Function at 0x39804ebb0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
pxor xmm0, xmm0
mov rbp, rsp
push r15
push r14
mov r14, rcx
push r13
push r12
push rdi
push rsi
push rbx
and rsp, 0xfffffffffffffff0
sub rsp, 0x2a0
mov rax, qword [0x398136bb0]
mov qword [rsp + 0x90], 0
mov rcx, qword [rax]
movaps xmmword [rsp + 0x80], xmm0
cmp byte [rcx], 0
jne 0x39804ede0
xor r12d, r12d
xor esi, esi
mov rax, qword [0x398136bd0]
mov rdx, qword [rax]
cmp byte [rdx], 0
jne 0x39804eea8
mov rax, qword [0x398136bc0]
mov rdi, qword [rax]
cmp byte [rdi], 0
jne 0x39804f000
mov rbx, qword [0x398136ba0]
mov rdi, qword [rbx]
test rdi, rdi
je 0x39804f20c
lea rax, [rsp + 0xc0]
lea rdx, [rsp + 0x80]
mov qword [rbp + 0x10], r14
mov r14, rdi
mov qword [rsp + 0x58], rdx
lea r13, [rsp + 0xd0]
mov rdi, rax
jmp 0x39804ecd4
movzx eax, byte [r14]
mov byte [rsp + 0xd0], al
mov rax, r13
mov qword [rsp + 0xc8], r15
mov byte [rax + r15], 0
cmp r12, rsi
je 0x39804ed10
lea rax, [rsi + 0x10]
mov qword [rsi], rax
mov rax, qword [rsp + 0xc0]
cmp rax, r13
je 0x39804edc8
mov qword [rsi], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsi + 0x10], rax
mov rax, qword [rsp + 0xc8]
mov r14, qword [rbx + 8]
add rsi, 0x20
add rbx, 8
mov qword [rsi - 0x18], rax
mov qword [rsp + 0x88], rsi
test r14, r14
je 0x39804ed5f
mov rcx, r14
mov qword [rsp + 0xc0], r13
call sub.msvcrt.dll_strlen
mov r15, rax
cmp rax, 0xf
ja 0x39804ed90
cmp rax, 1
je 0x39804ec60
mov rax, r13
test r15, r15
je 0x39804ec6e
mov rcx, r13
jmp 0x39804edac
mov rcx, qword [rsp + 0x58]
mov r8, rdi
mov rdx, r12
call fcn.3980e1800
mov rcx, qword [rsp + 0xc0]
cmp rcx, r13
je 0x39804ed3e
mov rax, qword [rsp + 0xd0]
lea rdx, [rax + 1]
call fcn.3981079d0
mov r14, qword [rbx + 8]
add rbx, 8
mov rsi, qword [rsp + 0x88]
mov r12, qword [rsp + 0x90]
test r14, r14
jne 0x39804ecd4
mov r14, qword [rbp + 0x10]
mov rdx, qword [rsp + 0x80]
mov qword [r14], rdx
mov rax, r14
mov qword [r14 + 8], rsi
mov qword [r14 + 0x10], r12
lea rsp, [rbp - 0x38]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [rax + 1]
call fcn.398107a10
mov qword [rsp + 0xd0], r15
mov qword [rsp + 0xc0], rax
mov rcx, rax
mov r8, r15
mov rdx, r14
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0xc0]
jmp 0x39804ec6e
movdqa xmm1, xmmword [rsp + 0xd0]
movups xmmword [rsi + 0x10], xmm1
jmp 0x39804ecab
call sub.msvcrt.dll_getenv
mov r12, rax
test rax, rax
je 0x39804ebf8
cmp byte [rax], 0
je 0x39804ebf8
lea r13, [rsp + 0xd0]
mov rcx, rax
mov qword [rsp + 0xc0], r13
call sub.msvcrt.dll_strlen
mov rbx, rax
cmp rax, 0xf
ja 0x39804f2e3
cmp rax, 1
je 0x39804f1f0
mov rax, r13
test rbx, rbx
jne 0x39804f41e
mov qword [rsp + 0xc8], rbx
lea rcx, [rsp + 0x80]
lea r8, [rsp + 0xc0]
xor edx, edx
mov byte [rax + rbx], 0
call fcn.3980e1800
mov rcx, qword [rsp + 0xc0]
cmp rcx, r13
je 0x39804ee76
mov rax, qword [rsp + 0xd0]
lea rdx, [rax + 1]
call fcn.3981079d0
mov rax, qword [rsp + 0x90]
mov rsi, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov r12, rax
cmp rdx, rsi
je 0x39804ebfd
mov r12, rax
jmp 0x39804ed6b
lea rax, [rsp + 0xa0]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0x20], rax
