Function at 0x100040758
Capabilities:
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x4a0
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0x490], rax
xor ebx, ebx
lea rax, [rsp + 0x58]
mov ebp, edx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
mov r13, r8
mov r12, rcx
mov qword [rsp + 0x30], rbx
mov rsi, 0xffffffff80000002
lea rdx, [0x10001cff8]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x20], ebx
lea edi, [rbx + 1]
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
je 0x100040819
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x58]
lea rdx, [0x10001cff8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], ebx
mov edi, ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
je 0x100040819
xor eax, eax
jmp 0x100040a4e
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
lea rdx, [0x1000233b0]
xor r8d, r8d
mov dword [rsp + 0x60], 0x208
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x50], 2
mov esi, eax
mov r15d, 0x104
jne 0x1000408cb
cmp eax, ebx
jne 0x1000408da
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x70]
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdi, [rsp + 0x280]
lea rax, [rsp + 0x70]
sub rdi, rax
mov rdx, r15
lea rcx, [rsp + 0x70]
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbx
je 0x1000408ba
movzx eax, word [rdi + rcx]
cmp ax, bx
je 0x1000408ba
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x100040898
cmp rdx, rbx
jne 0x1000408c3
sub rcx, 2
mov word [rcx], bx
jmp 0x100040a0d
cmp dword [rsp + 0x50], 1
jne 0x1000408da
cmp eax, ebx
je 0x100040a0d
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
lea rdx, [0x1000233e0]
xor r8d, r8d
mov dword [rsp + 0x60], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x50], 1
mov word [rsp + 0x276], bx
mov esi, eax
jne 0x100040925
cmp eax, ebx
je 0x10004098b
lea rax, [rsp + 0x70]
cmp rax, rbx
je 0x100040983
lea rcx, [rsp + 0x70]
mov edx, r15d
call fcn.100045870
cmp eax, ebx
jne 0x100040983
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov rcx, qword [0x10004ce70]
lea r8, [rsp + 0x280]
mov r9d, r15d
mov edx, 0x26fd
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, ebx
je 0x100040983
lea r8, [rsp + 0x280]
lea rcx, [rsp + 0x70]
mov rdx, r15
call fcn.10002e3d4
mov esi, ebx
cmp esi, ebx
jne 0x100040a3c
cmp edi, ebx
je 0x100040a09
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
lea rdx, [0x1000233b0]
mov r9d, 1
not rcx
xor r8d, r8d
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x70]
lea rdx, [0x1000233f8]
repne scasw ax, word [rdi]
mov r9d, 1
xor r8d, r8d
not rcx
lea eax, [rcx + rcx]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, ebx
jne 0x100040a3c
mov word [rsp + 0x276], bx
cmp ebp, ebx
jne 0x100040a2c
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x70]
mov r8d, r15d
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea r8, [rsp + 0x70]
mov rdx, r13
mov rcx, r12
call fcn.10002e2e8
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.1000475f0
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret