Function at 0x140015f24
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x68
xor r14d, r14d
mov r15, rcx
mov esi, r14d
mov r13d, r14d
mov ebx, r14d
test rcx, rcx
je 0x14001621f
cmp r14w, word [rcx]
je 0x14001621f
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
nop dword [rax + rax]
mov edi, eax
test eax, eax
je 0x1400161d8
mov ebx, edi
add rbx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
lea r12d, [r14 + 8]
mov r8, rbx
mov rcx, rax
mov edx, r12d
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
je 0x1400161d8
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x1400161d8
or rdi, 0xffffffffffffffff
xor eax, eax
inc rdi
cmp word [rbx + rdi*2], ax
jne 0x140015fc9
mov edx, 1
test edi, edi
je 0x140015fe9
lea ecx, [rdi - 1]
lea eax, [rdx + 0x5b]
cmp ax, word [rbx + rcx*2]
cmovne r14d, edx
mov rcx, qword gs:[0x60]
lea eax, [r14 + 0xe]
add eax, edi
mov edx, r12d
mov qword [rbp - 0x18], rax
mov rcx, qword [rcx + 0x30]
lea r8, [rax + rax]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov r12, rax
test rax, rax
jne 0x140016030
mov rax, qword gs:[0x30]
mov dword [rax + 0x68], 8
jmp 0x1400161e7
mov rdx, qword [rbp - 0x18]
lea rax, [rbp + 0x60]
mov qword [rsp + 0x28], rax
mov r8, rbx
lea rax, [rbp - 0x28]
mov r9d, edi
mov rcx, r12
mov qword [rsp + 0x20], rax
call fcn.140008850
mov edi, eax
test eax, eax
js 0x1400161a9
test r14d, r14d
je 0x140016091
mov rdx, qword [rbp + 0x60]
lea rax, [rbp + 0x60]
mov rcx, qword [rbp - 0x28]
lea r8, [0x140028e20]
mov qword [rsp + 0x28], rax
mov r9d, 1
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
call fcn.140008850
mov edi, eax
xor r14d, r14d
test edi, edi
js 0x1400161a9
mov rdx, qword [rbp + 0x60]
lea r9d, [r14 + 0xd]
mov rcx, qword [rbp - 0x28]
lea r8, str.System32OOBE
call fcn.140003a3c
mov edi, eax
test eax, eax
js 0x1400161a9
mov rax, qword gs:[0x30]
lea edi, [r14 + 1]
or dword [rsp + 0x28], 0xffffffff
or r9d, 0xffffffff
mov r8, r15
mov qword [rbp - 0x20], r14
mov edx, edi
mov qword [rsp + 0x20], r12
mov ecx, 0x409
mov dword [rax + 0x68], r14d
call qword [sym.imp.KERNEL32.dll_CompareStringW]
nop dword [rax + rax]
cmp eax, 2
jne 0x140016187
lea rax, [rbp - 0x20]
mov r9d, edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SystemSetup
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x140016187
mov rcx, qword [rbp - 0x20]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x58]
lea rax, [rbp + 0x48]
mov dword [rbp + 0x58], r14d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SetupPhase
mov dword [rbp + 0x50], 4
mov dword [rbp + 0x48], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140016177
cmp dword [rbp + 0x48], 4
cmove esi, edi
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, r12
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
jmp 0x1400161e7
mov rcx, qword gs:[0x60]
mov r8, r12
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rax, qword gs:[0x30]
movzx ecx, di
mov dword [rax + 0x68], ecx
jmp 0x1400161e7
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r13d, eax
test rbx, rbx
je 0x14001620c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov eax, esi
jmp 0x140016232
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret