Function at 0x180007380
Capabilities:
Query environment variable
Query or enumerate registry value
Terminate process

Disassembly:
push rbp
push rbx
lea rbp, [rsp - 0x4f]
sub rsp, 0x98
xor ebx, ebx
cmp dword [0x1800d5678], 0x114f8554
jne 0x1800074ac
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadMenuIndirectW]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetMenuItemRect]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetComputerNameW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetComboBoxInfo]
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeImpersonateClient]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_KillTimer]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
lea r9, [0x1800ec808]
xor r8d, r8d
xor edx, edx
lea rcx, [0x1800ec848]
call qword [sym.imp.KERNEL32.dll_GetTimeFormatEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumberOfConsoleMouseButtons]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
call qword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetClientRect]
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetNumaAvailableMemoryNodeEx]
mov edx, dword [rbp + 0x67]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleScreenBufferSize]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetLastInputInfo]
xor ecx, ecx
call qword [sym.imp.USER32.dll_TranslateMessage]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetConsoleActiveScreenBuffer]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetVolumeLabelW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetCaretPos]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_IntersectRect]
xor ecx, ecx
call qword [sym.imp.USER32.dll_IsWindowUnicode]
lea rcx, [0x1800ec870]
call qword [sym.imp.KERNEL32.dll_AddDllDirectory]
xor edx, edx
xor ecx, ecx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsValidCodePage]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [rbp + 0x6f], ebx
mov dword [rbp + 0x67], ebx
lea rax, [rbp + 0x77]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [0x1800ec7e8]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18000777a
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
lea r9, [rbp + 0x6f]
xor r8d, r8d
lea rdx, [0x1800ec8a0]
mov rcx, qword [rbp + 0x77]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1800075e0
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rax, 0x1f7
mov qword [rbp - 0x19], rax
mov dword [rbp - 0x11], 0x1f7
mov eax, dword [rbp - 0xd]
mov dword [rbp - 0xd], eax
xor eax, eax
mov word [rbp - 9], ax
mov byte [rbp - 7], al
mov qword [rbp - 1], rbx
mov qword [rbp + 7], rbx
mov qword [rbp + 0xf], rbx
mov qword [rbp + 0x17], rbx
mov qword [rbp + 0x1f], rbx
lea ecx, [rax + 0x10]
call fcn.180051c58
mov qword [rax + 8], rbx
mov qword [rbp - 1], rax
lea rcx, [rbp - 1]
mov qword [rax], rcx
mov word [rbp + 0x2f], bx
mov qword [rbp + 0x35], rbx
mov qword [rbp + 0x3d], rbx
xor eax, eax
mov word [rbp + 0x32], ax
mov byte [rbp + 0x34], al
mov word [rbp + 0x35], ax
mov byte [rbp + 0x37], al
mov word [rbp + 0x38], ax
mov byte [rbp + 0x3a], al
mov word [rbp + 0x3b], ax
mov byte [rbp + 0x3d], al
mov word [rbp + 0x3e], ax
mov byte [rbp + 0x40], al
mov word [rbp + 0x41], ax
mov byte [rbp + 0x43], al
mov dword [rbp - 5], ebx
mov dword [rbp + 0x2b], ebx
movaps xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rbp - 0x19], xmm0
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 9]
call fcn.18000f920
nop
lea rcx, [rbp - 1]
call fcn.180011450
mov rcx, qword [rbp - 1]
mov qword [rbp - 1], rbx
mov edx, 0x10
call fcn.180051b6c
mov al, 1
add rsp, 0x98
pop rbx
pop rbp
ret
mov r9d, 0x38efc
mov r10d, 0x14808
mov r8d, 0x15857
nop dword [rax]
nop word [rax + rax]
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x180007600
sub r9d, r8d
add r9d, 0xfffff27d
add r9d, r10d
mov r8d, 0xfff69458
nop dword [rax]
inc r8d
mov eax, 0x55555556
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x180007630
lea edx, [r9 + 0x2922a]
lea ecx, [r8 + 0x2623]
add ecx, r9d
add ecx, edx
add edx, 0xf0c
sub r9d, edx
sub ecx, edx
test cl, 1
mov eax, 0xffffefe1
mov r8d, 0xffffe547
cmove eax, r8d
sub eax, r9d
lea r8d, [rax + 0x4ea0]
add r8d, ecx
add r9d, 0xffff7ef7
cmp edx, 0x6125f
jne 0x180007786
cmp r9d, 0xfffcddc1
jne 0x180007786
cmp r8d, 0xfffcf1b7
jne 0x180007786
mov rax, qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rax, 0x204
mov qword [rbp - 0x19], rax
mov dword [rbp - 0x11], 0x204
mov eax, dword [rbp - 0xd]
mov dword [rbp - 0xd], eax
xor eax, eax
mov word [rbp - 9], ax
mov byte [rbp - 7], al
mov qword [rbp - 1], rbx
mov qword [rbp + 7], rbx
mov qword [rbp + 0xf], rbx
mov qword [rbp + 0x17], rbx
mov qword [rbp + 0x1f], rbx
lea ecx, [rax + 0x10]
call fcn.180051c58
mov qword [rax + 8], rbx
mov qword [rbp - 1], rax
lea rcx, [rbp - 1]
mov qword [rax], rcx
mov word [rbp + 0x2f], bx
mov qword [rbp + 0x35], rbx
mov qword [rbp + 0x3d], rbx
xor eax, eax
mov word [rbp + 0x32], ax
mov byte [rbp + 0x34], al
mov word [rbp + 0x35], ax
mov byte [rbp + 0x37], al
mov word [rbp + 0x38], ax
mov byte [rbp + 0x3a], al
mov word [rbp + 0x3b], ax
mov byte [rbp + 0x3d], al
mov word [rbp + 0x3e], ax
mov byte [rbp + 0x40], al
mov word [rbp + 0x41], ax
mov byte [rbp + 0x43], al
mov dword [rbp - 5], ebx
mov dword [rbp + 0x2b], ebx
movaps xmm0, xmmword [rbp - 0x19]
movdqa xmmword [rbp - 0x19], xmm0
lea r8, [rbp + 0x77]
lea rdx, [rbp - 0x19]
lea rcx, [rbp - 9]
call fcn.18000f920
nop
lea rcx, [rbp - 1]
call fcn.180011450
mov rcx, qword [rbp - 1]
mov qword [rbp - 1], rbx
mov edx, 0x10
call fcn.180051b6c
xor al, al
add rsp, 0x98
pop rbx
pop rbp
ret
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]