Function at 0x140006738
Capabilities:
Get common file path
Query or enumerate registry key
Query or enumerate registry value
Set environment variable

Disassembly:
mov r11, rsp
push r13
push r14
push r15
sub rsp, 0x4f0
mov qword [r11 - 0x468], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
mov rax, qword [0x1400db348]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rcx, qword [0x1400dbe00]
xor esi, esi
lea rax, [0x140051790]
test rcx, rcx
je 0x140006793
cmp rcx, rax
jne 0x1400071f8
mov qword [0x1400dbe00], rax
mov r14d, 1
mov dword [rsp + 0x68], r14d
lea ebx, [r14 + 3]
mov r8d, ebx
lea rdx, [rsp + 0x68]
lea ecx, [rbx - 2]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
nop dword [rax + rax]
mov dword [rsp + 0x48], 2
mov r8d, ebx
lea rdx, [rsp + 0x48]
lea r12d, [r14 + 8]
mov ecx, r12d
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
nop dword [rax + rax]
mov dword [rsp + 0x58], r14d
mov r8d, ebx
lea rdx, [rsp + 0x58]
lea ecx, [rbx + 6]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
nop dword [rax + rax]
mov r15d, esi
mov dword [rsp + 0x48], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
nop dword [rax + rax]
test eax, eax
jns 0x140006824
mov eax, 0x800401f0
jmp 0x1400071c5
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapSetInformation]
nop dword [rax + rax]
mov rdi, rsi
mov qword [rsp + 0x78], rsi
call fcn.140007dfc
test al, al
je 0x1400069eb
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
lea r8, str.SOFTWAREMicrosoftWindows_SearchGatherWindowsSystemIndexProtocols
mov rdx, 0xffffffff80000002
call fcn.14000add8
test eax, eax
jne 0x1400069eb
mov r12d, 0xff
mov ebx, esi
xor edx, edx
jmp 0x14000699a
mov rcx, r12
lea rax, [rsp + 0xd0]
cmp word [rax], si
je 0x1400068a2
add rax, 2
sub rcx, r14
jne 0x140006894
test rcx, rcx
je 0x1400068af
mov rax, r12
sub rax, rcx
jmp 0x1400068b2
mov rax, rsi
test rcx, rcx
je 0x14000690d
mov rdx, r12
sub rdx, rax
lea rcx, [rsp + 0xd0]
lea rcx, [rcx + rax*2]
je 0x1400068ff
lea r8, [rax + 0x7ffffeff]
add r8, rdx
lea rax, [0x1400a89a0]
sub rax, rcx
test r8, r8
je 0x1400068ff
movzx r9d, word [rax + rcx]
test r9w, r9w
je 0x1400068ff
mov word [rcx], r9w
add rcx, 2
sub r8, r14
sub rdx, r14
jne 0x1400068df
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], si
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
lea r8, [rsp + 0xd0]
mov rdx, qword [rsp + 0x60]
call fcn.14000add8
test eax, eax
jne 0x140006995
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x50], r14d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.ProgIdHandler
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x140006984
lea rcx, [rsp + 0x2d0]
call fcn.140007da0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
add ebx, r14d
mov edx, ebx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x58], r12d
lea r9, [rsp + 0x58]
lea r8, [rsp + 0xd0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x140006889
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
call fcn.140026a6c
nop
jmp 0x140006a01
call fcn.1400288a0
test byte [0x1400dd8c2], 8
je 0x140006a32
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea rdx, [0x1400a84d8]
lea rcx, [0x1400da440]
call fcn.140029954
test byte [0x1400dd8c1], 8
je 0x140006a5d
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
nop dword [rax + rax]
mov r8d, eax
lea rdx, [0x1400b5728]
lea rcx, [0x1400da440]
call fcn.14004d558
call fcn.1400038f4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
nop dword [rax + rax]
mov rcx, rax
mov edx, 0x20
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetPriorityClass]
nop dword [rax + rax]
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140002f80]
lea rcx, [0x1400dc308]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_InitOnceExecuteOnce]
nop dword [rax + rax]
cmp byte [0x1400dbe28], sil
je 0x140006ab0
call fcn.140051db8
mov byte [rsp + 0x59], r14b
mov qword [rsp + 0x68], rsi
lea rcx, [rsp + 0x68]
call fcn.140027b18
nop
lea rcx, [rsp + 0xd0]
call fcn.14001eb08
nop
lea rcx, [rsp + 0x60]
call fcn.14001dc48
nop
lea rcx, [rsp + 0x70]
call fcn.14001dc14
nop
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x801c
xor ecx, ecx
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetFolderPathW]
nop dword [rax + rax]
test eax, eax
jns 0x140006b88
mov rcx, qword [rsp + 0x508]
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0xf7
call fcn.14004b128
mov r15d, r14d
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140006b4a
mov rax, qword [0x14009e368]
call qword [case.0x140024a95.0]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140006b62
mov rax, qword [0x14009e368]
call qword [case.0x140024a95.0]
nop
lea rcx, [rsp + 0xd0]
call fcn.14001e86c
nop
mov rcx, qword [rsp + 0x68]
mov rax, qword [0x14009e368]
call qword [case.0x140024a95.0]
nop
jmp 0x1400070f5
lea rdx, [rsp + 0x2d0]
lea rcx, str.LOCALAPPDATA
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetEnvironmentVariableW]
nop dword [rax + rax]
test eax, eax
jne 0x140006c19
mov rcx, qword [rsp + 0x508]
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x101
call fcn.1400521e0
mov r15d, r14d
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140006bdb
mov rax, qword [0x14009e368]
call qword [case.0x140024a95.0]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140006bf3
mov rax, qword [0x14009e368]
call qword [case.0x140024a95.0]
nop
lea rcx, [rsp + 0xd0]
call fcn.14001e86c
nop
mov rcx, qword [rsp + 0x68]
mov rax, qword [0x14009e368]
call qword [case.0x140024a95.0]
nop
jmp 0x1400070f5
lea rcx, [rsp + 0xd0]
call fcn.140026f58
mov byte [rsp + 0x40], sil
mov ebx, 0xc0100000
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb0]
mov edx, r14d
lea rcx, [rsp + 0x68]
call fcn.1400272d0
mov byte [rsp + 0x40], sil
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb0]
mov edx, r14d
lea rcx, [rsp + 0x68]
call fcn.1400272d0
mov rbx, qword [rsp + 0x68]
mov r8, rbx
lea rcx, [rsp + 0xd0]
call fcn.14001eb7c
mov dword [rsp + 0x80], SafeArrayPutElement
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x90], esi
mov r12d, esi
cmp r12d, 0xf
jae 0x140006e27
lea r8, str.SearchServiceMUT
mov edx, r14d
lea rcx, [rsp + 0x80]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
nop dword [rax + rax]
mov rdx, rax
lea rcx, [0x1400dc480]
call fcn.14000cc28
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r13d, eax
mov rcx, qword [0x1400dc480]
dec rcx
cmp rcx, 0xfffffffffffffffd
ja 0x140006d41
test eax, eax
je 0x140006e27
xor edx, edx
lea rcx, [0x1400dc480]
call fcn.14000cc28
cmp r13d, 0xb7
je 0x140006daf
mov r15d, r14d
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140006d73
mov rax, qword [0x14009e368]
call qword [case.0x140024a95.0]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140006d8b
mov rax, qword [0x14009e368]
call qword [case.0x140024a95.0]
nop
lea rcx, [rsp + 0xd0]
call fcn.14001e86c
nop
mov rcx, rbx
mov rax, qword [0x14009e368]
call qword [case.0x140024a95.0]
nop
jmp 0x1400070f5
cmp r12d, 0xe
jne 0x140006e0e
lea r15d, [r12 - 0xc]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140006dd2
mov rax, qword [0x14009e368]
call qword [case.0x140024a95.0]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140006dea
mov rax, qword [0x14009e368]
call qword [case.0x140024a95.0]
nop
lea rcx, [rsp + 0xd0]
call fcn.14001e86c
nop
mov rcx, rbx
mov rax, qword [0x14009e368]
call qword [case.0x140024a95.0]
nop
jmp 0x1400070f5
mov ecx, 0x7d0
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
nop dword [rax + rax]
add r12d, r14d
jmp 0x140006ce3
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140006e3f
mov rax, qword [0x14009e368]
call qword [case.0x140024a95.0]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140006e57
mov rax, qword [0x14009e368]
call qword [case.0x140024a95.0]
nop
lea rcx, [rsp + 0xd0]
call fcn.14001e86c
nop
mov rcx, rbx
mov rax, qword [0x14009e368]
call qword [case.0x140024a95.0]
nop
lea rcx, [rsp + 0x68]
call fcn.140025450
mov rdi, rax
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x140006e9a
mov r15d, r14d
mov dword [rsp + 0x48], r14d
jmp 0x1400070f5
cmp dword [rsp + 0x68], 2
jne 0x140006efc
mov ebx, r14d
cmp ebx, dword [rsp + 0x68]
jge 0x140006efc
movsxd rax, ebx
mov rcx, qword [rdi + rax*8]
movzx eax, word [rcx]
sub ax, 0x2d
mov edx, 0xfffd
test dx, ax
je 0x140006ecf
mov r15d, r14d
mov dword [rsp + 0x48], r14d
jmp 0x1400070f5
add rcx, 2
lea rdx, str.Embedding
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006eef
add ebx, r14d
jmp 0x140006ea4
mov r15d, r14d
mov dword [rsp + 0x48], r14d
jmp 0x1400070f5
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x50], eax
mov r12d, eax
mov rcx, qword [rsp + 0x508]
test eax, eax
jns 0x140006f3a
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x16c
call fcn.140043510
jmp 0x14000700c
mov qword [rsp + 0x60], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [0x1400a8a68]
mov r8d, r14d
xor edx, edx
lea rcx, [0x1400a7ae8]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x508]
test eax, eax
jns 0x140006f88
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x173
call fcn.140043510
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140006fc7
mov rax, qword [rcx]
mov r8, r14
mov edx, 5
mov rax, qword [rax + 0x18]
call qword [case.0x140024a95.0]
mov rcx, qword [rsp + 0x508]
test eax, eax
jns 0x140006fc7
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x176
call fcn.140043510
call fcn.14001eba8
mov r12d, eax
mov rcx, qword [rsp + 0x508]
test eax, eax
jns 0x140006ff0
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x17a
call fcn.140043510
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140007007
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140024a95.0]
test r12d, r12d
jns 0x14000702a
mov r15d, r12d
mov dword [rsp + 0x48], r12d
test ebx, ebx
js 0x140007025
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop dword [rax + rax]
nop
jmp 0x1400070f5
mov bl, sil
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x8c], xmm0
mov dword [rsp + 0x9c], esi
mov r12d, 3
mov dword [rsp + 0x88], r12d
lea rax, str.AllowWindowsIndexer
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0xb0], xmm0
movups xmm1, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0xc0], xmm1
xor edx, edx
lea rcx, [rsp + 0xb0]
call fcn.140019b14
test eax, eax
jne 0x140007098
mov bl, r14b
call fcn.140051d34
mov dl, bl
call fcn.1400285f0
call fcn.140054c18
mov rcx, qword [rsp + 0x508]
test eax, eax
jns 0x1400070c4
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x191
call fcn.140043510
mov dword [rsp + 0x50], r12d
lea rcx, [rsp + 0x50]
call fcn.14004d864
nop
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop dword [rax + rax]
nop
jmp 0x1400070f5
call qword [sym.imp.MSSRCH.DLL_public:_static_void___cdecl_CSearchServiceObj::Cleanup_void_]
nop dword [rax + rax]
call fcn.140007dfc
test al, al
je 0x140007124
lea rdx, [0x14004d6e0]
call fcn.140007e20
mov r8b, r14b
mov edx, dword [0x1400dda40]
call fcn.140051c14
test byte [0x1400dd8c1], 8
je 0x14000714f
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
nop dword [rax + rax]
mov r8d, eax
lea rdx, [0x1400b5a98]
lea rcx, [0x1400da440]
call fcn.14004d558
test byte [0x1400dd8c2], 8
je 0x14000717b
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea rdx, [0x1400b56d8]
lea rcx, [0x1400da440]
call fcn.140029954
call fcn.140055f74
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop dword [rax + rax]
nop
cmp byte [rsp + 0x59], sil
je 0x1400071ac
mov ecx, dword [0x1400db3b8]
cmp ecx, 0xffffffff
je 0x1400071ac
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsFree]
nop dword [rax + rax]
nop
test rdi, rdi
je 0x1400071c2
mov rcx, rdi
mov rax, qword [0x14009e368]
call qword [case.0x140024a95.0]
nop
mov eax, r15d
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.14002a8b0
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
xor edx, edx
mov r8d, SysAllocStringByteLen
lea rcx, [r11 - 0x438]
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0xd0]
call fcn.140042ffc
int3