Function at 0x140017d38
Capabilities:
Get common file path
Query or enumerate registry value
Read .ini file

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xa78]
sub rsp, 0xb70
mov qword [rbp - 0x48], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1400c2688]
xor rax, rsp
mov qword [rbp + 0xa40], rax
mov rbx, rcx
mov qword [rbp - 0x78], rcx
call fcn.1400293ac
mov rcx, qword [rax + 8]
mov eax, dword [rcx + 0x17c]
mov dword [rbx + 0x138], eax
call fcn.1400293ac
lea rdx, [rbp - 0x80]
mov rcx, qword [rax + 8]
call fcn.14000ddc8
nop
call fcn.140061820
mov r9, qword [rbp - 0x80]
mov r12d, 1
mov r8d, r12d
lea rdx, str.autostart
lea r13, str.common
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ebx, eax
mov r9, qword [rbp - 0x80]
mov r8d, r12d
lea rdx, str.trayicon
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
mov r9, qword [rbp - 0x80]
mov r8d, r12d
lea rdx, [0x14008b590]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
mov r9, qword [rbp - 0x80]
mov r8d, r12d
lea rdx, str.shellext
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [rbp - 0x70], eax
mov r9, qword [rbp - 0x80]
xor r8d, r8d
lea rdx, str.disable
lea rcx, str.space
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov r14d, eax
mov r9, qword [rbp - 0x80]
xor r8d, r8d
lea rdx, str.encrypt
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov r15d, eax
mov r9, qword [rbp - 0x80]
mov r8d, r12d
lea rdx, str.checkupdate
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov r12d, eax
mov r9, qword [rbp - 0x80]
mov r8d, 1
lea rdx, str.hibernation
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov r13d, eax
call fcn.140061710
mov edx, 0x45e
mov rcx, qword [rbp - 0x78]
call fcn.140032178
xor r8d, r8d
cmp ebx, 1
sete r8b
xor r9d, r9d
mov edx, 0xf1
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x433
mov rbx, qword [rbp - 0x78]
mov rcx, rbx
call fcn.140032178
xor r8d, r8d
cmp edi, 1
sete r8b
xor r9d, r9d
mov edi, 0xf1
mov edx, edi
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x408
mov rcx, rbx
call fcn.140032178
xor r8d, r8d
cmp esi, 1
sete r8b
xor r9d, r9d
mov edx, edi
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x404
mov rcx, rbx
call fcn.140032178
xor r8d, r8d
cmp dword [rbp - 0x70], r8d
setne r8b
xor r9d, r9d
mov edx, edi
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x44b
mov rcx, rbx
call fcn.140032178
xor r8d, r8d
test r14d, r14d
sete r8b
xor r9d, r9d
mov edx, edi
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x409
mov rcx, rbx
call fcn.140032178
xor r8d, r8d
cmp r15d, 1
sete r8b
xor r9d, r9d
mov edx, edi
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x40a
mov rcx, rbx
call fcn.140032178
xor r8d, r8d
cmp r12d, 1
sete r8b
xor r9d, r9d
mov edx, edi
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x40c
mov rcx, rbx
call fcn.140032178
xor r8d, r8d
cmp r13d, 1
sete r8b
xor r9d, r9d
mov edx, edi
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
lea rax, [rbx + 0x140]
mov qword [rbp - 0x58], rax
xor edx, edx
mov rcx, rax
call fcn.140032da4
call fcn.1400293ac
lea r8d, [rdi - 0x71]
lea rdx, [rbp + 0x530]
mov rcx, qword [rax + 8]
call fcn.14000df2c
mov esi, 0x200
mov r8d, esi
xor edx, edx
lea rcx, [rbp + 0x130]
call fcn.140064220
lea rcx, [rbp - 0x30]
call fcn.140001370
nop
lea rcx, [rbp + 0x130]
call fcn.140061ba0
mov edi, 0x100
test eax, eax
jne 0x1400180a4
mov dword [rbp - 0x6c], esi
lea r9, [0x140085178]
lea r8, str.SYSTEMCurrentControlSetServices_s
lea edx, [rdi - 0x80]
lea rcx, [rbp + 0x630]
call fcn.140003410
lea rax, [rbp - 0x6c]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x130]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x64]
lea r8, str.GUID
lea rdx, [rbp + 0x630]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x1400180a4
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
lea rcx, [rbp - 0x30]
call fcn.1400013cc
jmp 0x140018237
lea r8, str._BLANKPWD
mov rdx, rdi
lea rcx, [rbp + 0x130]
call fcn.1400673e8
lea rcx, [rbp + 0x130]
call fcn.1400675ec
lea r8d, [rax + rax]
lea rdx, [rbp + 0x130]
lea rcx, [rbp - 0x30]
call fcn.140001df8
lea rdx, [rbp + 0x110]
lea rcx, [rbp - 0x30]
call fcn.1400014bc
movzx eax, byte [rbp + 0x11f]
movzx ecx, byte [rbp + 0x11e]
movzx edx, byte [rbp + 0x11d]
movzx r8d, byte [rbp + 0x11c]
movzx r10d, byte [rbp + 0x11b]
movzx r11d, byte [rbp + 0x11a]
movzx ebx, byte [rbp + 0x119]
movzx edi, byte [rbp + 0x118]
movzx esi, byte [rbp + 0x117]
movzx r14d, byte [rbp + 0x116]
movzx r15d, byte [rbp + 0x115]
movzx r12d, byte [rbp + 0x114]
movzx r13d, byte [rbp + 0x113]
movzx r9d, byte [rbp + 0x110]
mov dword [rsp + 0x90], eax
mov dword [rsp + 0x88], ecx
mov dword [rsp + 0x80], edx
mov dword [rsp + 0x78], r8d
mov dword [rsp + 0x70], r10d
mov dword [rsp + 0x68], r11d
mov dword [rsp + 0x60], ebx
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], r14d
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], r13d
movzx eax, byte [rbp + 0x112]
mov dword [rsp + 0x28], eax
movzx eax, byte [rbp + 0x111]
mov dword [rsp + 0x20], eax
lea r8, str._02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x
mov edi, 0x100
mov edx, edi
lea rcx, [rbp + 0x130]
call fcn.140003410
lea rdx, [rbp + 0x530]
lea rcx, [rbp + 0x130]
call fcn.1400675b4
nop
lea rcx, [rbp - 0x30]
test eax, eax
jne 0x140018229
call fcn.1400013cc
mov edx, 0x401
mov rbx, qword [rbp - 0x78]
mov rcx, rbx
call fcn.140032178
xor r9d, r9d
xor r8d, r8d
lea edx, [rdi - 0xf]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x40b
mov rcx, rbx
call fcn.140032178
mov rcx, rax
xor edx, edx
call fcn.140032030
jmp 0x1400184b2
call fcn.1400013cc
mov rbx, qword [rbp - 0x78]
mov esi, 0x200
mov edx, 0x401
mov rcx, rbx
call fcn.140032178
xor r9d, r9d
mov edx, 0xf1
lea r8d, [r9 + 1]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov edx, 0x40b
mov rcx, rbx
call fcn.140032178
mov rcx, rax
mov edx, 1
call fcn.140032030
mov r8, rsi
xor edx, edx
lea rcx, [rbp + 0x330]
call fcn.140064220
lea rcx, [rbp + 0x70]
call fcn.140001370
nop
lea rcx, [rbp + 0x330]
call fcn.140061ba0
test eax, eax
jne 0x140018310
mov dword [rbp - 0x68], esi
lea r9, [0x140085178]
lea r8, str.SYSTEMCurrentControlSetServices_s
mov edx, 0x80
lea rcx, [rbp + 0x730]
call fcn.140003410
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x330]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x60]
lea r8, str.GUID
lea rdx, [rbp + 0x730]
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x140018310
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
lea rcx, [rbp + 0x70]
call fcn.1400013cc
jmp 0x1400184b2
lea r8, [0x140085170]
mov rdx, rdi
lea rcx, [rbp + 0x330]
call fcn.1400673e8
lea rcx, [rbp + 0x330]
call fcn.1400675ec
