Function at 0x1400ae3a0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x6b0
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov qword [rsp + 0x6e0], rbx
mov rdi, rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
or r13, 0xffffffffffffffff
mov r9d, r13d
mov r8d, 0xfde9
lea rcx, [rsp + 0x40]
call fcn.14007bc10
nop
lea rax, [rsp + 0x6f0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x6f8]
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x1400ae47a
mov byte [rsp + 0xa0], r12b
mov r9d, r13d
lea r8, str.get_registry_value_length
mov edx, 0x100
lea rcx, [rsp + 0xa0]
call fcn.14007b3b0
mov edx, ebx
lea rcx, [rsp + 0xa0]
call fcn.14007f910
lea rcx, [rsp + 0x1a4]
lea rdx, [rsp + 0xa0]
mov r8d, 0x104
call fcn.14011e9b0
lea rdx, [0x14020b6e8]
lea rcx, [rsp + 0x1a4]
call fcn.14011f050
int3
movsxd rbx, dword [rsp + 0x6f0]
test ebx, ebx
je 0x1400ae493
mov rcx, rbx
call fcn.14011f040
mov rsi, rax
jmp 0x1400ae496
mov rsi, r12
mov dword [rsp + 0x80], ebx
xor ecx, ecx
call fcn.14011e0c0
mov qword [rsp + 0x88], rsi
lea rax, [rsp + 0x6f0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x6f8]
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
je 0x1400ae540
mov byte [rsp + 0xa0], 0
mov r9d, r13d
lea r8, str.get_registry_value
mov edx, 0x100
lea rcx, [rsp + 0xa0]
call fcn.14007b3b0
mov edx, edi
lea rcx, [rsp + 0xa0]
call fcn.14007f910
lea rcx, [rsp + 0x1a4]
lea rdx, [rsp + 0xa0]
mov r8d, 0x104
call fcn.14011e9b0
lea rdx, [0x14020b6e8]
lea rcx, [rsp + 0x1a4]
call fcn.14011f050
int3
mov eax, dword [rsp + 0x6f8]
sub eax, 1
je 0x1400ae80e
sub eax, 1
je 0x1400ae641
sub eax, 1
je 0x1400ae60b
cmp eax, 1
je 0x1400ae5bb
mov byte [rsp + 0x2a8], 0
mov r9d, r13d
lea r8, str.unsupported_registry_type
mov edx, 0x100
lea rcx, [rsp + 0x2a8]
call fcn.14007b3b0
lea rcx, [rsp + 0x4a8]
lea rdx, [rsp + 0x2a8]
mov r8d, 0x100
call fcn.14011e9b0
lea rdx, [0x14020b7d0]
lea rcx, [rsp + 0x4a8]
call fcn.14011f050
int3
mov qword [rsp + 0x60], r12
mov dword [rsp + 0x68], r12d
mov r8d, dword [rsi]
lea rdx, [0x140197c8c]
lea rcx, [rsp + 0x60]
call fcn.14007aa50
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x60], r12
mov dword [rsp + 0x68], r12d
xor ecx, ecx
call fcn.14011e950
nop
mov rcx, rsi
call fcn.14011e0c0
nop
mov rcx, qword [rsp + 0x40]
call fcn.14011e0c0
mov rax, rbx
jmp 0x1400ae8b2
movaps xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.140089d90
mov rbx, rax
mov rcx, rsi
call fcn.14011e0c0
nop
mov rcx, qword [rsp + 0x40]
call fcn.14011e0c0
mov rax, rbx
jmp 0x1400ae8b2
test ebx, ebx
je 0x1400ae7e1
movaps xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.1400add50
mov rbx, rax
mov qword [rsp + 0x90], rax
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
movsxd rdi, eax
test eax, eax
jne 0x1400ae6ec
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov byte [rsp + 0x1a4], 0
mov r9d, r13d
lea r8, str.ExpandEnvironmentStrings
mov edx, 0x100
lea rcx, [rsp + 0x1a4]
call fcn.14007b3b0
mov edx, ebx
lea rcx, [rsp + 0x1a4]
call fcn.14007f910
lea rcx, [rsp + 0x5a8]
lea rdx, [rsp + 0x1a4]
mov r8d, 0x104
call fcn.14011e9b0
lea rdx, [0x14020b6e8]
lea rcx, [rsp + 0x5a8]
call fcn.14011f050
int3
mov eax, 2
mul rdi
cmovo rax, r13
mov rcx, rax
call fcn.14011f040
mov rbp, rax
xor ecx, ecx
call fcn.14011e0c0
mov qword [rsp + 0x50], rbp
mov r8d, edi
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x6f0], eax
cmp edi, eax
jae 0x1400ae77d
mov byte [rsp + 0x3a8], 0
mov r9d, r13d
lea r8, str.unable_to_expand_environment_strings
mov edx, 0x100
lea rcx, [rsp + 0x3a8]
call fcn.14007b3b0
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x3a8]
mov r8d, 0x100
call fcn.14011e9b0
lea rdx, [0x14020b7d0]
lea rcx, [rsp + 0xa0]
call fcn.14011f050
int3
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
mov r9d, r13d
mov r8d, 0xfde9
mov rdx, rbp
lea rcx, [rsp + 0x78]
call fcn.14007ba40
mov rdi, qword [rsp + 0x78]
mov qword [rsp + 0x78], r12
xor ecx, ecx
call fcn.14011e0c0
nop
mov rcx, rbp
call fcn.14011e0c0
nop
mov rcx, rbx
call fcn.14011e0c0
nop
mov rcx, rsi
call fcn.14011e0c0
nop
mov rcx, qword [rsp + 0x40]
call fcn.14011e0c0
mov rax, rdi
jmp 0x1400ae8b2
mov edx, r13d
lea rcx, [0x14018fa3b]
call fcn.14007b6e0
mov rbx, rax
mov rcx, rsi
call fcn.14011e0c0
nop
mov rcx, qword [rsp + 0x40]
call fcn.14011e0c0
mov rax, rbx
jmp 0x1400ae8b2
test ebx, ebx
je 0x1400ae88a
movaps xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.1400add50
mov rbx, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
mov r9d, r13d
mov r8d, 0xfde9
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.14007ba40
mov rdi, qword [rsp + 0x70]
mov qword [rsp + 0x70], r12
xor ecx, ecx
call fcn.14011e0c0
nop
mov rcx, rbx
call fcn.14011e0c0
nop
mov rcx, rsi
call fcn.14011e0c0
nop
mov rcx, qword [rsp + 0x40]
call fcn.14011e0c0
mov rax, rdi
jmp 0x1400ae8b2
mov edx, r13d
lea rcx, [0x14018fa3b]
call fcn.14007b6e0
mov rbx, rax
mov rcx, rsi
call fcn.14011e0c0
nop
mov rcx, qword [rsp + 0x40]
call fcn.14011e0c0
mov rax, rbx
mov rbx, qword [rsp + 0x6e0]
add rsp, 0x6b0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret