Function at 0x140001370
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x40
mov rdi, r8
mov r15, rdx
mov rsi, rcx
test r8, r8
jne 0x140001395
mov eax, 0xa0
add rsp, 0x40
pop r15
pop rdi
pop rsi
ret
xor ecx, ecx
mov qword [rsp + 0x60], rbx
lea rax, [rsp + 0x70]
mov dword [rsp + 0x78], ecx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x78]
mov qword [rsp + 0x20], rcx
xor r8d, r8d
mov dword [rsp + 0x70], ecx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x1400013fd
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r9, r15
lea r8, str.get_reg_string
lea rdx, str._s:_enumerating___ls__registry_value_failed
mov ecx, 0x120
call section..text
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r15
pop rdi
pop rsi
ret
mov r9d, dword [rsp + 0x78]
mov eax, r9d
sub eax, 1
je 0x14000143a
cmp eax, 1
je 0x14000143a
lea r8, str.get_reg_string
mov ecx, 0x20
lea rdx, str._s:___ls__registry_value_is_not_string__type__u_
call section..text
mov rbx, qword [rsp + 0x60]
mov eax, 0x65e
add rsp, 0x40
pop r15
pop rdi
pop rsi
ret
mov ecx, dword [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x140001471
mov r9d, dword [rsp + 0x70]
lea r8, str.get_reg_string
lea rdx, str._s:_malloc__u__failed
lea ecx, [rax + 0x10]
call section..text
lea ecx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
int3
lea rax, [rsp + 0x70]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov rdx, r15
mov qword [rsp + 0x20], rbx
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test eax, eax
je 0x1400014d4
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r9, r15
lea r8, str.get_reg_string
lea rdx, str._s:_reading___ls__registry_value_failed
mov ecx, 0x120
call section..text
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x60]
mov eax, esi
add rsp, 0x40
pop r15
pop rdi
pop rsi
ret
cmp dword [rsp + 0x78], 2
jne 0x1400015f8
mov eax, dword [rsp + 0x70]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], r14
lea r14d, [rax + rax]
mov ebp, r14d
mov ecx, r14d
shr ebp, 1
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
mov rcx, rbx
test rax, rax
jne 0x140001533
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r9d, r14d
lea r8, str.get_reg_string
lea rdx, str._s:_malloc__u__failed
lea ecx, [rsi + 0x10]
call section..text
lea ecx, [rsi + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
int3
mov r8d, ebp
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r14d, eax
test eax, eax
jne 0x14000158d
mov r9, r15
lea r8, str.get_reg_string
lea rdx, str._s:_expanding___ls__registry_value_failed
mov ecx, 0x120
call section..text
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbp, qword [rsp + 0x38]
xor eax, eax
mov r14, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r15
pop rdi
pop rsi
ret
cmp r14d, ebp
jbe 0x1400015e7
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea ebp, [r14 + r14]
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
mov rcx, rbx
test rax, rax
jne 0x1400015db
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r9d, ebp
lea r8, str.get_reg_string
lea rdx, str._s:_malloc__u__failed
lea ecx, [rsi + 0x10]
call section..text
lea ecx, [rsi + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__exit]
int3
mov r8d, r14d
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rdi], rsi
jmp 0x140001573
mov qword [rdi], rbx
xor eax, eax
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop r15
pop rdi
pop rsi
ret