Function at 0x14006afd0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x570
mov rsi, rcx
xor r13d, r13d
mov ecx, 0x208
mov r12d, r8d
mov rbx, rdx
mov edi, r13d
call fcn.14011e9a4
mov r14, rax
test rax, rax
jne 0x14006b02b
test byte [0x1402d741c], 4
je 0x14006b024
lea r8, str.No_enough_memory_n
lea edx, [rax + 3]
lea rcx, str.CPopupMenu::AppendRegistryExecutables
call fcn.14011a490
xor eax, eax
jmp 0x14006b38a
mov qword [rsp + 0x5a8], r15
lea r15, [rbx + 8]
mov rcx, r15
call fcn.14011b8d0
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x5b8]
lea rdx, [rsp + 0x360]
mov r8d, 0x104
mov rcx, r15
mov qword [rsp + 0x20], rax
call fcn.14011ae70
test eax, eax
je 0x14006b378
mov qword [rsp + 0x5a0], rbp
mov ecx, dword [rsp + 0x5b8]
lea eax, [rcx - 1]
cmp eax, 1
ja 0x14006b303
cmp word [rsp + 0x50], r13w
je 0x14006b303
cmp ecx, 2
jne 0x14006b0f1
lea rcx, [rsp + 0x50]
mov r8d, 0x104
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rsp + 0x50]
mov rax, r14
sub rdx, r14
nop word [rax + rax]
movzx ecx, word [rax]
lea rax, [rax + 2]
mov word [rdx + rax - 2], cx
test cx, cx
jne 0x14006b0e0
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test byte [0x1402d741c], 4
mov rbp, rax
je 0x14006b129
lea r8, str.hi_d_n
lea rcx, str.CPopupMenu::AppendRegistryExecutables
mov r9, rax
mov edx, 3
call fcn.14011a490
test rbp, rbp
je 0x14006b207
lea r8, [rsp + 0x260]
mov r9d, 0x100
mov edx, r12d
mov rcx, rbp
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14006b207
test byte [0x1402d741c], 4
je 0x14006b17d
lea r9, [rsp + 0x260]
lea r8, str.szIntlName_s_n
lea rcx, str.CPopupMenu::AppendRegistryExecutables
mov edx, 3
call fcn.14011a590
cmp qword [rsi + 0x10], r13
jne 0x14006b19c
lea rdx, str.CPopupMenu.cpp
lea rcx, str.m_hMenu
mov r8d, 0x6e
call fcn.14000cb10
mov edi, dword [rsi + 8]
mov ecx, 0x18
lea eax, [rdi + 1]
mov dword [rsi + 8], eax
call fcn.14011f8a0
mov rbx, rax
test rax, rax
je 0x14006b2d8
lea rax, vtable.CStringedMenuItem.0
mov qword [rbx + 0x10], r13
lea rcx, [rsp + 0x50]
mov qword [rbx], rax
mov dword [rbx + 8], edi
call fcn.14011f90c
mov qword [rbx + 0x10], rax
test rax, rax
je 0x14006b2db
lea rcx, [rsi + 0x18]
mov r8, rbx
xor edx, edx
call fcn.14006bc80
test rax, rax
je 0x14006b2db
lea r9, [rsp + 0x260]
jmp 0x14006b2aa
test byte [0x1402d741c], 2
je 0x14006b231
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Error_getting_module_name_d_n
lea rcx, str.CPopupMenu::AppendRegistryExecutables
mov r9d, eax
mov edx, 2
call fcn.14011a490
cmp qword [rsi + 0x10], r13
jne 0x14006b250
lea rdx, str.CPopupMenu.cpp
lea rcx, str.m_hMenu
mov r8d, 0x6e
call fcn.14000cb10
mov edi, dword [rsi + 8]
mov ecx, 0x18
lea eax, [rdi + 1]
mov dword [rsi + 8], eax
call fcn.14011f8a0
mov rbx, rax
test rax, rax
je 0x14006b2d8
lea rax, vtable.CStringedMenuItem.0
mov qword [rbx + 0x10], r13
lea rcx, [rsp + 0x50]
mov qword [rbx], rax
mov dword [rbx + 8], edi
call fcn.14011f90c
mov qword [rbx + 0x10], rax
test rax, rax
je 0x14006b2db
lea rcx, [rsi + 0x18]
mov r8, rbx
xor edx, edx
call fcn.14006bc80
test rax, rax
je 0x14006b2db
lea r9, [rsp + 0x360]
mov rcx, qword [rsi + 0x10]
mov r8, rdi
xor edx, edx
call qword [sym.imp.USER32.dll_AppendMenuW]
test eax, eax
jne 0x14006b2f3
lea rdx, str.CPopupMenu.cpp
lea rcx, str.bSuccess
mov r8d, 0x8b
call fcn.14000cb10
jmp 0x14006b2f3
mov rbx, r13
dec dword [rsi + 8]
test rbx, rbx
je 0x14006b2f0
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov edi, r13d
test rbp, rbp
je 0x14006b324
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x14006b324
test byte [0x1402d741c], 4
je 0x14006b324
lea r8, str.Popup_config_key_contains_non_string_value_or_an_empty_string___n
lea rcx, str.CPopupMenu::AppendRegistryExecutables
mov edx, 3
call fcn.14011a490
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x360]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x5b8]
mov r8d, 0x104
mov rcx, r15
mov qword [rsp + 0x20], rax
call fcn.14011ae70
test eax, eax
jne 0x14006b093
mov rbp, qword [rsp + 0x5a0]
mov rcx, r14
call fcn.140120c5c
mov r15, qword [rsp + 0x5a8]
mov eax, edi
mov rbx, qword [rsp + 0x5b0]
add rsp, 0x570
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret