Function at 0x140246c50
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
jmp 0x140246c50
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x658
lea rbp, [rsp + 0x30]
mov r13, r8
mov rax, rsp
mov r15, r9
mov r12, qword [rbp + 0x698]
mov rbx, rdx
mov r14, rcx
mov rcx, r13
mov rdx, r12
lea r8, [0x1404fccbc]
mov r9d, 1
lea rdi, [0x140000000]
mov qword [rax + 0x20], 0
call fcn.1400025f4
mov edx, 0x12c
lea rcx, [rbp + 0x4f0]
mov r8, r14
mov r9, r15
mov dword [rbp + 0x12c], 0
mov qword [rbp + 0x620], 0
call fcn.1400042eb
mov rax, qword [rbp + 0x610]
mov esi, dword [rbp + 0x618]
mov qword [0x140686b20], rax
mov eax, 0x120
mov dword [0x140686b28], esi
movups xmm0, xmmword [rbp + rax + 0x4e0]
movups xmm1, xmmword [rbp + rax + 0x4d0]
movups xmm2, xmmword [rbp + rax + 0x4c0]
movups xmm3, xmmword [rbp + rax + 0x4b0]
movups xmm4, xmmword [rbp + rax + 0x4a0]
movups xmm5, xmmword [rbp + rax + 0x490]
movups xmmword [rdi + rax + 0x6869f0], xmm0
movups xmmword [rdi + rax + 0x6869e0], xmm1
movups xmmword [rdi + rax + 0x6869d0], xmm2
movups xmmword [rdi + rax + 0x6869c0], xmm3
movups xmmword [rdi + rax + 0x6869b0], xmm4
movups xmmword [rdi + rax + 0x6869a0], xmm5
sub rax, 0x60
jne 0x140246cf0
mov rax, rsp
mov rcx, 0xffffffff80000002
lea rdx, [0x140686a00]
xor r8d, r8d
mov r9d, 0x20019
lea rsi, [rbp + 0x620]
mov qword [rax + 0x20], rsi
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
je 0x140246e51
mov edx, 0x12c
lea rcx, [rbp + 0x3c0]
mov r8, r14
mov r9, r15
call fcn.1400042eb
mov rax, qword [rbp + 0x4e0]
mov r10d, dword [rbp + 0x4e8]
mov qword [0x140686b20], rax
mov eax, 0x120
mov dword [0x140686b28], r10d
movups xmm0, xmmword [rbp + rax + 0x3b0]
movups xmm1, xmmword [rbp + rax + 0x3a0]
movups xmm2, xmmword [rbp + rax + 0x390]
movups xmm3, xmmword [rbp + rax + 0x380]
movups xmm4, xmmword [rbp + rax + 0x370]
movups xmm5, xmmword [rbp + rax + 0x360]
movups xmmword [rdi + rax + 0x6869f0], xmm0
movups xmmword [rdi + rax + 0x6869e0], xmm1
movups xmmword [rdi + rax + 0x6869d0], xmm2
movups xmmword [rdi + rax + 0x6869c0], xmm3
movups xmmword [rdi + rax + 0x6869b0], xmm4
movups xmmword [rdi + rax + 0x6869a0], xmm5
sub rax, 0x60
jne 0x140246dc0
mov rax, rsp
mov rcx, 0xffffffff80000001
lea rdx, [0x140686a00]
xor r8d, r8d
mov r9d, 0x20019
mov qword [rax + 0x20], rsi
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x140247139
mov rsi, qword [rbp + 0x690]
mov rcx, rbx
mov edx, esi
mov edi, r12d
mov dword [rbp + 0x12c], edi
call fcn.14000425a
test eax, eax
jne 0x140246e9a
mov rbx, rsp
xor edx, edx
xor r8d, r8d
xor r9d, r9d
mov rcx, qword [rbp + 0x620]
lea rax, [rbp + 0x12c]
mov qword [rbx + 0x20], r13
mov qword [rbx + 0x28], rax
call sub.ADVAPI32.dll_RegQueryValueExA
jmp 0x140246f85
mov edx, 0x12c
lea rcx, [rbp + 0x290]
mov r8, rbx
mov r9, rsi
call fcn.1400042eb
mov eax, 0x12c
mov rax, 0x130
sub rsp, rax
