Function at 0x10000a8ac
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0x330
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x10006e0c8]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov rbx, r8
mov rsi, rdx
mov r12, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [r12 + 0xb0]
xor r13d, r13d
cmp rcx, r13
je 0x10000caee
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp eax, r13d
je 0x10000caff
mov eax, 0xea
cmp edi, eax
je 0x100020a26
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x10000a94f
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.100001670
add rsp, 0x330
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
lea ecx, [r13 + 6]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x10000a94f
mov eax, 0xea
mov ecx, dword [rsp + 0x34]
cmp ecx, 1
je 0x10000cb1b
cmp ecx, 7
je 0x10000cb1b
cmp ecx, 2
jne 0x10000a943
cmp dword [rsp + 0x34], 2
jne 0x100020a9d
cmp edi, eax
je 0x100020a2b
mov esi, 0x104
cmp dword [rbx + 0x10], esi
jae 0x10000cb42
mov rax, qword [rbx]
mov edx, esi
mov rcx, rbx
call qword [rax]
mov r8d, esi
mov rdx, qword [rbx + 8]
lea rcx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x30], eax
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x100020a6a
add eax, eax
mov dword [rsp + 0x30], eax
jmp 0x10000cb72
cmp edi, r13d
jne 0x100020b87
shr eax, 1
mov dword [rsp + 0x30], eax
je 0x100020c0f
lea ecx, [rax - 1]
mov eax, dword [rbx + 0x10]
dec eax
cmp ecx, eax
ja 0x100020bd0
mov dword [rbx + 0x14], ecx
mov rax, qword [rbx + 8]
mov word [rax + rcx*2], r13w
jmp 0x10000cba5
mov eax, 1
jmp 0x10000a94f
jmp 0x10000cb04
mov edx, 0x80010135
lea rcx, [rsp + 0x38]
call fcn.100029020
lea rcx, [rsp + 0xc8]
mov rdx, rax
mov r8d, 0x20
call sub.msvcrt.dll_memcpy
lea rdx, [0x10005cb70]
lea rcx, [rsp + 0xc8]
call sub.msvcrt.dll__CxxThrowException
nop
jmp 0x10000cb2e
mov edx, 0x80010135
lea rcx, [rsp + 0x38]
call fcn.100029020
lea rcx, [rsp + 0x68]
mov rdx, rax
mov r8d, 0x20
call sub.msvcrt.dll_memcpy
lea rdx, [0x10005cb70]
lea rcx, [rsp + 0x68]
call sub.msvcrt.dll__CxxThrowException
cmp edi, eax
jne 0x100020aeb
mov edx, dword [rsp + 0x30]
shr edx, 1
cmp edx, dword [rbx + 0x10]
jbe 0x100020ab4
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 8]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [r12 + 0xb0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x30]
jmp 0x10000cb72
mov eax, dword [rsp + 0x30]
mov edx, eax
shr edx, 1
cmp edx, dword [rbx + 0x10]
jbe 0x100020b04
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, dword [rsp + 0x30]
mov rcx, qword [rbx + 8]
mov r8d, eax
shr r8, 1
mov edx, r13d
je 0x100020b1c
cmp r8, 0x7fffffff
jbe 0x100020b21
mov edx, 0x80070057
cmp edx, r13d
jl 0x100020c20
mov eax, 0x7ffffffe
lea r10, [rsp + 0x110]
mov edx, r13d
mov r11, r13
cmp r8, r13
je 0x100020b68
cmp rax, r13
je 0x100020b71
movzx r9d, word [r10]
cmp r9w, r13w
je 0x100020b71
mov word [rcx], r9w
add rcx, 2
add r10, 2
dec r8
dec rax
inc r11
jmp 0x100020b3d
sub rcx, 2
mov edx, 0x8007007a
mov word [rcx], r13w
cmp edx, r13d
jl 0x100020c20
mov eax, dword [rsp + 0x30]
jmp 0x10000cb72
movzx edx, di
or edx, 0x80070000
cmp edi, r13d
cmovle edx, edi
lea rcx, [rsp + 0x38]
call fcn.100029020
lea rcx, [rsp + 0xa8]
mov rdx, rax
mov r8d, 0x20
call sub.msvcrt.dll_memcpy
lea rdx, [0x10005cb70]
lea rcx, [rsp + 0xa8]
call sub.msvcrt.dll__CxxThrowException
nop
jmp 0x10000cb7b
mov edx, 0x800700ce
lea rcx, [rsp + 0x38]
call fcn.100029020
lea rcx, [rsp + 0xe8]
mov rdx, rax
mov r8d, 0x20
call sub.msvcrt.dll_memcpy
lea rdx, [0x10005cb70]
lea rcx, [rsp + 0xe8]
call sub.msvcrt.dll__CxxThrowException
int3
mov dword [rbx + 0x14], r13d
mov rcx, qword [rbx + 8]
mov word [rcx], r13w
jmp 0x10000cba5
lea rcx, [rsp + 0x38]
call fcn.100029020
lea rcx, [rsp + 0x88]
mov rdx, rax
mov r8d, 0x20
call sub.msvcrt.dll_memcpy
lea rdx, [0x10005cb70]
lea rcx, [rsp + 0x88]
call sub.msvcrt.dll__CxxThrowException
nop
xor eax, eax
jmp 0x10000a94f