Function at 0x14001ad84
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0xf80]
mov eax, 0x1080
call fcn.140025140
sub rsp, rax
mov rax, qword [0x1400400b0]
xor rax, rsp
mov qword [rbp + 0xf70], rax
movdqa xmm0, xmmword [0x140039020]
lea rax, str.SoftwareMicrosoftCommand_Processor
mov r14d, 1
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
xor r15d, r15d
lea rax, str.SystemSoftwareMicrosoftCommand_Processor
mov qword [rsp + 0x68], 0xffffffff80000002
mov qword [rsp + 0x50], rax
mov rsi, rcx
lea r13d, [r14 + 0x1f]
mov byte [0x14004cbc5], r14b
movdqu xmmword [rsp + 0x58], xmm0
mov edi, r15d
mov ebx, 0x1000
mov rdx, qword [rsp + rdi*8 + 0x40]
lea rax, [rsp + 0x38]
mov rcx, qword [rsp + rdi*8 + 0x58]
mov r9d, 0x2000000
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b24a
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x30], r15d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.DisableUNCCheck
mov dword [rsp + 0x34], ebx
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001aeb8
cmp dword [rsp + 0x30], 4
jne 0x14001ae96
cmp dword [rsp + 0x70], r15d
setne byte [0x14004cbe4]
jmp 0x14001aeb8
cmp dword [rsp + 0x30], r14d
jne 0x14001aeb8
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wtol]
nop dword [rax + rax]
cmp eax, r14d
sete byte [0x14004cbe4]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x34], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.EnableExtensions
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001af2b
cmp dword [rsp + 0x30], 4
jne 0x14001af09
cmp dword [rsp + 0x70], r15d
setne byte [0x14004cbc5]
jmp 0x14001af2b
cmp dword [rsp + 0x30], r14d
jne 0x14001af2b
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wtol]
nop dword [rax + rax]
cmp eax, r14d
sete byte [0x14004cbc5]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x34], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.DelayedExpansion
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001af9e
cmp dword [rsp + 0x30], 4
jne 0x14001af7c
cmp dword [rsp + 0x70], r15d
setne byte [0x14004cbc4]
jmp 0x14001af9e
cmp dword [rsp + 0x30], r14d
jne 0x14001af9e
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__wtol]
nop dword [rax + rax]
cmp eax, r14d
sete byte [0x14004cbc4]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x34], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.DefaultColor
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b00c
cmp dword [rsp + 0x30], 4
jne 0x14001afe8
movzx eax, word [rsp + 0x70]
jmp 0x14001b005
cmp dword [rsp + 0x30], r14d
jne 0x14001b00c
xor r8d, r8d
lea rcx, [rsp + 0x70]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_wcstol]
nop dword [rax + rax]
mov word [0x14004cbd4], ax
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x34], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.CompletionChar
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b0ab
cmp dword [rsp + 0x30], 4
jne 0x14001b05d
movzx ecx, word [rsp + 0x70]
mov word [0x1400400f4], cx
jmp 0x14001b08c
cmp dword [rsp + 0x30], r14d
jne 0x14001b085
xor r8d, r8d
lea rcx, [rsp + 0x70]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_wcstol]
nop dword [rax + rax]
mov ecx, eax
mov word [0x1400400f4], ax
jmp 0x14001b08c
movzx ecx, word [0x1400400f4]
movzx eax, cx
mov edx, 0xffe0
sub ax, r14w
test dx, ax
jne 0x14001b0a3
cmp cx, 0xd
jne 0x14001b0ab
mov word [0x1400400f4], r13w
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x34], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.PathCompletionChar
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b14f
cmp dword [rsp + 0x30], 4
jne 0x14001b0fc
movzx ecx, word [rsp + 0x70]
mov word [0x1400400f0], cx
jmp 0x14001b12b
cmp dword [rsp + 0x30], r14d
jne 0x14001b124
xor r8d, r8d
lea rcx, [rsp + 0x70]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_wcstol]
nop dword [rax + rax]
mov ecx, eax
mov word [0x1400400f0], ax
jmp 0x14001b12b
movzx ecx, word [0x1400400f0]
movzx eax, cx
mov edx, 0xffe0
sub ax, r14w
test dx, ax
jne 0x14001b142
cmp cx, 0xd
jne 0x14001b156
movzx ecx, r13w
mov word [0x1400400f0], cx
jmp 0x14001b156
movzx ecx, word [0x1400400f0]
movzx eax, word [0x1400400f4]
cmp ax, r13w
jne 0x14001b172
cmp cx, r13w
jae 0x14001b176
mov word [0x1400400f4], cx
jmp 0x14001b187
cmp cx, r13w
jne 0x14001b187
cmp ax, r13w
cmovb cx, ax
mov word [0x1400400f0], cx
cmp rdi, 2
jae 0x14001b239
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
lea rax, [rsp + 0x70]
mov dword [rsp + 0x34], ebx
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.AutoRun
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x14001b239
cmp dword [rsp + 0x30], 2
jne 0x14001b223
mov ecx, dword [rsp + 0x34]
lea rbx, [rsp + 0x74]
shr ecx, 1
mov r8d, 0x7fe
sub r8d, ecx
lea rbx, [rbx + rcx*2]
mov rdx, rbx
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
test eax, eax
je 0x14001b218
mov r8, rbx
lea rcx, [rsp + 0x70]
mov edx, 0x800
call fcn.1400158f0
jmp 0x14001b21e
mov word [rsp + 0x70], r15w
mov ebx, 0x1000
cmp word [rsp + 0x70], r15w
je 0x14001b239
lea rcx, [rsp + 0x70]
call fcn.14000fcb0
mov qword [rsi + rdi*8], rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
add rdi, r14
cmp rdi, 3
jl 0x14001ae0f
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time32]
nop dword [rax + rax]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_srand]
nop dword [rax + rax]
mov rcx, qword [rbp + 0xf70]
xor rcx, rsp
call fcn.14001f920
lea r11, [rsp + 0x1080]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret