Function at 0x140048c40
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rbp
push rdi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov r13, r8
mov rsi, rcx
mov rcx, r8
call fcn.140038c18
xor edi, edi
mov dword [rbp + 0x38], edi
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x48]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
test eax, eax
je 0x140048cb5
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
mov r15d, 0x80004005
test eax, eax
cmovns eax, r15d
jmp 0x140048f5c
mov eax, dword [rbp + 0x48]
dec eax
mov r14d, 1
cmp eax, r14d
ja 0x140048f57
test byte [rbp + 0x38], r14b
jne 0x140048f57
call fcn.140034f08
mov rcx, rax
test rax, rax
je 0x140048f80
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x10], rbx
mov edx, dword [rbp + 0x38]
shr edx, 1
sub edx, r14d
js 0x140048f75
mov ecx, r14d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x140048d1c
lea rcx, [rbp - 0x10]
call fcn.140034b68
mov rbx, qword [rbp - 0x10]
lea rax, [rbp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x48]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r15d, 0x80004005
xor r8d, r8d
test eax, eax
je 0x140048d5f
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
cmovns esi, r15d
jmp 0x140048d62
mov esi, r8d
mov ecx, dword [rbp + 0x38]
test ecx, ecx
je 0x140048d94
test esi, esi
jne 0x140048d94
mov eax, dword [rbp + 0x48]
dec eax
cmp eax, r14d
jbe 0x140048d81
mov esi, 0x8007000d
mov edi, r8d
jmp 0x140048db3
test r14b, cl
jne 0x140048d77
mov edi, ecx
shr edi, 1
sub edi, r14d
cmp word [rbx + rdi*2], r8w
jne 0x140048d77
cmp edi, 0xffffffff
jne 0x140048dab
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call fcn.14006c1e4
mov rdi, rax
xor r8d, r8d
test edi, edi
js 0x140048f75
cmp edi, dword [rbx - 0xc]
jg 0x140048f75
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov word [rbx + rax*2], r8w
test esi, esi
js 0x140048f38
cmp dword [rbp + 0x48], 2
jne 0x140048f26
cmp dword [rbx - 0x10], r8d
jle 0x140048f26
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, eax
test eax, eax
jne 0x140048e16
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
cmovns esi, r15d
jmp 0x140048f38
call fcn.140034f08
mov rcx, rax
test rax, rax
je 0x140048f8b
mov rax, qword [rax]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rdi, [rax + 0x18]
mov qword [rbp - 8], rdi
lea edx, [rsi - 1]
test edx, edx
js 0x140048f94
sub r14d, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, edx
or eax, r14d
jge 0x140048e5b
lea rcx, [rbp - 8]
call fcn.140034b68
mov rdi, qword [rbp - 8]
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
xor r8d, r8d
test eax, eax
jne 0x140048e92
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx esi, ax
or esi, 0x80070000
xor r8d, r8d
test eax, eax
cmovle esi, eax
test esi, esi
cmovns esi, r15d
jmp 0x140048eb0
mov esi, r8d
dec eax
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140048eb0
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.14006c1e4
mov rbx, rax
xor r8d, r8d
test ebx, ebx
js 0x140048f94
cmp ebx, dword [rdi - 0xc]
jg 0x140048f94
mov dword [rdi - 0x10], ebx
movsxd rax, ebx
mov word [rdi + rax*2], r8w
test esi, esi
jns 0x140048ef0
lea rdx, [rdi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140048eea
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp - 0x10]
jmp 0x140048f38
lea rdx, [rbp - 8]
mov rcx, r13
call fcn.140040c7c
nop
lea rdx, [rdi - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
xor r8d, r8d
sub eax, 1
jg 0x140048f20
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp - 0x10]
jmp 0x140048f32
mov rbx, qword [rbp - 0x10]
jmp 0x140048f35
lea rdx, [rbp - 0x10]
mov rcx, r13
call fcn.140040c7c
xor r8d, r8d
mov esi, r8d
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x140048f53
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, esi
jmp 0x140048f5c
mov eax, 0x8007000d
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
mov ecx, 0x80070057
call fcn.140034ce8
nop
mov ecx, 0x80004005
call fcn.140034ce8
nop
mov ecx, r15d
call fcn.140034ce8
nop
mov ecx, 0x80070057
call fcn.140034ce8
int3