Function at 0x140047cf0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x770]
sub rsp, 0x870
mov rsi, rcx
xor r13d, r13d
mov qword [rbp + 0x7c0], r13
mov rax, rcx
cmp qword [rcx + 0x18], 8
jb 0x140047d29
mov rax, qword [rcx]
mov qword [rcx + 0x10], r13
mov word [rax], r13w
lea rdx, str.JaqKKLKJSDKTn9NPjHsGku6Tny6RJL6TSDpRjHcSkm6NJLrSoarRj1IJXuMOcLbSSL_RrabSkuMRau6T
lea rcx, [rsp + 0x50]
call fcn.140057130
nop
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.14004a420
cmp qword [rax + 0x18], 8
jb 0x140047d5a
mov rax, qword [rax]
lea rcx, [rbp + 0x7c0]
mov qword [rsp + 0x20], rcx
mov r9d, 0x20019
xor r8d, r8d
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x140047dc1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047dbc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140048097
call fcn.140011ab0
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r13w
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x140047e12
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140047e0d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004809d
call fcn.140011ab0
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x70]
call fcn.1400141d0
mov dword [rbp + 0x7b0], 0x400
mov rcx, qword [rbp + 0x7c0]
test rcx, rcx
je 0x140048070
lea rax, [rbp + 0x7b0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x7b8]
xor r8d, r8d
lea rdx, str.TEMP
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140048063
lea rax, [rsp + 0x70]
mov rdi, 0xffffffffffffffff
mov rbx, rdi
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140047e82
mov r12, qword [rsi + 0x18]
cmp rbx, r12
ja 0x140047ec2
mov r14, rsi
cmp r12, 8
jb 0x140047ea1
mov r14, qword [rsi]
mov qword [rsi + 0x10], rbx
add rbx, rbx
mov r8, rbx
lea rdx, [rsp + 0x70]
mov rcx, r14
call fcn.140013b20
mov word [rbx + r14], r13w
jmp 0x140047fd1
movabs r15, 0x7ffffffffffffffe
cmp rbx, r15
ja 0x1400480a3
mov rcx, rbx
or rcx, 7
cmp rcx, r15
jbe 0x140047eea
mov rcx, 0xfffffffffffffffe
jmp 0x140047f35
mov rdx, r12
shr rdx, 1
mov rax, r15
sub rax, rdx
cmp r12, rax
jbe 0x140047f04
mov rcx, 0xfffffffffffffffe
jmp 0x140047f35
lea rax, [rdx + r12]
mov r15, rcx
cmp rcx, rax
cmovb r15, rax
lea rcx, [r15 + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140048091
add rcx, rcx
cmp rcx, 0x1000
jb 0x140047f61
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140048091
mov rcx, rax
call fcn.140011ab8
test rax, rax
je 0x14004808b
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140047f73
test rcx, rcx
je 0x140047f70
call fcn.140011ab8
mov r14, rax
jmp 0x140047f73
mov r14, r13
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], r15
add rbx, rbx
mov r8, rbx
lea rdx, [rsp + 0x70]
mov rcx, r14
call fcn.140013b20
mov word [rbx + r14], r13w
cmp r12, 8
jb 0x140047fce
lea rdx, [r12*2 + 2]
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x140047fc9
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004808b
mov rcx, r8
call fcn.140011ab0
mov qword [rsi], r14
mov r9, qword [0x1400b4fa8]
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp word [r9 + rax*2], 0
jne 0x140047fe0
mov rcx, rsi
cmp qword [rsi + 0x18], 8
jb 0x140047ff8
mov rcx, qword [rsi]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, qword [rsi + 0x10]
call fcn.140006050
mov rbx, rax
cmp rax, rdi
je 0x140048063
mov edx, 0x400
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x140048063
lea rax, [rsp + 0x70]
mov rcx, rdi
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140048030
mov rax, qword [0x1400b4fa8]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x140048041
mov r8, rdi
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x70]
mov rdx, rbx
mov rcx, rsi
call fcn.140005d40
mov rcx, qword [rbp + 0x7c0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rsp + 0x8c8]
add rsp, 0x870
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14001828c
int3
call fcn.140001814
nop
call fcn.14001828c
nop
call fcn.14001828c
int3
call fcn.14000235c
int3