Function at 0x1401fdcc0
Capabilities:
Query environment variable
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 8], 0xfffffffffffffffe
mov qword [rsp + 0xc0], rbx
mov rbx, rdx
mov r14, rcx
xor r12d, r12d
mov dword [rbp + 0x50], r12d
lea rcx, [0x14042f270]
mov rax, qword [0x14042f270]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x60], rax
lea rcx, [0x14042f270]
mov rax, qword [0x14042f270]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x58], rax
lea rcx, [0x14042f270]
mov rax, qword [0x14042f270]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x50], rax
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x58]
mov rcx, rbx
call fcn.1401fd870
mov r11, qword [rbp - 0x60]
lea rcx, [0x14042f270]
mov rax, qword [0x14042f270]
cmp dword [r11 - 0x10], r12d
jne 0x1401fddd5
call qword [rax + 0x18]
add rax, 0x18
mov qword [r14], rax
mov rdx, qword [rbp + 0x50]
add rdx, 0xffffffffffffffe8
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fdd92
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fddb1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x1401fddcd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, r14
jmp 0x1401fe57f
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rbp - 0x18], rbx
lea rdx, str.softwaremicrosoftwindowscurrentversion_setuppnplockdownfiles
test rdx, 0xffffffffffff0000
jne 0x1401fde12
movzx edi, dx
xor edx, edx
mov ecx, edi
call fcn.140001440
test rax, rax
je 0x1401fde25
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x18]
call fcn.140002960
jmp 0x1401fde21
mov r8d, 0x40
lea rcx, [rbp - 0x18]
call fcn.140002560
mov rbx, qword [rbp - 0x18]
lea r8, [rbp - 0x28]
mov rdx, rbx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
setne dil
lea rdx, [rbx - 0x18]
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fde5c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [0x14042f270]
mov rax, qword [0x14042f270]
test dil, dil
je 0x1401fdebc
call qword [rax + 0x18]
add rax, 0x18
mov qword [r14], rax
mov rdx, qword [rbp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fde98
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fdeb7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x1401fddb1
mov r15d, r12d
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp + 0x58], rax
movzx ebx, byte [rbp + 0x50]
lea r13, str.Owners
mov ecx, 1
mov rax, qword [rbp + 0x58]
sub ecx, dword [rax - 8]
mov eax, dword [rax - 0xc]
sub eax, 0x200
or eax, ecx
jge 0x1401fdefb
mov edx, 0x200
lea rcx, [rbp + 0x58]
call fcn.140002650
mov r9d, 0x200
mov r8, qword [rbp + 0x58]
mov edx, r15d
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
inc r15d
test eax, eax
jne 0x1401fdf1e
mov dil, 1
jmp 0x1401fdf21
xor dil, dil
mov rcx, qword [rbp + 0x58]
movsxd rdx, dword [rcx - 0xc]
call fcn.140251840
test eax, eax
js 0x1401fe574
mov rcx, qword [rbp + 0x58]
cmp eax, dword [rcx - 0xc]
jg 0x1401fe574
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbp + 0x58]
mov word [rax + rcx*2], r12w
test dil, dil
je 0x1401fe3a0
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], r12
lea rcx, [0x14042f270]
mov rax, qword [0x14042f270]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x20], rax
test r13, 0xffffffffffff0000
jne 0x1401fdfac
movzx edi, r13w
xor edx, edx
mov ecx, edi
call fcn.140001440
test rax, rax
je 0x1401fdfbf
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.140002960
jmp 0x1401fdfbf
mov r8d, 6
mov rdx, r13
lea rcx, [rbp - 0x20]
call fcn.140002560
nop
lea r9, [rbp - 0x50]
lea r8, [rbp - 0x20]
lea rdx, [rbp + 0x58]
mov rcx, qword [rbp - 0x28]
call fcn.1401fd1d0
test al, al
sete dil
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fdff8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x1401fe048
mov rdi, qword [rbp - 0x50]
test rdi, rdi
je 0x1401fded5
cmp rdi, qword [rbp - 0x48]
je 0x1401fe03b
mov rdx, qword [rdi]
sub rdx, 0x18
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fe02d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rdi, 8
cmp rdi, qword [rbp - 0x48]
jne 0x1401fe010
mov rdi, qword [rbp - 0x50]
mov rcx, rdi
call fcn.140250354
jmp 0x1401fded5
mov rdi, qword [rbp - 0x50]
mov r9, rdi
mov r13, qword [rbp - 0x48]
cmp rdi, r13
je 0x1401fe24b
mov rax, qword [rbp - 0x60]
mov rcx, qword [r9]
mov r8, rax
sub r8, rcx
nop dword [rax]
movzx edx, word [rcx]
cmp dx, word [rcx + r8]
jne 0x1401fe088
add rcx, 2
test dx, dx
jne 0x1401fe070
mov ecx, r12d
jmp 0x1401fe08d
sbb ecx, ecx
sbb ecx, 0xffffffff
test ecx, ecx
sete cl
test cl, cl
jne 0x1401fe0a4
add r9, 8
cmp r9, r13
jne 0x1401fe060
jmp 0x1401fe24b
cmp r9, r13
je 0x1401fe24b
movzx r9d, bl
mov r8, rdi
mov rdx, r13
mov rcx, r13
call fcn.1401e6cf0
mov r12, rax
mov rdi, rax
cmp rax, r13
je 0x1401fe0f7
nop word [rax + rax]
mov rdx, qword [rdi]
sub rdx, 0x18
mov ecx, esi
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1401fe0ed
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rdi, 8
cmp rdi, qword [rbp - 0x48]
jne 0x1401fe0d0
mov qword [rbp - 0x48], r12
lea rcx, [0x14042f270]
mov rax, qword [0x14042f270]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x30], rax
lea rax, str.Source
test rax, 0xffffffffffff0000
jne 0x1401fe145
movzx edi, ax
xor edx, edx
mov ecx, edi
call fcn.140001440
test rax, rax
je 0x1401fe158
mov r8d, edi
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140002960
jmp 0x1401fe158
mov r8d, 6
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140002560
nop
lea r9, [rbp - 0x50]
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0x58]
mov rcx, qword [rbp - 0x28]
call fcn.1401fd1d0
test al, al
sete dil
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fe191
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x1401fe1eb
mov rdi, qword [rbp - 0x50]
test rdi, rdi
je 0x1401fe1e3
cmp rdi, qword [rbp - 0x48]
je 0x1401fe1db
nop word [rax + rax]
mov rdx, qword [rdi]
sub rdx, 0x18
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fe1cd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rdi, 8
cmp rdi, qword [rbp - 0x48]
jne 0x1401fe1b0
mov rdi, qword [rbp - 0x50]
mov rcx, rdi
call fcn.140250354
xor r12d, r12d
jmp 0x1401fdece
mov rcx, qword [rbp - 0x48]
mov rax, rcx
mov rdi, qword [rbp - 0x50]
sub rax, rdi
test rax, 0xfffffffffffffff8
jne 0x1401fe298
test rdi, rdi
je 0x1401fe1e3
cmp rdi, rcx
je 0x1401fe23b
nop
mov rdx, qword [rdi]
sub rdx, 0x18
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fe22d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rdi, 8
cmp rdi, qword [rbp - 0x48]
jne 0x1401fe210
mov rdi, qword [rbp - 0x50]
mov rcx, rdi
call fcn.140250354
xor r12d, r12d
jmp 0x1401fdece
test rdi, rdi
je 0x1401fdece
cmp rdi, r13
je 0x1401fe28b
nop dword [rax]
mov rdx, qword [rdi]
sub rdx, 0x18
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fe27d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rdi, 8
cmp rdi, qword [rbp - 0x48]
jne 0x1401fe260
mov rdi, qword [rbp - 0x50]
mov rcx, rdi
call fcn.140250354
jmp 0x1401fdece
lea rcx, [0x14042f270]
mov rax, qword [0x14042f270]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x10], rax
lea r8, [rbp - 0x10]
lea rdx, [rbp + 0x50]
mov rcx, rdi
call fcn.1401fd870
mov rcx, qword [rbp + 0x50]
mov edx, 1
sub edx, dword [rcx - 8]
mov eax, dword [rcx - 0xc]
sub eax, 0x104
or eax, edx
jge 0x1401fe2eb
mov edx, 0x104
lea rcx, [rbp + 0x50]
call fcn.140002650
mov rcx, qword [rbp + 0x50]
mov r8d, 0x104
mov rdx, rcx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, qword [rbp + 0x50]
movsxd rdx, dword [rcx - 0xc]
call fcn.140251840
test eax, eax
js 0x1401fe395
mov rcx, qword [rbp + 0x50]
cmp eax, dword [rcx - 0xc]
jg 0x1401fe395
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rbp + 0x50]
xor edx, edx
mov word [rax + rcx*2], dx
mov rdx, qword [rbp - 0x10]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fe34b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rbx, qword [rbp - 0x50]
test rbx, rbx
je 0x1401fe3a0
cmp rbx, qword [rbp - 0x48]
je 0x1401fe38b
nop word [rax + rax]
mov rdx, qword [rbx]
sub rdx, 0x18
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fe37d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rbx, 8
cmp rbx, qword [rbp - 0x48]
jne 0x1401fe360
mov rbx, qword [rbp - 0x50]
mov rcx, rbx
call fcn.140250354
jmp 0x1401fe3a0
mov ecx, 0x80070057
call fcn.140001290
nop
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r11, qword [rbp + 0x50]
cmp dword [r11 - 0x10], 0
jl 0x1401fe502
lea rdx, str.FileRepository
mov rcx, r11
call fcn.1402513f0
mov r11, qword [rbp + 0x50]
test rax, rax
je 0x1401fe502
sub rax, r11
sar rax, 1
cmp eax, 0xffffffff
je 0x1401fe502
lea ecx, [rax + 0xf]
test ecx, ecx
js 0x1401fe490
cmp ecx, dword [r11 - 0x10]
jge 0x1401fe490
mov edx, 0x5c
movsxd rax, ecx
lea rcx, [r11 + rax*2]
call fcn.140257c6c
mov r11, qword [rbp + 0x50]
test rax, rax
je 0x1401fe490
sub rax, r11
sar rax, 1
cmp eax, 0xffffffff
je 0x1401fe490
mov r8d, eax
mov rdx, r14
lea rcx, [rbp + 0x50]
call fcn.140187530
nop
mov rdx, qword [rbp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fe44d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fe46c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fe48b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x1401fddb1
lea rcx, [r11 - 0x18]
call fcn.1400026b0
add rax, 0x18
mov qword [r14], rax
mov rdx, qword [rbp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fe4bf
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fe4de
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fe4fd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x1401fddb1
lea rcx, [r11 - 0x18]
call fcn.1400026b0
add rax, 0x18
mov qword [r14], rax
mov rdx, qword [rbp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fe531
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fe550
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fe56f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
jmp 0x1401fddb1
mov ecx, 0x80070057
call fcn.140001290
nop
mov rbx, qword [rsp + 0xc0]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret