Function at 0x1400578a0
Capabilities:
Query environment variable
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x478]
sub rsp, 0x578
mov rax, qword [0x14033e810]
xor rax, rsp
mov qword [rbp + 0x460], rax
mov qword [rbp - 0x58], r9
mov rbx, r8
mov rdi, rcx
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x70], rdx
mov rsi, qword [rbp + 0x4e0]
mov rcx, qword [rbp + 0x4e8]
mov qword [rbp - 0x30], rcx
mov r15, qword [rbp + 0x4f0]
mov qword [rbp - 0x60], r15
mov rax, qword [rbp + 0x4f8]
mov qword [rbp - 0x10], rax
test rcx, rcx
je 0x1400580ce
cmp qword [rsi + 0x10], 0
je 0x1400580ce
mov rcx, qword [rdi + 8]
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400580ce
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x250]
call fcn.140241ba0
mov dword [rbp - 8], 0x104
xor r14d, r14d
mov dword [rbp - 0x3c], r14d
mov dword [rbp - 0x50], r14d
mov dword [rbp - 0x7c], r14d
mov dword [rbp - 0x78], r14d
mov eax, r14d
mov ecx, dword [rbp + 0x500]
test ecx, ecx
setne al
inc eax
mov dword [rbp - 0x68], eax
mov eax, 0x20219
mov r9d, 0x20119
test ecx, ecx
cmove r9d, eax
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rbp - 0x70]
test eax, eax
jne 0x1400580c8
lea rax, [rbp + 0x10]
mov qword [rsp + 0x58], rax
lea rax, [rbp]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x24]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 4]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 8]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x3c]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp - 8]
lea rdx, [rbp + 0x250]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov r12d, dword [rbp + 0x520]
test r12d, r12d
jne 0x140057a1f
cmp dword [rbp + 0x528], r14d
je 0x1400580f3
cmp dword [rbp - 0x40], r14d
je 0x1400580f3
mov ecx, dword [rbp - 0x28]
call fcn.1400164e0
mov rdi, rax
mov qword [rbp - 0x20], rax
mov ecx, dword [rbp - 0x24]
add rcx, 2
mov eax, 2
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400164e0
mov r14, rax
mov qword [rbp - 0x38], rax
xor r13d, r13d
mov dword [rbp - 0x44], r13d
mov ebx, dword [rbp + 0x510]
mov dword [rbp - 0x80], ebx
cmp dword [rbp - 0x40], r13d
jbe 0x14005807a
nop dword [rax + rax]
mov rax, qword [rbp - 0x18]
mov rcx, qword [rax + 8]
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400580b4
test ebx, ebx
je 0x140058093
mov eax, dword [rbp - 0x28]
mov dword [rbp - 0x78], eax
mov eax, dword [rbp - 0x24]
add eax, 2
mov dword [rbp - 0x50], eax
lea rax, [rbp - 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
lea rax, [rbp - 0x7c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
lea r9, [rbp - 0x50]
mov r8, r14
mov edx, r13d
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x140058069
test r12d, r12d
je 0x140057bd0
cmp dword [rbp - 0x50], 2
jbe 0x140057bd0
mov r12d, dword [rbp + 0x530]
test r14, r14
je 0x140057bd7
xor edi, edi
xor ebx, ebx
mov rcx, qword [rsi + 0x10]
test rcx, rcx
jle 0x140057bc7
test r12d, r12d
je 0x140057b8a
test rbx, rbx
js 0x1400583ae
cmp rbx, rcx
jge 0x1400583ae
mov rax, qword [rsi + 8]
mov rdx, qword [rax + rbx*8]
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x140057bb2
mov eax, dword [rbp - 0x68]
mov dword [rsp + 0x48], eax
mov eax, dword [rbp - 0x78]
mov dword [rsp + 0x28], eax
mov rdi, qword [rbp - 0x20]
mov qword [rsp + 0x20], rdi
mov r9d, dword [rbp - 0x7c]
mov r8, r14
mov rdx, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x30]