lea rax, [rsp + 0x30]
mov r11, rax
mov rax, qword [rbp + 0x3b0]
mov qword [r11 + 0x120], rax
mov eax, 0x120
mov r10d, dword [rbp + 0x3b8]
mov dword [r11 + 0x128], r10d
movups xmm0, xmmword [rbp + rax + 0x280]
movups xmmword [r11 + rax - 0x10], xmm0
movups xmm1, xmmword [rbp + rax + 0x270]
movups xmmword [r11 + rax - 0x20], xmm1
movups xmm2, xmmword [rbp + rax + 0x260]
movups xmmword [r11 + rax - 0x30], xmm2
movups xmm3, xmmword [rbp + rax + 0x250]
movups xmmword [r11 + rax - 0x40], xmm3
movups xmm4, xmmword [rbp + rax + 0x240]
movups xmmword [r11 + rax - 0x50], xmm4
movups xmm5, xmmword [rbp + rax + 0x230]
movups xmmword [r11 + rax - 0x60], xmm5
sub rax, 0x60
jne 0x140246ee9
mov edx, 0x12c
lea rcx, [rbp + 0x130]
mov r8, rbx
mov r9, rsi
call fcn.1400042eb
mov rbx, rsp
xor r8d, r8d
xor r9d, r9d
lea rdx, [rbp + 0x130]
mov rcx, qword [rbp + 0x620]
lea rax, [rbp + 0x12c]
mov qword [rbx + 0x20], r13
mov qword [rbx + 0x28], rax
call sub.ADVAPI32.dll_RegQueryValueExA
mov rcx, qword [rbp + 0x620]
call sub.ADVAPI32.dll_RegCloseKey
mov ebx, dword [rbp + 0x12c]
mov edx, ebx
sar edx, 0x1f
mov rax, rsp
not edx
lea r8, [0x1404fccc0]
and edx, ebx
xor ebx, ebx
movsxd rdx, edx
mov r9d, 1
mov qword [rax + 0x20], rbx
lea rcx, [r13 + rdx]
neg rdx
add rdx, r12
test rdx, rdx
cmovle rdx, rbx
call fcn.1400025f4
movsxd rax, dword [rbp + 0x12c]
test rax, rax
jle 0x140246fea
cmp byte [rax + r13 - 1], 0
jne 0x140246fea
mov byte [rax + r13 - 1], 0x20
mov rax, rsp
mov rcx, r13
mov edx, edi
lea r8, [0x1404fccc4]
mov r9d, 1
mov dword [rax + 0x20], 0
call fcn.140006019
mov r15d, eax
test r15d, r15d
jle 0x14024712e
movsxd rsi, r15d
mov rdx, r12
sub rdx, rsi
mov rax, rsp
test rdx, rdx
lea r8, [0x1404fccc8]
cmovle rdx, rbx
mov r9d, 1
lea rdi, [r13 + rsi]
mov rcx, rdi
mov dword [rax + 0x20], 0
call fcn.140006019
mov r14d, eax
add r14d, r15d
cmp r14d, r15d
jle 0x14024712e
mov rax, rsp
lea rcx, [0x140686b40]
mov edx, 0x200
lea r8, [0x1404fcccc]
mov r9d, 1
mov qword [rax + 0x20], 0
call fcn.1400025f4
movsxd r14, r14d
lea rcx, [rbp]
mov edx, 0x12c
mov r8, rdi
lea r9, [r14 - 1]
sub r9, rsi
cmovle r9, rbx
call fcn.1400042eb
lea rcx, [0x140686a00]
lea rdx, [rbp]
mov r8d, 0x12c
call fcn.1400066b3
lea rcx, [0x140686a00]
lea rdx, [0x140686b40]
mov r8d, 0x200
call sub.KERNEL32.dll_GetEnvironmentVariableA
mov edi, eax
test edi, edi
jle 0x14024712e
dec rsi
lea rcx, [rbp + 0x260]
movsxd rdi, edi
cmovle rsi, rbx
mov edx, 3
test rdi, rdi
mov qword [rcx + 8], rsi
lea rsi, [r14 + r13]
cmovle rdi, rbx
neg r14
add r14, r12
mov r8, r13
test r14, r14
mov r9, r12
lea rax, [0x140686b40]
cmovg rbx, r14
mov qword [rcx], r13
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x20], rsi
mov qword [rcx + 0x28], rbx
call fcn.1400048cc
mov rcx, r13
mov rdx, r12
call fcn.1400046f1
lea rsp, [rbp + 0x628]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret