Function at 0x140023210
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov r11, rsp
push r14
sub rsp, 0x2c0
mov rax, qword [0x1400db800]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov qword [r11 - 0x10], rbx
mov r14, rcx
mov qword [r11 - 0x18], rbp
lea rcx, [rsp + 0x60]
mov qword [r11 - 0x28], rdi
mov rbp, rdx
xor edi, edi
mov qword [r11 - 0x30], r12
mov qword [rsp + 0x20], r9
mov edx, 0x104
mov r9, r8
mov qword [r11 - 0x40], r15
lea r8, str._s_shell_scommand
mov dword [rsp + 0x48], edi
lea ebx, [rdi + 2]
mov r15d, edi
mov r12d, edi
call fcn.140001040
lea rax, [rsp + 0x50]
xor r8d, r8d
lea r9d, [rdi + 1]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x60]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140023552
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [rsp + 0x48]
test eax, eax
je 0x1400232f8
mov ecx, eax
call fcn.140094b74
mov rcx, qword [rsp + 0x50]
mov r12, rax
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test r12, r12
je 0x140023552
test ebx, ebx
jne 0x140023552
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
test eax, eax
je 0x140023552
mov eax, 2
mov qword [rsp + 0x290], r13
mul rbx
mov r13, 0xffffffffffffffff
cmovo rax, r13
mov rcx, rax
call fcn.140094b74
mov r8d, ebx
mov rdx, rax
mov rcx, r12
mov r15, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp word [r15], di
je 0x14002354a
mov qword [rsp + 0x2a8], rsi
mov rsi, r13
inc rsi
cmp word [rbp + rsi*2], di
jne 0x140023376
mov rcx, r13
inc rcx
cmp word [r15 + rcx*2], di
jne 0x140023383
add rsi, rcx
mov eax, 2
lea rcx, [rsi + 1]
mul rcx
cmovo rax, r13
mov rcx, rax
call fcn.140094b74
mov qword [r14 + 8], rax
mov rbx, r15
movzx ecx, word [r15]
mov qword [rsp + 0x40], rax
lea rsi, [rax + rsi*2]
cmp di, cx
jae 0x1400233d4
cmp cx, 0x20
ja 0x1400233d4
movzx ecx, word [rbx + 2]
add rbx, 2
cmp di, cx
jb 0x1400233c1
cmp word [rbx], di
je 0x140023460
lea r13, str.__s_
cmp rax, rsi
jae 0x140023460
movzx ecx, word [rbx]
cmp cx, 0x22
jne 0x1400234a6
cmp word [rbx + 2], 0x25
jne 0x14002344b
cmp word [rbx + 4], 0x4c
jne 0x14002343d
cmp word [rbx + 6], cx
jne 0x14002343d
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x40]
mov rdx, rsi
mov qword [rsp + 0x28], r13
sub rdx, rax
mov qword [rsp + 0x20], rdi
sar rdx, 1
xor r9d, r9d
mov rcx, rax
call fcn.140001db0
mov rax, qword [rsp + 0x40]
add rbx, 8
jmp 0x14002345b
cmp word [rbx + 4], 0x31
jne 0x14002344b
cmp word [rbx + 6], 0x22
je 0x14002340a
mov word [rax], cx
add rax, 2
mov qword [rsp + 0x40], rax
add rbx, 2
cmp word [rbx], di
jne 0x1400233e4
mov rsi, qword [rsp + 0x2a8]
mov word [rax], di
mov rbx, qword [r14 + 8]
cmp word [rbx], 0x22
jne 0x1400234f2
movzx eax, word [rbx + 2]
lea rcx, [rbx + 2]
mov rdx, rcx
test ax, ax
je 0x140023498
cmp ax, 0x22
je 0x140023498
movzx eax, word [rdx + 2]
add rdx, 2
test ax, ax
jne 0x140023485
cmp rdx, rcx
jbe 0x140023547
jmp 0x14002353f
cmp cx, 0x25
jne 0x14002344b
movzx edx, word [rbx + 2]
cmp dx, 0x4c
je 0x1400234bc
cmp dx, 0x31
jne 0x14002344b
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x40]
mov rdx, rsi
mov qword [rsp + 0x28], r13
sub rdx, rax
mov qword [rsp + 0x20], rdi
sar rdx, 1
xor r9d, r9d
mov rcx, rax
call fcn.140001db0
mov rax, qword [rsp + 0x40]
add rbx, 4
jmp 0x14002345b
lea rdx, str..exe
mov rcx, rbx
call fcn.140096798
test rax, rax
je 0x140023514
lea rdx, [rax + 8]
cmp rdx, rbx
jbe 0x140023547
mov rcx, rbx
jmp 0x14002353f
movzx eax, word [rbx + 2]
mov rcx, rbx
add rbx, 2
test ax, ax
je 0x140023537
cmp ax, 0x20
je 0x140023537
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
jne 0x140023524
cmp rbx, rcx
jbe 0x140023547
mov rdx, rbx
call fcn.140094400
mov rdi, rax
mov qword [r14], rdi
mov r13, qword [rsp + 0x290]
mov rcx, r15
call fcn.140062970
mov rcx, r12
call fcn.140062970
cmp qword [r14], 0
mov r15, qword [rsp + 0x288]
mov r12, qword [rsp + 0x298]
mov rdi, qword [rsp + 0x2a0]
mov rbp, qword [rsp + 0x2b0]
mov rbx, qword [rsp + 0x2b8]
je 0x1400235a2
cmp qword [r14 + 8], 0
je 0x1400235a2
cmp qword [r14 + 0x18], 0
je 0x1400235a2
mov al, 1
jmp 0x1400235a4
xor al, al
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140094850
add rsp, 0x2c0
pop r14
ret