mov rax, qword [0x398136be0]
mov rcx, qword [rax]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x39804f204
mov rax, qword [0x398136bf0]
lea r15, [rsp + 0x78]
xor r8d, r8d
lea rbx, [rsp + 0x7c]
mov qword [rsp + 0x28], rbx
mov rdi, qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov r9, r15
mov qword [rsp + 0x20], 0
mov rdx, qword [rax]
mov dword [rsp + 0x78], 0
mov dword [rsp + 0x7c], 0
call rdi
mov eax, dword [rsp + 0x7c]
test eax, eax
je 0x39804efc7
cmp dword [rsp + 0x78], 1
jne 0x39804efc7
lea r10, [rsp + 0xc0]
lea rdx, [rax + 1]
xor r8d, r8d
mov rcx, r10
lea r13, [rsp + 0xd0]
mov qword [rsp + 0x58], r10
mov qword [rsp + 0xc0], r13
call fcn.3980e2cb0
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov r9, r15
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xa0]
mov qword [rsp + 0x20], rax
mov rax, qword [0x398136bf0]
mov rdx, qword [rax]
call rdi
mov rcx, qword [rsp + 0xc0]
mov r10, qword [rsp + 0x58]
cmp byte [rcx], 0
jne 0x39804f38a
cmp rcx, r13
je 0x39804efc7
mov rax, qword [rsp + 0xd0]
lea rdx, [rax + 1]
call fcn.3981079d0
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rsi
mov rsi, qword [rsp + 0x80]
cmp rax, rsi
je 0x39804ec10
mov rdx, rsi
mov rsi, rax
mov rax, qword [rsp + 0x90]
jmp 0x39804ee9a
lea r15, [rsp + 0x190]
lea r13, [rsp + 0xc0]
mov rcx, r15
mov qword [rsp + 0x58], r13
call fcn.3980fbfb0
mov rax, qword [0x398137760]
pxor xmm0, xmm0
mov qword [rsp + 0x268], 0
movups xmmword [rsp + 0x278], xmm0
add rax, 0x10
movups xmmword [rsp + 0x288], xmm0
mov qword [rsp + 0x190], rax
xor eax, eax
mov word [rsp + 0x270], ax
mov rax, qword [0x398137270]
mov rbx, qword [rax + 8]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbx - 0x18]
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0x50], rdx
mov qword [rsp + rax + 0xc0], rdx
xor edx, edx
mov qword [rsp + 0xc8], 0
mov rcx, qword [rbx - 0x18]
add rcx, r13
lea r13, [rsp + 0xd0]
call fcn.3980fd080
mov rax, qword [0x3981374d0]
mov rcx, r13
add rax, 0x18
mov qword [rsp + 0xc0], rax
mov rax, qword [0x3981374d0]
add rax, 0x40
mov qword [rsp + 0x190], rax
call fcn.3980c4460
mov rdx, r13
mov rcx, r15
call fcn.3980fd080
mov rcx, r13
mov r8d, 0xa
mov rdx, rdi
call fcn.3980c2960
mov rcx, qword [rsp + 0x58]
test rax, rax
mov rax, qword [rsp + 0xc0]
je 0x39804f2cf
add rcx, qword [rax - 0x18]
xor edx, edx
call fcn.3980fd250
lea rdi, [rsp + 0x118]
mov rcx, rdi
call fcn.3980652d0
mov rdx, rsi
test al, al
jne 0x39804f214
mov rax, qword [0x3981374d0]
mov rcx, r13
mov qword [rsp + 0x58], rdx
add rax, 0x18
mov qword [rsp + 0xc0], rax
mov rax, qword [0x3981374d0]
add rax, 0x40
mov qword [rsp + 0x190], rax
mov rax, qword [0x398137480]
add rax, 0x10
mov qword [rsp + 0xd0], rax
call fcn.3980c2df0
mov rcx, rdi
call fcn.3980bb740
mov rax, qword [0x398137510]
lea rcx, [rsp + 0x108]
add rax, 0x10
mov qword [rsp + 0xd0], rax
call fcn.3980e03e0
mov rax, qword [rbx - 0x18]
mov rdi, qword [rsp + 0x50]
mov rcx, r15
mov qword [rsp + 0xc0], rbx
mov qword [rsp + rax + 0xc0], rdi
mov rax, qword [0x398137760]
mov qword [rsp + 0xc8], 0
add rax, 0x10
mov qword [rsp + 0x190], rax
call fcn.3980fc060
mov rdx, qword [rsp + 0x58]
cmp rdx, rsi
je 0x39804ec23
jmp 0x39804ed6b
movzx eax, byte [r12]
mov byte [rsp + 0xd0], al
mov rax, r13
jmp 0x39804ee35
mov rax, rsi
jmp 0x39804efd8
mov rdx, rsi
jmp 0x39804ed6b
lea r11, [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, r11
mov qword [rsp + 0x38], r11
call fcn.3980b0860
lea r9, [rsp + 0xa0]
mov rdx, qword [rsp + 0x60]
xor r8d, r8d
mov rcx, r9
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x48], rax
mov qword [rsp + 0xa0], rax
call fcn.3980e2cb0
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
call fcn.3980b0630
mov rcx, qword [rsp + 0x58]
mov r8, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0xa0]
call fcn.3980b0390
mov rcx, qword [rsp + 0xa0]
mov r9, qword [rsp + 0x40]
cmp byte [rcx], 0
jne 0x39804f317
cmp rcx, qword [rsp + 0x48]
je 0x39804f2c2
mov rax, qword [rsp + 0xb0]
lea rdx, [rax + 1]
call fcn.3981079d0
mov rdx, qword [rsp + 0x80]
jmp 0x39804f12a
add rcx, qword [rax - 0x18]
mov edx, dword [rcx + 0x20]
or edx, 4
call fcn.3980fd250
jmp 0x39804f10f
lea rcx, [rax + 1]
call fcn.398107a10
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xc0], rax
mov rcx, rax
mov r8, rbx
mov rdx, r12
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0xc0]
jmp 0x39804ee35
cmp r12, rsi
je 0x39804f35a
lea rax, [rsi + 0x10]
mov r8, qword [rsp + 0xa8]
mov rcx, rsi
xor r9d, r9d
mov qword [rsi], rax
mov rdx, qword [rsp + 0xa0]
add rsi, 0x20
add r8, rdx
call fcn.3980e31c0
mov qword [rsp + 0x88], rsi
mov rcx, qword [rsp + 0xa0]
jmp 0x39804f2aa
lea rcx, [rsp + 0x80]
mov rdx, r12
mov r8, r9
call fcn.3980e15b0
mov rcx, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x88]
mov r12, qword [rsp + 0x90]
jmp 0x39804f2aa
cmp rsi, r12
je 0x39804f3ee
lea rcx, [rsi + 0x10]
mov rbx, qword [rsp + 0xc8]
mov qword [rsi], rcx
mov r15, qword [rsp + 0xc0]
mov rax, r15
add rax, rbx
je 0x39804f3b3
test r15, r15
je 0x39804f426
cmp rbx, 0xf
ja 0x39804f444
cmp rbx, 1
jne 0x39804f432
movzx eax, byte [r15]
mov byte [rsi + 0x10], al
mov rax, qword [rsi]
mov qword [rsi + 8], rbx
add rsi, 0x20
mov qword [rsp + 0x88], rsi
mov byte [rax + rbx], 0
mov rcx, qword [rsp + 0xc0]
jmp 0x39804efb1
lea rcx, [rsp + 0x80]
mov rdx, rsi
mov r8, r10
call fcn.3980e15b0
mov rcx, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0x88]
mov r12, qword [rsp + 0x90]
jmp 0x39804efb1
mov rcx, r13
jmp 0x39804f2ff
lea rcx, [0x398132130]
call fcn.39812ac90
test rbx, rbx
je 0x39804f3ca
mov r8, rbx
mov rdx, r15
call sub.msvcrt.dll_memcpy
jmp 0x39804f3ca
test rbx, rbx
js 0x39804f463
mov rcx, rbx
add rcx, 1
js 0x39804f46f
call fcn.398107a10
mov qword [rsi + 0x10], rbx
mov qword [rsi], rax
mov rcx, rax
jmp 0x39804f437
lea rcx, [0x3981320c5]
call fcn.39812ad80
call fcn.39812ab90
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
push r13
lea r13, [rcx + 0x60]
push r12
push rbx
mov rbx, rcx
mov rcx, r13
sub rsp, 0x20
call fcn.3980464ae
test eax, eax
jne 0x39804f4bd
mov rcx, qword [rbx + 0x40]
call sub.msvcrt.dll__strdup_1
mov rcx, r13
mov r12, rax
call fcn.398046507
add rsp, 0x20
mov rax, r12
pop rbx
pop r12
pop r13
ret
mov ecx, eax
call fcn.39812b140
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop