Function at 0x100037964
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0xb60
mov rax, qword [0x10004a110]
xor rax, rsp
mov qword [rsp + 0xb50], rax
mov rax, r8
xor ebx, ebx
mov r13, rdx
mov r12d, ecx
mov ebp, 0x117
lea esi, [rbx + 1]
lea rdx, [r11 - 0x678]
mov r8d, ebp
mov rcx, rax
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x38], rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rsp + 0x500]
call qword [sym.imp.msvcrt.dll__wcslwr]
cmp dword [0x10004d39c], ebx
je 0x100037a25
lea rcx, [rsp + 0x500]
call fcn.100037734
cmp eax, ebx
jne 0x1000379f6
lea rcx, [rsp + 0x500]
call fcn.100037798
mov esi, eax
mov eax, esi
mov rcx, qword [rsp + 0xb50]
xor rcx, rsp
call fcn.1000475f0
lea r11, [rsp + 0xb60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
lea rdi, [rsp + 0x500]
lea rax, [rsp + 0x50]
mov rdx, rbp
sub rdi, rax
lea rcx, [rsp + 0x50]
lea rax, [rdx + 0x7ffffee7]
cmp rax, rbx
je 0x100037a5e
movzx eax, word [rdi + rcx]
cmp ax, bx
je 0x100037a5e
mov word [rcx], ax
add rcx, 2
sub rdx, rsi
jne 0x100037a3d
cmp rdx, rbx
jne 0x100037a67
sub rcx, 2
mov word [rcx], bx
lea rdx, [0x10001ea80]
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll_wcsstr]
mov ecx, 0x5c
cmp rax, rbx
je 0x100037bea
mov edx, ecx
lea rcx, [rsp + 0x50]
mov word [rax + 8], bx
call qword [sym.imp.msvcrt.dll_wcschr]
mov edi, ebx
cmp rax, rbx
setne dil
cmp edi, ebx
je 0x100037bea
lea rcx, [rsp + 0x50]
mov edx, 0x22
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, rbx
je 0x100037bc6
lea rdi, [rax + 2]
lea rax, [rsp + 0x280]
mov edx, 0x103
sub rdi, rax
lea rcx, [rsp + 0x280]
lea rax, [rdx + 0x7ffffefb]
cmp rax, rbx
je 0x100037b02
movzx eax, word [rdi + rcx]
cmp ax, bx
je 0x100037b02
mov word [rcx], ax
add rcx, 2
sub rdx, rsi
jne 0x100037ae1
cmp rdx, rbx
jne 0x100037b0b
sub rcx, 2
mov word [rcx], bx
lea rcx, [rsp + 0x280]
mov edx, 0x22
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, rbx
jne 0x100037bea
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x280]
repne scasw ax, word [rdi]
not rcx
sub rcx, rsi
cmp rcx, 8
jbe 0x100037bea
movzx ecx, word [rsp + 0x280]
call qword [sym.imp.msvcrt.dll_iswalpha]
cmp eax, ebx
je 0x100037bea
mov eax, 0x3a
cmp ax, word [rsp + 0x282]
jne 0x100037bea
mov eax, 0x5c
cmp ax, word [rsp + 0x284]
jne 0x100037bea
lea rdi, [rsp + 0x280]
lea rax, [rsp + 0x50]
mov rdx, rbp
sub rdi, rax
lea rcx, [rsp + 0x50]
lea rax, [rdx + 0x7ffffee7]
cmp rax, rbx
je 0x100037bb8
movzx eax, word [rdi + rcx]
cmp ax, bx
je 0x100037bb8
mov word [rcx], ax
add rcx, 2
sub rdx, rsi
jne 0x100037b97
cmp rdx, rbx
jne 0x100037bc1
sub rcx, 2
mov word [rcx], bx
mov edi, esi
cmp edi, ebx
je 0x100037bea
lea rax, [rsp + 0x50]
cmp rax, rbx
je 0x100037be0
lea rcx, [rsp + 0x50]
call fcn.1000400f0
jmp 0x100037be2
mov eax, ebx
cmp eax, ebx
je 0x1000379f6
cmp dword [0x10004d398], ebx
je 0x100037bf9
xor eax, eax
jmp 0x1000379f8
lea rdx, [0x10001edf0]
lea rax, [rsp + 0x50]
lea rcx, [rsp + 0x50]
sub rdx, rax
lea rax, [rbp + 0x7ffffee7]
cmp rax, rbx
je 0x100037c2e
movzx eax, word [rdx + rcx]
cmp ax, bx
je 0x100037c2e
mov word [rcx], ax
add rcx, 2
sub rbp, rsi
jne 0x100037c0d
cmp rbp, rbx
jne 0x100037c37
sub rcx, 2
mov edi, 0x118
mov word [rcx], bx
lea rcx, [rsp + 0x50]
mov rdx, rdi
cmp r12d, ebx
je 0x100037c64
cmp r12d, 2
je 0x100037c5b
lea r8, [0x100020458]
jmp 0x100037c6b
lea r8, [0x100020440]
jmp 0x100037c6b
lea r8, [0x100020420]
call fcn.10002e3d4
lea rcx, [rsp + 0x50]
mov r8, r13
mov rdx, rdi
call fcn.10002e3d4
lea rdx, [rsp + 0x38]
mov r9d, esi
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x50]
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x1000379f6
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x940]
lea rdx, [0x100020478]
xor r8d, r8d
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x34], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x100037d1b
cmp dword [rsp + 0x30], esi
jne 0x100037d1b
lea rdx, [0x10001c8c0]
lea rcx, [rsp + 0x940]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, ebx
jne 0x100037d1b
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100037bf2
mov rcx, qword [0x10004d400]
lea rax, [rsp + 0x40]
lea rdx, [rsp + 0x50]
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r12d, 0x230
cmp eax, ebx
jne 0x100037dc3
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, [0x1000204b0]
xor r8d, r8d
mov dword [rsp + 0x34], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x100037db8
cmp dword [rsp + 0x30], esi
jne 0x100037db8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x1000204d8]
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, ebx
setne bl
mov eax, ebx
jmp 0x1000379f8
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, [0x1000204e0]
xor r8d, r8d
mov dword [rsp + 0x34], r12d
mov ebp, ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x100037e19
cmp dword [rsp + 0x30], esi
jne 0x100037e19
lea rdx, [0x1000204d8]
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, ebx
cmove ebp, esi
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, [0x100020500]
xor r8d, r8d
mov dword [rsp + 0x34], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov r13d, 0x7c
cmp eax, ebx
jne 0x100037f46
cmp dword [rsp + 0x30], esi
jne 0x100037f46
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll__wcslwr]
lea rdi, [rsp + 0x50]
lea rax, [rsp + 0x730]
mov r8, rdi
mov edx, 0x103
sub r8, rax
lea rcx, [rsp + 0x730]
lea rax, [rdx + 0x7ffffefb]
cmp rax, rbx
je 0x100037eb1
movzx eax, word [r8 + rcx]
cmp ax, bx
je 0x100037eb1
mov word [rcx], ax
add rcx, 2
sub rdx, rsi
jne 0x100037e8f
cmp rdx, rbx
jne 0x100037eba
sub rcx, 2
mov word [rcx], bx
lea rcx, [rsp + 0x730]
mov edx, r13d
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, rbx
je 0x100037ed6
mov word [rax], bx
lea rdx, [0x10001d5c0]
lea rcx, [rsp + 0x730]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, ebx
je 0x100037f08
lea rdx, [0x100020520]
lea rcx, [rsp + 0x730]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, ebx
jne 0x100037f0a
mov ebp, esi
lea rdx, [rsp + 0x730]
lea rcx, [rsp + 0x500]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, rbx
jne 0x100038134
mov edx, r13d
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcschr]
mov rdi, rax
cmp rax, rbx
je 0x100037f46
add rdi, 2
jmp 0x100037e74
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea r9, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
lea rdx, [0x100020528]
xor r8d, r8d
mov dword [rsp + 0x34], r12d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x100038132
cmp dword [rsp + 0x30], esi
jne 0x100038132
cmp ebp, ebx
jne 0x100037fc3
lea rdx, [0x10001d5c0]
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, ebx
je 0x100038132
lea rdx, [0x100020520]
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, ebx
je 0x100038132
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll__wcslwr]
lea rcx, [rsp + 0x500]
call qword [sym.imp.msvcrt.dll__wcslwr]
lea rdi, [rsp + 0x50]
movsxd r12, ebp
lea rax, [rsp + 0x280]
mov r8, rdi
mov edx, 0x103
sub r8, rax
lea rcx, [rsp + 0x280]
lea rax, [rdx + 0x7ffffefb]
cmp rax, rbx
je 0x100038021
movzx eax, word [rcx + r8]
cmp ax, bx
je 0x100038021
mov word [rcx], ax
add rcx, 2
sub rdx, rsi
jne 0x100037fff
cmp rdx, rbx
jne 0x10003802a
sub rcx, 2
mov word [rcx], bx
lea rcx, [rsp + 0x280]
mov edx, r13d
call qword [sym.imp.msvcrt.dll_wcschr]
cmp rax, rbx
je 0x100038046
mov word [rax], bx
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x500]
call qword [sym.imp.msvcrt.dll_wcsstr]
mov rbp, rax
cmp rax, rbx
jne 0x10003809f
cmp r12, rbx
jne 0x100038115
lea rdx, [0x10001d5c0]
lea rcx, [rsp + 0x280]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, ebx
je 0x10003809f
lea rdx, [0x100020520]
lea rcx, [rsp + 0x280]
call qword [sym.imp.msvcrt.dll__wcsicmp]
cmp eax, ebx
jne 0x100038115
lea rax, [rsp + 0x500]
cmp rbp, rax
je 0x100038132
movzx ecx, word [rbp - 2]
call qword [sym.imp.msvcrt.dll_iswalnum]
mov ecx, ebx
cmp eax, ebx
sete cl
cmp ecx, ebx
jne 0x100038132
mov eax, 0x5c
cmp ax, word [rsp + 0x280]
je 0x100038115
lea r9, [rsp + 0x280]
lea r8, [0x100020540]
lea edx, [rax - 0x2b]
lea rcx, [rsp + 0x490]
call fcn.10002e570
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0x500]
call qword [sym.imp.msvcrt.dll_wcsstr]
mov edx, ebx
cmp rax, rbx
setne dl
cmp edx, ebx
jne 0x100038132
mov edx, r13d
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcschr]
mov rdi, rax
cmp rax, rbx
je 0x100038134
add rdi, 2
jmp 0x100037fe4
mov ebx, esi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x100037db1