Function at 0x10000d810
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
sub rsp, 0x4a0
mov rax, qword [0x100012150]
xor rax, rsp
mov qword [rsp + 0x490], rax
movzx r8d, byte [rcx + 0x15]
movzx r9d, byte [rcx + 0x14]
movzx eax, byte [rcx + 0x17]
movzx r10d, byte [rcx + 0x13]
movzx r11d, byte [rcx + 0x12]
mov dword [rsp + 0x68], eax
mov rbp, rcx
mov r12, rdx
movzx edx, byte [rcx + 0x16]
movzx ecx, byte [rcx + 0x11]
movzx edi, word [rbp + 0xe]
movzx ebx, byte [rbp + 0x10]
movzx esi, word [rbp + 0xc]
mov dword [rsp + 0x60], edx
mov dword [rsp + 0x58], r8d
mov dword [rsp + 0x50], r9d
mov r9d, dword [rbp + 8]
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ecx
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], edi
mov edi, 0x100
lea r8, [0x100002410]
lea rcx, [rsp + 0x90]
mov rdx, rdi
mov dword [rsp + 0x84], 0x208
mov dword [rsp + 0x20], esi
call fcn.10000c0fc
xor ebx, ebx
cmp eax, ebx
jge 0x10000d8cd
xor eax, eax
jmp 0x10000da69
lea r9, [rsp + 0x90]
lea r8, [0x1000023b8]
lea rcx, [rsp + 0x290]
mov rdx, rdi
call fcn.10000c0fc
cmp eax, ebx
jl 0x10000d8c6
mov eax, dword [0x100014d90]
test al, 1
jne 0x10000d928
or eax, 1
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], ebx
mov dword [0x100014d90], eax
call fcn.10000cc7c
cmp eax, ebx
mov eax, ebx
je 0x10000d922
cmp dword [rsp + 0x70], 0x2000
setb al
mov dword [0x100014d94], eax
lea rax, [rsp + 0x78]
lea rdx, [rsp + 0x290]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x10000da67
mov rcx, qword [rsp + 0x78]
lea rax, [rsp + 0x84]
lea r9, [rsp + 0x80]
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x80], 2
mov ebp, eax
jne 0x10000da4c
mov rcx, 0xffffffffffffffff
mov esi, 0x104
mov eax, 2
mul rsi
cmovo rax, rcx
mov rcx, rax
call fcn.10000db98
mov r8d, esi
mov rcx, r12
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebx
je 0x10000d9e6
cmp eax, esi
jae 0x10000d9e6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
cmp rcx, 0x7ffffffe
jbe 0x10000d9fe
mov word [r12], bx
mov rcx, rdi
call sub.msvcrt.dll_free
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10000d8c6
mov rdx, rdi
mov rax, r12
mov r8d, ebx
sub rdx, r12
cmp rcx, rbx
je 0x10000da2d
movzx r9d, word [rdx + rax]
cmp r9w, bx
je 0x10000da2d
dec rsi
mov word [rax], r9w
dec rcx
add rax, 2
cmp rsi, rbx
jne 0x10000da0a
cmp rsi, rbx
jne 0x10000da3c
sub rax, 2
mov r8d, 0x8007007a
mov word [rax], bx
cmp r8d, ebx
jne 0x10000d9e6
mov rcx, rdi
call sub.msvcrt.dll_free
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebp, ebx
jne 0x10000da67
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rbx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.10000e1c0
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret