Function at 0x140006050
Capabilities:
Get common file path
Query or enumerate registry key
Query or enumerate registry value
Set environment variable

Disassembly:
mov r11, rsp
push r13
push r14
push r15
sub rsp, 0x4f0
mov qword [r11 - 0x468], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
mov rax, qword [0x1400da318]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rcx, qword [0x1400dadd0]
xor esi, esi
lea rax, [0x140050950]
test rcx, rcx
je 0x1400060ab
cmp rcx, rax
jne 0x140006b10
mov qword [0x1400dadd0], rax
mov r14d, 1
mov dword [rsp + 0x68], r14d
lea ebx, [r14 + 3]
mov r8d, ebx
lea rdx, [rsp + 0x68]
lea ecx, [rbx - 2]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
nop dword [rax + rax]
mov dword [rsp + 0x48], 2
mov r8d, ebx
lea rdx, [rsp + 0x48]
lea r12d, [r14 + 8]
mov ecx, r12d
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
nop dword [rax + rax]
mov dword [rsp + 0x58], r14d
mov r8d, ebx
lea rdx, [rsp + 0x58]
lea ecx, [rbx + 6]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
nop dword [rax + rax]
mov r15d, esi
mov dword [rsp + 0x48], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
nop dword [rax + rax]
test eax, eax
jns 0x14000613c
mov eax, 0x800401f0
jmp 0x140006add
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapSetInformation]
nop dword [rax + rax]
mov rdi, rsi
mov qword [rsp + 0x78], rsi
call fcn.14000771c
test al, al
je 0x140006303
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
lea r8, str.SOFTWAREMicrosoftWindows_SearchGatherWindowsSystemIndexProtocols
mov rdx, 0xffffffff80000002
call fcn.14000a6d8
test eax, eax
jne 0x140006303
mov r12d, 0xff
mov ebx, esi
xor edx, edx
jmp 0x1400062b2
mov rcx, r12
lea rax, [rsp + 0xd0]
cmp word [rax], si
je 0x1400061ba
add rax, 2
sub rcx, r14
jne 0x1400061ac
test rcx, rcx
je 0x1400061c7
mov rax, r12
sub rax, rcx
jmp 0x1400061ca
mov rax, rsi
test rcx, rcx
je 0x140006225
mov rdx, r12
sub rdx, rax
lea rcx, [rsp + 0xd0]
lea rcx, [rcx + rax*2]
je 0x140006217
lea r8, [rax + 0x7ffffeff]
add r8, rdx
lea rax, [0x1400a7c30]
sub rax, rcx
test r8, r8
je 0x140006217
movzx r9d, word [rax + rcx]
test r9w, r9w
je 0x140006217
mov word [rcx], r9w
add rcx, 2
sub r8, r14
sub rdx, r14
jne 0x1400061f7
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], si
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
lea r8, [rsp + 0xd0]
mov rdx, qword [rsp + 0x60]
call fcn.14000a6d8
test eax, eax
jne 0x1400062ad
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x50], r14d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.ProgIdHandler
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14000629c
lea rcx, [rsp + 0x2d0]
call fcn.1400076c0
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
add ebx, r14d
mov edx, ebx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x58], r12d
lea r9, [rsp + 0x58]
lea r8, [rsp + 0xd0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x1400061a1
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
call fcn.14002613c
nop
jmp 0x140006319
call fcn.140027fa0
test byte [0x1400dc882], 8
je 0x14000634a
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea rdx, [0x1400a7768]
lea rcx, [0x1400d9440]
call fcn.140029054
test byte [0x1400dc881], 8
je 0x140006375
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
nop dword [rax + rax]
mov r8d, eax
lea rdx, [0x1400b43f8]
lea rcx, [0x1400d9440]
call fcn.14004c718
call fcn.140003470
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
nop dword [rax + rax]
mov rcx, rax
mov edx, 0x20
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetPriorityClass]
nop dword [rax + rax]
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140002af0]
lea rcx, [0x1400db2c8]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_InitOnceExecuteOnce]
nop dword [rax + rax]
cmp byte [0x1400dadf8], sil
je 0x1400063c8
call fcn.140050f78
mov byte [rsp + 0x59], r14b
mov qword [rsp + 0x68], rsi
lea rcx, [rsp + 0x68]
call fcn.1400271a8
nop
lea rcx, [rsp + 0xd0]
call fcn.14001e108
nop
lea rcx, [rsp + 0x60]
call fcn.14001d368
nop
lea rcx, [rsp + 0x70]
call fcn.14001d334
nop
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x801c
xor ecx, ecx
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetFolderPathW]
nop dword [rax + rax]
test eax, eax
jns 0x1400064a0
mov rcx, qword [rsp + 0x508]
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0xf7
call fcn.14004a2e8
mov r15d, r14d
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140006462
mov rax, qword [0x14009d348]
call qword [case.0x140024095.0]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000647a
mov rax, qword [0x14009d348]
call qword [case.0x140024095.0]
nop
lea rcx, [rsp + 0xd0]
call fcn.14001debc
nop
mov rcx, qword [rsp + 0x68]
mov rax, qword [0x14009d348]
call qword [case.0x140024095.0]
nop
jmp 0x140006a0d
lea rdx, [rsp + 0x2d0]
lea rcx, str.LOCALAPPDATA
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetEnvironmentVariableW]
nop dword [rax + rax]
test eax, eax
jne 0x140006531
mov rcx, qword [rsp + 0x508]
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x101
call fcn.1400513a0
mov r15d, r14d
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400064f3
mov rax, qword [0x14009d348]
call qword [case.0x140024095.0]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000650b
mov rax, qword [0x14009d348]
call qword [case.0x140024095.0]
nop
lea rcx, [rsp + 0xd0]
call fcn.14001debc
nop
mov rcx, qword [rsp + 0x68]
mov rax, qword [0x14009d348]
call qword [case.0x140024095.0]
nop
jmp 0x140006a0d
lea rcx, [rsp + 0xd0]
call fcn.140026628
mov byte [rsp + 0x40], sil
mov ebx, 0xc0100000
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb0]
mov edx, r14d
lea rcx, [rsp + 0x68]
call fcn.1400269a0
mov byte [rsp + 0x40], sil
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb0]
mov edx, r14d
lea rcx, [rsp + 0x68]
call fcn.1400269a0
mov rbx, qword [rsp + 0x68]
mov r8, rbx
lea rcx, [rsp + 0xd0]
call fcn.14001e17c
mov dword [rsp + 0x80], SafeArrayPutElement
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x90], esi
mov r12d, esi
cmp r12d, 0xf
jae 0x14000673f
lea r8, str.SearchServiceMUT
mov edx, r14d
lea rcx, [rsp + 0x80]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
nop dword [rax + rax]
mov rdx, rax
lea rcx, [0x1400db440]
call fcn.14000c528
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r13d, eax
mov rcx, qword [0x1400db440]
dec rcx
cmp rcx, 0xfffffffffffffffd
ja 0x140006659
test eax, eax
je 0x14000673f
xor edx, edx
lea rcx, [0x1400db440]
call fcn.14000c528
cmp r13d, 0xb7
je 0x1400066c7
mov r15d, r14d
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14000668b
mov rax, qword [0x14009d348]
call qword [case.0x140024095.0]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400066a3
mov rax, qword [0x14009d348]
call qword [case.0x140024095.0]
nop
lea rcx, [rsp + 0xd0]
call fcn.14001debc
nop
mov rcx, rbx
mov rax, qword [0x14009d348]
call qword [case.0x140024095.0]
nop
jmp 0x140006a0d
cmp r12d, 0xe
jne 0x140006726
lea r15d, [r12 - 0xc]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400066ea
mov rax, qword [0x14009d348]
call qword [case.0x140024095.0]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140006702
mov rax, qword [0x14009d348]
call qword [case.0x140024095.0]
nop
lea rcx, [rsp + 0xd0]
call fcn.14001debc
nop
mov rcx, rbx
mov rax, qword [0x14009d348]
call qword [case.0x140024095.0]
nop
jmp 0x140006a0d
mov ecx, 0x7d0
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
nop dword [rax + rax]
add r12d, r14d
jmp 0x1400065fb
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140006757
mov rax, qword [0x14009d348]
call qword [case.0x140024095.0]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000676f
mov rax, qword [0x14009d348]
call qword [case.0x140024095.0]
nop
lea rcx, [rsp + 0xd0]
call fcn.14001debc
nop
mov rcx, rbx
mov rax, qword [0x14009d348]
call qword [case.0x140024095.0]
nop
lea rcx, [rsp + 0x68]
call fcn.140024a50
mov rdi, rax
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x1400067b2
mov r15d, r14d
mov dword [rsp + 0x48], r14d
jmp 0x140006a0d
cmp dword [rsp + 0x68], 2
jne 0x140006814
mov ebx, r14d
cmp ebx, dword [rsp + 0x68]
jge 0x140006814
movsxd rax, ebx
mov rcx, qword [rdi + rax*8]
movzx eax, word [rcx]
sub ax, 0x2d
mov edx, 0xfffd
test dx, ax
je 0x1400067e7
mov r15d, r14d
mov dword [rsp + 0x48], r14d
jmp 0x140006a0d
add rcx, 2
lea rdx, str.Embedding
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006807
add ebx, r14d
jmp 0x1400067bc
mov r15d, r14d
mov dword [rsp + 0x48], r14d
jmp 0x140006a0d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x50], eax
mov r12d, eax
mov rcx, qword [rsp + 0x508]
test eax, eax
jns 0x140006852
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x16c
call fcn.140042700
jmp 0x140006924
mov qword [rsp + 0x60], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [0x1400a5418]
mov r8d, r14d
xor edx, edx
lea rcx, [0x1400a6d88]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x508]
test eax, eax
jns 0x1400068a0
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x173
call fcn.140042700
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400068df
mov rax, qword [rcx]
mov r8, r14
mov edx, 5
mov rax, qword [rax + 0x18]
call qword [case.0x140024095.0]
mov rcx, qword [rsp + 0x508]
test eax, eax
jns 0x1400068df
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x176
call fcn.140042700
call fcn.14001e1a8
mov r12d, eax
mov rcx, qword [rsp + 0x508]
test eax, eax
jns 0x140006908
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x17a
call fcn.140042700
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000691f
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x140024095.0]
test r12d, r12d
jns 0x140006942
mov r15d, r12d
mov dword [rsp + 0x48], r12d
test ebx, ebx
js 0x14000693d
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop dword [rax + rax]
nop
jmp 0x140006a0d
mov bl, sil
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x8c], xmm0
mov dword [rsp + 0x9c], esi
mov r12d, 3
mov dword [rsp + 0x88], r12d
lea rax, str.AllowWindowsIndexer
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0xb0], xmm0
movups xmm1, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0xc0], xmm1
xor edx, edx
lea rcx, [rsp + 0xb0]
call fcn.140019234
test eax, eax
jne 0x1400069b0
mov bl, r14b
call fcn.140050ef4
mov dl, bl
call fcn.140027cf0
call fcn.140053dd8
mov rcx, qword [rsp + 0x508]
test eax, eax
jns 0x1400069dc
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x191
call fcn.140042700
mov dword [rsp + 0x50], r12d
lea rcx, [rsp + 0x50]
call fcn.14004ca24
nop
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop dword [rax + rax]
nop
jmp 0x140006a0d
call qword [sym.imp.MSSRCH.DLL_public:_static_void___cdecl_CSearchServiceObj::Cleanup_void_]
nop dword [rax + rax]
call fcn.14000771c
test al, al
je 0x140006a3c
lea rdx, [0x14004c8a0]
call fcn.14000775c
mov r8b, r14b
mov edx, dword [0x1400dca08]
call fcn.140050dd4
test byte [0x1400dc881], 8
je 0x140006a67
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
nop dword [rax + rax]
mov r8d, eax
lea rdx, [0x1400b4778]
lea rcx, [0x1400d9440]
call fcn.14004c718
test byte [0x1400dc882], 8
je 0x140006a93
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea rdx, [0x1400b43a8]
lea rcx, [0x1400d9440]
call fcn.140029054
call fcn.140055134
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop dword [rax + rax]
nop
cmp byte [rsp + 0x59], sil
je 0x140006ac4
mov ecx, dword [0x1400da388]
cmp ecx, 0xffffffff
je 0x140006ac4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsFree]
nop dword [rax + rax]
nop
test rdi, rdi
je 0x140006ada
mov rcx, rdi
mov rax, qword [0x14009d348]
call qword [case.0x140024095.0]
nop
mov eax, r15d
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.140029fb0
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
xor edx, edx
mov r8d, SysAllocStringByteLen
lea rcx, [r11 - 0x438]
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0xd0]
call fcn.1400421ec
int3