Function at 0x14000e760
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xce0]
sub rsp, 0xde0
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov qword [rsp + 0xe38], rbx
mov rax, qword [0x140079698]
xor rax, rsp
mov qword [rbp + 0xcd0], rax
mov r12, r8
mov r14, rdx
mov r13, rcx
lea rdx, str.winmgmts
mov rcx, r14
call fcn.14003b738
test eax, eax
je 0x14000ef03
call fcn.140015cb0
mov rcx, rax
test rax, rax
jne 0x14000e7d4
mov ecx, 0x80004005
call fcn.1400026e0
int3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x40], rbx
or rdi, 0xffffffffffffffff
xor esi, esi
test r14, r14
je 0x14000e82c
test r14, 0xffffffffffff0000
jne 0x14000e81a
movzx r15d, r14w
mov ecx, r15d
call fcn.14001633c
test rax, rax
je 0x14000e843
mov r8d, r15d
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002150
jmp 0x14000e83e
mov rax, rdi
nop dword [rax]
inc rax
cmp word [r14 + rax*2], si
jne 0x14000e820
jmp 0x14000e82e
mov eax, esi
mov r8d, eax
mov rdx, r14
lea rcx, [rsp + 0x40]
call fcn.140002550
mov rbx, qword [rsp + 0x40]
mov word [rbp - 0x60], si
mov word [rbp + 0x6b0], si
cmp dword [rbx - 0x10], 0
je 0x14000eeec
lea rdx, str.CLSID
lea rcx, [rsp + 0x40]
call fcn.14000f300
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rbx, qword [rsp + 0x40]
mov rdx, rbx
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000e8f9
mov dword [rsp + 0x30], 0x200
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000e8e9
cmp dword [rsp + 0x34], 1
jne 0x14000e8e9
lea r8, [rbp + 0x2b0]
lea edx, [rax + 0x40]
lea rcx, [rbp + 0x6b0]
call fcn.140040128
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x14000eb3f
mov rdx, r14
lea rcx, [rsp + 0x50]
call fcn.140002640
nop
lea rdx, str.CurVer
lea rcx, [rsp + 0x50]
call fcn.14000f300
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000eb1c
mov dword [rsp + 0x30], 0x200
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000eb1c
cmp dword [rsp + 0x34], 1
jne 0x14000eb1c
call fcn.140015cb0
mov rcx, rax
test rax, rax
jne 0x14000e9a3
mov ecx, 0x80004005
call fcn.1400026e0
int3
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x48], rbx
lea rcx, [rbp + 0x2b0]
lea rax, [rbp + 0x2b0]
test rax, 0xffffffffffff0000
jne 0x14000e9eb
movzx r14d, cx
mov ecx, r14d
call fcn.14001633c
test rax, rax
je 0x14000ea18
mov r8d, r14d
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.140002150
jmp 0x14000ea13
lea rcx, [rbp + 0x2b0]
mov rax, rdi
inc rax
cmp word [rcx + rax*2], 0
jne 0x14000e9f5
mov r8d, eax
lea rdx, [rbp + 0x2b0]
lea rcx, [rsp + 0x48]
call fcn.140002550
mov rbx, qword [rsp + 0x48]
cmp dword [rbx - 0x10], 0
jne 0x14000ea65
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000ea38
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000ea57
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
jmp 0x14000eef0
lea rdx, str.CLSID
lea rcx, [rsp + 0x48]
call fcn.14000f300
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rbx, qword [rsp + 0x48]
mov rdx, rbx
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000eb02
mov dword [rsp + 0x30], 0x200
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000eaf6
cmp dword [rsp + 0x34], 1
jne 0x14000eaf6
lea r8, [rbp + 0x2b0]
lea edx, [rax + 0x40]
lea rcx, [rbp + 0x6b0]
call fcn.140040128
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000eb1c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000eb3a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x40]
lea r8, str.CLSID_
mov edx, 0x80
lea rcx, [rbp + 0x1b0]
call fcn.140040128
lea r8, [rbp + 0x6b0]
mov edx, 0x80
lea rcx, [rbp + 0x1b0]
call fcn.140040190
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, [rbp + 0x1b0]
mov rcx, 0xffffffff80000000
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000eeec
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.TypeLib
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000ec31
mov dword [rsp + 0x30], 0x80
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000eee0
cmp dword [rsp + 0x34], 1
jne 0x14000eee0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov r8, r12
lea rdx, [rbp + 0x2b0]
mov rcx, r13
call fcn.14000e270
mov esi, eax
jmp 0x14000eec0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.InprocServer32
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000ed8d
mov dword [rsp + 0x30], 0x105
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000ed82
mov eax, dword [rsp + 0x34]
cmp eax, 1
je 0x14000ecd8
cmp eax, 2
jne 0x14000ed82
mov r8d, 0x104
lea rdx, [rbp + 0x8b0]
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x14000ecd8
lea r8, [rbp + 0x8b0]
mov edx, 0x104
lea rcx, [rbp - 0x60]
call fcn.140040128
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rbp - 0x80]
mov edx, 2
lea rcx, [rbp - 0x60]
call qword [sym.imp.OLEAUT32.dll_SystemTimeToVariantTime]
test eax, eax
js 0x14000ed64
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
lea rdx, [rsp + 0x68]
call qword [rax + 0x38]
test eax, eax
jne 0x14000ed64
mov rcx, qword [r13 + 0xb8]
test rcx, rcx
je 0x14000ed36
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x68]
movzx r9d, word [rdx + 0x1a]
movzx r8d, word [rdx + 0x18]
mov dword [rsp + 0x20], esi
call qword [rax + 0x48]
test eax, eax
jne 0x14000ed64
mov rcx, qword [r13 + 0xd8]
test rcx, rcx
je 0x14000ed5f
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x68]
movzx r9d, word [rdx + 0x1a]
movzx r8d, word [rdx + 0x18]
mov dword [rsp + 0x20], esi
call qword [rax + 0x48]
test eax, eax
jne 0x14000ed64
mov esi, 1
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14000ed7b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, esi
jmp 0x14000ef05
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
lea rdx, str.LocalServer32
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000eeec
mov dword [rsp + 0x30], 0x105
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14000eee0
mov eax, dword [rsp + 0x34]
cmp eax, 1
je 0x14000ee34
cmp eax, 2
jne 0x14000eee0
mov r8d, 0x104
lea rdx, [rbp + 0xac0]
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x14000ee34
lea r8, [rbp + 0xac0]
mov edx, 0x104
lea rcx, [rbp - 0x60]
call fcn.140040128
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rbp - 0x78]
mov edx, 2
lea rcx, [rbp - 0x60]
call qword [sym.imp.OLEAUT32.dll_SystemTimeToVariantTime]
test eax, eax
js 0x14000eec0
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
lea rdx, [rsp + 0x70]
call qword [rax + 0x38]
test eax, eax
jne 0x14000eec0
mov rcx, qword [r13 + 0xb8]
test rcx, rcx
je 0x14000ee92
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x70]
movzx r9d, word [rdx + 0x1a]
movzx r8d, word [rdx + 0x18]
mov dword [rsp + 0x20], esi
call qword [rax + 0x48]
test eax, eax
jne 0x14000eec0
mov rcx, qword [r13 + 0xd8]
test rcx, rcx
je 0x14000eebb
mov rax, qword [rcx]
mov rdx, qword [rsp + 0x70]
movzx r9d, word [rdx + 0x1a]
movzx r8d, word [rdx + 0x18]
mov dword [rsp + 0x20], esi
call qword [rax + 0x48]
test eax, eax
jne 0x14000eec0
mov esi, 1
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14000ed7b
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov eax, esi
jmp 0x14000ef05
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x14000ef03
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rcx, qword [rbp + 0xcd0]
xor rcx, rsp
call fcn.1400371e0
mov rbx, qword [rsp + 0xe38]
add rsp, 0xde0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret