Function at 0x14000e770
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xce0]
sub rsp, 0xde0
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov qword [rsp + 0xe38], rbx
mov rax, qword [0x140079698]
xor rax, rsp
mov qword [rbp + 0xcd0], rax
mov r12, r8
mov r14, rdx
mov r13, rcx
lea rdx, str.winmgmts
mov rcx, r14
call fcn.14003b7f8
test eax, eax
je 0x14000ef13
call fcn.140015d90
mov rcx, rax
test rax, rax
jne 0x14000e7e4
mov ecx, 0x80004005
call fcn.140002430
int3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
or rdi, 0xffffffffffffffff
xor esi, esi
test r14, r14
je 0x14000e83c
test r14, 0xffffffffffff0000
jne 0x14000e82a
movzx r15d, r14w
mov ecx, r15d
call fcn.140016424
test rax, rax
je 0x14000e853
mov r8d, r15d
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140001ea0
jmp 0x14000e84e
mov rax, rdi
nop dword [rax]
inc rax
cmp word [r14 + rax*2], si
jne 0x14000e830
jmp 0x14000e83e
mov eax, esi
mov r8d, eax
mov rdx, r14
lea rcx, [rsp + 0x40]
call fcn.1400022a0
mov rbx, qword [rsp + 0x40]
mov word [rbp - 0x60], si
mov word [rbp + 0x6b0], si
cmp dword [rbx - 0x10], 0
je 0x14000eefc
lea rdx, str.CLSID
lea rcx, [rsp + 0x40]
call fcn.14000f310
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rbx, qword [rsp + 0x40]
mov rdx, rbx
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000e909
mov dword [rsp + 0x30], 0x200
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000e8f9
cmp dword [rsp + 0x34], 1
jne 0x14000e8f9
lea r8, [rbp + 0x2b0]
lea edx, [rax + 0x40]
lea rcx, [rbp + 0x6b0]
call fcn.140040390
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000eb4f
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.140002390
nop
lea rdx, str.CurVer
lea rcx, [rsp + 0x50]
call fcn.14000f310
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000eb2c
mov dword [rsp + 0x30], 0x200
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000eb2c
cmp dword [rsp + 0x34], 1
jne 0x14000eb2c
call fcn.140015d90
mov rcx, rax
test rax, rax
jne 0x14000e9b3
mov ecx, 0x80004005
call fcn.140002430
int3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
lea rcx, [rbp + 0x2b0]
lea rax, [rbp + 0x2b0]
test rax, 0xffffffffffff0000
jne 0x14000e9fb
movzx r14d, cx
mov ecx, r14d
call fcn.140016424
test rax, rax
je 0x14000ea28
mov r8d, r14d
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140001ea0
jmp 0x14000ea23
lea rcx, [rbp + 0x2b0]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000ea05
mov r8d, eax
lea rdx, [rbp + 0x2b0]
lea rcx, [rsp + 0x48]
call fcn.1400022a0
mov rbx, qword [rsp + 0x48]
cmp dword [rbx - 0x10], 0
jne 0x14000ea75
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000ea48
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000ea67
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
jmp 0x14000ef00
lea rdx, str.CLSID
lea rcx, [rsp + 0x48]
call fcn.14000f310
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rbx, qword [rsp + 0x48]
mov rdx, rbx
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000eb12
mov dword [rsp + 0x30], 0x200
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000eb06
cmp dword [rsp + 0x34], 1
jne 0x14000eb06
lea r8, [rbp + 0x2b0]
lea edx, [rax + 0x40]
lea rcx, [rbp + 0x6b0]
call fcn.140040390
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000eb2c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000eb4a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x40]
lea r8, str.CLSID_
mov edx, 0x80
lea rcx, [rbp + 0x1b0]
call fcn.140040390
lea r8, [rbp + 0x6b0]
mov edx, 0x80
lea rcx, [rbp + 0x1b0]
call fcn.1400403f8
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x1b0]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000eefc
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.TypeLib
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000ec41
mov dword [rsp + 0x30], 0x80
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000eef0
cmp dword [rsp + 0x34], 1
jne 0x14000eef0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8, r12
lea rdx, [rbp + 0x2b0]
mov rcx, r13
call fcn.14000e280
mov esi, eax
jmp 0x14000eed0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.InprocServer32
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000ed9d
mov dword [rsp + 0x30], 0x105
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000ed92
mov eax, dword [rsp + 0x34]
cmp eax, 1
je 0x14000ece8
cmp eax, 2
jne 0x14000ed92
mov r8d, 0x104
lea rdx, [rbp + 0x8b0]
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x14000ece8
lea r8, [rbp + 0x8b0]
mov edx, 0x104
lea rcx, [rbp - 0x60]
call fcn.140040390
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rbp - 0x80]
mov edx, 2
lea rcx, [rbp - 0x60]
call qword [sym.imp.OLEAUT32.dll_SystemTimeToVariantTime]
test eax, eax
js 0x14000ed74
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
lea rdx, [rsp + 0x68]
call qword [rax + 0x38]
test eax, eax
jne 0x14000ed74
mov rcx, qword [r13 + 0xb8]
test rcx, rcx
je 0x14000ed46
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x68]
movzx r9d, word [rdx + 0x1a]
movzx r8d, word [rdx + 0x18]
mov dword [rsp + 0x20], esi
call qword [rax + 0x48]
test eax, eax
jne 0x14000ed74
mov rcx, qword [r13 + 0xd8]
test rcx, rcx
je 0x14000ed6f
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x68]
movzx r9d, word [rdx + 0x1a]
movzx r8d, word [rdx + 0x18]
mov dword [rsp + 0x20], esi
call qword [rax + 0x48]
test eax, eax
jne 0x14000ed74
mov esi, 1
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14000ed8b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, esi
jmp 0x14000ef15
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.LocalServer32
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000eefc
mov dword [rsp + 0x30], 0x105
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000eef0
mov eax, dword [rsp + 0x34]
cmp eax, 1
je 0x14000ee44
cmp eax, 2
jne 0x14000eef0
mov r8d, 0x104
lea rdx, [rbp + 0xac0]
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x14000ee44
lea r8, [rbp + 0xac0]
mov edx, 0x104
lea rcx, [rbp - 0x60]
call fcn.140040390
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rbp - 0x78]
mov edx, 2
lea rcx, [rbp - 0x60]
call qword [sym.imp.OLEAUT32.dll_SystemTimeToVariantTime]
test eax, eax
js 0x14000eed0
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
call qword [rax + 0x38]
test eax, eax
jne 0x14000eed0
mov rcx, qword [r13 + 0xb8]
test rcx, rcx
je 0x14000eea2
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x70]
movzx r9d, word [rdx + 0x1a]
movzx r8d, word [rdx + 0x18]
mov dword [rsp + 0x20], esi
call qword [rax + 0x48]
test eax, eax
jne 0x14000eed0
mov rcx, qword [r13 + 0xd8]
test rcx, rcx
je 0x14000eecb
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x70]
movzx r9d, word [rdx + 0x1a]
movzx r8d, word [rdx + 0x18]
mov dword [rsp + 0x20], esi
call qword [rax + 0x48]
test eax, eax
jne 0x14000eed0
mov esi, 1
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14000ed8b
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, esi
jmp 0x14000ef15
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14000ef13
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, qword [rbp + 0xcd0]
xor rcx, rsp
call fcn.140037060
mov rbx, qword [rsp + 0xe38]
add rsp, 0xde0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret