Function at 0x7ff74b0aa90
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe0
mov rax, qword [0x7ff74b58340]
xor rax, rsp
mov qword [rsp + 0xd0], rax
lea rax, [rsp + 0x30]
mov rsi, r8
lea r15, [0x7ff74b51108]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
xor r12d, r12d
mov qword [r8], r12
lea r9, [rsp + 0x34]
mov rdx, r15
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rbp, rcx
mov dword [rsp + 0x30], 0x80
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
lea r14, [0x7ff74b58350]
lea ebx, [r12 + 0xb]
mov r13d, 0xea
mov edi, eax
cmp eax, r12d
jne 0x7ff74b1c55e
mov eax, dword [rsp + 0x34]
cmp eax, 1
jne 0x7ff74b1c50f
mov ebx, dword [rsp + 0x30]
mov rcx, qword [0x7ff74b584e0]
xor edx, edx
add rbx, 2
mov word [rsp + 0xc0], r12w
mov r8, rbx
call qword [0x7ff74b58358]
mov qword [rsi], rax
cmp rax, r12
je 0x7ff74b1c5af
cmp edi, r13d
je 0x7ff74b1c5b9
mov r8d, dword [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov ecx, dword [rsp + 0x30]
mov rax, qword [rsi]
shr rcx, 1
mov word [rax + rcx*2], r12w
cmp dword [rsp + 0x34], 7
je 0x7ff74b0ac1b
mov rax, qword [rsi]
mov r8d, 0x22
cmp r8w, word [rax]
je 0x7ff74b1c62d
mov r8, qword [rsi]
mov rcx, r8
movzx eax, word [r8]
cmp ax, r12w
je 0x7ff74b1c7c4
mov ebp, 0x20
lea r13d, [rbp - 0x17]
cmp bp, ax
je 0x7ff74b1c656
cmp r13w, ax
je 0x7ff74b1c656
cmp word [rcx], r12w
je 0x7ff74b1c7c4
cmp r8, rcx
jb 0x7ff74b1c66c
mov rbx, qword [rsi]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
lea rax, [rbx + rcx*2]
cmp rax, rbx
je 0x7ff74b0ac0c
lea rcx, [rax - 2]
cmp bp, word [rcx]
je 0x7ff74b1c6c1
cmp r13w, word [rcx]
je 0x7ff74b1c6c1
mov word [rax], r12w
cmp dword [rsp + 0x34], 2
je 0x7ff74b1c6d2
mov eax, edi
jmp 0x7ff74b0ac1f
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.7ff74ae3090
mov rbx, qword [rsp + 0x128]
add rsp, 0xe0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
cmp eax, 7
je 0x7ff74b0ab23
cmp eax, 2
je 0x7ff74b0ab23
mov eax, dword [0x7ff74b582c8]
mov edi, ebx
cmp eax, r12d
je 0x7ff74b0ac1b
mov rcx, qword [0x7ff74b58350]
cmp rcx, r14
je 0x7ff74b1c574
test byte [rcx + 0x1c], 1
je 0x7ff74b1c574
mov rcx, qword [rcx + 0x10]
lea edx, [rbx - 1]
lea r8, [0x7ff74b517f0]
mov r9, r15
mov dword [rsp + 0x20], ebx
call fcn.7ff74b298f0
cmp edi, r13d
je 0x7ff74b0ab23
mov eax, dword [0x7ff74b582c8]
mov rcx, qword [0x7ff74b58350]
cmp eax, r12d
je 0x7ff74b0ac1b
cmp rcx, r14
je 0x7ff74b0ac1b
test byte [rcx + 0x1c], 8
je 0x7ff74b0ac1b
mov edx, ebx
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b517f0]
mov r9, r15
mov dword [rsp + 0x20], edi
call fcn.7ff74b298f0
nop
jmp 0x7ff74b0ac1b
mov eax, 0xe
jmp 0x7ff74b0ac1f
lea rcx, [rsp + 0x30]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rcx
mov rcx, rbp
mov rdx, r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
mov edi, eax
cmp eax, r12d
je 0x7ff74b0ab6d
mov r8, qword [rsi]
mov rcx, qword [0x7ff74b584e0]
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
mov qword [rsi], r12
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74b0ac1b
mov rcx, qword [0x7ff74b58350]
cmp rcx, r14
je 0x7ff74b0ac1b
test byte [rcx + 0x1c], 8
je 0x7ff74b0ac1b
mov edx, 0xc
jmp 0x7ff74b1c592
lea rdx, [rax + 2]
jmp 0x7ff74b1c644
cmp cx, r8w
je 0x7ff74b1c64d
mov word [rax], cx
add rax, 2
add rdx, 2
movzx ecx, word [rdx]
cmp cx, r12w
jne 0x7ff74b1c633
mov word [rax], r12w
jmp 0x7ff74b0ab9a
add rcx, 2
mov ax, word [rcx]
cmp ax, r12w
je 0x7ff74b0abca
jmp 0x7ff74b0abb7
shr rbx, 1
je 0x7ff74b0abdd
cmp rbx, 0x7fffffff
ja 0x7ff74b0abdd
mov edx, 0x7ffffffe
sub rdx, rbx
sub rcx, r8
lea rax, [rdx + rbx]
cmp rax, r12
je 0x7ff74b1c6af
movzx eax, word [r8 + rcx]
cmp ax, r12w
je 0x7ff74b1c6af
mov word [r8], ax
add r8, 2
sub rbx, 1
jne 0x7ff74b1c68d
cmp rbx, r12
jne 0x7ff74b1c6b8
sub r8, 2
mov word [r8], r12w
jmp 0x7ff74b0abdd
mov rax, rcx
cmp rcx, qword [rsi]
je 0x7ff74b0ac0c
jmp 0x7ff74b0abf5
shr dword [rsp + 0x30], 1
xor r8d, r8d
jmp 0x7ff74b1c6fe
mov r8d, dword [rsp + 0x30]
mov rcx, qword [rsi]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, r12d
je 0x7ff74b1c76a
cmp eax, dword [rsp + 0x30]
jbe 0x7ff74b1c765
mov dword [rsp + 0x30], eax
mov r8, rbx
mov rcx, qword [0x7ff74b584e0]
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
mov r8d, dword [rsp + 0x30]
mov rcx, qword [0x7ff74b584e0]
inc r8d
xor edx, edx
add r8, r8
call qword [0x7ff74b58358]
mov rbx, rax
cmp rax, r12
jne 0x7ff74b1c6db
mov edi, 0xe
mov r8, qword [rsi]
mov rcx, qword [0x7ff74b584e0]
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
cmp edi, r12d
jne 0x7ff74b1c7aa
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rcx, eax
mov word [rbx + rcx*2 + 2], r12w
mov qword [rsi], rbx
jmp 0x7ff74b0ac1b
mov edi, r12d
jmp 0x7ff74b1c734
call sub.KERNEL32.dll_GetLastError
mov edi, eax
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74b1c734
mov rcx, qword [0x7ff74b58350]
cmp rcx, r14
je 0x7ff74b1c734
test byte [rcx + 0x1c], 1
je 0x7ff74b1c734
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b517f0]
mov edx, 0xe
mov r9, r15
mov dword [rsp + 0x20], eax
call fcn.7ff74b298f0
jmp 0x7ff74b1c734
mov rcx, qword [0x7ff74b584e0]
mov r8, rbx
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
mov qword [rsi], r12
jmp 0x7ff74b0ac1b
mov rcx, qword [0x7ff74b584e0]
xor edx, edx
call qword [case.0x7ff74b3e5fd.0]
mov qword [rsi], r12
cmp dword [0x7ff74b582c8], r12d
je 0x7ff74b1c80d
mov rcx, qword [0x7ff74b58350]
cmp rcx, r14
je 0x7ff74b1c80d
test byte [rcx + 0x1c], 1
je 0x7ff74b1c80d
mov rcx, qword [rcx + 0x10]
lea r8, [0x7ff74b517f0]
mov edx, 0xd
mov r9, r15
mov dword [rsp + 0x20], edi
call fcn.7ff74b298f0
mov eax, 0xa1
jmp 0x7ff74b0ac1f