Function at 0x140024b10
Capabilities:
Get common file path
Query or enumerate registry key
Query or enumerate registry value
Set environment variable

Disassembly:
mov rax, rsp
push r12
push r14
push r15
sub rsp, 0x540
mov qword [rax - 0x4b8], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rsp + 0x530], rax
mov rcx, qword [0x1400ca008]
lea rax, [fcn.14001b1a0]
test rcx, rcx
je 0x140024b68
cmp rcx, rax
je 0x140024b68
mov ecx, 7
int 0x29
mov qword [0x1400ca008], rax
xor r14d, r14d
mov r15d, r14d
mov dword [rsp + 0x58], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
test eax, eax
jns 0x140024b92
mov eax, 0x800401f0
jmp 0x14002553d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapSetInformation]
mov rdi, r14
mov qword [rsp + 0x70], r14
call fcn.140030760
test al, al
je 0x140024d8f
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 9
lea rdx, str.SOFTWAREMicrosoftWindows_SearchGatherWindowsSystemIndexProtocols
mov rcx, 0xffffffff80000002
call fcn.14001e414
test eax, eax
jne 0x140024d8f
mov dword [rsp + 0x5c], 0xff
mov ebx, r14d
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x5c]
lea r8, [rsp + 0x120]
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
jne 0x140024d83
nop word [rax + rax]
mov ecx, 0xff
lea rax, [rsp + 0x120]
nop dword [rax]
cmp word [rax], 0
je 0x140024c50
add rax, 2
sub rcx, 1
jne 0x140024c40
test rcx, rcx
je 0x140024c5f
mov eax, 0xff
sub rax, rcx
jmp 0x140024c62
mov rax, r14
test rcx, rcx
je 0x140024cc0
mov edx, 0xff
sub rdx, rax
lea rcx, [rsp + 0x120]
lea rcx, [rcx + rax*2]
je 0x140024cb1
add rax, 0x7ffffeff
add rax, rdx
lea r9, [0x140098210]
sub r9, rcx
test rax, rax
je 0x140024cb1
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x140024cb1
mov word [rcx], r8w
add rcx, 2
dec rax
sub rdx, 1
jne 0x140024c90
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], r14w
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea rdx, [rsp + 0x120]
mov rcx, qword [rsp + 0x50]
call fcn.14001e414
test eax, eax
jne 0x140024d43
mov dword [rsp + 0x68], 0xff
mov dword [rsp + 0x48], 1
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x320]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, str.ProgIdHandler
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x140024d38
lea rcx, [rsp + 0x320]
call fcn.14002556c
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov dword [rsp + 0x5c], 0xff
inc ebx
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x5c]
lea r8, [rsp + 0x120]
mov edx, ebx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
je 0x140024c30
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x50]
call fcn.1400285e0
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140024dc2
lea rdx, str.AccessDebugTracer
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test rax, rax
je 0x140024dc2
lea rcx, [0x1400c9148]
call qword [case.0x14000702c.0]
call fcn.1400285c0
nop
jmp 0x140024dd5
call int.140028f74
mov eax, dword [0x1400ca100]
bt eax, 0x13
jae 0x140024dff
lea rdx, [0x140097e28]
lea rcx, [0x1400c8290]
call fcn.140028d78
mov eax, dword [0x1400ca100]
bt eax, 0xb
jae 0x140024e21
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
mov r8d, eax
lea rdx, [0x140097ce8]
lea rcx, [0x1400c8290]
call fcn.140052eb8
call fcn.14001f640
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x20
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetPriorityClass]
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140028e00]
lea rcx, [0x1400ca048]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_InitOnceExecuteOnce]
cmp byte [0x1400ca038], 0
je 0x140024e62
call fcn.140030704
mov byte [rsp + 0x5d], 1
mov qword [rsp + 0x68], r14
lea rcx, [rsp + 0x68]
call fcn.140027848
nop
lea rcx, [rsp + 0xb0]
call fcn.140027174
nop
lea rcx, [rsp + 0x50]
call fcn.1400274f8
nop
lea rcx, [rsp + 0x60]
call fcn.1400274cc
nop
lea rax, [rsp + 0x320]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x801c
xor ecx, ecx
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetFolderPathW]
test eax, eax
jns 0x140024f1f
mov rcx, qword [rsp + 0x558]
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0xdf
call fcn.14001f2e8
mov r15d, 1
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140024ef1
call fcn.14000e5b8
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140024f01
call fcn.14000e5b8
nop
lea rcx, [rsp + 0xb0]
call fcn.14002708c
nop
mov rcx, qword [rsp + 0x68]
call fcn.14000e5b8
nop
jmp 0x1400254ba
lea rdx, [rsp + 0x320]
lea rcx, str.LOCALAPPDATA
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x140024f95
mov rcx, qword [rsp + 0x558]
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0xe9
call fcn.14005616c
mov r15d, 1
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140024f67
call fcn.14000e5b8
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140024f77
call fcn.14000e5b8
nop
lea rcx, [rsp + 0xb0]
call fcn.14002708c
nop
mov rcx, qword [rsp + 0x68]
call fcn.14000e5b8
nop
jmp 0x1400254ba
lea rcx, [rsp + 0xb0]
call fcn.1400270f4
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x48], 0xc0100000
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
mov edx, 1
lea rcx, [rsp + 0x68]
call fcn.1400276e8
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x48], 0xc0100000
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
mov edx, 1
lea rcx, [rsp + 0x68]
call fcn.1400276e8
mov rbx, qword [rsp + 0x68]
mov r8, rbx
lea rcx, [rsp + 0xb0]
call fcn.1400270d4
mov dword [rsp + 0x80], SafeArrayPutElement
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x90], r14d
mov esi, r14d
nop dword [rax + rax]
cmp esi, 0xf
jae 0x140025163
lea r8, str.SearchServiceMUT
mov edx, 1
lea rcx, [rsp + 0x80]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov rdx, rax
lea rcx, [0x1400ca108]
call fcn.1400094b8
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r12d, eax
mov rcx, qword [0x1400ca108]
dec rcx
cmp rcx, 0xfffffffffffffffd
ja 0x1400250b3
test eax, eax
je 0x140025163
xor edx, edx
lea rcx, [0x1400ca108]
call fcn.1400094b8
cmp r12d, 0xb7
je 0x14002510c
mov r15d, 1
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400250e0
call fcn.14000e5b8
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400250f0
call fcn.14000e5b8
nop
lea rcx, [rsp + 0xb0]
call fcn.14002708c
nop
mov rcx, rbx
call fcn.14000e5b8
nop
jmp 0x1400254ba
cmp esi, 0xe
jne 0x140025151
lea r15d, [rsi - 0xc]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140025125
call fcn.14000e5b8
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140025135
call fcn.14000e5b8
nop
lea rcx, [rsp + 0xb0]
call fcn.14002708c
nop
mov rcx, rbx
call fcn.14000e5b8
nop
jmp 0x1400254ba
mov ecx, 0x7d0
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
inc esi
jmp 0x140025060
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140025173
call fcn.14000e5b8
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140025183
call fcn.14000e5b8
nop
lea rcx, [rsp + 0xb0]
call fcn.14002708c
nop
mov rcx, rbx
call fcn.14000e5b8
nop
lea rcx, [rsp + 0x48]
call fcn.1400233bc
mov rdi, rax
mov qword [rsp + 0x70], rax
test rax, rax
jne 0x1400251c1
mov r15d, 1
mov dword [rsp + 0x58], r15d
jmp 0x1400254ba
mov esi, dword [rsp + 0x48]
cmp esi, 2
jne 0x140025226
mov ebx, 1
mov r12d, 0xfffd
cmp ebx, esi
jge 0x140025226
movsxd rax, ebx
mov rcx, qword [rdi + rax*8]
movzx eax, word [rcx]
sub ax, 0x2d
test r12w, ax
je 0x1400251fd
mov r15d, 1
mov dword [rsp + 0x58], r15d
jmp 0x1400254ba
add rcx, 2
lea rdx, str.Embedding
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x140025216
inc ebx
jmp 0x1400251d5
mov r15d, 1
mov dword [rsp + 0x58], r15d
jmp 0x1400254ba
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
mov ebx, eax
mov dword [rsp + 0x48], eax
mov esi, eax
mov rcx, qword [rsp + 0x558]
test eax, eax
jns 0x14002525d
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x154
call fcn.14002cfec
jmp 0x14002532a
mov qword [rsp + 0x50], r14
lea rcx, [rsp + 0x50]
call fcn.1400306d8
mov qword [rsp + 0x20], rax
lea r9, [0x140094c58]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140097338]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
mov rcx, qword [rsp + 0x558]
test eax, eax
jns 0x1400252ab
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x15b
call fcn.14002cfec
lea rcx, [rsp + 0x50]
call fcn.14003068c
test al, al
je 0x1400252f4
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
mov edx, 5
lea r8d, [rdx - 4]
mov rax, qword [rax + 0x18]
call qword [case.0x14000702c.0]
mov rcx, qword [rsp + 0x558]
test eax, eax
jns 0x1400252f4
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x15e
call fcn.14002cfec
call fcn.140025dec
mov esi, eax
mov rcx, qword [rsp + 0x558]
test eax, eax
jns 0x14002531c
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x162
call fcn.14002cfec
nop
lea rcx, [rsp + 0x50]
call fcn.1400306b8
test esi, esi
jns 0x140025341
mov r15d, esi
mov dword [rsp + 0x58], esi
test ebx, ebx
js 0x14002533c
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop
jmp 0x1400254ba
xor bl, bl
xor eax, eax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x88], 3
lea rax, str.AllowWindowsIndexer
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x100], xmm0
movups xmm1, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0x110], xmm1
xor edx, edx
lea rcx, [rsp + 0x100]
call fcn.140021c78
test eax, eax
jne 0x1400253b1
mov bl, 1
call fcn.140055e1c
movzx edx, bl
call fcn.140026908
mov rbx, qword [0x1400c9cb8]
test rbx, rbx
je 0x140025407
cmp qword [rbx], 0
je 0x140025407
nop dword [rax + rax]
mov rax, qword [rbx + 0x38]
call qword [case.0x14000702c.0]
mov rdx, rax
mov rcx, qword [rbx]
call fcn.14002bdf4
test eax, eax
js 0x140025474
xor ecx, ecx
mov rax, qword [rbx + 8]
call qword [case.0x14000702c.0]
test eax, eax
js 0x140025474
add rbx, 0x48
cmp qword [rbx], 0
jne 0x1400253d0
mov rax, qword [0x1400cb790]
test rax, rax
je 0x14002541d
call qword [case.0x14000702c.0]
test eax, eax
js 0x140025474
mov eax, r14d
mov rbx, qword [0x1400cb470]
mov rcx, qword [0x1400cb478]
cmp rbx, rcx
jae 0x140025474
mov rsi, qword [rbx]
test rsi, rsi
je 0x14002546b
mov rax, qword [rsi + 0x38]
call qword [case.0x14000702c.0]
mov rdx, rax
mov rcx, qword [rsi]
call fcn.14002bdf4
test eax, eax
js 0x140025474
xor ecx, ecx
mov rax, qword [rsi + 8]
call qword [case.0x14000702c.0]
test eax, eax
js 0x140025474
mov rcx, qword [0x1400cb478]
add rbx, 8
cmp rbx, rcx
jb 0x140025433
mov rcx, qword [rsp + 0x558]
test eax, eax
jns 0x140025494
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x179
call fcn.14002cfec
mov dword [rsp + 0x48], 3
lea rcx, [rsp + 0x48]
call fcn.14002a480
nop
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop
jmp 0x1400254ba
call qword [sym.imp.MSSRCH.DLL_public:_static_void___cdecl_CSearchServiceObj::Cleanup_void_]
mov byte [rsp + 0x40], 1
lea rdx, [rsp + 0x40]
call fcn.140029f00
mov eax, dword [0x1400ca100]
bt eax, 0xb
jae 0x1400254fd
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
mov r8d, eax
lea rdx, [0x140097b38]
lea rcx, [0x1400c8290]
call fcn.140052eb8
mov eax, dword [0x1400ca100]
bt eax, 0x13
jae 0x140025516
lea rdx, [0x140097c98]
lea rcx, [0x1400c8290]
call fcn.140028d78
call fcn.14002d024
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop
lea rcx, [rsp + 0x5c]
call fcn.140030694
nop
test rdi, rdi
je 0x14002553a
mov rcx, rdi
call fcn.14000e5b8
mov eax, r15d
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.14002dd40
lea r11, [rsp + 0x540]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret