Function at 0x180018270
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x180112440]
xor rax, rsp
mov qword [rbp + 0x118], rax
xor ebx, ebx
mov dword [rsp + 0x40], ebx
lea r14, [rcx + 0x10]
cmp qword [r14], rbx
jne 0x180018a37
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r15d, eax
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], 7
mov word [rbp - 0x38], bx
lea r8d, [rbx + 0x14]
lea rdx, str.EppServiceLogEnabled
lea rcx, [rbp - 0x38]
call fcn.180016910
nop
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], bx
lea r8d, [rbx + 0x11]
lea rdx, str.SoftwareEmsisoft
lea rcx, [rsp + 0x68]
call fcn.180016910
mov dword [rbp + 0xc0], ebx
mov dword [rbp + 0xc8], 4
lea r8, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae r8, qword [rbp - 0x38]
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rdx, qword [rsp + 0x68]
lea rax, [rbp + 0xc8]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xc0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov rcx, 0xffffffff80000002
lea r9d, [rbx + 0x10]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov r13d, dword [rbp + 0xc0]
test eax, eax
cmovne r13d, ebx
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x1800183ba
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800183b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018a74
call fcn.180085560
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], bx
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x18001840c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018407
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018a7a
call fcn.180085560
mov qword [rbp - 8], rbx
mov qword [rbp], 7
mov word [rbp - 0x18], bx
mov r8d, 0x11
lea rdx, str.EppClientLogLevel
lea rcx, [rbp - 0x18]
call fcn.180016910
nop
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], bx
mov r8d, 0x11
lea rdx, str.SoftwareEmsisoft
lea rcx, [rbp - 0x78]
call fcn.180016910
mov dword [rbp + 0xc4], ebx
mov dword [rbp + 0xcc], 4
lea r8, [rbp - 0x18]
cmp qword [rbp], 8
cmovae r8, qword [rbp - 0x18]
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rdx, qword [rbp - 0x78]
lea rax, [rbp + 0xcc]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xc4]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov rcx, 0xffffffff80000002
mov r9d, 0x10
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
mov r12d, dword [rbp + 0xc4]
mov edi, 2
test eax, eax
cmovne r12d, edi
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x180018507
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018502
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018a80
call fcn.180085560
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], bx
mov rdx, qword [rbp]
cmp rdx, 8
jb 0x180018557
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018552
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018a86
call fcn.180085560
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], bx
mov r8d, 0x30
lea rdx, str.EmsisoftProtection_Platformeppwscclient__d.log
lea rcx, [rsp + 0x48]
call fcn.180016910
nop
lea r8, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r8, qword [rsp + 0x48]
mov r9d, r15d
xor edx, edx
xor ecx, ecx
call fcn.180025100
inc eax
movsxd rbx, eax
mov rax, rdi
mul rbx
mov rsi, 0xffffffffffffffff
cmovo rax, rsi
mov rcx, rax
call fcn.180085bbc
mov rdi, rax
mov qword [rbp + 0x110], rax
lea r8, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r8, qword [rsp + 0x48]
mov r9d, r15d
mov rdx, rbx
mov rcx, rax
call fcn.180025100
lea r8, [rbx - 1]
lea r8, [rdi + r8*2]
xor r15d, r15d
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xe8], 7
mov word [rbp + 0xd0], r15w
cmp rdi, r8
je 0x180018625
sub r8, rdi
sar r8, 1
mov rdx, rdi
lea rcx, [rbp + 0xd0]
call fcn.180016910
mov dword [rsp + 0x40], 4
mov rcx, rdi
call fcn.180085560
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x180018678
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018673
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018a8c
call fcn.180085560
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r15w
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x68]
call fcn.180006ec0
nop
mov qword [rbp + 0x38], r15
mov qword [rbp + 0x40], 7
mov word [rbp + 0x28], r15w
xor r8d, r8d
lea rdx, [0x1800f31e0]
lea rcx, [rbp + 0x28]
call fcn.180016910
mov dword [rsp + 0x40], 0xc
mov qword [rbp + 0xb8], r15
lea r9, [rbp + 0xb8]
xor r8d, r8d
mov edx, 0x2000
lea rcx, [0x1800dc740]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x180018721
mov rdx, qword [rbp + 0xb8]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x180018700
lea rcx, [rbp + 0x28]
call fcn.180016910
mov rcx, qword [rbp + 0xb8]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
lea rdx, [rbp + 0x28]
lea rcx, [rbp + 0x48]
call fcn.180006ec0
nop
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x48]
call fcn.180047c40
movups xmm0, xmmword [rbp + 0x48]
movups xmmword [rbp + 0xf0], xmm0
movups xmm1, xmmword [rbp + 0x58]
movups xmmword [rbp + 0x100], xmm1
mov qword [rbp + 0x58], r15
mov qword [rbp + 0x60], 7
mov word [rbp + 0x48], r15w
mov rdx, qword [rbp + 0x40]
cmp rdx, 8
jb 0x1800187a4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001879e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018a92
call fcn.180085560
nop
mov rdx, qword [rbp + 0x80]
cmp rdx, 8
jb 0x1800187e7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800187e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018a98
call fcn.180085560
mov qword [rbp + 0x78], r15
mov qword [rbp + 0x80], 7
mov word [rbp + 0x68], r15w
test r13d, r13d
je 0x180018821
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x98]
call fcn.180006ec0
lea rdi, [rbp + 0x98]
mov ebx, 0x15
jmp 0x18001883b
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x20], 7
mov word [rbp + 8], r15w
lea rdi, [rbp + 8]
mov ebx, 0x16
mov dword [rsp + 0x40], ebx
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
mov r8d, 0xc
lea rdx, str.EppWscClient
lea rcx, [rbp - 0x58]
call fcn.180007670
nop
mov r9d, r12d
mov r8, rdi
lea rdx, [rbp - 0x58]
lea rcx, [rbp + 0x88]
call fcn.180034900
mov rdx, rax
mov rcx, r14
call fcn.180025160
mov rdi, qword [rbp + 0x90]
test rdi, rdi
je 0x1800188be
mov eax, esi
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x1800188ba
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
lock xadd dword [rdi + 0xc], esi
cmp esi, 1
jne 0x1800188ba
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 8]
mov ebx, dword [rsp + 0x40]
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1800188f9
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800188f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018a9e
call fcn.180085560
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
test bl, 2
je 0x180018962
and ebx, 0xfffffffd
mov rdx, qword [rbp + 0x20]
cmp rdx, 8
jb 0x180018951
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001894c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018aa4
call fcn.180085560
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x20], 7
mov word [rbp + 8], r15w
test bl, 1
je 0x1800189ae
mov rdx, qword [rbp + 0xb0]
cmp rdx, 8
jb 0x1800189ae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800189a8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018aaa
call fcn.180085560
nop
mov rdx, qword [rbp + 0x108]
cmp rdx, 8
jb 0x1800189f5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800189ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018ab0
call fcn.180085560
nop
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x180018a37
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180018a32
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180018a6e
call fcn.180085560
cmp qword [r14], 0
setne al
mov rcx, qword [rbp + 0x118]
xor rcx, rsp
call fcn.180085510
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1800a889c
nop
call fcn.1800a889c
nop
call fcn.1800a889c
nop
call fcn.1800a889c
nop
call fcn.1800a889c
nop
call fcn.1800a889c
nop
call fcn.1800a889c
nop
call fcn.1800a889c
nop
call fcn.1800a889c
nop
call fcn.1800a889c
nop
call fcn.1800a889c
nop
call fcn.1800a889c
int3