Function at 0x140001860
Capabilities:
Delete file
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
push rsi
push rdi
sub rsp, 0x4a8
mov rax, qword [0x7ffe0020]
mov rcx, qword [0x7ffe0014]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
xor edx, edx
mov rax, qword [rsp + 0x60]
mov ecx, 0x2710
div rcx
mov qword [rsp + 0x68], rax
xor edx, edx
mov rax, qword [rsp + 0x68]
mov ecx, 0x3e8
div rcx
mov qword [rsp + 0x50], rax
xor edx, edx
mov rax, qword [rsp + 0x50]
mov ecx, 0x3c
div rcx
mov qword [rsp + 0x58], rax
xor edx, edx
mov rax, qword [rsp + 0x58]
mov ecx, 0x3c
div rcx
mov qword [rsp + 0x78], rax
lea rcx, str.Working..._n
call fcn.140001380
call fcn.140001410
mov ecx, dword [0x7ffe0014]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov qword [rsp + 0x30], 0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftCryptography
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400019f9
lea rax, [rsp + 0x2a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x1fe
rep stosb byte [rdi], al
mov dword [rsp + 0x38], 0x1fe
lea rdx, [0x1400034d0]
mov rcx, qword [rsp + 0x30]
call fcn.140001260
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x2a0]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400019eb
lea rcx, [rsp + 0x2a0]
call fcn.140001700
nop
lea rdx, str.MachineGuid
mov rcx, qword [rsp + 0x30]
call fcn.140001260
mov ecx, dword [rsp + 0x38]
mov dword [rsp + 0x28], ecx
lea rcx, [rsp + 0x2a0]
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x1400019eb
lea rdx, [rsp + 0x2a0]
lea rcx, str.___MachineGuid____S__n
call fcn.140001380
nop
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
jmp 0x140001a06
lea rcx, str.____MachineGuid__Failed__n
call fcn.140001380
nop
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x2001f
xor r8d, r8d
lea rdx, str.SOFTWARESmartly_Dressed_GamesUnturned
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140001b66
lea rax, [rsp + 0x90]
mov rdi, rax
xor eax, eax
mov ecx, 0xff
rep stosb byte [rdi], al
mov dword [rsp + 0x3c], 0xff
lea rdx, [0x140003590]
mov rcx, qword [rsp + 0x30]
call fcn.140001260
lea rcx, [rsp + 0x3c]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140001b5a
lea rcx, [rsp + 0x90]
call fcn.1400015c0
lea rdx, [rsp + 0x90]
lea rcx, str.___CloudStorage___s__n
call fcn.140001380
lea rcx, [rsp + 0x90]
call fcn.140001c90
movzx eax, al
mov dword [rsp + 0x40], eax
lea rdx, str.CloudStorage
mov rcx, qword [rsp + 0x30]
call fcn.140001260
mov ecx, dword [rsp + 0x3c]
mov dword [rsp + 0x28], ecx
lea rcx, [rsp + 0x90]
mov qword [rsp + 0x20], rcx
mov r9d, 3
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140001b5a
lea rdx, str.unity.player_session_restoreflags
mov rcx, qword [rsp + 0x30]
call fcn.140001260
mov dword [rsp + 0x28], 4
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov r9d, 4
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x140001b5a
mov edx, dword [rsp + 0x40]
lea rcx, str.___restoreflags_____i__n
call fcn.140001380
nop
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rax, [rsp + 0x190]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea rcx, str.___Savedata________Modified__n
call fcn.140001380
nop
mov r8d, 0x104
lea rdx, [rsp + 0x190]
lea rcx, str.ProgramFiles_x86_
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jbe 0x140001bfe
lea rax, [rsp + 0x190]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x48], 0xffffffffffffffff
inc qword [rsp + 0x48]
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x48]
cmp byte [rax + rcx], 0
jne 0x140001bbc
mov rax, qword [rsp + 0x48]
lea rcx, str.Steam_steamappscommonUnturnedCloudConvenientSavedata.json
lea rdi, [rsp + rax + 0x190]
mov rsi, rcx
mov ecx, 0x3f
rep movsb byte [rdi], byte [rsi]
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
xor edx, edx
mov rax, qword [rsp + 0x50]
mov ecx, 0x3c
div rcx
mov rax, rdx
mov qword [rsp + 0x80], rax
xor edx, edx
mov rax, qword [rsp + 0x58]
mov ecx, 0x3c
div rcx
mov rax, rdx
mov qword [rsp + 0x88], rax
xor edx, edx
mov rax, qword [rsp + 0x78]
mov ecx, 0x3c
div rcx
mov rax, rdx
xor edx, edx
mov ecx, 0xc
div rcx
mov rax, rdx
mov rcx, qword [rsp + 0x80]
mov r9, rcx
mov rcx, qword [rsp + 0x88]
mov r8, rcx
mov rdx, rax
lea rcx, str.__02i:_02i:_02i__Change_Steam64ID__IP_Address._n
call fcn.140001380
nop
add rsp, 0x4a8
pop rdi
pop rsi
ret