Function at 0x140008a80
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x1170]
mov eax, 0x1270
call fcn.140015a30
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1160], rax
mov rsi, rdx
mov dword [rsp + 0x40], 4
mov rdi, rcx
mov dword [rsp + 0x38], 4
xor ebx, ebx
lea rax, [rsp + 0x30]
lea rdx, str.SOFTWAREINTELNETWORK_SERVICESNCS2
mov dword [rsp + 0x3c], ebx
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x30], rbx
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140008d1c
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x3c]
xor r8d, r8d
lea rdx, str.Trace
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
test eax, eax
cmove ebx, dword [rsp + 0x3c]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, 0xfffffffd
je 0x140008d1c
xor edx, edx
lea rcx, [rbp + 0x160]
mov r8d, 0x800
call fcn.140017670
lea r9, [0x14002eb04]
mov edx, 0xb9
lea r8, [rbp + 0x160]
lea rcx, str.C:Sandbox1094746CommonSrcNcsDebug.cpp
call fcn.1400086b0
xor edx, edx
lea rcx, [rbp + 0x960]
mov r8d, 0x800
call fcn.140017670
lea rax, [rsp + 0x30]
mov dword [rsp + 0x44], 1
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x38], 0x400
lea rdx, str.SOFTWAREINTELNETWORK_SERVICESNCS2
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140008c09
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x44]
lea rax, [rbp + 0x960]
xor r8d, r8d
lea rdx, str.InstalledDir
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140008c23
mov r8d, 0x104
lea rdx, [rbp + 0x960]
lea rcx, str.Temp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea r9, [rbp + 0x960]
mov edx, 0xd0
lea r8, [rbp + 0x160]
lea rcx, str.C:Sandbox1094746CommonSrcNcsDebug.cpp
call fcn.140008690
lea r9, [0x14002eb08]
mov edx, 0xd1
lea r8, [rbp + 0x160]
lea rcx, str.C:Sandbox1094746CommonSrcNcsDebug.cpp
call fcn.140008690
mov r9, rsi
lea r8, [rbp + 0x160]
mov edx, 0xd2
lea rcx, str.C:Sandbox1094746CommonSrcNcsDebug.cpp
call fcn.140008690
mov r8d, 0x20
lea rdx, [0x14002fd54]
lea rcx, [rbp + 0x160]
call fcn.14001b658
mov qword [rdi], rax
test rax, rax
jne 0x140008d15
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x208
call fcn.140017670
mov r8d, 0x104
lea rdx, [rsp + 0x50]
lea rcx, str.Temp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edx, 0x5c
lea rcx, [rbp + 0x160]
call fcn.140017810
test rax, rax
je 0x140008d15
mov r9, rax
lea r8, [rsp + 0x50]
mov edx, 0xdf
lea rcx, str.C:Sandbox1094746CommonSrcNcsDebug.cpp
call fcn.1400056f0
mov r8d, 0x20
lea rdx, [0x14002fd54]
lea rcx, [rsp + 0x50]
call fcn.14001b658
mov qword [rdi], rax
test rax, rax
je 0x140008d1c
mov byte [rdi + 0x38], 1
mov dword [rdi + 0x3c], ebx
xor eax, eax
mov rcx, qword [rbp + 0x1160]
xor rcx, rsp
call fcn.140015690
mov rbx, qword [rsp + 0x12a0]
add rsp, 0x1270
pop rdi
pop rsi
pop rbp
ret