call fcn.140055970
mov ebx, dword [rbp - 0x80]
dec ebx
mov dword [rbp - 0x80], ebx
inc dword [r15]
jmp 0x140058062
test rbx, rbx
js 0x1400583ae
cmp rbx, rcx
jge 0x1400583ae
mov rax, qword [rsi + 8]
mov rdx, qword [rax + rbx*8]
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x140057b4f
inc edi
inc rbx
mov rcx, qword [rsi + 0x10]
movsxd rax, edi
cmp rax, rcx
jl 0x140057b23
mov rdi, qword [rbp - 0x20]
mov ebx, dword [rbp - 0x80]
jmp 0x140057bd7
mov r12d, dword [rbp + 0x530]
cmp dword [rbp + 0x528], 0
je 0x140058062
mov r15d, dword [rbp - 0x78]
mov dword [rbp - 0x4c], r15d
test r15d, r15d
je 0x14005805e
mov r13, rdi
mov dword [rbp - 0x48], 0
mov eax, dword [rbp - 0x7c]
sub eax, 1
je 0x140057c29
sub eax, 1
je 0x140057c29
cmp eax, 5
jne 0x140057c83
mov eax, r15d
shr rax, 1
cmp word [rdi + rax*2 - 2], 0
je 0x140057e1f
add r15d, 4
jmp 0x140057c3b
mov rax, r15
shr rax, 1
cmp word [rdi + rax*2 - 2], 0
je 0x140057c83
add r15d, 2
mov eax, 2
mov ebx, r15d
mul rbx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov dword [rbp - 0x48], 1
mov dword [rbp - 0x4c], r15d
mov rcx, rax
call fcn.1400164e0
mov r13, rax
mov r8d, r15d
xor edx, edx
mov rcx, rax
call fcn.140241ba0
mov r8d, dword [rbp - 0x78]
mov rdx, rdi
mov rcx, r13
call fcn.1402414f0
cmp dword [rbp - 0x7c], 1
jne 0x140057d12
cmp r15d, 2
jbe 0x140057e1f
test r13, r13
je 0x140057e1f
xor edi, edi
xor ebx, ebx
mov rcx, qword [rsi + 0x10]
test rcx, rcx
jle 0x140057d12
nop dword [rax]
test r12d, r12d
je 0x140057f55
test rbx, rbx
js 0x1400583ae
cmp rbx, rcx
jge 0x1400583ae
mov rax, qword [rsi + 8]
mov rdx, qword [rax + rbx*8]
mov rcx, r13
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x140057f81
mov eax, dword [rbp - 0x68]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r13
mov r9d, dword [rbp - 0x7c]
mov r8, r14
mov rdx, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x30]
call fcn.140055970
dec dword [rbp - 0x80]
mov rax, qword [rbp - 0x60]
inc dword [rax]
cmp dword [rbp - 0x7c], 2
jne 0x140057e1f
mov ecx, 0x400
call fcn.1400164e0
mov r14, rax
xor edx, edx
mov r8d, 0x200
mov rcx, rax
call fcn.140241ba0
mov r8d, 0x200
mov rdx, r14
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
cmp eax, 0x200
jbe 0x140057d99
mov rcx, r14
call fcn.140095d64
lea ebx, [rdi + 2]
mov eax, 2
mul rbx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.1400164e0
mov r14, rax
mov r8d, ebx
xor edx, edx
mov rcx, rax
call fcn.140241ba0
mov r8d, edi
mov rdx, r14
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test r14, r14
je 0x140057e13
xor edi, edi
xor ebx, ebx
mov rcx, qword [rsi + 0x10]
test rcx, rcx
jle 0x140057e13
nop dword [rax + rax]
test r12d, r12d
je 0x140057f9b
test rbx, rbx
js 0x1400583ae
cmp rbx, rcx
jge 0x1400583ae
mov rax, qword [rsi + 8]
mov rdx, qword [rax + rbx*8]
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x140057fc7
mov eax, dword [rbp - 0x68]
mov dword [rsp + 0x48], eax
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r13
mov r9d, dword [rbp - 0x7c]
mov r8, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x30]
call fcn.140055970
dec dword [rbp - 0x80]
mov rax, qword [rbp - 0x60]
inc dword [rax]
mov rcx, r14
call fcn.140095d64
mov r14, qword [rbp - 0x38]
cmp dword [rbp - 0x7c], 7
jne 0x140058045
lea rcx, [rbp + 0x18]
call fcn.1400a64e0
nop
xor edi, edi
mov rbx, r13
test r15d, r15d
je 0x140057e93
mov r12, 0xffffffffffffffff
nop dword [rax]
nop dword [rax + rax]
mov rax, r12
inc rax
cmp word [rbx + rax*2], 0
jne 0x140057e53
test rax, rax
je 0x140057e72
mov r8, rbx
mov rdx, qword [rbp + 0x28]
lea rcx, [rbp + 0x18]
call fcn.1400a6854
mov rcx, r12
inc rcx
cmp word [rbx + rcx*2], 0
jne 0x140057e75
inc ecx
movsxd rax, ecx
lea rbx, [rbx + rax*2]
lea edi, [rdi + rcx*2]
add edi, 2
cmp edi, r15d
jb 0x140057e50
xor r12d, r12d
xor r15d, r15d
mov rdx, qword [rbp + 0x28]
test rdx, rdx
jle 0x14005803c
test r15, r15
js 0x1400583a8
cmp r15, rdx
jge 0x1400583a8
mov rax, qword [rbp + 0x20]
mov r14, qword [rax + r15*8]
test r14, r14
je 0x140058026
xor edi, edi
xor ebx, ebx
mov rcx, qword [rsi + 0x10]
test rcx, rcx
jle 0x140058026
nop word [rax + rax]
cmp dword [rbp + 0x530], 0
je 0x140057fe1
test rbx, rbx
js 0x1400583a8
cmp rbx, rcx
jge 0x1400583a8
mov rax, qword [rsi + 8]
mov rdx, qword [rax + rbx*8]
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x14005800d
mov eax, dword [rbp - 0x68]
mov dword [rsp + 0x48], eax
mov eax, dword [rbp - 0x4c]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r13
mov r9d, dword [rbp - 0x7c]
mov r14, qword [rbp - 0x38]
mov r8, r14
mov rdx, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x30]
call fcn.140055970
dec dword [rbp - 0x80]
mov rax, qword [rbp - 0x60]
inc dword [rax]
mov rdx, qword [rbp + 0x28]
jmp 0x14005802a
test rbx, rbx
js 0x1400583ae
cmp rbx, rcx
jge 0x1400583ae
mov rax, qword [rsi + 8]
mov rdx, qword [rax + rbx*8]
mov rcx, r13
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x140057ce4
inc edi
inc rbx
mov rcx, qword [rsi + 0x10]
movsxd rax, edi
cmp rax, rcx
jl 0x140057cb0
jmp 0x140057d12
test rbx, rbx
js 0x1400583ae
cmp rbx, rcx
jge 0x1400583ae
mov rax, qword [rsi + 8]
mov rdx, qword [rax + rbx*8]
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x140057de4
inc edi
inc rbx
mov rcx, qword [rsi + 0x10]
movsxd rax, edi
cmp rax, rcx
jl 0x140057db0
jmp 0x140057e13
test rbx, rbx
js 0x1400583a8
cmp rbx, rcx
jge 0x1400583a8
mov rax, qword [rsi + 8]
mov rdx, qword [rax + rbx*8]
mov rcx, r14
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x140057f18
inc edi
inc rbx
mov rcx, qword [rsi + 0x10]
movsxd rax, edi
cmp rax, rcx
jl 0x140057ee0
mov rdx, qword [rbp + 0x28]
mov r14, qword [rbp - 0x38]
inc r12d
inc r15
movsxd rax, r12d
cmp rax, rdx
jl 0x140057ea6
lea rcx, [rbp + 0x18]
call fcn.1400a6500
cmp dword [rbp - 0x48], 0
je 0x140058053
mov rcx, r13
call fcn.140095d64
mov rdi, qword [rbp - 0x20]
mov ebx, dword [rbp - 0x80]
mov r13d, dword [rbp - 0x44]
mov r15, qword [rbp - 0x60]
mov r12d, dword [rbp + 0x520]
inc r13d
mov dword [rbp - 0x44], r13d
cmp r13d, dword [rbp - 0x40]
jb 0x140057a80
mov rcx, r14
call fcn.140095d64
mov rcx, rdi
call fcn.140095d64
mov rdi, qword [rbp - 0x18]
xor r14d, r14d
jmp 0x1400580fc
mov rcx, r14
call fcn.140095d64
mov rcx, rdi
call fcn.140095d64
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x1400580d0
mov rcx, r14
call fcn.140095d64
mov rcx, rdi
call fcn.140095d64
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rcx, qword [rbp + 0x460]
xor rcx, rsp
call fcn.1402155d0
add rsp, 0x578
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ebx, dword [rbp + 0x510]
mov dword [rbp - 0x80], ebx
mov eax, dword [rbp - 0x3c]
test eax, eax
je 0x1400580a3
mov r13d, dword [rbp + 0x508]
test r13d, r13d
je 0x1400580a3
test eax, eax
je 0x1400580a3
mov r15d, dword [rbp + 0x518]
mov r12d, dword [rbp + 0x530]
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rdi + 8]
xor edx, edx
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400580c4
test ebx, ebx
je 0x1400580a3
mov dword [rbp - 4], 0x104
lea rax, [rbp + 0x10]
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
lea r9, [rbp - 4]
lea r8, [rbp + 0x40]
mov edx, r14d
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140058396
mov rax, qword [rbp - 0x10]
test rax, rax
je 0x1400581ea
xor edi, edi
xor ebx, ebx
mov rcx, qword [rax + 0x10]
test rcx, rcx
jle 0x1400581e7
jmp 0x1400581a6
mov rax, qword [rbp - 0x10]
test rbx, rbx
js 0x1400583ae
cmp rbx, rcx
jge 0x1400583ae
mov rax, qword [rax + 8]
mov rdx, qword [rax + rbx*8]
lea rcx, [rbp + 0x40]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14005838f
inc edi
inc rbx
mov rcx, qword [rbp - 0x10]
mov rcx, qword [rcx + 0x10]
movsxd rax, edi
cmp rax, rcx
jl 0x1400581a2
mov ebx, dword [rbp - 0x80]
lea rdx, [0x1402ed690]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.SHLWAPI.dll_StrCatW]
lea rdx, [rbp + 0x40]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.SHLWAPI.dll_StrCatW]
test r15d, r15d
je 0x1400582db
xor edi, edi
xor ebx, ebx
mov rcx, qword [rsi + 0x10]
test rcx, rcx
jle 0x1400582d8
cmp dword [rbp + 0x530], 0
je 0x140058293
test rbx, rbx
js 0x1400583ae
cmp rbx, rcx
jge 0x1400583ae
mov rax, qword [rsi + 8]
mov rdx, qword [rax + rbx*8]
lea rcx, [rbp + 0x40]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x1400582bc
mov rdx, qword [rbp - 0x58]
mov rcx, qword [rbp - 0x30]
call fcn.140055020
mov rcx, rax
test rax, rax
je 0x14005836b
mov eax, dword [rbp - 0x68]
mov dword [rcx + 0x20], eax
mov eax, dword [rcx + 0x24]
test eax, eax
je 0x140058352
cmp eax, 2
jne 0x14005836b
mov dword [rcx + 0x24], 5
jmp 0x14005836b
test rbx, rbx
js 0x1400583ae
cmp rbx, rcx
jge 0x1400583ae
mov rax, qword [rsi + 8]
mov rdx, qword [rax + rbx*8]
lea rcx, [rbp + 0x40]
call qword [sym.imp.SHLWAPI.dll_StrStrIW]
test rax, rax
jne 0x140058254
inc edi
inc rbx
mov rcx, qword [rsi + 0x10]
movsxd rax, edi
cmp rax, rcx
jl 0x140058223
mov r12d, dword [rbp + 0x530]
mov ebx, dword [rbp - 0x80]
lea eax, [r13 - 1]
mov dword [rsp + 0x70], r12d
mov ecx, dword [rbp + 0x528]
mov dword [rsp + 0x68], ecx
mov ecx, dword [rbp + 0x520]
mov dword [rsp + 0x60], ecx
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x48], eax
mov eax, dword [rbp + 0x500]
mov dword [rsp + 0x40], eax
mov rax, qword [rbp - 0x10]
mov qword [rsp + 0x38], rax
mov rax, qword [rbp - 0x60]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov r9, qword [rbp - 0x58]
lea r8, [rbp + 0x40]
mov rdx, qword [rbp - 0x70]
mov rdi, qword [rbp - 0x18]
mov rcx, rdi
call fcn.1400578a0
mov rdx, qword [rbp - 0x58]
call fcn.14005a250
jmp 0x140058396
mov rax, qword [rcx + 0x28]
cmp qword [rax + 0x18], 0
jne 0x14005836b
cmp qword [rcx + 8], 0
jne 0x14005836b
mov dword [rcx + 0x24], 1
mov ebx, dword [rbp - 0x80]
dec ebx
mov dword [rbp - 0x80], ebx
mov rax, qword [rbp - 0x60]
inc dword [rax]
mov r12d, dword [rbp + 0x530]
mov rdi, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x58]
call fcn.14005a250
jmp 0x140058396
mov ebx, dword [rbp - 0x80]
mov rdi, qword [rbp - 0x18]
inc r14d
cmp r14d, dword [rbp - 0x3c]
jae 0x1400580a3
jmp 0x140058130
call fcn.1400a2cd8
nop
call fcn.1400a2cd8
int3