Function at 0x7ff82669de08
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rdi, rcx
xor ebx, ebx
add rcx, 0x40
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
nop dword [rax + rax]
jmp 0x7ff82669de47
mov r12d, 1
mov byte [rdi + 6], r12b
xor ecx, ecx
call fcn.7ff82669c7f4
mov r14, rax
test rax, rax
je 0x7ff8266aeade
mov rdx, rax
call fcn.7ff82669e2c4
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventA]
nop dword [rax + rax]
mov qword [rdi + 0x10], rax
test rax, rax
je 0x7ff8266aeb02
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x80]
xor r8d, r8d
lea rdx, str.NameSpace_Callout
mov rcx, r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x7ff8266aebc6
mov eax, dword [rsp + 0x80]
dec eax
cmp eax, r12d
ja 0x7ff8266aebc6
mov ecx, dword [rsp + 0x78]
lea esi, [r12 + 1]
add rcx, rsi
mov eax, esi
mul rcx
lea r13, [rsi - 3]
cmovo rax, r13
mov r8, rax
xor edx, edx
mov rcx, qword [0x7ff8266e2850]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov r15, rax
test rax, rax
je 0x7ff8266aeb3d
mov r8d, dword [rsp + 0x78]
add r8, rsi
xor edx, edx
mov rcx, rax
call sub.api_ms_win_core_crt_l1_1_0.dll_memset
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x80]
xor r8d, r8d
lea rdx, str.NameSpace_Callout
mov rcx, r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x7ff82669dfe4
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
mov dword [rsp + 0x78], eax
test eax, eax
je 0x7ff82669dfe4
mov ecx, eax
add rcx, rsi
mov eax, esi
mul rcx
cmovo rax, r13
mov r8, rax
xor edx, edx
mov rcx, qword [0x7ff8266e2850]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
mov qword [rdi + 0x68], rax
test rax, rax
je 0x7ff8266aeb68
mov r8d, dword [rsp + 0x78]
mov rdx, rax
mov rcx, r15
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
test eax, eax
je 0x7ff8266aeba4
cmp eax, dword [rsp + 0x78]
jg 0x7ff8266aeba4
movsxd rcx, eax
mov rax, qword [rdi + 0x68]
mov word [rax + rcx*2], bx
mov r8, r15
xor edx, edx
mov rcx, qword [0x7ff8266e2850]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapFree]
nop dword [rax + rax]
xor edx, edx
mov r8d, 0x98
mov rcx, qword [0x7ff8266e2850]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
test rax, rax
je 0x7ff8266aebd0
mov dword [rax + 0x10], ebx
mov qword [rax + 0x20], rbx
mov dword [rax + 0x18], ebx
mov dword [rax + 0x1c], 0x3e8
mov qword [rax], rbx
mov dword [rax + 0x60], ebx
mov qword [rax + 0x68], rbx
mov dword [rax + 0x70], ebx
mov qword [rax + 0x28], rbx
mov dword [rax + 0x30], ebx
mov dword [rax + 0x74], esi
lea rcx, str.Catalog_Entries64
mov qword [rax + 0x90], rcx
lea rcx, str.Num_Catalog_Entries64
mov qword [rax + 0x80], rcx
lea rcx, str.Catalog_Entries
mov qword [rax + 0x88], rcx
lea rcx, str.Num_Catalog_Entries
mov qword [rax + 0x78], rcx
mov qword [rdi + 8], rax
test rax, rax
je 0x7ff8266aebd8
mov dword [rax + 0x2c], r12d
mov r8, qword [rdi + 0x10]
mov rdx, r14
mov rcx, qword [rdi + 8]
call fcn.7ff82669ddc8
mov esi, eax
test eax, eax
jne 0x7ff8266aebef
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventA]
nop dword [rax + rax]
mov qword [rdi + 0x20], rax
test rax, rax
je 0x7ff8266aec12
xor edx, edx
mov r8d, 0x80
mov rcx, qword [0x7ff8266e2850]
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapAlloc]
nop dword [rax + rax]
test rax, rax
je 0x7ff82669e14d
mov rcx, rax
call fcn.7ff82669e158
mov qword [rdi + 0x18], rax
test rax, rax
je 0x7ff8266aec2e
mov r8, qword [rdi + 0x20]
mov rdx, r14
mov rcx, rax
call fcn.7ff82669dd88
mov esi, eax
test eax, eax
jne 0x7ff8266aec40
mov qword [rdi + 0x28], rbx
mov qword [rdi + 0x30], rbx
mov qword [rdi + 0x38], rbx
test r14, r14
je 0x7ff82669e13a
mov rcx, r14
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
mov eax, esi
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov rax, rbx
jmp 0x7ff82669e0f4
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
enter 4, 0
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
invalid
insd dword [rdi], dx
in eax, 1
add al, byte [rax]
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], dh
add byte [rax], al
add byte [rax], al
js 0x7ff8266aeb8e
add byte [rax], al
pop rax
add dword [rax], eax
add byte [rsi], ch
add byte [rax], al
sbb byte [0x7ff8266aebd6], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rsi], ch
push 1
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
xor byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add dword [rax], eax
add byte [rax], al
sbb byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
adc eax, 0x28001600
sub byte [rax], al
or byte [rax], al
loopne 0x7ff8266aec46
add dword [rax], eax
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rdi], ah
out 0x1c, al
add byte [rax], al
add byte [rax], al
add byte [rdx], dh
add dword [rax], eax
add byte [rax - 0x73000000], al
in eax, 1
add al, byte [rax]
add byte [rax], al
add byte [rcx + 0x201e5], al
add byte [rax], al
add byte [rcx + 0x201e5], al
add byte [rax], al
add byte [rax], bl
add byte [rax], al
add byte [rax], al
add byte [rax], al
add dword [rax], eax
add byte [rax], al
sbb byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
or eax, dword [rax]
or eax, dword [rax]
sub byte [rax], al
sbb byte [rax], al
add byte [rax], bl
add byte [rax], bl
add byte [rcx], al
add byte [rax], dl
add dword [rax], eax
add byte [rdx], al
add byte [rdx], al
add byte [0x7ff8266aecb5], cl