Function at 0x1400020a0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x10758]
mov eax, 0x10858
call fcn.14003f630
sub rsp, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
mov r8d, 0x3ff
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor r15d, r15d
lea rdi, [r15 - 1]
test eax, eax
je 0x14000211f
lea rcx, [rsp + 0x40]
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r15w
jne 0x1400020f0
dec eax
movsxd rcx, eax
test eax, eax
jle 0x14000211f
cmp word [rsp + rcx*2 + 0x40], 0x5c
je 0x140002117
dec eax
dec rcx
test rcx, rcx
jg 0x140002103
jmp 0x14000211f
cdqe
mov word [rsp + rax*2 + 0x40], r15w
xor edx, edx
mov r8d, 0x10002
lea rcx, [rbp + 0x740]
call fcn.14005fd20
mov r8d, 0x8001
lea rdx, [rbp + 0x740]
lea rcx, str.PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov word [rbp + 0x740], r15w
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r14d, 1
mov r9d, r14d
xor r8d, r8d
lea rdx, str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400021d6
mov dword [rbp + 0x10790], 0x10002
mov dword [rbp + 0x10798], 2
lea rax, [rbp + 0x10790]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x740]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x10798]
xor r8d, r8d
lea rdx, str.Path
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [rbp + 0x740], r15w
je 0x1400023d3
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x1400023fb
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x107a0], rax
lea rax, [rbp + 0x740]
cmp rax, 0x10000
lea rax, [rbp + 0x740]
jae 0x14000222d
movzx edx, ax
lea rcx, [rbp + 0x107a0]
call fcn.140002950
jmp 0x14000224f
mov r8, rdi
inc r8
cmp word [rax + r8*2], 0
jne 0x140002230
lea rdx, [rbp + 0x740]
lea rcx, [rbp + 0x107a0]
call fcn.140002da0
nop
mov rcx, qword [rbp + 0x107a0]
cmp dword [rcx - 0x10], 0
jl 0x140002266
lea rdx, [rsp + 0x40]
call fcn.1400407c8
call fcn.140001a70
mov rcx, rax
test rax, rax
je 0x1400023e5
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x107a8], rax
lea r8, [rsp + 0x40]
lea rdx, [0x14006cdb0]
lea rcx, [rbp + 0x107a8]
call fcn.140002f70
lea r8, [0x14006cce4]
mov rbx, qword [rbp + 0x107a8]
mov rdx, rbx
lea rcx, [rbp + 0x107a0]
call fcn.1400024d0
lea r8, [0x14006cce4]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x107a0]
call fcn.1400024d0
movsxd rsi, dword [rbx - 0x10]
test esi, esi
js 0x1400023f0
sub r14d, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, esi
or eax, r14d
jge 0x140002304
mov edx, esi
lea rcx, [rbp + 0x107a8]
call fcn.140002b00
mov rbx, qword [rbp + 0x107a8]
lea eax, [rsi + 1]
movsxd rdx, eax
mov rcx, rbx
call fcn.14004b7b4
cmp esi, dword [rbx - 0xc]
jg 0x1400023f0
mov dword [rbx - 0x10], esi
mov word [rbx + rsi*2], r15w
lea r8, [0x14006cce4]
mov rdx, rbx
lea rcx, [rbp + 0x107a0]
call fcn.1400024d0
lea rsi, [0x14006cd90]
mov r8, rdi
inc r8
cmp word [rsi + r8*2], 0
jne 0x140002343
mov rdx, rsi
lea rcx, [rbp + 0x107a0]
call fcn.140002b60
mov r8, rsi
lea rdx, [0x14006cd94]
lea rcx, [rbp + 0x107a0]
call fcn.1400024d0
mov r8, rsi
lea rdx, [0x14006cdb8]
lea rcx, [rbp + 0x107a0]
call fcn.1400024d0
mov rax, qword [rbp + 0x107a0]
mov qword [rsp + 0x20], rax
call fcn.1400125a0
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400023b5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x107a0]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400023d3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov al, 1
add rsp, 0x10858
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.1400018b0
nop
mov ecx, 0x80070057
call fcn.1400018b0
nop
mov ecx, 0x80004005
call fcn.1400018b0
int3