Function at 0x140180e60
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x168
mov ebp, r9d
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x14031d040]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor esi, esi
xor edx, edx
call fcn.140180530
test al, al
je 0x140180efc
mov dword [rsp + 0x15c], esi
mov dword [rsp + 0x158], esi
movsx rax, byte [rdi + 0x17]
mov rdx, rdi
test rax, rax
jns 0x140180ec0
mov rax, qword [rdi + 8]
mov rdx, qword [rdi]
test rax, rax
cmove rdx, rax
mov rcx, qword [rbx]
lea r13, [rsp + 0x158]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x15c]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbx + 0x40], eax
test eax, eax
je 0x140181088
movabs rax, 0xaaaaaaaaaaaaaaaa
lea rsi, [rsp + 0x50]
mov qword [rsi + 0x20], rax
movaps xmm0, xmmword [0x1402825c0]
movaps xmmword [rsi + 0x10], xmm0
movaps xmmword [rsi], xmm0
mov rcx, rbx
mov rdx, rsi
mov r8b, 1
call fcn.1401801d0
movsx rax, byte [rdi + 0x17]
test rax, rax
jns 0x140180f39
mov rax, qword [rdi + 8]
test rax, rax
je 0x140181153
movabs rbx, 0x7fffffffffffffff
movsx rax, byte [rsp + 0x67]
test rax, rax
jns 0x140181034
mov rdx, qword [rsp + 0x60]
and rdx, rbx
dec rdx
mov rax, qword [rsp + 0x58]
cmp rdx, rax
je 0x140181041
mov rsi, qword [rsp + 0x50]
lea rcx, [rsi + rax*2]
lea rdx, [rsi + rax*2]
add rdx, 2
lea r8, [0x14029d5ee]
cmp rcx, r8
seta r9b
cmp rdx, r8
setbe dl
or dl, r9b
je 0x140181ad7
mov word [rcx], 0x5c
lea rcx, [rax + 1]
cmp byte [rsp + 0x67], 0
jns 0x14018107c
mov qword [rsp + 0x58], rcx
mov word [rsi + rax*2 + 2], 0
movsx r14, byte [rdi + 0x17]
test r14, r14
jns 0x140180fd3
mov r14, qword [rdi + 8]
mov rdi, qword [rdi]
test r14, r14
sete al
test rdi, rdi
setne cl
or cl, al
je 0x140181ad7
movsx rax, byte [rsp + 0x67]
mov edx, 0xa
mov rsi, rax
test rax, rax
jns 0x14018100a
and rbx, qword [rsp + 0x60]
dec rbx
mov rsi, qword [rsp + 0x58]
mov rdx, rbx
mov rcx, rdx
sub rcx, rsi
cmp rcx, r14
jb 0x1401810d6
test r14, r14
je 0x140181153
test al, al
js 0x14018110e
lea rbx, [rsp + 0x50]
jmp 0x140181113
cmp al, 0xa
jne 0x140180f79
mov edx, 0xa
lea rax, [0x14029d5ee]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x50]
mov r8d, 1
mov r9, rdx
call fcn.14004d230
jmp 0x140180fc2
and cl, 0x7f
mov byte [rsp + 0x67], cl
jmp 0x140180fbb
mov edx, dword [rsp + 0x15c]
lea eax, [rdx - 1]
cmp eax, 2
setb r12b
jae 0x140181337
mov r15d, dword [rsp + 0x158]
cmp r15, 1
ja 0x140181774
cmp byte [r14 + 0x17], 0
js 0x140181ac2
mov word [r14], 0
mov byte [r14 + 0x17], 0
cmp dword [rbx + 0x40], 0
jne 0x140180efc
jmp 0x140181310
lea r8, [rsi + r14]
sub r8, rdx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x50]
mov r9, rsi
call fcn.14004d230
jmp 0x140181153
mov eax, esi
and al, 0x7f
mov byte [rsp + 0x67], al
jmp 0x14018114d
mov rbx, qword [rsp + 0x50]
test r14, r14
js 0x140181ad7
lea rcx, [rbx + rsi*2]
cmp rcx, rdi
ja 0x140181132
lea rax, [rcx + r14*2]
cmp rax, rdi
ja 0x140181ad7
lea r8, [r14 + r14]
mov rdx, rdi
call fcn.1402357f0
add rsi, r14
cmp byte [rsp + 0x67], 0
jns 0x140181104
mov qword [rsp + 0x58], rsi
mov word [rbx + rsi*2], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
xor eax, eax
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xc0], rax
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
lea rdx, str.Cant_read_value_of__s
lea rcx, [rsp + 0x78]
call fcn.1400343a0
call fcn.140113640
test rax, rax
je 0x1401811c5
lea rdx, [rsp + 0x78]
lea r8, [rsp + 0xa0]
lea r9, [rsp + 0xd0]
mov rcx, rax
call fcn.1401137c0
test rax, rax
jne 0x1401811cf
lea rcx, [rsp + 0x78]
call fcn.140113740
call fcn.1400ab720
mov rsi, rax
call fcn.1400ab720
mov rdi, rax
call fcn.1400ab720
mov rbx, rax
mov rcx, qword [rsp + 0x68]
call fcn.140071eb0
cmp byte [rsp + 0x67], 0
jns 0x140181202
mov rcx, qword [rsp + 0x50]
call fcn.1401ef41c
call fcn.1400ab720
cmp rbx, rax
je 0x140181238
dec word [rbx + 0x10]
setne al
test rbx, rbx
sete cl
or cl, al
jne 0x140181233
cmp byte [rbx + 0x12], 1
jne 0x14018122b
mov rcx, qword [rbx]
call fcn.140071eb0
mov rcx, rbx
call fcn.1401ef41c
call fcn.1400ab720
call fcn.1400ab720
cmp rdi, rax
je 0x14018126e
dec word [rdi + 0x10]
setne al
test rdi, rdi
sete cl
or cl, al
jne 0x140181269
cmp byte [rdi + 0x12], 1
jne 0x140181261
mov rcx, qword [rdi]
call fcn.140071eb0
mov rcx, rdi
call fcn.1401ef41c
call fcn.1400ab720
call fcn.1400ab720
cmp rsi, rax
je 0x1401812a4
dec word [rsi + 0x10]
setne al
test rsi, rsi
sete cl
or cl, al
jne 0x14018129f
cmp byte [rsi + 0x12], 1
jne 0x140181297
mov rcx, qword [rsi]
call fcn.140071eb0
mov rcx, rsi
call fcn.1401ef41c
call fcn.1400ab720
mov rcx, qword [rsp + 0x90]
call fcn.140071eb0
cmp byte [rsp + 0x8f], 0
jns 0x1401812c5
mov rcx, qword [rsp + 0x78]
call fcn.1401ef41c
mov rcx, qword [rsp + 0xb8]
call fcn.140071eb0
cmp byte [rsp + 0xb7], 0
jns 0x1401812e9
mov rcx, qword [rsp + 0xa0]
call fcn.1401ef41c
mov rcx, qword [rsp + 0xe8]
call fcn.140071eb0
cmp byte [rsp + 0xe7], 0
jns 0x14018130d
mov rcx, qword [rsp + 0xd0]
call fcn.1401ef41c
xor r12d, r12d
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1401f08b0
mov eax, r12d
add rsp, 0x168
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x130]
call fcn.140180820
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r14, [rsp + 0x100]
mov qword [r14 + 0x20], rax
movaps xmm0, xmmword [0x1402825c0]
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov rcx, rbx
mov rdx, r14
mov r8b, 1
call fcn.1401801d0
movsx rax, byte [rdi + 0x17]
test rax, rax
jns 0x140181386
mov rax, qword [rdi + 8]
test rax, rax
je 0x140181518
movabs r15, 0x7fffffffffffffff
movsx rax, byte [rsp + 0x117]
test rax, rax
jns 0x14018170a
mov rdx, qword [rsp + 0x110]
and rdx, r15
dec rdx
mov rax, qword [rsp + 0x108]
cmp rdx, rax
je 0x140181717
mov r14, qword [rsp + 0x100]
lea rcx, [r14 + rax*2]
lea rdx, [r14 + rax*2]
add rdx, 2
lea r8, [0x14029d5ee]
cmp rcx, r8
seta r9b
cmp rdx, r8
setbe dl
or dl, r9b
je 0x140181ad7
mov word [rcx], 0x5c
lea rcx, [rax + 1]
cmp byte [rsp + 0x117], 0
jns 0x140181765
mov qword [rsp + 0x108], rcx
mov word [r14 + rax*2 + 2], 0
movsx r14, byte [rdi + 0x17]
test r14, r14
jns 0x140181433
mov r14, qword [rdi + 8]
mov rdi, qword [rdi]
test r14, r14
sete al
test rdi, rdi
setne cl
or cl, al
je 0x140181ad7
movsx rax, byte [rsp + 0x117]
mov edx, 0xa
mov rbx, rax
test rax, rax
jns 0x140181473
and r15, qword [rsp + 0x110]
dec r15
mov rbx, qword [rsp + 0x108]
mov rdx, r15
mov rcx, rdx
sub rcx, rbx
cmp rcx, r14
jb 0x140181495
test r14, r14
je 0x140181518
test al, al
js 0x1401814c6
lea rsi, [rsp + 0x100]
jmp 0x1401814ce
lea r8, [rbx + r14]
sub r8, rdx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x100]
mov r9, rbx
call fcn.14004d230
jmp 0x140181518
mov rsi, qword [rsp + 0x100]
test r14, r14
js 0x140181ad7
lea rcx, [rsi + rbx*2]
cmp rcx, rdi
ja 0x1401814ed
lea rax, [rcx + r14*2]
cmp rax, rdi
ja 0x140181ad7
lea r8, [r14 + r14]
mov rdx, rdi
call fcn.1402357f0
add rbx, r14
cmp byte [rsp + 0x117], 0
jns 0x140181755
mov qword [rsp + 0x108], rbx
mov word [rsi + rbx*2], 0
xorps xmm0, xmm0
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xd0], xmm0
xor eax, eax
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xc0], rax
movaps xmmword [rsp + 0xb0], xmm0
movaps xmmword [rsp + 0xa0], xmm0
lea rdx, str.Registry_value___s__is_not_text__but_of_type__s_
lea rcx, [rsp + 0x78]
call fcn.1400343a0
call fcn.140113640
test rax, rax
je 0x14018158a
lea rdx, [rsp + 0x78]
lea r8, [rsp + 0xa0]
lea r9, [rsp + 0xd0]
mov rcx, rax
call fcn.1401137c0
test rax, rax
jne 0x140181594
lea rcx, [rsp + 0x78]
call fcn.140113740
call fcn.1400ab720
mov rdi, rax
call fcn.1400ab720
mov rbx, rax
call fcn.1400ab720
mov r14, rax
mov rcx, qword [rsp + 0x118]
call fcn.140071eb0
cmp byte [rsp + 0x117], 0
jns 0x1401815d0
mov rcx, qword [rsp + 0x100]
call fcn.1401ef41c
mov rcx, qword [rsp + 0x148]
call fcn.140071eb0
cmp byte [rsp + 0x147], 0
jns 0x1401815f4
mov rcx, qword [rsp + 0x130]
call fcn.1401ef41c
call fcn.1400ab720
cmp r14, rax
je 0x14018162c
dec word [r14 + 0x10]
setne al
test r14, r14
sete cl
or cl, al
jne 0x140181627
cmp byte [r14 + 0x12], 1
jne 0x14018161f
mov rcx, qword [r14]
call fcn.140071eb0
mov rcx, r14
call fcn.1401ef41c
call fcn.1400ab720
call fcn.1400ab720
cmp rbx, rax
je 0x140181662
dec word [rbx + 0x10]
setne al
test rbx, rbx
sete cl
or cl, al
jne 0x14018165d
cmp byte [rbx + 0x12], 1
jne 0x140181655
mov rcx, qword [rbx]
call fcn.140071eb0
mov rcx, rbx
call fcn.1401ef41c
call fcn.1400ab720
call fcn.1400ab720
cmp rdi, rax
je 0x140181698
dec word [rdi + 0x10]
setne al
test rdi, rdi
sete cl
or cl, al
jne 0x140181693
cmp byte [rdi + 0x12], 1
jne 0x14018168b
mov rcx, qword [rdi]
call fcn.140071eb0
mov rcx, rdi
call fcn.1401ef41c
call fcn.1400ab720
mov rcx, qword [rsp + 0x90]
call fcn.140071eb0
cmp byte [rsp + 0x8f], 0
jns 0x1401816b9
mov rcx, qword [rsp + 0x78]
call fcn.1401ef41c
mov rcx, qword [rsp + 0xb8]
call fcn.140071eb0
cmp byte [rsp + 0xb7], 0
jns 0x1401816dd
mov rcx, qword [rsp + 0xa0]
call fcn.1401ef41c
mov rcx, qword [rsp + 0xe8]
call fcn.140071eb0
cmp byte [rsp + 0xe7], 0
jns 0x140181310
mov rcx, qword [rsp + 0xd0]
call fcn.1401ef41c
jmp 0x140181310
cmp al, 0xa
jne 0x1401813d2
mov edx, 0xa
lea rax, [0x14029d5ee]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0x100]
mov r8d, 1
mov r9, rdx
call fcn.14004d230
jmp 0x140181422
mov eax, ebx
and al, 0x7f
mov byte [rsp + 0x117], al
jmp 0x140181512
and cl, 0x7f
mov byte [rsp + 0x117], cl
jmp 0x14018141a
mov dword [rsp + 0x4c], r12d
mov esi, r15d
shr esi, 1
movaps xmm0, xmmword [0x1402825c0]
lea r12, [rsp + 0xd0]
movaps xmmword [r12 + 0x10], xmm0
movaps xmmword [r12], xmm0
mov rcx, r12
mov rdx, r14
mov r8, rsi
call fcn.140082670
mov qword [r12 + 0x10], 0
mov byte [r12 + 0x18], 0
mov rax, qword [r12 + 8]
mov rax, qword [rax]
movsx rcx, byte [rdi + 0x17]
mov rdx, rdi
test rcx, rcx
jns 0x1401817d1
mov rcx, qword [rdi + 8]
mov rdx, qword [rdi]
test rcx, rcx
cmove rdx, rcx
mov rcx, qword [rbx]
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x15c]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [rbx + 0x40], eax
mov rax, qword [rsp + 0xd8]
mov rcx, qword [rax]
and r15d, 0xfffffffe
cmp word [rcx + r15 - 2], 1
mov r12, qword [rsp + 0xd0]
sbb esi, 0
mov qword [rsp + 0xe0], rsi
mov byte [rsp + 0xe8], 1
mov r13, qword [rax]
mov r15, qword [0x1402e6408]
test r13, r13
je 0x140181849
cmp r15, rsi
jne 0x140181849
mov rcx, r13
call fcn.14021cf84
mov rsi, rax
cmp r15, rsi
jne 0x140181894
cmp qword [0x14031f9c0], 0
je 0x140181894
lea rax, str.must_have_real_length
mov qword [rsp + 0x20], rax
lea rcx, str.....update_notifier_thirdpartywxWidgetsincludewx_string.h
lea r8, str.wxString::SubstrBufFromType_const_wchar_t__::SubstrBufFromType
lea r9, str.len___npos
mov edx, 0x159
call fcn.1400d9180
cmp byte [0x140331ad8], 1
jne 0x140181894
mov byte [0x140331ad8], 0
int3
test r13, r13
jne 0x1401818a2
test rsi, rsi
jne 0x140181ad7
mov rcx, r12
mov rdx, r13
mov r8, rsi
call fcn.14004d650
cmp byte [rsp + 0xe8], 0
jne 0x140181900
cmp qword [0x14031f9c0], 0
je 0x140181900
lea rax, str.forgot_to_call_SetLength__
mov qword [rsp + 0x20], rax
lea rcx, str.....update_notifier_thirdpartywxWidgetsincludewx_string.h
lea r8, str.wxStringTypeBufferLengthBase_wchar_t_::wxStringTypeBufferLengthBase
lea r9, str.this__m_lenSet
mov edx, 0xf61
call fcn.1400d9180
cmp byte [0x140331ad8], 1
jne 0x140181900
mov byte [0x140331ad8], 0
int3
mov rsi, qword [rsp + 0xd8]
call fcn.1400ab720
cmp rsi, rax
mov r12d, dword [rsp + 0x4c]
je 0x14018194d
mov r15, qword [rsp + 0xd8]
dec word [r15 + 0x10]
setne al
test r15, r15
sete cl
or cl, al
jne 0x140181948
cmp byte [r15 + 0x12], 1
jne 0x140181940
mov rcx, qword [r15]
call fcn.140071eb0
mov rcx, r15
call fcn.1401ef41c
call fcn.1400ab720
cmp dword [rsp + 0x15c], 2
setne al
or al, bpl
jne 0x1401810c7
cmp byte [r14 + 0x17], 0
mov rcx, r14
jns 0x14018196e
mov rcx, qword [r14]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x1401810c7
mov ebp, eax
xorps xmm0, xmm0
lea r15, [rsp + 0xd0]
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
mov qword [r15 + 0x20], 0
mov r8d, eax
lea r12, [rsp + 0xa0]
mov rcx, r12
mov rdx, r15
call fcn.140082670
mov rax, qword [r12 + 8]
mov rdx, qword [rax]
cmp byte [r14 + 0x17], 0
mov rcx, r14
jns 0x1401819ca
mov rcx, qword [r14]
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, qword [rsp + 0xa0]
mov rax, qword [rsp + 0xa8]
mov rax, qword [rax]
test rax, rax
lea rdx, [0x14029d4fc]
cmovne rdx, rax
call fcn.14004d7f0
mov rsi, qword [rsp + 0xa8]
call fcn.1400ab720
cmp rsi, rax
je 0x140181a44
mov r12, qword [rsp + 0xa8]
dec word [r12 + 0x10]
setne al
test r12, r12
sete cl
or cl, al
jne 0x140181a3f
cmp byte [r12 + 0x12], 1
jne 0x140181a37
mov rcx, qword [r12]
call fcn.140071eb0
mov rcx, r12
call fcn.1401ef41c
call fcn.1400ab720
cmp r15, r14
mov r12d, dword [rsp + 0x4c]
je 0x140181a7b
cmp byte [r14 + 0x17], 0
movzx r8d, byte [rsp + 0xe7]
js 0x140181ad9
test r8b, r8b
jns 0x140181aa8
mov rdx, qword [rsp + 0xd0]
mov r8, qword [rsp + 0xd8]
mov rcx, r14
call fcn.14004da20
mov rcx, qword [rsp + 0xe8]
call fcn.140071eb0
cmp byte [rsp + 0xe7], 0
jns 0x1401810c7
mov rcx, qword [rsp + 0xd0]
call fcn.1401ef41c
jmp 0x1401810c7
mov rax, qword [rsp + 0xe0]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [rsp + 0xd0]
movups xmmword [r14], xmm0
jmp 0x140181a7b
mov rax, qword [r14]
mov word [rax], 0
mov qword [r14 + 8], 0
jmp 0x1401810c7
ud2
test r8b, r8b
cmovs r8, qword [rsp + 0xd8]
cmovs r15, qword [rsp + 0xd0]
mov rcx, r14
mov rdx, r15
call fcn.14004d8c0
jmp 0x140181a7b