Function at 0x10003e054
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x5f0
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x5e0], rax
mov rax, qword [rcx]
mov rsi, rcx
lea r9, [0x10001edf0]
lea r8, [0x100020d28]
lea rcx, [rsp + 0x40]
xor ebx, ebx
mov edx, 0x103
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], rbx
call fcn.10002e570
lea rdx, [rsp + 0x38]
mov r9d, 0x20019
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x40]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x10003e7bb
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r12d, [rbx + 1]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x30]
lea rdx, [0x100022e48]
mov r13d, 0x208
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x34], r13d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
or rcx, 0xffffffffffffffff
mov ebp, 0x104
cmp eax, ebx
jne 0x10003e226
mov edx, dword [rsp + 0x30]
cmp edx, r12d
je 0x10003e142
cmp edx, 2
jne 0x10003e226
xor eax, eax
lea rdi, [rsp + 0x40]
repne scasw ax, word [rdi]
not rcx
sub rcx, r12
cmp rcx, 5
jbe 0x10003e226
cmp edx, 2
jne 0x10003e1d6
lea rdx, [rsp + 0x350]
lea rcx, [rsp + 0x40]
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebx
je 0x10003e7b0
lea rdi, [rsp + 0x350]
lea rax, [rsp + 0x40]
mov rdx, rbp
lea rcx, [rsp + 0x40]
mov r8d, ebx
sub rdi, rax
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbx
je 0x10003e1bb
movzx eax, word [rdi + rcx]
cmp ax, bx
je 0x10003e1bb
mov word [rcx], ax
add rcx, 2
sub rdx, r12
jne 0x10003e19a
cmp rdx, rbx
jne 0x10003e1ca
sub rcx, 2
mov r8d, 0x8007007a
cmp r8d, ebx
mov word [rcx], bx
jl 0x10003e7b0
lea rax, [rsp + 0x40]
cmp rax, rbx
je 0x10003e1f7
lea rdx, [rsp + 0x350]
lea rcx, [rsp + 0x40]
mov r8d, r12d
call fcn.100045e8c
jmp 0x10003e1fc
mov eax, 0x80004003
cmp eax, ebx
jl 0x10003e226
lea rax, [rsp + 0x350]
cmp rax, rbx
je 0x10003e21c
lea rcx, [rsp + 0x350]
call fcn.1000400f0
jmp 0x10003e21e
mov eax, ebx
cmp eax, ebx
je 0x10003e7b0
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, [0x100022e68]
xor r8d, r8d
mov dword [rsp + 0x34], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10003e272
cmp dword [rsp + 0x30], r12d
jne 0x10003e272
lea rcx, [rsi + 0x40]
lea rdx, [rsp + 0x40]
call fcn.10003fc68
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, [0x100022e80]
xor r8d, r8d
mov dword [rsp + 0x34], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10003e2cc
cmp dword [rsp + 0x30], r12d
jne 0x10003e2cc
lea rdx, [0x10001c8c0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, ebx
jne 0x10003e2cc
mov dword [rsi + 0x68], r12d
jmp 0x10003e2cf
mov dword [rsi + 0x68], ebx
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rsi + 8]
lea rdx, [0x100001da8]
xor r8d, r8d
mov dword [rsp + 0x34], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10003e31a
cmp dword [rsp + 0x30], r12d
jne 0x10003e31a
lea rdx, [rsp + 0x40]
lea rcx, [rsi + 8]
call fcn.10003fc68
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, [0x100022ea0]
xor r8d, r8d
mov dword [rsp + 0x34], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10003e7b0
cmp dword [rsp + 0x30], r12d
je 0x10003e367
cmp dword [rsp + 0x30], 2
jne 0x10003e7b0
lea rcx, [rsi + 0x38]
lea rdx, [rsp + 0x40]
call fcn.10003fc68
cmp eax, ebx
jne 0x10003e7b0
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, [0x100022ec0]
xor r8d, r8d
mov dword [rsp + 0x34], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10003e7b0
cmp dword [rsp + 0x30], r12d
jne 0x10003e7b0
lea rcx, [rsi + 0x28]
lea rdx, [rsp + 0x40]
call fcn.10003fc68
cmp eax, ebx
jne 0x10003e7b0
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, [0x100022ef0]
xor r8d, r8d
mov dword [rsp + 0x34], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10003e488
cmp dword [rsp + 0x30], r12d
jne 0x10003e488
mov eax, 0x40
mov word [rsp + 0x350], ax
lea rax, [rsp + 0x352]
cmp rax, rbx
je 0x10003e445
lea rcx, [rsp + 0x352]
mov edx, 0x103
call fcn.10003fbdc
jmp 0x10003e447
mov eax, ebx
cmp eax, ebx
je 0x10003e488
lea r8, [0x100022f20]
lea rcx, [rsp + 0x350]
mov rdx, rbp
call fcn.10002e3d4
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x350]
mov rdx, rbp
call fcn.10002e3d4
lea rcx, [rsi + 0x30]
lea rdx, [rsp + 0x350]
call fcn.10003fc68
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, [0x100022f28]
xor r8d, r8d
mov dword [rsp + 0x34], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10003e4d4
cmp dword [rsp + 0x30], r12d
jne 0x10003e4d4
lea rcx, [rsi + 0x18]
lea rdx, [rsp + 0x40]
call fcn.10003fc68
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, [0x100020a68]
xor r8d, r8d
mov dword [rsp + 0x34], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10003e520
cmp dword [rsp + 0x30], r12d
jne 0x10003e520
lea rcx, [rsi + 0x20]
lea rdx, [rsp + 0x40]
call fcn.10003fc68
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x250]
lea rdx, [0x100022e08]
mov edi, 0x100
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x34], edi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea ebp, [rdi + 0x43]
cmp eax, ebx
jne 0x10003e5ac
cmp dword [rsp + 0x30], r12d
jne 0x10003e5ac
lea rax, [rsp + 0x250]
lea r9, [0x10004cf80]
lea r8, [0x100022e20]
lea rcx, [rsp + 0x350]
mov rdx, rbp
mov qword [rsp + 0x20], rax
call fcn.10002e570
lea rcx, [rsi + 0x60]
lea rdx, [rsp + 0x350]
call fcn.10003fc68
cmp eax, ebx
jne 0x10003e7b0
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x250]
lea rdx, [0x100022f48]
xor r8d, r8d
mov dword [rsp + 0x34], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10003e648
cmp dword [rsp + 0x30], r12d
jne 0x10003e648
lea rax, [rsp + 0x250]
cmp rax, rbx
je 0x10003e638
cmp bx, word [rsp + 0x250]
je 0x10003e638
lea rax, [rsp + 0x250]
lea r9, [0x10004cf80]
lea r8, [0x100022e20]
lea rcx, [rsp + 0x350]
mov rdx, rbp
mov qword [rsp + 0x20], rax
call fcn.10002e570
lea rdx, [rsp + 0x350]
jmp 0x10003e63f
lea rdx, [0x100001db4]
lea rcx, [rsi + 0x58]
call fcn.10003fc68
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, [0x10001ead0]
xor r8d, r8d
mov dword [rsp + 0x34], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10003e686
cmp dword [rsp + 0x30], r12d
je 0x10003e6c4
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, [0x10001eae8]
xor r8d, r8d
mov dword [rsp + 0x34], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10003e6dc
cmp dword [rsp + 0x30], r12d
jne 0x10003e6dc
lea rcx, [rsi + 0x10]
lea rdx, [rsp + 0x40]
call fcn.10003fc68
cmp eax, ebx
jne 0x10003e7b0
jmp 0x10003e750
mov rdi, qword [rsi]
or r8, 0xffffffffffffffff
xor eax, eax
mov rcx, r8
repne scasw ax, word [rdi]
lea eax, [r8 + 3]
not rcx
sub rcx, r12
lea rbp, [rcx + 0xb]
mul rbp
cmovo rax, r8
mov rcx, rax
call sub.msvcrt.dll_void____ptr64___cdecl_operator_new___unsigned_long_long_unsigned___int64__
mov rdi, rax
cmp rax, rbx
je 0x10003e7b0
mov r8, qword [rsi]
mov rdx, rbp
mov rcx, rax
add r8, 2
call fcn.10002e2e8
lea r8, [0x100022f70]
mov rdx, rbp
mov rcx, rdi
call fcn.10002e3d4
lea rcx, [rsi + 0x10]
mov rdx, rdi
call fcn.10003fc68
cmp eax, ebx
jne 0x10003e7b0
mov rcx, rdi
call sub.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea rdx, [0x100022f80]
xor r8d, r8d
mov dword [rsp + 0x34], r13d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x10003e7aa
cmp dword [rsp + 0x30], r12d
jne 0x10003e7aa
lea rdx, [0x10001c8c0]
lea rcx, [rsp + 0x40]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, ebx
jne 0x10003e7aa
mov dword [rsi + 0x6c], r12d
jmp 0x10003e7ad
mov dword [rsi + 0x6c], ebx
mov ebx, r12d
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x5e0]
xor rcx, rsp
call fcn.1000475f0
lea r11, [rsp + 0x5f0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret