Function at 0x1400015e4
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4d8
movabs rsi, 0x8000000000000000
lea rdx, str.USERPROFILEiconspopcat_open.icopopcat_close.ico
lea rdi, [rsp + 0xd8]
mov r8d, 0xb
mov rcx, rdi
call fcn.140004210
mov rax, qword [rdi]
mov qword [rsp + 0x30], rax
cmp rax, rsi
je 0x140001c6a
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x68]
and qword [rax], 0
mov qword [rax + 8], 2
and qword [rax + 0x10], 0
mov ebx, 0x200
mov r15d, 2
xor r12d, r12d
mov esi, 0xffffffff
xor edi, edi
cmp rbx, 0x201
jae 0x140001683
lea r13, [rsp + 0xd8]
mov r14d, 0x200
mov rbp, rbx
jmp 0x1400016b7
sub rbx, rdi
lea rcx, [rsp + 0x68]
mov rdx, rbx
call fcn.140003a5a
mov r12, qword [rsp + 0x68]
mov r15, qword [rsp + 0x70]
cmp r12, rsi
mov edi, 0xffffffff
cmovb rdi, r12
mov qword [rsp + 0x78], rdi
mov r13, r15
mov r14, rdi
mov rbp, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [rsp + 0x38]
mov rdx, r13
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebx, eax
test eax, eax
jne 0x1400016e4
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400017b6
mov ebx, ebx
cmp rbp, rbx
jne 0x14000170c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140001c77
add rbp, rbp
cmp rbp, rsi
cmovae rbp, rsi
mov rbx, rbp
jmp 0x140001667
jb 0x140001667
cmp r14, rbx
jb 0x140001c77
mov rcx, rbx
call fcn.1400020a9
lea rsi, [rsp + 0x40]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
and qword [rsi + 0x10], 0
mov byte [rsi + 0x18], 1
lea rax, [rbx*2]
add rax, r13
lea rdi, [rsp + 0x98]
mov qword [rdi], r13
mov qword [rdi + 8], rax
and word [rdi + 0x10], 0
mov rbx, qword [rsp + 0x30]
mov rcx, rdi
call fcn.140001df4
test ax, ax
je 0x14000177b
movzx ecx, ax
cmp ecx, 2
je 0x14000178b
shr eax, 0x10
mov byte [rsp + 0x58], 0
jmp 0x14000177f
shr rax, 0x20
mov rcx, rsi
mov edx, eax
call fcn.140003994
jmp 0x14000175c
mov r13, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rcx, r12
mov rdx, r15
call fcn.140003b19
movabs r12, 0x8000000000000000
cmp r13, r12
je 0x1400017d8
jmp 0x1400017e3
call fcn.140003b02
mov r14, rax
mov rcx, r12
mov rdx, r15
call fcn.140003b19
movabs r12, 0x8000000000000000
mov rbx, qword [rsp + 0x30]
mov rcx, r14
call fcn.1400032ea
mov r13, r12
mov rcx, rbx
mov rdx, qword [rsp + 0x38]
call fcn.140003b19
cmp r13, r12
je 0x140001c77
mov qword [rsp + 0x20], 5
lea r9, [0x14000730b]
lea rsi, [rsp + 0xb8]
mov rcx, rsi
mov rdx, r14
mov r8, rdi
call fcn.140004cfc
lea rdi, [rsp + 0xd8]
mov rcx, rdi
mov rdx, rsi
call fcn.140001209
mov rbx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov qword [rsp + 0x20], 0xf
lea r9, [0x140007310]
lea rcx, [rsp + 0x68]
mov rdx, rbx
call fcn.140004cfc
mov rcx, qword [rdi]
mov rdx, rbx
call fcn.140002093
lea rdi, [rsp + 0xd8]
mov rcx, rdi
mov rdx, rsi
call fcn.140001209
mov rbx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov qword [rsp + 0x20], 0x10
lea r9, [0x14000731f]
lea rcx, [rsp + 0x98]
mov rdx, rbx
call fcn.140004cfc
mov rcx, qword [rdi]
mov rdx, rbx
call fcn.140002093
mov rdi, qword [rsi]
mov rbx, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
mov rcx, rbx
call fcn.140004c88
mov rsi, rax
mov rcx, rdi
mov rdx, rbx
call fcn.140002093
test rsi, rsi
je 0x1400018d6
mov rcx, rsi
call fcn.14000112c
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rcx, rbp
mov rdx, rsi
call fcn.140001000
test rax, rax
jne 0x140001c77
mov rbx, rdx
lea rdx, [0x14000732f]
mov r8d, 0x148ca
mov rcx, rbx
call fcn.140004ba5
test rax, rax
jne 0x140001c77
mov rcx, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0xa8]
call fcn.140001000
test rax, rax
jne 0x140001c77
mov rdi, rdx
lea rdx, [0x14001bbf9]
mov r8d, 0x1229f
mov rcx, rdi
call fcn.140004ba5
test rax, rax
jne 0x140001c77
mov qword [rsp + 0x38], rdi
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerCLSID645FF040_5081_101B_9F08_00AA002F954EDefaultIcon_0emptyfull
lea rdi, [rsp + 0xd8]
mov r8d, 0x6b
mov rcx, rdi
call fcn.14000577e
cmp qword [rdi], r12
jne 0x140001c77
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], r13
mov qword [rsp + 0x30], r14
mov rdi, qword [rsp + 0xe0]
mov r14, qword [rsp + 0xe8]
lea rax, [rsp + 0x40]
and qword [rax], 0
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
mov rdx, rdi
xor r8d, r8d
mov r9d, 0x20006
call sub.ADVAPI32.dll_RegOpenKeyExW
test eax, eax
je 0x140001a3b
mov r15d, eax
lea r13, [rsp + 0xd8]
mov rcx, r13
mov rdx, rdi
mov r8, r14
call fcn.1400053a2
shl r15, 0x20
or r15, 2
mov rcx, r15
call fcn.14000296c
xor ecx, ecx
cmp al, 1
setne cl
lea rcx, [rcx*2 + 1]
xor ebx, ebx
test al, al
cmovne rbx, rcx
mov r12, qword [r13]
mov r13, qword [r13 + 8]
mov rcx, rdi
mov rdx, r14
call fcn.140001187
mov rdi, r15
mov r14, r12
movabs r12, 0x8000000000000000
cmp ebx, 4
je 0x140001a40
jmp 0x140001c77
mov r13, qword [rsp + 0x40]
mov rcx, rbp
mov rdx, rsi
call fcn.140001041
test rax, rax
je 0x140001c77
mov r15, rax
mov rsi, rdx
mov rcx, rdx
call fcn.1400020a9
mov rbp, rax
mov rbx, rdx
mov rcx, rdx
mov rdx, r15
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
lea r15, [rsp + 0xd8]
mov qword [r15], rbp
mov qword [r15 + 8], rbx
mov qword [r15 + 0x10], rsi
lea rdx, [0x14002df03]
lea r8, [0x14002df05]
mov rcx, r15
call fcn.140001e9c
mov rax, qword [r15 + 0x10]
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [r15]
movaps xmmword [rsi], xmm0
lea rbx, [rsp + 0xd8]
mov rcx, rbx
mov rdx, rsi
call fcn.140005727
cmp qword [rbx], r12
jne 0x140001c77
lea rbx, [rsp + 0xd8]
movups xmm0, xmmword [rbx + 8]
movups xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x40], 2
mov qword [rsp + 0x20], rsi
lea r8, [0x14002df05]
mov r9d, 5
mov rcx, rbx
mov rdx, r13
call fcn.14000125f
mov rcx, rbx
call fcn.14000119b
mov rcx, rsi
call fcn.140001072
mov rcx, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0xa8]
call fcn.140001041
test rax, rax
je 0x140001c77
mov r15, rax
mov rsi, rdx
mov rcx, rdx
call fcn.1400020a9
mov rbx, rax
mov rbp, rdx
mov rcx, rdx
mov rdx, r15
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
lea r15, [rsp + 0xd8]
mov qword [r15], rbx
mov qword [r15 + 8], rbp
mov qword [r15 + 0x10], rsi
lea rdx, [0x14002df03]
lea r8, [0x14002df05]
mov rcx, r15
call fcn.140001e9c
mov rax, qword [r15 + 0x10]
lea rsi, [rsp + 0x40]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [r15]
movaps xmmword [rsi], xmm0
lea rbx, [rsp + 0xd8]
mov rcx, rbx
mov rdx, rsi
call fcn.140005727
cmp qword [rbx], r12
jne 0x140001c77
lea rbx, [rsp + 0xd8]
movups xmm0, xmmword [rbx + 8]
movups xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x40], 2
mov qword [rsp + 0x20], rsi
lea r8, [0x14002df0a]
mov r9d, 4
mov rcx, rbx
mov rdx, r13
call fcn.14000125f
mov rcx, rbx
call fcn.14000119b
mov rcx, rsi
call fcn.140001072
mov rcx, r13
call sub.ADVAPI32.dll_RegCloseKey
mov rcx, rdi
mov rdx, r14
call fcn.140001187
mov rsi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x38]
call rsi
mov rcx, qword [rsp + 0x88]
call rsi
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rsp + 0xa0]
call fcn.140002093
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
call fcn.140002093
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x30]
call fcn.140002093
nop
add rsp, 0x4d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0xe0]
call fcn.1400032ea
ud2