Function at 0x140029020
Capabilities:
Query environment variable
Query or enumerate registry value
Set environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x10180]
mov eax, 0x10280
call fcn.14009f8b0
sub rsp, rax
mov rax, qword [0x1400ec008]
xor rax, rsp
mov qword [rbp + 0x10170], rax
mov rsi, rcx
xor ebx, ebx
lea rcx, [rbp + 0x160]
mov qword [rsp + 0x50], rbx
xor edx, edx
mov r8d, 0x10002
call fcn.14007a110
mov rdx, rsi
mov dword [rsp + 0x44], 0x100
lea rcx, str.USERPROFILE
mov dword [rsp + 0x48], ebx
mov r14d, ebx
mov r15d, ebx
mov r12d, ebx
mov r13d, ebx
mov edi, ebx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp word [rsi], bx
je 0x1400290e5
cmp word [rsi + 2], 0x3a
jne 0x1400290e5
lea rdx, [rsi + 4]
lea rcx, str.HOMEPATH
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
movzx ebx, word [rsi + 4]
lea rcx, str.HOMEDRIVE
xor eax, eax
mov rdx, rsi
mov word [rsi + 4], ax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov word [rsi + 4], bx
xor ebx, ebx
jmp 0x1400290f5
mov rdx, rsi
lea rcx, str.HOMEPATH
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9, rsi
lea r8, str._sAppDataLocal
mov edx, 0x8001
lea rcx, [rbp + 0x160]
call fcn.1400284e0
lea rdx, [rbp + 0x160]
lea rcx, str.LOCALAPPDATA
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov r9, rsi
lea r8, str._sAppDataRoaming
mov edx, 0x8001
lea rcx, [rbp + 0x160]
call fcn.1400284e0
lea rdx, [rbp + 0x160]
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rax, [rsp + 0x50]
mov esi, 1
mov r9d, esi
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.Environment
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140029455
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x44]
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x60]
xor edx, edx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x44], 0x100
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edx, eax
cmp eax, 0x103
je 0x14002941e
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [rsp + 0x40]
cmp edx, 0xea
je 0x140029374
lea eax, [r13*2]
cmp ecx, eax
ja 0x140029374
test edx, edx
jne 0x14002941e
mov eax, dword [rsp + 0x4c]
cmp eax, 1
jne 0x140029216
mov rbx, r14
jmp 0x140029267
cmp eax, 2
jne 0x140029267
mov r8d, edi
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x40], eax
cmp eax, edi
jbe 0x140029264
test r15, r15
je 0x140029243
mov rcx, r15
call fcn.14007a8b4
mov eax, dword [rsp + 0x40]
lea ecx, [rax + rax]
call fcn.14004cbb0
mov r8d, dword [rsp + 0x40]
mov rdx, rax
mov rcx, r14
mov dword [rsp + 0x48], r8d
mov r15, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rbx, r15
lea rdx, [0x1400d2f88]
lea rcx, [rsp + 0x60]
call fcn.140087f48
test eax, eax
jne 0x14002935f
xor r8d, r8d
lea rcx, [0x1400d2f88]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [rsp + 0x40], eax
test eax, eax
je 0x14002935f
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rbx + rcx*2], 0
jne 0x1400292a2
mov eax, eax
add rcx, rax
lea rdi, [rcx*2 + 2]
test rdi, rdi
jne 0x1400292ca
lea rcx, str.xmalloc:_zero_size
call fcn.14004db00
mov rcx, rdi
call fcn.140088334
mov r12, rax
test rax, rax
jne 0x1400292e9
mov rdx, rdi
lea rcx, str.xmalloc:_out_of_memory__allocating__zu_bytes_
call fcn.14004db00
mov r8d, dword [rsp + 0x40]
lea rcx, [0x1400d2f88]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [rsp + 0x40]
mov eax, 0x3b
dec ecx
mov word [r12 + rcx*2], ax
or rax, 0xffffffffffffffff
cmp word [rbx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140029312
lea r9, [rax*2 + 2]
or rdx, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rbx + rdx*2 + 2], 0
lea rdx, [rdx + 1]
jne 0x140029330
mov eax, dword [rsp + 0x40]
lea rdx, [rdx*2 + 2]
mov r8, rbx
lea rcx, [r12 + rax*2]
call fcn.140028eb0
test eax, eax
jne 0x14002941e
mov rbx, r12
test rbx, rbx
je 0x1400293c0
mov rdx, rbx
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x1400293c0
test r14, r14
je 0x140029385
mov rcx, r14
call fcn.14007a8b4
mov ecx, dword [rsp + 0x40]
mov ebx, ecx
test ecx, ecx
jne 0x140029397
lea rcx, str.xmalloc:_zero_size
call fcn.14004db00
mov rcx, rbx
call fcn.140088334
mov r14, rax
test rax, rax
jne 0x1400293b6
mov rdx, rbx
lea rcx, str.xmalloc:_out_of_memory__allocating__zu_bytes_
call fcn.14004db00
mov r13d, dword [rsp + 0x40]
shr r13d, 1
dec esi
mov rcx, qword [rsp + 0x50]
lea eax, [r13*2]
mov dword [rsp + 0x40], eax
lea r9, [rsp + 0x44]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x44], 0x100
mov qword [rsp + 0x38], rax
lea r8, [rsp + 0x60]
lea rax, [rsp + 0x4c]
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], rax
xor ebx, ebx
mov edx, esi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, dword [rsp + 0x48]
inc esi
mov edx, eax
cmp eax, 0x103
jne 0x1400291e0
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14002942e
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r14, r14
je 0x14002943b
mov rcx, r14
call fcn.14007a8b4
test r15, r15
je 0x140029448
mov rcx, r15
call fcn.14007a8b4
test r12, r12
je 0x140029455
mov rcx, r12
call fcn.14007a8b4
mov rcx, qword [rbp + 0x10170]
xor rcx, rsp
call fcn.140078840
lea r11, [rsp + 0x10280]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret