Function at 0x18000e480
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
xor r14d, r14d
mov ecx, 0x208
mov dword [rbp + 0x50], r14d
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x4e], cx
mov r13, rdx
mov qword [rbp + 0x58], r14
xorps xmm1, xmm1
movups xmmword [rbp - 0x40], xmm1
mov rax, qword gs:[0x60]
lea edx, [r14 + 8]
mov r8d, ecx
mov r15d, r14d
mov esi, r14d
mov r12d, r14d
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov qword [rbp - 0x48], rax
test rax, rax
je 0x18002f946
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntdll.dll_RtlFormatCurrentUserKeyPath]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x18002f985
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x50]
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeStringToString]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x18002f9d1
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
lea rcx, [rbp - 0x50]
call qword [sym.imp.ntdll.dll_RtlAppendUnicodeToString]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x18002f994
lea rax, [rbp - 0x50]
mov dword [rbp - 0x30], 0x30
xorps xmm0, xmm0
mov qword [rbp - 0x28], r14
lea edi, [r14 + 1]
mov dword [rbp - 0x18], 0x40
mov edx, edi
mov qword [rbp - 0x20], rax
lea r8, [rbp - 0x30]
lea rcx, [rbp + 0x58]
movdqu xmmword [rbp - 0x10], xmm0
call qword [sym.imp.ntdll.dll_ZwOpenKey]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
js 0x18000e6fc
mov rax, qword gs:[0x60]
lea edx, [rdi + 7]
mov ebx, 0x208
mov r8d, ebx
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
je 0x18002f95f
mov rcx, qword [rbp + 0x58]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, [0x18007f010]
mov r9, rsi
mov dword [rsp + 0x20], ebx
mov r8d, edi
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
nop dword [rax + rax]
mov ebx, eax
cmp eax, 0xc0000023
je 0x18002f9e0
cmp ebx, 0xc0000034
je 0x18000e658
test ebx, ebx
js 0x18002fa67
mov eax, dword [rsi + 4]
sub eax, edi
cmp eax, edi
ja 0x18002fa7d
mov ebx, dword [rsi + 8]
mov eax, dword [rsi + 0xc]
add rbx, rsi
mov word [rax + rbx - 2], r14w
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], r14w
jne 0x18000e630
cmp dword [rsi + 4], 2
je 0x18002fa94
mov r8d, eax
mov rdx, r13
mov rcx, rbx
call sub.ntdll.dll__wcsnicmp
test eax, eax
cmove r12d, edi
mov ebx, r14d
cmp qword [rbp - 0x38], r14
je 0x18000e671
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
nop dword [rax + rax]
cmp qword [rbp - 0x48], r14
je 0x18000e696
mov rcx, qword gs:[0x60]
xor edx, edx
mov r8, qword [rbp - 0x48]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
test rsi, rsi
je 0x18000e6b9
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x18000e6ce
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
test r15, r15
jne 0x18002fbca
mov rax, qword [rbp + 0x40]
mov dword [rax], r12d
mov eax, ebx
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp eax, 0xc0000034
je 0x18000e658
jmp 0x18002f9ac
mov ebx, 0xc0000017
lea r9, str.Out_of_memory
mov r8d, 0x18c
mov ecx, 1
jmp 0x18002f973
mov r8d, 0x1b7
lea r9, str.Out_of_memory
mov ebx, 0xc0000017
mov ecx, edi
lea rdx, str.AslPathIsTemporaryInternetFile
call fcn.18001188c
nop
jmp 0x18000e65b
lea r9, str.RtlFormatCurrentUserKeyPath_failed___x_
mov r8d, 0x192
jmp 0x18002f9a1
lea r9, str.RtlAppendUnicodeToString_failed_for_shell_folders_path___x_
mov r8d, 0x19e
mov dword [rsp + 0x20], eax
mov ecx, 1
jmp 0x18002f9bf
mov dword [rsp + 0x20], eax
lea r9, str.AslRegistryOpenKey_failed___x_
mov r8d, 0x1ad
mov ecx, edi
lea rdx, str.AslPathIsTemporaryInternetFile
call fcn.18001188c
nop
jmp 0x18000e65b
lea r9, str.RtlAppendUnicodeStringToString_failed_for_root_HKCU_path___x_
mov r8d, 0x198
jmp 0x18002f9a1
mov rcx, qword gs:[0x60]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov rax, qword gs:[0x60]
mov edx, 8
mov r8d, dword [rbp + 0x50]
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rsi, rax
test rax, rax
jne 0x18002fa33
mov r8d, 0x1c7
jmp 0x18002f965
mov rcx, qword [rbp + 0x58]
lea rax, [rbp + 0x50]
mov qword [rsp + 0x28], rax
lea rdx, [0x18007f010]
mov eax, dword [rbp + 0x50]
mov r9, rsi
mov r8d, edi
mov dword [rsp + 0x20], eax
call qword [sym.imp.ntdll.dll_NtQueryValueKey]
nop dword [rax + rax]
mov ebx, eax
jmp 0x18000e600
mov dword [rsp + 0x20], ebx
lea r9, str.NtQueryValueKey_failed_to_get_registry_value_of_temporary_internet_file___x_
mov r8d, 0x1db
jmp 0x18002f9bd
mov ebx, 0xc000014c
lea r9, str.Error_in_registry_value_retrieved_with_NtQueryValueKey__not_REG_SZ_or_REG_EXPAND_SZ
mov r8d, 0x1e1
jmp 0x18002f971
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
mov r14d, eax
test eax, eax
jne 0x18002fafd
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
xor r14d, r14d
test eax, eax
jg 0x18002fad2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x18002fae7
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0xc0070000
mov dword [rsp + 0x20], ebx
lea r9, str.Failed_to_expand_environment_variables_in_temporary_internet_file_path___x_
mov r8d, 0x1ef
jmp 0x18002f9bd
mov rax, qword gs:[0x60]
mov r8, r14
add r8, r8
mov edx, 8
mov rcx, qword [rax + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov r15, rax
test rax, rax
jne 0x18002fb51
lea r9, str.Out_of_memory
mov r8d, 0x1f6
lea rdx, str.AslPathIsTemporaryInternetFile
mov ecx, edi
mov ebx, 0xc0000017
call fcn.18001188c
xor r14d, r14d
jmp 0x18000e65b
mov r8d, r14d
mov rdx, r15
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
test eax, eax
je 0x18002fb7c
cmp eax, r14d
ja 0x18002fb7c
dec eax
mov rbx, r15
xor r14d, r14d
jmp 0x18000e644
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
xor r14d, r14d
test eax, eax
jg 0x18002fb9f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
jmp 0x18002fbb4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0xc0070000
mov dword [rsp + 0x20], ebx
lea r9, str.Failed_to_expand_environment_variables_in_temporary_internet_file_path___x_
mov r8d, 0x1fd
jmp 0x18002f9bd
mov rcx, qword gs:[0x60]
mov r8, r15
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
nop
jmp 0x18000e6d7