xe50]
call fcn.140009910
mov r8, qword [rsp + 0x19f0]
add r8, 0x58
lea rdx, str.__Dias_data_path:
lea rcx, [rsp + 0xe78]
call fcn.14000d8b0
mov qword [rsp + 0x1928], rax
mov rax, qword [rsp + 0x1928]
mov qword [rsp + 0x1930], rax
mov rcx, qword [rsp + 0x1930]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xe78]
call fcn.140009910
mov dword [rsp + 0x290], 0x114
lea rax, [rsp + 0x290]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x160]
xor r8d, r8d
lea rdx, str.BuildNumber
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x164], eax
cmp dword [rsp + 0x164], 0
jne 0x140002fa6
lea rdx, [rsp + 0x4f0]
lea rcx, [rsp + 0xea0]
call fcn.140007f70
mov qword [rsp + 0x1938], rax
mov rax, qword [rsp + 0x1938]
mov qword [rsp + 0x1340], rax
mov rcx, qword [rsp + 0x19f0]
add rcx, 0xa8
mov r9, qword [0x1400256b8]
xor r8d, r8d
mov rdx, qword [rsp + 0x1340]
call fcn.140009120
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xea0]
call fcn.140009910
mov r8, qword [rsp + 0x19f0]
add r8, 0xa8
lea rdx, str.__Dias_build_ver:
lea rcx, [rsp + 0xec8]
call fcn.14000d8b0
mov qword [rsp + 0x1940], rax
mov rax, qword [rsp + 0x1940]
mov qword [rsp + 0x1948], rax
mov rcx, qword [rsp + 0x1948]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xec8]
call fcn.140009910
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsp + 0x19f0]
cmp qword [rax + 0x48], 0
jne 0x140002fd0
mov dword [rsp + 0x1950], 1
jmp 0x140002fdb
mov dword [rsp + 0x1950], 0
movzx eax, byte [rsp + 0x1950]
test eax, eax
je 0x1400031ed
mov dword [rsp + 0x290], 0x114
lea rax, [rsp + 0x298]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersion
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x164], eax
cmp dword [rsp + 0x164], 0
jne 0x1400031e6
lea rax, [rsp + 0x290]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x4f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x160]
xor r8d, r8d
lea rdx, str.ProgramFilesDir
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x164], eax
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x164], 0
jne 0x1400031dd
lea rdx, [rsp + 0x4f0]
lea rcx, [rsp + 0xef0]
call fcn.140007f70
mov qword [rsp + 0x1958], rax
mov rax, qword [rsp + 0x1958]
mov qword [rsp + 0x1960], rax
lea r8, str.CanonDIAS_
mov rdx, qword [rsp + 0x1960]
lea rcx, [rsp + 0xf18]
call fcn.14000d9c0
mov qword [rsp + 0x1968], rax
mov rax, qword [rsp + 0x1968]
mov qword [rsp + 0x1970], rax
lea r8, str.CnxDias.exe
mov rdx, qword [rsp + 0x1970]
lea rcx, [rsp + 0xf40]
call fcn.14000d9c0
mov qword [rsp + 0x1978], rax
mov rax, qword [rsp + 0x1978]
mov qword [rsp + 0x1360], rax
mov rcx, qword [rsp + 0x19f0]
add rcx, 0x30
mov r9, qword [0x1400256b8]
xor r8d, r8d
mov rdx, qword [rsp + 0x1360]
call fcn.140009120
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xf40]
call fcn.140009910
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xf18]
call fcn.140009910
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xef0]
call fcn.140009910
mov r8, qword [rsp + 0x19f0]
add r8, 0x30
lea rdx, str.__Dias_installation_path:
lea rcx, [rsp + 0xf68]
call fcn.14000d8b0
mov qword [rsp + 0x1980], rax
mov rax, qword [rsp + 0x1980]
mov qword [rsp + 0x1988], rax
mov rcx, qword [rsp + 0x1988]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xf68]
call fcn.140009910
jmp 0x1400031e4
xor al, al
jmp 0x1400035fc
jmp 0x1400031ed
xor al, al
jmp 0x1400035fc
mov rax, qword [rsp + 0x19f0]
cmp qword [rax + 0x70], 0
jne 0x140003209
mov dword [rsp + 0x1990], 1
jmp 0x140003214
mov dword [rsp + 0x1990], 0
movzx eax, byte [rsp + 0x1990]
test eax, eax
je 0x1400033df
mov dword [rsp + 0x290], 0x114
lea rax, [rsp + 0x298]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [rsp + 0x164], eax
cmp dword [rsp + 0x164], 0
jne 0x1400033d8
lea rax, [rsp + 0x290]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x610]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x160]
xor r8d, r8d
lea rdx, str.Common_AppData
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [rsp + 0x164], eax
mov rcx, qword [rsp + 0x298]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rsp + 0x164], 0
jne 0x1400033cf
lea rdx, [rsp + 0x610]
lea rcx, [rsp + 0xf90]
call fcn.140007f70
mov qword [rsp + 0x1998], rax
mov rax, qword [rsp + 0x1998]
mov qword [rsp + 0x19a0], rax
lea r8, str.Canon
mov rdx, qword [rsp + 0x19a0]
lea rcx, [rsp + 0xfb8]
call fcn.14000d9c0
mov qword [rsp + 0x19a8], rax
mov rax, qword [rsp + 0x19a8]
mov qword [rsp + 0x13a0], rax
mov rcx, qword [rsp + 0x19f0]
add rcx, 0x58
mov r9, qword [0x1400256b8]
xor r8d, r8d
mov rdx, qword [rsp + 0x13a0]
call fcn.140009120
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xfb8]
call fcn.140009910
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xf90]
call fcn.140009910
mov r8, qword [rsp + 0x19f0]
add r8, 0x58
lea rdx, str.__Dias_data_path:
lea rcx, [rsp + 0xfe0]
call fcn.14000d8b0
mov qword [rsp + 0x19b0], rax
mov rax, qword [rsp + 0x19b0]
mov qword [rsp + 0x19b8], rax
mov rcx, qword [rsp + 0x19b8]
call fcn.1400019b0
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0xfe0]
call fcn.140009910
jmp 0x1400033d6
xor al, al
jmp 0x1400035fc
jmp 0x1400033df
xor al, al
jmp 0x1400035fc
lea rax, [rsp + 0x738]
mov qword [rsp + 0x1418], rax
lea rax, [rsp + 0x1408]
mov qword [rsp + 0x1410], rax
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x1418]
call fcn.140009910
nop
mov dword [rsp + 0x730], 2
lea r8, str.DIASLog
lea rdx, [0x14003fa78]
lea rcx, [rsp + 0x1008]
call fcn.14000d9c0
mov qword [rsp + 0x19c0], rax
mov rax, qword [rsp + 0x19c0]
mov qword [rsp + 0x1420], rax
mov r9, qword [0x1400256b8]
xor r8d, r8d
mov rdx, qword [rsp + 0x1420]
lea rcx, [rsp + 0x738]
call fcn.140009120
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x1008]
call fcn.140009910
lea rdx, [rsp + 0x730]
lea rcx, [0x14003fb50]
call fcn.140008920
mov dword [rsp + 0x730], 1
lea r8, str.DIASCfg
lea rdx, [0x14003fa78]
lea rcx, [rsp + 0x1030]
call fcn.14000d9c0
mov qword [rsp + 0x19c8], rax
mov rax, qword [rsp + 0x19c8]
mov qword [rsp + 0x1530], rax
mov r9, qword [0x1400256b8]
xor r8d, r8d
mov rdx, qword [rsp + 0x1530]
lea rcx, [rsp + 0x738]
call fcn.140009120
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x1030]
call fcn.140009910
lea rdx, [rsp + 0x730]
lea rcx, [0x14003fb50]
call fcn.140008920
mov dword [rsp + 0x730], 1
lea r8, [0x140025750]
lea rdx, [0x14003fa78]
lea rcx, [rsp + 0x1058]
call fcn.14000d9c0
mov qword [rsp + 0x19d0], rax
mov rax, qword [rsp + 0x19d0]
mov qword [rsp + 0x1648], rax
mov r9, qword [0x1400256b8]
xor r8d, r8d
mov rdx, qword [rsp + 0x1648]
lea rcx, [rsp + 0x738]
call fcn.140009120
nop
xor r8d, r8d
mov dl, 1
lea rcx, [rsp + 0x1058]
call fcn.140009910
lea rdx, [rsp + 0x730]
lea rcx, [0x14003fb50]
call fcn.140008920
mov dword [rsp + 0x730], 1
mov r9, qword [0x1400256b8]
xor r8d, r8d
lea rdx, [0x14003fa78]
lea rcx, [rsp + 0x738]
call fcn.140009120
lea rdx, [rsp + 0x730]
lea rcx, [0x14003fb50]
call fcn.140008920
mov byte [rsp + 0x1080], 1
lea rcx, [rsp + 0x738]
xor r8d, r8d
mov dl, 1
call fcn.140009910
mov al, byte [rsp + 0x1080]
mov rcx, qword [rsp + 0x19d8]
xor rcx, rsp
call fcn.140016740
add rsp, 0x19e8
ret