lea r8d, [rax + rax]
lea rdx, [rbp + 0x330]
lea rcx, [rbp + 0x70]
call fcn.140001df8
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x70]
call fcn.1400014bc
movzx eax, byte [rbp + 0x12f]
movzx ecx, byte [rbp + 0x12e]
movzx edx, byte [rbp + 0x12d]
movzx r10d, byte [rbp + 0x12c]
movzx r11d, byte [rbp + 0x12b]
movzx ebx, byte [rbp + 0x12a]
movzx edi, byte [rbp + 0x129]
movzx esi, byte [rbp + 0x128]
movzx r14d, byte [rbp + 0x127]
movzx r15d, byte [rbp + 0x126]
movzx r12d, byte [rbp + 0x125]
movzx r13d, byte [rbp + 0x124]
movzx r8d, byte [rbp + 0x123]
movzx r9d, byte [rbp + 0x120]
mov dword [rsp + 0x90], eax
mov dword [rsp + 0x88], ecx
mov dword [rsp + 0x80], edx
mov dword [rsp + 0x78], r10d
mov dword [rsp + 0x70], r11d
mov dword [rsp + 0x68], ebx
mov dword [rsp + 0x60], edi
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x50], r14d
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x40], r12d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], r8d
movzx eax, byte [rbp + 0x122]
mov dword [rsp + 0x28], eax
movzx eax, byte [rbp + 0x121]
mov dword [rsp + 0x20], eax
lea r8, str._02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x_02x
mov edx, 0x100
lea rcx, [rbp + 0x330]
call fcn.140003410
lea rdx, [rbp + 0x530]
lea rcx, [rbp + 0x330]
call fcn.1400675b4
nop
lea rcx, [rbp + 0x70]
test eax, eax
jne 0x1400184a9
call fcn.1400013cc
call fcn.1400293ac
mov r8d, 0xc356
lea rdx, [rbp - 0x50]
mov rcx, qword [rax + 8]
call fcn.14000d8dc
nop
mov rdx, qword [rax]
mov rbx, qword [rbp - 0x58]
mov rcx, rbx
call fcn.140032d38
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001849a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov edx, 5
mov rcx, rbx
call fcn.140032da4
jmp 0x1400184ae
call fcn.1400013cc
mov rbx, qword [rbp - 0x78]
mov edx, 0x404
mov rcx, rbx
call fcn.140032178
xor r9d, r9d
xor r8d, r8d
mov edi, 0xf0
mov edx, edi
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x140018541
mov edx, 0x401
mov rcx, rbx
call fcn.140032178
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x140018541
mov edx, 0x44d
mov rcx, rbx
call fcn.140032178
mov rcx, rax
mov edx, 1
call fcn.140032030
mov edx, 0x44d
mov rcx, rbx
call fcn.140032178
xor r8d, r8d
cmp dword [rbp - 0x70], 2
sete r8b
xor r9d, r9d
lea edx, [rdi + 1]
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
jmp 0x140018558
mov edx, 0x44d
mov rcx, rbx
call fcn.140032178
mov rcx, rax
xor edx, edx
call fcn.140032030
mov edx, 0x44b
mov rcx, rbx
call fcn.140032178
xor r9d, r9d
xor r8d, r8d
mov edx, edi
mov rcx, qword [rax + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
jne 0x140018592
mov edx, 0x453
mov rcx, rbx
call fcn.140032178
mov rcx, rax
xor edx, edx
call fcn.140032030
mov edx, 0x104
lea rcx, [rbp + 0x830]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea rdx, [rbp - 0x40]
movzx ecx, word [rbp + 0x830]
call fcn.1400620e0
test eax, eax
je 0x1400185cf
cmp dword [rbp - 0x3c], 1
jne 0x1400185cf
mov edx, 0x40c
mov rcx, rbx
call fcn.140032178
xor edx, edx
jmp 0x1400185e1
mov edx, 0x40c
mov rcx, rbx
call fcn.140032178
mov edx, 1
mov rcx, rax
call fcn.140032030
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140018608
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rbp + 0xa40]
xor rcx, rsp
call fcn.14005ef50
lea r11, [rsp + 0xb70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret