Function at 0x1000367c4
Capabilities:
Persist via run registry key
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x260
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov eax, dword [rdx]
and qword [rsp + 0x38], 0
xor ebx, ebx
lea r12d, [rbx + 1]
mov rsi, rdx
mov rdi, rcx
mov dword [rsp + 0x34], eax
mov r13, 0xffffffff80000001
mov dword [rsp + 0x30], r12d
cmp eax, 0x208
jb 0x100036a83
lea rax, [rsp + 0x38]
lea rdx, [0x10001fd00]
mov r9d, r12d
xor r8d, r8d
mov rcx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100036996
mov eax, dword [rsi]
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x34]
lea rdx, [0x10001fd90]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebp, 0x104
test eax, eax
jne 0x1000368d2
mov eax, dword [rsp + 0x30]
cmp eax, r12d
jne 0x100036891
mov rcx, rdi
call fcn.10003fff0
test eax, eax
jne 0x1000368ca
mov eax, dword [rsp + 0x30]
cmp eax, 2
jne 0x1000368d2
lea rdx, [rsp + 0x40]
mov r8d, ebp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x1000368d2
mov edx, dword [rsi]
lea r8, [rsp + 0x40]
mov rcx, rdi
call fcn.10002e35c
test eax, eax
js 0x1000368d2
mov rcx, rdi
call fcn.10003fff0
test eax, eax
je 0x1000368d2
mov ebx, r12d
jmp 0x100036983
mov eax, dword [rsi]
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x34]
lea rdx, [0x10001fdb0]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100036983
mov eax, dword [rsp + 0x30]
cmp eax, r12d
jne 0x10003691e
mov rcx, rdi
call fcn.10003fff0
test eax, eax
jne 0x100036957
mov eax, dword [rsp + 0x30]
cmp eax, 2
jne 0x100036983
lea rdx, [rsp + 0x40]
mov r8d, ebp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x100036983
mov edx, dword [rsi]
lea r8, [rsp + 0x40]
mov rcx, rdi
call fcn.10002e35c
test eax, eax
js 0x100036983
mov rcx, rdi
call fcn.10003fff0
test eax, eax
je 0x100036983
mov rcx, rdi
mov ebp, r12d
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov edx, dword [rsi]
lea r8, [0x10001fdc0]
mov rcx, rdi
call fcn.10002e4a0
mov rcx, rdi
call fcn.10003fff0
neg eax
sbb ebx, ebx
and ebx, r12d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x100036b11
lea rax, [rsp + 0x38]
lea rdx, [0x10001fe20]
mov r9d, r12d
xor r8d, r8d
mov rcx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100036a83
mov eax, dword [rsi]
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x34]
lea rdx, [0x10001fd90]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100036a09
cmp dword [rsp + 0x30], r12d
jne 0x100036a09
mov rcx, rdi
call fcn.10003fff0
test eax, eax
je 0x100036a09
mov ebx, r12d
jmp 0x100036a70
mov eax, dword [rsi]
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x34]
lea rdx, [0x10001fdb0]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100036a6e
cmp dword [rsp + 0x30], r12d
jne 0x100036a6e
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov edx, dword [rsi]
lea r8, [0x10001fdc0]
mov rcx, rdi
call fcn.10002e4a0
mov rcx, rdi
call fcn.10003fff0
neg eax
sbb ebx, ebx
and ebx, r12d
jmp 0x100036a70
xor ebx, ebx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x100036b11
lea rax, [rsp + 0x38]
lea rdx, [0x10001feb0]
mov r9d, r12d
xor r8d, r8d
mov rcx, r13
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100036b11
mov rcx, qword [0x10004ce70]
mov r9d, 0x96
lea r8, [rsp + 0x40]
lea edx, [r9 + 7]
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x100036b06
mov eax, dword [rsi]
mov rcx, qword [rsp + 0x38]
lea r9, [rsp + 0x30]
mov dword [rsp + 0x34], eax
lea rax, [rsp + 0x34]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100036b04
cmp dword [rsp + 0x30], r12d
jne 0x100036b04
mov ebx, r12d
jmp 0x100036b06
xor ebx, ebx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [rsp + 0x34]
mov eax, ebx
mov dword [rsi], ecx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1000475f0
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x260
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret