Function at 0x1400a2cd0
Capabilities:
Check if file exists
Get disk information
Query or enumerate registry value

Disassembly:
push rbx
push rbp
sub rsp, 0x58
mov rax, qword [0x1403a0088]
xor rax, rsp
mov qword [rsp + 0x48], rax
movabs rax, 0x5c003a0058
mov word [str.X:windows_system32_ntdll.dll], dx
mov qword [rsp + 0x40], rax
movzx ebx, dx
mov rax, qword [0x14043bd80]
mov rbp, rcx
mov word [str.X:windows_system32winload.exe], dx
mov word [str.X:windows_system32winload.EFI], dx
mov word [str.X:windows_system32_ntoskrnl.exe], dx
mov word [rsp + 0x40], dx
cmp dx, word [rax + 0x30]
je 0x1400a300e
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x1400a300e
lea rcx, str.X:windows_system32configSYSTEM
mov word [str.X:windows_system32configSYSTEM], bx
mov word [str.X:windows_system32configSOFTWARE], bx
mov word [str.X:windows_system32configDEFAULT], bx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400a300e
lea rcx, str.X:windows_system32configSOFTWARE
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400a300e
lea rcx, str.X:windows_system32configDEFAULT
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400a300e
lea rcx, str.X:windows_system32_ntdll.dll
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400a300e
lea rcx, str.X:windows_system32winload.exe
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400a300e
lea rcx, str.X:windows_system32winload.EFI
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400a300e
lea rcx, str.X:windows_system32_ntoskrnl.exe
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400a300e
lea rdx, [0x1403330d0]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rdx, [0x1403330b8]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rdx, [0x140333158]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea r8, str.X:windows_system32configSYSTEM
mov rcx, 0xffffffff80000002
lea rdx, [0x140333140]
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
test eax, eax
jne 0x1400a300e
lea r8, str.X:windows_system32configSOFTWARE
mov rcx, 0xffffffff80000002
lea rdx, [0x140333128]
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
test eax, eax
jne 0x1400a300e
lea r8, str.X:windows_system32configDEFAULT
mov rcx, 0xffffffff80000002
lea rdx, [0x140333110]
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
test eax, eax
jne 0x1400a300e
mov qword [rsp + 0x80], rsi
lea rax, [rsp + 0x38]
xor esi, esi
mov qword [rsp + 0x50], rdi
lea rdx, str.PESOFTWAREMicrosoftWindows_NTCurrentVersion
mov qword [rsp + 0x38], rsi
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x30], esi
mov edi, esi
mov qword [rsp + 0x20], rax
lea r9d, [rsi + 1]
lea r8d, [rsi + 4]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400a2f7b
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400a2f90
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [0x14044378c]
lea rdx, [0x140333200]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400a2f7b
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x1400a2f7b
add eax, 4
mov ecx, eax
mov dword [rsp + 0x30], eax
call fcn.140125a94
mov rdi, rax
test rax, rax
je 0x1400a2f7b
mov r8d, dword [rsp + 0x30]
xor edx, edx
mov rcx, rax
call fcn.1402767a0
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [0x14044378c]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, [0x140333200]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400a2f70
cmp dword [rsp + 0x30], esi
ja 0x1400a2f7b
mov rcx, rdi
call fcn.140125e14
mov rdi, rsi
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1400a2f90
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x38], rsi
lea rdx, str.PESYSTEM
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rdx, str.PESOFTWARE
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea rdx, str.PEDEFAULT
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
movzx ecx, bx
call fcn.14004f3b0
mov esi, eax
test eax, eax
js 0x1400a3001
mov ecx, eax
call fcn.14004f130
test rax, rax
jle 0x1400a3001
mov r8, rax
mov edx, esi
mov rcx, rbp
call fcn.1400a2780
mov r8, rdi
movzx edx, bx
mov rcx, rbp
call fcn.1400a29d0
mov rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140125a70
add rsp, 0x58
pop rbp
pop rbx
ret