Function at 0x10000a6cc
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor r13d, r13d
mov rbp, rdx
lea rax, [r11 - 0x38]
mov esi, 0x20019
lea rdx, str.SOFTWAREMicrosoftAssistanceClient1.0LocalReg
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov r9d, esi
mov qword [r11 - 0x68], rax
mov rdi, r13
mov qword [r11 - 0x38], r13
mov qword [r11 - 0x50], r13
mov qword [r11 - 0x30], r13
mov qword [r11 - 0x48], r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r12, qword [rsp + 0xb8]
mov r14d, 0x8007000e
cmp eax, r13d
jne 0x1000220a7
mov rcx, qword [rsp + 0x50]
cmp rcx, r13
je 0x1000220a7
lea rax, [rsp + 0x38]
lea rdx, str.CLSID
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r13d
jne 0x10002209d
cmp qword [rsp + 0x38], r13
je 0x10002209d
lea rdx, [rsp + 0x48]
mov rcx, rbp
mov qword [rsp + 0x48], r13
call qword [sym.imp.ole32.dll_StringFromCLSID]
mov ebx, eax
cmp eax, r13d
jne 0x10000a945
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x58]
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp ebx, r13d
jne 0x10002209d
mov rcx, qword [rsp + 0x58]
cmp rcx, r13
je 0x10002209d
lea rax, [rsp + 0x40]
lea rdx, str.InprocServer32
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r13d
jne 0x10002209d
mov rcx, qword [rsp + 0x40]
cmp rcx, r13
je 0x10002209d
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x34], r13d
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x30], r13d
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
cmp eax, r13d
jne 0x1000220a7
mov esi, dword [rsp + 0x30]
lea ebx, [r13 + 2]
lea r15, [r13 - 1]
shr rsi, 1
mov rax, rbx
mul rsi
cmovo rax, r15
mov rcx, rax
call fcn.1000080f0
mov rdi, rax
cmp rax, r13
je 0x10002205a
mov word [rax], r13w
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
cmp eax, r13d
jne 0x1000220a7
mov eax, dword [rsp + 0x34]
sub eax, 1
je 0x10000a906
cmp eax, 1
jne 0x100022062
lea rcx, [rsi + 0x104]
mov rax, rbx
mul rcx
cmovo rax, r15
mov rcx, rax
call fcn.1000080f0
mov rbx, rax
cmp rax, r13
je 0x10002205a
lea r8d, [rsi + 0x104]
mov rdx, rax
mov rcx, rdi
mov word [rax], r13w
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, r13d
je 0x100022084
mov rcx, rdi
call sub.msvcrt.dll_free
mov rdi, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp rax, r13
je 0x100022084
lea rdx, str.DllGetClassObject
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
cmp rax, r13
je 0x100022084
lea rdx, [0x10006a868]
mov r8, r12
mov rcx, rbp
call rax
jmp 0x10000a941
mov ebx, eax
jmp 0x10000a945
mov rcx, qword [rsp + 0x50]
cmp rcx, r13
je 0x10000a955
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
cmp rcx, r13
je 0x10000a965
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
cmp rcx, r13
je 0x10000a975
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
cmp rcx, r13
je 0x10000a985
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp rdi, r13
je 0x10000a992
mov rcx, rdi
call sub.msvcrt.dll_free
cmp ebx, r14d
je 0x1000220b1
cmp ebx, r13d
jl 0x1000220b9
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ebx, r14d
jmp 0x10000a945
xor r8d, r8d
lea r9, [0x10006a868]
mov rcx, rbp
lea edx, [r8 + 1]
mov qword [rsp + 0x20], r12
call qword [sym.imp.ole32.dll_CoGetClassObject]
nop
jmp 0x10000a941
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r13d
cmovle ebx, eax
jmp 0x10000a945
mov ebx, 0x80040154
jmp 0x10000a945
mov ebx, 0x80040150
jmp 0x10000a945
mov eax, r14d
jmp 0x10000a9a6
xor r8d, r8d
lea r9, [0x10006a868]
mov rcx, rbp
lea edx, [r8 + 1]
mov qword [rsp + 0x20], r12
call qword [sym.imp.ole32.dll_CoGetClassObject]
cmp eax, r13d
jge 0x1000220e3
cmp eax, r14d
jne 0x10000a9a4
mov ebx, eax
jmp 0x10000a9a4