Function at 0x140017030
Capabilities:
Query environment variable
Query or enumerate registry key

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x348
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x2b0], xmm6
mov qword [rbp + 0x2a8], 0xfffffffffffffffe
nop
mov qword [rbp + 0x2a0], rcx
call fcn.1400186b0
mov dil, 1
test al, al
jne 0x140017bfe
nop
cmp dword [0x140090658], 0
je 0x140017b06
lea rdx, [0x140070e90]
lea rdi, [rbp + 0x208]
mov rcx, rdi
mov r8d, gethostname
call fcn.140006940
nop
cmp qword [rbp + 0x220], 8
jb 0x1400170b1
mov rdi, qword [rbp + 0x208]
mov rcx, 0xffffffff80000002
mov rdx, rdi
mov r8d, 0x20019
call fcn.140016490
mov qword [rbp + 0x200], rax
mov al, 1
mov dword [rbp + 0x22c], eax
cmp qword [rbp + 0x200], 0
je 0x140017b92
nop
mov dword [rbp + 0x228], 0xff
mov rax, qword [rbp + 0x2a0]
add rax, 0x10
mov qword [rbp + 0x270], rax
xor r14d, r14d
xorps xmm6, xmm6
lea r15, [rbp - 0x40]
jmp 0x14001712b
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
test dil, dil
je 0x140017b87
nop
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov rcx, qword [rbp + 0x200]
mov edx, r14d
mov r8, r15
lea r9, [rbp + 0x228]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140017b77
nop
movaps xmmword [rbp + 0x260], xmm6
movaps xmmword [rbp + 0x250], xmm6
nop
cmp qword [rbp + 0x220], 8
lea rdi, [rbp + 0x208]
jb 0x140017180
mov rdi, qword [rbp + 0x208]
mov rbx, qword [rbp + 0x218]
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
jae 0x140017def
cmp rbx, 7
ja 0x1400171d0
nop
mov qword [rbp + 0x260], rbx
mov qword [rbp + 0x268], 7
movups xmm0, xmmword [rdi]
movaps xmmword [rbp + 0x250], xmm0
jmp 0x140017252
nop
mov qword [rbp + 0x268], 7
mov rsi, rbx
or rsi, 7
mov rcx, 0xfffffffffffffffe
movabs r12, 0x7ffffffffffffffe
cmp rsi, r12
ja 0x14001721a
cmp rsi, 0xb
mov eax, 0xa
cmovb rsi, rax
lea rcx, [rsi*2 + 2]
cmp rsi, 0x7ff
jb 0x140017221
mov r12, rsi
call fcn.140005860
jmp 0x140017229
call fcn.14001ef3c
mov r12, rsi
nop
mov qword [rbp + 0x250], rax
mov qword [rbp + 0x260], rbx
mov qword [rbp + 0x268], r12
lea r8, [rbx*2 + 2]
mov rcx, rax
mov rdx, rdi
call fcn.14006d670
nop
mov rax, qword [rbp + 0x260]
mov rcx, qword [rbp + 0x268]
cmp rcx, rax
jne 0x140017290
nop
mov qword [rsp + 0x20], 1
mov edx, 1
lea rcx, [rbp + 0x250]
lea r9, [0x1400713ae]
call fcn.140005e10
jmp 0x1400172bc
lea rdx, [rax + 1]
mov qword [rbp + 0x260], rdx
lea rdx, [rbp + 0x250]
cmp rcx, 8
jb 0x1400172af
mov rdx, qword [rbp + 0x250]
mov word [rdx + rax*2], 0x5c
mov word [rdx + rax*2 + 2], 0
mov rcx, r15
call fcn.1400441fc
mov rcx, qword [rbp + 0x260]
mov rdx, qword [rbp + 0x268]
mov r8, rdx
sub r8, rcx
cmp r8, rax
jae 0x140017300
nop
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x250]
mov rdx, rax
mov r9, r15
call fcn.140005e10
jmp 0x140017337
lea rsi, [rcx + rax]
mov qword [rbp + 0x260], rsi
lea rdi, [rbp + 0x250]
cmp rdx, 8
jb 0x14001731f
mov rdi, qword [rbp + 0x250]
lea rcx, [rdi + rcx*2]
add rax, rax
mov rdx, r15
mov r8, rax
call fcn.14006d670
mov word [rdi + rsi*2], 0
nop
cmp qword [rbp + 0x268], 8
lea rdx, [rbp + 0x250]
jb 0x140017350
mov rdx, qword [rbp + 0x250]
mov rcx, 0xffffffff80000002
mov r8d, 0x20019
call fcn.140016490
mov rdi, rax
test rax, rax
je 0x140017a91
lea rcx, [rbp + 0x1c0]
lea rdx, [0x140070f70]
mov r8d, 0x10
call fcn.140006940
nop
cmp qword [rbp + 0x1d8], 8
lea r8, [rbp + 0x1c0]
jb 0x1400173a0
mov r8, qword [rbp + 0x1c0]
lea rcx, [rbp + 0x278]
mov rdx, rdi
call fcn.1400164e0
lea rcx, [rbp + 0x230]
lea rdx, [0x140070fb0]
mov r8d, inet_ntoa
call fcn.140006940
nop
cmp qword [rbp + 0x248], 8
lea r9, [rbp + 0x230]
jb 0x1400173e1
mov r9, qword [rbp + 0x230]
mov r8, qword [rbp + 0x240]
mov rax, qword [rbp + 0x288]
mov rcx, qword [rbp + 0x290]
mov rdx, rcx
sub rdx, rax
cmp rdx, r8
jae 0x140017420
nop
mov qword [rsp + 0x20], r8
lea rcx, [rbp + 0x278]
mov rdx, r8
call fcn.140005e10
jmp 0x140017454
lea rsi, [rax + r8]
mov qword [rbp + 0x288], rsi
lea rbx, [rbp + 0x278]
cmp rcx, 8
jb 0x14001743f
mov rbx, qword [rbp + 0x278]
lea rcx, [rbx + rax*2]
add r8, r8
mov rdx, r9
call fcn.14006d670
mov word [rbx + rsi*2], 0
nop
mov rax, qword [rbp + 0x248]
cmp rax, 8
jb 0x1400174a3
nop
mov rcx, qword [rbp + 0x230]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14001749e
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140017df9
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
lea rcx, str.SeRestorePrivilege
call fcn.140006140
lea rcx, str.SeBackupPrivilege
call fcn.140006140
nop
mov r8, qword [rbp + 0x278]
mov rbx, qword [rbp + 0x288]
mov rax, qword [rbp + 0x290]
cmp rax, 8
lea r12, [rbp + 0x278]
cmovae r12, r8
test rbx, rbx
je 0x1400176f0
mov ecx, 2
mov rdx, rbx
nop word cs:[rax + rax]
nop
cmp word [r12 + rcx - 2], 0x25
je 0x140017518
add rcx, 2
dec rdx
jne 0x140017500
jmp 0x1400176f0
test rcx, rcx
je 0x1400176f0
mov rax, rbx
sub rax, 0xffffffffffffff80
lea rcx, [rbx + rbx + 0x100]
mov rax, 0xffffffffffffffff
cmovs rcx, rax
call fcn.14001efc0
mov qword [rbp + 0x298], rax
sub ebx, 0xffffff80
mov rcx, r12
mov rdx, qword [rbp + 0x298]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop
cmp qword [rbp + 0x290], 8
lea rax, [rbp + 0x278]
jb 0x140017576
mov rax, qword [rbp + 0x278]
mov qword [rbp + 0x288], 0
mov word [rax], 0
mov rcx, qword [rbp + 0x298]
call fcn.1400441fc
mov r12, rax
mov r13, qword [rbp + 0x290]
cmp r13, rax
jae 0x140017693
movabs rax, 0x7fffffffffffffff
cmp r12, rax
jae 0x140017e12
mov rax, r12
or rax, 7
mov rcx, 0xfffffffffffffffe
movabs rsi, 0x7ffffffffffffffe
cmp rax, rsi
ja 0x14001760f
mov rdx, r13
shr rdx, 1
mov r8, rsi
sub r8, rdx
cmp r8, r13
jb 0x14001760f
add rdx, r13
cmp rax, rdx
mov rsi, rdx
cmova rsi, rax
mov rax, rsi
inc rax
js 0x140017e1c
lea rcx, [rax + rax]
cmp rax, 0x800
jb 0x140017afc
call fcn.140005860
mov rbx, rax
nop
mov qword [rbp + 0x288], r12
mov qword [rbp + 0x290], rsi
mov r8, r12
add r8, r12
mov rcx, rax
mov rdx, qword [rbp + 0x298]
call fcn.14006d670
mov word [rbx + r12*2], 0
cmp r13, 8
jb 0x140017689
nop
mov rcx, qword [rbp + 0x278]
lea rdx, [r13*2 + 2]
cmp rdx, 0x1000
jb 0x140017684
nop
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x140017e21
add r13, r13
add r13, 0x29
mov rdx, r13
mov rcx, rax
call fcn.14001ef80
nop
mov qword [rbp + 0x278], rbx
jmp 0x1400176ca
lea rbx, [rbp + 0x278]
cmp r13, 8
jb 0x1400176a7
mov rbx, qword [rbp + 0x278]
mov qword [rbp + 0x288], r12
mov r8, r12
add r8, r12
mov rcx, rbx
mov rdx, qword [rbp + 0x298]
call fcn.14006d670
mov word [rbx + r12*2], 0
nop
mov rcx, qword [rbp + 0x298]
call fcn.14001efd0
mov r8, qword [rbp + 0x278]
mov rax, qword [rbp + 0x290]
nop word cs:[rax + rax]
cmp rax, 8
lea rax, [rbp + 0x278]
cmovb r8, rax
mov rcx, 0xffffffff80000003
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov r12d, eax
lea rcx, [rbp + 0x230]
mov rdx, 0xffffffff80000003
mov r8, r15
call fcn.140019170
nop
mov rbx, qword [rbp + 0x240]
cmp rbx, 2
jb 0x140017800
lea rax, [rbp + 0x230]
cmp qword [rbp + 0x270], rax
je 0x1400177c0
nop
cmp qword [rbp + 0x248], 8
lea r9, [rbp + 0x230]
jb 0x140017763
mov r9, qword [rbp + 0x230]
mov rax, qword [rbp + 0x2a0]
mov rax, qword [rax + 0x28]
cmp rax, rbx
jae 0x140017785
nop
mov rcx, qword [rbp + 0x270]
mov rdx, rbx
call fcn.140005d00
jmp 0x1400177c0
nop
mov r13, qword [rbp + 0x270]
cmp rax, 8
jb 0x14001779e
mov rax, qword [rbp + 0x2a0]
mov r13, qword [rax + 0x10]
mov rax, qword [rbp + 0x2a0]
mov qword [rax + 0x20], rbx
lea r8, [rbx + rbx]
mov rcx, r13
mov rdx, r9
call fcn.14006d670
mov word [r13 + rbx*2], 0
nop
mov rcx, qword [rbp + 0x2a0]
mov dword [rcx + 4], 3
call fcn.1400186b0
test al, al
je 0x140017800
test r12d, r12d
jne 0x140017970
mov rcx, 0xffffffff80000003
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
jmp 0x140017970
lea rcx, [rbp + 0x1e0]
mov rdx, 0xffffffff80000003
mov r8, r15
call fcn.140018a10
nop
mov rax, qword [rbp + 0x248]
cmp rax, 8
jb 0x140017865
nop
mov rcx, qword [rbp + 0x230]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140017860
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140017e0d
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
nop
movups xmm0, xmmword [rbp + 0x1e0]
movups xmm1, xmmword [rbp + 0x1f0]
movaps xmmword [rbp + 0x240], xmm1
movaps xmmword [rbp + 0x230], xmm0
mov qword [rbp + 0x1f0], 0
mov qword [rbp + 0x1f8], 7
mov word [rbp + 0x1e0], 0
nop
mov rbx, qword [rbp + 0x240]
cmp rbx, 2
jb 0x140017980
lea rax, [rbp + 0x230]
cmp qword [rbp + 0x270], rax
je 0x140017939
nop
cmp qword [rbp + 0x248], 8
lea r9, [rbp + 0x230]
jb 0x1400178dc
mov r9, qword [rbp + 0x230]
mov rax, qword [rbp + 0x2a0]
mov rax, qword [rax + 0x28]
cmp rax, rbx
jae 0x1400178fe
nop
mov rcx, qword [rbp + 0x270]
mov rdx, rbx
call fcn.140005d00
jmp 0x140017939
nop
mov r13, qword [rbp + 0x270]
cmp rax, 8
jb 0x140017917
mov rax, qword [rbp + 0x2a0]
mov r13, qword [rax + 0x10]
mov rax, qword [rbp + 0x2a0]
mov qword [rax + 0x20], rbx
lea r8, [rbx + rbx]
mov rcx, r13
mov rdx, r9
call fcn.14006d670
mov word [r13 + rbx*2], 0
nop
mov rcx, qword [rbp + 0x2a0]
mov dword [rcx + 4], 4
call fcn.1400186b0
test al, al
je 0x140017980
test r12d, r12d
jne 0x140017970
mov rcx, 0xffffffff80000003
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
nop word cs:[rax + rax]
xor ebx, ebx
jmp 0x1400179a0
test r12d, r12d
jne 0x140017995
mov rcx, 0xffffffff80000003
mov rdx, r15
call qword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov bl, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rax, qword [rbp + 0x248]
cmp rax, 8
jb 0x1400179ef
nop
mov rcx, qword [rbp + 0x230]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x1400179ea
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140017e08
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
nop
mov rax, qword [rbp + 0x290]
cmp rax, 8
jb 0x140017a3e
nop
mov rcx, qword [rbp + 0x278]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140017a39
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140017dfe
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
nop
mov rax, qword [rbp + 0x1d8]
cmp rax, 8
jb 0x140017a8d
nop
mov rcx, qword [rbp + 0x1c0]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140017a88
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140017e03
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
test bl, bl
je 0x140017ab0
nop
mov word [rbp - 0x40], 0
mov dword [rbp + 0x228], 0xff
inc r14d
mov dil, 1
jmp 0x140017ab2
xor edi, edi
nop
mov rax, qword [rbp + 0x268]
cmp rax, 8
jb 0x140017122
nop
mov rcx, qword [rbp + 0x250]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14001711d
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jb 0x140017110
jmp 0x140017df4
call fcn.14001ef3c
jmp 0x140017614
lea r8, [0x14007144e]
lea rbx, [rbp - 0x40]
mov rcx, rbx
mov rdx, 0xffffffff80000001
call fcn.140019170
nop
mov r14, qword [rbp - 0x30]
cmp r14, 2
jb 0x140017c69
mov rax, qword [rbp + 0x2a0]
lea r15, [rax + 0x10]
lea r9, [rbp - 0x40]
cmp r15, r9
je 0x140017c4d
nop
cmp qword [rbp - 0x28], 8
jb 0x140017b53
mov r9, qword [rbp - 0x40]
mov rax, qword [rbp + 0x2a0]
mov rax, qword [rax + 0x28]
cmp rax, r14
jae 0x140017c1b
mov rcx, r15
mov rdx, r14
call fcn.140005d00
jmp 0x140017c4d
nop
mov rcx, qword [rbp + 0x200]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140017b92
nop
mov dword [rbp + 0x22c], 0
nop
mov rax, qword [rbp + 0x220]
cmp rax, 8
jb 0x140017be1
nop
mov rcx, qword [rbp + 0x208]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140017bdc
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140017e17
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
mov dil, 1
cmp byte [rbp + 0x22c], 0
je 0x140017bfe
nop
mov rax, qword [rbp + 0x2a0]
mov dword [rax + 4], 5
xor edi, edi
mov eax, edi
movaps xmm6, xmmword [rbp + 0x2b0]
add rsp, 0x348
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
cmp rax, 8
jb 0x140017c2c
mov rax, qword [rbp + 0x2a0]
mov r15, qword [rax + 0x10]
mov rax, qword [rbp + 0x2a0]
mov qword [rax + 0x20], r14
lea r8, [r14 + r14]
mov rcx, r15
mov rdx, r9
call fcn.14006d670
mov word [r15 + r14*2], 0
nop
mov rcx, qword [rbp + 0x2a0]
mov dword [rcx + 4], 1
call fcn.1400186b0
test al, al
jne 0x140017d97
lea r8, [0x14007144e]
lea rcx, [rbp + 0x208]
mov rdx, 0xffffffff80000001
call fcn.140018a10
nop
mov rax, qword [rbp - 0x28]
cmp rax, 8
jb 0x140017ccc
nop
mov rcx, qword [rbp - 0x40]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140017cc7
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140017e2b
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
nop
movups xmm0, xmmword [rbp + 0x208]
movups xmm1, xmmword [rbp + 0x218]
movaps xmmword [rbp - 0x30], xmm1
movaps xmmword [rbp - 0x40], xmm0
mov qword [rbp + 0x218], 0
mov qword [rbp + 0x220], 7
mov word [rbp + 0x208], 0
nop
mov r14, qword [rbp - 0x30]
cmp r14, 2
jb 0x140017d9b
mov rax, qword [rbp + 0x2a0]
lea r15, [rax + 0x10]
cmp r15, rbx
je 0x140017d7f
nop
cmp qword [rbp - 0x28], 8
jb 0x140017d2d
mov rbx, qword [rbp - 0x40]
mov rax, qword [rbp + 0x2a0]
mov rax, qword [rax + 0x28]
cmp rax, r14
jae 0x140017d4d
mov rcx, r15
mov rdx, r14
mov r9, rbx
call fcn.140005d00
jmp 0x140017d7f
cmp rax, 8
jb 0x140017d5e
mov rax, qword [rbp + 0x2a0]
mov r15, qword [rax + 0x10]
mov rax, qword [rbp + 0x2a0]
mov qword [rax + 0x20], r14
lea r8, [r14 + r14]
mov rcx, r15
mov rdx, rbx
call fcn.14006d670
mov word [r15 + r14*2], 0
nop
mov rcx, qword [rbp + 0x2a0]
mov dword [rcx + 4], 2
call fcn.1400186b0
test al, al
je 0x140017d9b
xor ebx, ebx
jmp 0x140017d9d
mov bl, 1
nop
mov rax, qword [rbp - 0x28]
cmp rax, 8
jb 0x140017de2
nop
mov rcx, qword [rbp - 0x40]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140017ddd
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140017e26
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
test bl, bl
jne 0x140017bed
jmp 0x140017bfe
call fcn.140005840
call fcn.14003f990
call fcn.14003f990
call fcn.14003f990
call fcn.14003f990
call fcn.14003f990
call fcn.14003f990
call fcn.140005840
call fcn.14003f990
call fcn.140005890
call fcn.14003f990
call fcn.14003f990
call fcn.14003f990
int3