Function at 0x14001dbe0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x6b0
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov qword [rsp + 0x6e0], rbx
mov rdi, rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
or r13, 0xffffffffffffffff
mov r9d, r13d
mov r8d, 0xfde9
lea rcx, [rsp + 0x40]
call fcn.140012a60
nop
lea rax, [rsp + 0x6f0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x6f8]
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
je 0x14001dcba
mov byte [rsp + 0xa0], r12b
mov r9d, r13d
lea r8, str.get_registry_value_length
mov edx, 0x100
lea rcx, [rsp + 0xa0]
call fcn.14001a500
mov edx, ebx
lea rcx, [rsp + 0xa0]
call fcn.14001ac20
lea rcx, [rsp + 0x1a4]
lea rdx, [rsp + 0xa0]
mov r8d, 0x104
call fcn.1400374a0
lea rdx, [0x14007a800]
lea rcx, [rsp + 0x1a4]
call fcn.140035840
int3
movsxd rbx, dword [rsp + 0x6f0]
test ebx, ebx
je 0x14001dcd3
mov rcx, rbx
call fcn.140037b30
mov rsi, rax
jmp 0x14001dcd6
mov rsi, r12
mov dword [rsp + 0x80], ebx
xor ecx, ecx
call fcn.1400361f0
mov qword [rsp + 0x88], rsi
lea rax, [rsp + 0x6f0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x6f8]
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
test eax, eax
je 0x14001dd80
mov byte [rsp + 0xa0], 0
mov r9d, r13d
lea r8, str.get_registry_value
mov edx, 0x100
lea rcx, [rsp + 0xa0]
call fcn.14001a500
mov edx, edi
lea rcx, [rsp + 0xa0]
call fcn.14001ac20
lea rcx, [rsp + 0x1a4]
lea rdx, [rsp + 0xa0]
mov r8d, 0x104
call fcn.1400374a0
lea rdx, [0x14007a800]
lea rcx, [rsp + 0x1a4]
call fcn.140035840
int3
mov eax, dword [rsp + 0x6f8]
sub eax, 1
je 0x14001e04e
sub eax, 1
je 0x14001de81
sub eax, 1
je 0x14001de4b
cmp eax, 1
je 0x14001ddfb
mov byte [rsp + 0x2a8], 0
mov r9d, r13d
lea r8, str.unsupported_registry_type
mov edx, 0x100
lea rcx, [rsp + 0x2a8]
call fcn.14001a500
lea rcx, [rsp + 0x4a8]
lea rdx, [rsp + 0x2a8]
mov r8d, 0x100
call fcn.1400374a0
lea rdx, [0x14007a7a8]
lea rcx, [rsp + 0x4a8]
call fcn.140035840
int3
mov qword [rsp + 0x60], r12
mov dword [rsp + 0x68], r12d
mov r8d, dword [rsi]
lea rdx, [0x140062708]
lea rcx, [rsp + 0x60]
call fcn.140013810
mov rbx, qword [rsp + 0x60]
mov qword [rsp + 0x60], r12
mov dword [rsp + 0x68], r12d
xor ecx, ecx
call fcn.140034ee0
nop
mov rcx, rsi
call fcn.1400361f0
nop
mov rcx, qword [rsp + 0x40]
call fcn.1400361f0
mov rax, rbx
jmp 0x14001e0f2
movaps xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.14001b710
mov rbx, rax
mov rcx, rsi
call fcn.1400361f0
nop
mov rcx, qword [rsp + 0x40]
call fcn.1400361f0
mov rax, rbx
jmp 0x14001e0f2
test ebx, ebx
je 0x14001e021
movaps xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.14001d7d0
mov rbx, rax
mov qword [rsp + 0x90], rax
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
movsxd rdi, eax
test eax, eax
jne 0x14001df2c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov byte [rsp + 0x1a4], 0
mov r9d, r13d
lea r8, str.ExpandEnvironmentStrings
mov edx, 0x100
lea rcx, [rsp + 0x1a4]
call fcn.14001a500
mov edx, ebx
lea rcx, [rsp + 0x1a4]
call fcn.14001ac20
lea rcx, [rsp + 0x5a8]
lea rdx, [rsp + 0x1a4]
mov r8d, 0x104
call fcn.1400374a0
lea rdx, [0x14007a800]
lea rcx, [rsp + 0x5a8]
call fcn.140035840
int3
mov eax, 2
mul rdi
cmovo rax, r13
mov rcx, rax
call fcn.140037b30
mov rbp, rax
xor ecx, ecx
call fcn.1400361f0
mov qword [rsp + 0x50], rbp
mov r8d, edi
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x6f0], eax
cmp edi, eax
jae 0x14001dfbd
mov byte [rsp + 0x3a8], 0
mov r9d, r13d
lea r8, str.unable_to_expand_environment_strings
mov edx, 0x100
lea rcx, [rsp + 0x3a8]
call fcn.14001a500
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x3a8]
mov r8d, 0x100
call fcn.1400374a0
lea rdx, [0x14007a7a8]
lea rcx, [rsp + 0xa0]
call fcn.140035840
int3
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
mov r9d, r13d
mov r8d, 0xfde9
mov rdx, rbp
lea rcx, [rsp + 0x78]
call fcn.140012c10
mov rdi, qword [rsp + 0x78]
mov qword [rsp + 0x78], r12
xor ecx, ecx
call fcn.1400361f0
nop
mov rcx, rbp
call fcn.1400361f0
nop
mov rcx, rbx
call fcn.1400361f0
nop
mov rcx, rsi
call fcn.1400361f0
nop
mov rcx, qword [rsp + 0x40]
call fcn.1400361f0
mov rax, rdi
jmp 0x14001e0f2
mov edx, r13d
lea rcx, [0x140060f0a]
call fcn.1400129e0
mov rbx, rax
mov rcx, rsi
call fcn.1400361f0
nop
mov rcx, qword [rsp + 0x40]
call fcn.1400361f0
mov rax, rbx
jmp 0x14001e0f2
test ebx, ebx
je 0x14001e0ca
movaps xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call fcn.14001d7d0
mov rbx, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
mov r9d, r13d
mov r8d, 0xfde9
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140012c10
mov rdi, qword [rsp + 0x70]
mov qword [rsp + 0x70], r12
xor ecx, ecx
call fcn.1400361f0
nop
mov rcx, rbx
call fcn.1400361f0
nop
mov rcx, rsi
call fcn.1400361f0
nop
mov rcx, qword [rsp + 0x40]
call fcn.1400361f0
mov rax, rdi
jmp 0x14001e0f2
mov edx, r13d
lea rcx, [0x140060f0a]
call fcn.1400129e0
mov rbx, rax
mov rcx, rsi
call fcn.1400361f0
nop
mov rcx, qword [rsp + 0x40]
call fcn.1400361f0
mov rax, rbx
mov rbx, qword [rsp + 0x6e0]
add rsp, 0x6b0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret