Function at 0x140010384
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r14
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov rdi, r8
mov rbx, rdx
lea r12, vtable.CRegHandle.0
mov qword [rbp - 0x10], r12
xor r14d, r14d
mov qword [rbp - 8], r14
mov esi, 0x20a
mov ecx, esi
call fcn.1400346d8
mov qword [rbp - 0x20], rax
mov dword [rbp + 0x30], 0x208
mov ecx, esi
call fcn.1400346d8
mov qword [rbp - 0x28], rax
mov ecx, esi
call fcn.1400346d8
mov qword [rbp - 0x30], rax
mov qword [rsp + 0x28], rbx
lea rax, str.System
mov qword [rsp + 0x20], rax
lea r9, str.SYSTEMCurrentControlSetServicesEventlog
lea r8, str._s_s_s
mov esi, 0x104
mov edx, esi
mov rcx, qword [rbp - 0x20]
call fcn.140008af8
mov ebx, eax
test eax, eax
jns 0x14001045e
lfence
lea rax, [0x140060048]
mov rcx, qword [0x140060048]
cmp rcx, rax
je 0x140010452
test byte [rcx + 0x1c], 1
je 0x140010452
lea edx, [r14 + 0x29]
mov r9d, ebx
lea r8, [0x1400492d8]
mov rcx, qword [rcx + 0x10]
call fcn.1400012f0
lea rcx, str.ERROR:_StringCchPrintfW_failed___X__n
jmp 0x140010674
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rbp - 0x20]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x1400104d3
lfence
lea rax, [0x140060048]
mov rcx, qword [0x140060048]
cmp rcx, rax
je 0x1400104c7
test byte [rcx + 0x1c], 1
je 0x1400104c7
mov edx, 0x2a
mov r9d, ebx
lea r8, [0x1400492d8]
mov rcx, qword [rcx + 0x10]
call fcn.1400012f0
lea rcx, str.ERROR:_RegOpenKeyEx_failed___X__n
jmp 0x140010674
lea rax, [rbp + 0x30]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp - 0x28]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x48]
xor r8d, r8d
lea rdx, str.EventMessageFile
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x14001054f
lfence
lea rax, [0x140060048]
mov rcx, qword [0x140060048]
cmp rcx, rax
je 0x140010543
test byte [rcx + 0x1c], 1
je 0x140010543
mov edx, 0x2b
mov r9d, ebx
lea r8, [0x1400492d8]
mov rcx, qword [rcx + 0x10]
call fcn.1400012f0
lea rcx, str.ERROR:_RegQueryValueEx_failed___X__n
jmp 0x140010674
mov rax, qword [rbp - 0x28]
mov word [rax + 0x208], r14w
cmp dword [rbp + 0x48], 2
jne 0x1400105be
mov r8d, esi
mov rdx, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x140010611
call fcn.14002e738
mov ebx, eax
lea rax, [0x140060048]
mov rcx, qword [0x140060048]
cmp rcx, rax
je 0x1400105b2
test byte [rcx + 0x1c], 1
je 0x1400105b2
mov edx, 0x2c
mov r9d, ebx
lea r8, [0x1400492d8]
mov rcx, qword [rcx + 0x10]
call fcn.1400012f0
lea rcx, str.ERROR:_ExpandEnvironmentStrings_failed___X__n
jmp 0x140010674
mov r8, qword [rbp - 0x28]
mov rdx, rsi
mov rcx, qword [rbp - 0x30]
call fcn.140010e00
mov ebx, eax
test eax, eax
jns 0x140010611
lfence
lea rax, [0x140060048]
mov rcx, qword [0x140060048]
cmp rcx, rax
je 0x140010608
test byte [rcx + 0x1c], 1
je 0x140010608
mov edx, 0x2d
mov r9d, ebx
lea r8, [0x1400492d8]
mov rcx, qword [rcx + 0x10]
call fcn.1400012f0
lea rcx, str.ERROR:_StringCchCopy_failed___X__n
jmp 0x140010674
mov rax, qword [rbp - 0x30]
mov word [rax + 0x208], r14w
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rdi], rax
test rax, rax
jne 0x14001067b
call fcn.14002e738
mov ebx, eax
lea rax, [0x140060048]
mov rcx, qword [0x140060048]
cmp rcx, rax
je 0x14001066d
test byte [rcx + 0x1c], 1
je 0x14001066d
mov edx, 0x2e
mov r9d, ebx
lea r8, [0x1400492d8]
mov rcx, qword [rcx + 0x10]
call fcn.1400012f0
lea rcx, str.ERROR:_LoadLibraryEx_failed___X__n
mov edx, ebx
call fcn.140003cb0
mov rcx, r14
xchg qword [rbp - 0x30], rcx
test rcx, rcx
je 0x14001068d
call fcn.140034674
nop
mov rcx, r14
xchg qword [rbp - 0x28], rcx
test rcx, rcx
je 0x14001069f
call fcn.140034674
nop
mov rcx, r14
xchg qword [rbp - 0x20], rcx
test rcx, rcx
je 0x1400106b1
call fcn.140034674
nop
mov qword [rbp - 0x10], r12
mov rcx, qword [rbp - 8]
test rcx, rcx
je 0x1400106c4
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rbx, qword [rsp + 0x98]
add rsp, 0x60
pop r14
pop r12
pop rdi
pop rsi
pop rbp
ret