Function at 0x1400cbd80
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x628]
sub rsp, 0x728
mov rax, qword [0x14031a320]
xor rax, rsp
mov qword [rbp + 0x610], rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
cmp r8, r9
je 0x1400cbdd4
mov r8, qword [r9 + 0x10]
cmp qword [r9 + 0x18], 8
jb 0x1400cbdc9
mov r9, qword [r9]
mov rdx, r9
mov rcx, rbx
call fcn.1400bc200
mov dword [rbp - 0x30], 0x400
cmp qword [rdi + 0x18], 8
jb 0x1400cbde5
mov rdi, qword [rdi]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x210]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r12d, eax
test eax, eax
jne 0x1400cc208
lea rax, [rbp + 0x210]
mov r15, 0xffffffffffffffff
mov r8, r15
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400cbe30
lea rdx, [rbp + 0x210]
mov rcx, rbx
call fcn.1400bc200
xor r8d, r8d
mov rcx, rbx
call fcn.1400d19d0
mov rdi, rax
cmp rax, r15
je 0x1400cc208
lea rsi, [rax + 1]
mov r8, rsi
mov rcx, rbx
call fcn.1400d19d0
mov r14, rax
cmp rax, r15
je 0x1400cbf40
xor r13d, r13d
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r13w
mov rcx, qword [rbx + 0x10]
cmp rcx, rsi
jb 0x1400cc234
mov r8, rax
sub r8, rdi
dec r8
sub rcx, rsi
cmp rcx, r8
cmovb r8, rcx
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400cbebd
mov rax, qword [rbx]
lea rdx, [rax + rsi*2]
lea rcx, [rbp - 0x28]
call fcn.1400bc200
nop
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
mov r8d, 0x104
lea rdx, [rbp]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x1400cbf47
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x1400cbf40
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400cbf3b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400cc1fc
call fcn.140253504
xor eax, eax
jmp 0x1400cc20b
inc r14
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r13w
mov rax, qword [rbx + 0x10]
cmp rax, r14
jb 0x1400cc22e
sub rax, r14
cmp rax, 0xffffffffffffffff
cmovb r15, rax
mov rax, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400cbf81
mov rax, qword [rbx]
lea rdx, [rax + r14*2]
mov r8, r15
lea rcx, [rsp + 0x70]
call fcn.1400bc200
nop
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r13w
mov r8, rsi
lea rdx, [rbp]
lea rcx, [rsp + 0x50]
call fcn.1400bc200
nop
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r13w
cmp qword [rbx + 0x10], rdi
cmovb rdi, qword [rbx + 0x10]
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400cbfe3
mov rdx, qword [rbx]
mov r8, rdi
lea rcx, [rsp + 0x30]
call fcn.1400bc200
nop
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
lea rcx, [rbp - 0x50]
call fcn.1400d4920
nop
lea r9, [rsp + 0x70]
lea r8, [rbp - 0x50]
lea rcx, [rbp - 0x70]
call fcn.1400d4920
lea rax, [rbp - 0x70]
cmp rbx, rax
je 0x1400cc06c
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x1400cc05b
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x1400cc056
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400cc0a3
mov rcx, r8
call fcn.140253504
movups xmm0, xmmword [rbp - 0x70]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp - 0x60]
movups xmmword [rbx + 0x10], xmm1
jmp 0x1400cc0b0
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x1400cc0b0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400cc0aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400cc0aa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140253504
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x1400cc0f4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400cc0ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400cc0ee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140253504
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x1400cc13a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400cc134
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400cc134
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140253504
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x1400cc180
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400cc17a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400cc17a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140253504
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x1400cc1c5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400cc1bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400cc1bf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140253504
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x1400cc208
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400cc203
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400cc203
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140253504
mov eax, r12d
mov rcx, qword [rbp + 0x610]
xor rcx, rsp
call fcn.140252d20
add rsp, 0x728
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400bc590
nop
call fcn.1400bc590
int3