Function at 0x10006ae74
Capabilities:
Create directory
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r14
sub rsp, 0x480
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x470], rax
xor r12d, r12d
mov esi, edx
lea rax, [rsp + 0x38]
mov rbp, rcx
lea rdx, [0x100029890]
lea r9d, [r12 + 1]
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x38], r12
mov ebx, 0x80004005
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r12d
jne 0x10006b125
mov ecx, 0x208
mov eax, esi
lea r9, [rsp + 0x30]
cmp esi, ecx
lea rdx, [0x10002ee70]
mov dword [rsp + 0x30], 1
cmova eax, ecx
mov rcx, qword [rsp + 0x38]
xor r8d, r8d
mov dword [rsp + 0x40], eax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r14d, 0x104
cmp eax, r12d
jne 0x10006b000
mov eax, dword [rsp + 0x30]
cmp eax, 1
je 0x10006af41
cmp eax, 2
jne 0x10006b000
cmp eax, 2
jne 0x10006afaf
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x50]
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, r12d
je 0x10006b000
lea rdi, [rsp + 0x260]
lea rax, [rsp + 0x50]
mov edx, 0x103
sub rdi, rax
lea rcx, [rsp + 0x50]
lea rax, [rdx + 0x7ffffefb]
cmp rax, r12
je 0x10006afa2
movzx eax, word [rdi + rcx]
cmp ax, r12w
je 0x10006afa2
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x10006af7f
cmp rdx, r12
jne 0x10006afab
sub rcx, 2
mov word [rcx], r12w
lea rax, [rsp + 0x50]
cmp rax, r12
je 0x10006afc5
lea rcx, [rsp + 0x50]
call fcn.100053354
jmp 0x10006afc8
mov eax, r12d
cmp eax, r12d
jne 0x10006b0d5
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, [rsp + 0x50]
cmp rdx, r12
je 0x10006aff4
lea rcx, [rsp + 0x50]
call fcn.100053354
jmp 0x10006aff7
mov eax, r12d
cmp eax, r12d
jne 0x10006b0d5
lea rcx, [rsp + 0x260]
mov edx, r14d
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp eax, r12d
je 0x10006b11a
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x260]
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [0x1000297b0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll_wcsstr]
mov r11, rax
cmp rax, r12
je 0x10006b11a
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r11
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 4
jbe 0x10006b11a
mov rcx, qword [0x100088070]
lea r8, [rsp + 0x260]
mov r9d, r14d
mov edx, 0x26fc
mov word [r11 + 4], r12w
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, r12d
je 0x10006b11a
lea r8, [rsp + 0x260]
lea rcx, [rsp + 0x50]
mov rdx, r14
call fcn.100039ee4
lea rcx, [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, [rsp + 0x50]
cmp rdx, r12
je 0x10006b0cd
lea rcx, [rsp + 0x50]
call fcn.100053354
jmp 0x10006b0d0
mov eax, r12d
cmp eax, r12d
je 0x10006b115
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
mov rdx, rsi
mov ebx, r12d
not rcx
shr rdx, 1
cmp rdx, rcx
jbe 0x10006b103
lea r8, [rsp + 0x50]
mov rcx, rbp
call fcn.100039df8
jmp 0x10006b11a
mov ecx, 0x8007007a
mov ebx, 0x8007007a
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10006b11a
mov ebx, 0x80004005
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x470]
xor rcx, rsp
call fcn.10007fa70
mov rbx, qword [rsp + 0x4c0]
add rsp, 0x480
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret