Function at 0x10000a4a0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0x330
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1000700c8]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov rbx, r8
mov rsi, rdx
mov r12, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [r12 + 0xb0]
xor r13d, r13d
cmp rcx, r13
je 0x10000c992
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp eax, r13d
je 0x10000c9a3
mov eax, 0xea
cmp edi, eax
je 0x100021e17
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x10000a543
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.100001250
add rsp, 0x330
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
lea ecx, [r13 + 6]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x10000a543
mov eax, 0xea
mov ecx, dword [rsp + 0x34]
cmp ecx, 1
je 0x10000c9bf
cmp ecx, 7
je 0x10000c9bf
cmp ecx, 2
jne 0x10000a537
cmp dword [rsp + 0x34], 2
jne 0x100021e8e
cmp edi, eax
je 0x100021e1c
mov esi, 0x104
cmp dword [rbx + 0x10], esi
jae 0x10000c9e6
mov rax, qword [rbx]
mov edx, esi
mov rcx, rbx
call qword [rax]
mov r8d, esi
mov rdx, qword [rbx + 8]
lea rcx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x30], eax
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x100021e5b
add eax, eax
mov dword [rsp + 0x30], eax
jmp 0x10000ca16
cmp edi, r13d
jne 0x100021f78
shr eax, 1
mov dword [rsp + 0x30], eax
je 0x100022000
lea ecx, [rax - 1]
mov eax, dword [rbx + 0x10]
dec eax
cmp ecx, eax
ja 0x100021fc1
mov dword [rbx + 0x14], ecx
mov rax, qword [rbx + 8]
mov word [rax + rcx*2], r13w
jmp 0x10000ca49
mov eax, 1
jmp 0x10000a543
jmp 0x10000c9a8
mov edx, 0x80010135
lea rcx, [rsp + 0x38]
call fcn.10002a990
lea rcx, [rsp + 0xc8]
mov rdx, rax
mov r8d, 0x20
call sub.msvcrt.dll_memcpy
lea rdx, [0x10005db70]
lea rcx, [rsp + 0xc8]
call sub.msvcrt.dll__CxxThrowException
nop
jmp 0x10000c9d2
mov edx, 0x80010135
lea rcx, [rsp + 0x38]
call fcn.10002a990
lea rcx, [rsp + 0x68]
mov rdx, rax
mov r8d, 0x20
call sub.msvcrt.dll_memcpy
lea rdx, [0x10005db70]
lea rcx, [rsp + 0x68]
call sub.msvcrt.dll__CxxThrowException
cmp edi, eax
jne 0x100021edc
mov edx, dword [rsp + 0x30]
shr edx, 1
cmp edx, dword [rbx + 0x10]
jbe 0x100021ea5
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 8]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [r12 + 0xb0]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x30]
jmp 0x10000ca16
mov eax, dword [rsp + 0x30]
mov edx, eax
shr edx, 1
cmp edx, dword [rbx + 0x10]
jbe 0x100021ef5
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, dword [rsp + 0x30]
mov rcx, qword [rbx + 8]
mov r8d, eax
shr r8, 1
mov edx, r13d
je 0x100021f0d
cmp r8, 0x7fffffff
jbe 0x100021f12
mov edx, 0x80070057
cmp edx, r13d
jl 0x100022011
mov eax, 0x7ffffffe
lea r10, [rsp + 0x110]
mov edx, r13d
mov r11, r13
cmp r8, r13
je 0x100021f59
cmp rax, r13
je 0x100021f62
movzx r9d, word [r10]
cmp r9w, r13w
je 0x100021f62
mov word [rcx], r9w
add rcx, 2
add r10, 2
dec r8
dec rax
inc r11
jmp 0x100021f2e
sub rcx, 2
mov edx, 0x8007007a
mov word [rcx], r13w
cmp edx, r13d
jl 0x100022011
mov eax, dword [rsp + 0x30]
jmp 0x10000ca16
movzx edx, di
or edx, 0x80070000
cmp edi, r13d
cmovle edx, edi
lea rcx, [rsp + 0x38]
call fcn.10002a990
lea rcx, [rsp + 0xa8]
mov rdx, rax
mov r8d, 0x20
call sub.msvcrt.dll_memcpy
lea rdx, [0x10005db70]
lea rcx, [rsp + 0xa8]
call sub.msvcrt.dll__CxxThrowException
nop
jmp 0x10000ca1f
mov edx, 0x800700ce
lea rcx, [rsp + 0x38]
call fcn.10002a990
lea rcx, [rsp + 0xe8]
mov rdx, rax
mov r8d, 0x20
call sub.msvcrt.dll_memcpy
lea rdx, [0x10005db70]
lea rcx, [rsp + 0xe8]
call sub.msvcrt.dll__CxxThrowException
int3
mov dword [rbx + 0x14], r13d
mov rcx, qword [rbx + 8]
mov word [rcx], r13w
jmp 0x10000ca49
lea rcx, [rsp + 0x38]
call fcn.10002a990
lea rcx, [rsp + 0x88]
mov rdx, rax
mov r8d, 0x20
call sub.msvcrt.dll_memcpy
lea rdx, [0x10005db70]
lea rcx, [rsp + 0x88]
call sub.msvcrt.dll__CxxThrowException
nop
xor eax, eax
jmp 0x10000a543