Function at 0x1400245e0
Capabilities:
Get common file path
Query or enumerate registry key
Query or enumerate registry value
Set environment variable

Disassembly:
mov rax, rsp
push r12
push r14
push r15
sub rsp, 0x550
mov qword [rax - 0x4c0], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rsp + 0x540], rax
mov rcx, qword [0x1400ca008]
lea rax, [fcn.14001af10]
test rcx, rcx
je 0x140024638
cmp rcx, rax
je 0x140024638
mov ecx, 7
int 0x29
mov qword [0x1400ca008], rax
xor esi, esi
mov r15d, esi
mov dword [rsp + 0x50], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
test eax, eax
jns 0x140024660
mov eax, 0x800401f0
jmp 0x140024f51
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapSetInformation]
mov rdi, rsi
mov qword [rsp + 0x78], rsi
call fcn.14002f77c
test al, al
je 0x14002484e
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 9
lea rdx, str.SOFTWAREMicrosoftWindows_SearchGatherWindowsSystemIndexProtocols
mov rcx, 0xffffffff80000002
call fcn.14001e334
test eax, eax
jne 0x14002484e
mov dword [rsp + 0x60], 0xff
mov ebx, esi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x130]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
jne 0x140024842
mov ecx, 0xff
lea rax, [rsp + 0x130]
nop
cmp word [rax], 0
je 0x140024710
add rax, 2
sub rcx, 1
jne 0x140024700
test rcx, rcx
je 0x14002471f
mov eax, 0xff
sub rax, rcx
jmp 0x140024722
mov rax, rsi
test rcx, rcx
je 0x14002477f
mov edx, 0xff
sub rdx, rax
lea rcx, [rsp + 0x130]
lea rcx, [rcx + rax*2]
je 0x140024771
add rax, 0x7ffffeff
add rax, rdx
lea r9, [0x140097fb0]
sub r9, rcx
test rax, rax
je 0x140024771
movzx r8d, word [r9 + rcx]
test r8w, r8w
je 0x140024771
mov word [rcx], r8w
add rcx, 2
dec rax
sub rdx, 1
jne 0x140024750
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], si
lea rax, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 1
lea rdx, [rsp + 0x130]
mov rcx, qword [rsp + 0x58]
call fcn.14001e334
test eax, eax
jne 0x140024802
mov dword [rsp + 0x70], 0xff
mov dword [rsp + 0x48], 1
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x330]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x48]
xor r8d, r8d
lea rdx, str.ProgIdHandler
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1400247f7
lea rcx, [rsp + 0x330]
call fcn.140024f80
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
mov dword [rsp + 0x60], 0xff
inc ebx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x60]
lea r8, [rsp + 0x130]
mov edx, ebx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
test eax, eax
je 0x1400246f2
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop
lea rcx, [rsp + 0x58]
call fcn.1400216e0
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140024881
lea rdx, str.AccessDebugTracer
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test rax, rax
je 0x140024881
lea rcx, [0x1400c9148]
call qword [case.0x140006f84.0]
call fcn.1400218a8
nop
jmp 0x140024893
call int.1400218c8
mov eax, dword [0x1400ca100]
bt eax, 0x13
jae 0x1400248bd
lea rdx, [0x140097c98]
lea rcx, [0x1400c8290]
call fcn.1400218f4
mov eax, dword [0x1400ca100]
bt eax, 0xb
jae 0x1400248df
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
mov r8d, eax
lea rdx, [0x140097c88]
lea rcx, [0x1400c8290]
call fcn.140053178
call fcn.14002075c
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x20
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetPriorityClass]
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140027e90]
lea rcx, [0x1400ca048]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_InitOnceExecuteOnce]
cmp byte [0x1400ca038], 0
je 0x140024920
call fcn.14002f720
mov byte [rsp + 0x61], 1
mov qword [rsp + 0x70], rsi
lea rcx, [rsp + 0x70]
call fcn.140027104
nop
lea rcx, [rsp + 0xc0]
call fcn.140026a30
nop
lea rcx, [rsp + 0x58]
call fcn.140026db4
nop
lea rcx, [rsp + 0x68]
call fcn.140026d88
nop
lea rax, [rsp + 0x330]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x801c
xor ecx, ecx
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetFolderPathW]
test eax, eax
jns 0x1400249dd
mov rcx, qword [rsp + 0x568]
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0xde
call fcn.140020c10
mov r15d, 1
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400249af
call fcn.14000abd8
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400249bf
call fcn.14000abd8
nop
lea rcx, [rsp + 0xc0]
call fcn.140026948
nop
mov rcx, qword [rsp + 0x70]
call fcn.14000abd8
nop
jmp 0x140024ece
lea rdx, [rsp + 0x330]
lea rcx, str.LOCALAPPDATA
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x140024a53
mov rcx, qword [rsp + 0x568]
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, pe_nt_image_headers64
call fcn.1400563ec
mov r15d, 1
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140024a25
call fcn.14000abd8
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140024a35
call fcn.14000abd8
nop
lea rcx, [rsp + 0xc0]
call fcn.140026948
nop
mov rcx, qword [rsp + 0x70]
call fcn.14000abd8
nop
jmp 0x140024ece
lea rcx, [rsp + 0xc0]
call fcn.1400269b0
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x48], 0xc0100000
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x80]
mov edx, 1
lea rcx, [rsp + 0x70]
call fcn.140026fa4
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x48], 0xc0100000
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x80]
mov edx, 1
lea rcx, [rsp + 0x70]
call fcn.140026fa4
mov rbx, qword [rsp + 0x70]
mov r8, rbx
lea rcx, [rsp + 0xc0]
call fcn.140026990
mov dword [rsp + 0x88], SafeArrayPutElement
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x90], rax
mov dword [rsp + 0x98], esi
mov r14d, esi
cmp r14d, 0xf
jae 0x140024c2a
lea r8, str.SearchServiceMUT
mov edx, 1
lea rcx, [rsp + 0x88]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
mov rdx, rax
lea rcx, [0x1400ca108]
call fcn.14001a634
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r12d, eax
mov rcx, qword [0x1400ca108]
dec rcx
cmp rcx, 0xfffffffffffffffd
ja 0x140024b78
test eax, eax
je 0x140024c2a
xor edx, edx
lea rcx, [0x1400ca108]
call fcn.14001a634
cmp r12d, 0xb7
je 0x140024bd1
mov r15d, 1
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140024ba5
call fcn.14000abd8
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140024bb5
call fcn.14000abd8
nop
lea rcx, [rsp + 0xc0]
call fcn.140026948
nop
mov rcx, rbx
call fcn.14000abd8
nop
jmp 0x140024ece
cmp r14d, 0xe
jne 0x140024c17
lea r15d, [r14 - 0xc]
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140024beb
call fcn.14000abd8
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140024bfb
call fcn.14000abd8
nop
lea rcx, [rsp + 0xc0]
call fcn.140026948
nop
mov rcx, rbx
call fcn.14000abd8
nop
jmp 0x140024ece
mov ecx, 0x7d0
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
inc r14d
jmp 0x140024b24
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140024c3a
call fcn.14000abd8
nop
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x140024c4a
call fcn.14000abd8
nop
lea rcx, [rsp + 0xc0]
call fcn.140026948
nop
mov rcx, rbx
call fcn.14000abd8
nop
lea rcx, [rsp + 0x48]
call fcn.140022e8c
mov rdi, rax
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x140024c88
mov r15d, 1
mov dword [rsp + 0x50], r15d
jmp 0x140024ece
mov r14d, dword [rsp + 0x48]
cmp r14d, 2
jne 0x140024cf2
mov ebx, 1
mov r12d, 0xfffd
nop
cmp ebx, r14d
jge 0x140024cf2
movsxd rax, ebx
mov rcx, qword [rdi + rax*8]
movzx eax, word [rcx]
sub ax, 0x2d
test r12w, ax
je 0x140024cc9
mov r15d, 1
mov dword [rsp + 0x50], r15d
jmp 0x140024ece
add rcx, 2
lea rdx, str.Embedding
call qword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x140024ce2
inc ebx
jmp 0x140024ca0
mov r15d, 1
mov dword [rsp + 0x50], r15d
jmp 0x140024ece
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
mov ebx, eax
mov dword [rsp + 0x48], eax
mov r14d, eax
mov rcx, qword [rsp + 0x568]
test eax, eax
jns 0x140024d1b
mov r9d, eax
mov edx, 0x153
jmp 0x140024d37
call fcn.1400257fc
mov r14d, eax
mov rcx, qword [rsp + 0x568]
test eax, eax
jns 0x140024d5b
mov r9d, eax
mov edx, 0x158
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
call fcn.14002c058
mov r15d, r14d
mov dword [rsp + 0x50], r14d
test ebx, ebx
js 0x140024d56
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop
jmp 0x140024ece
xor bl, bl
xor eax, eax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov dword [rsp + 0x90], 3
lea rax, str.AllowWindowsIndexer
mov qword [rsp + 0x88], rax
movups xmm0, xmmword [rsp + 0x88]
movaps xmmword [rsp + 0x110], xmm0
movups xmm1, xmmword [rsp + 0x98]
movaps xmmword [rsp + 0x120], xmm1
xor edx, edx
lea rcx, [rsp + 0x110]
call fcn.14001f778
test eax, eax
jne 0x140024dcb
mov bl, 1
call fcn.14005609c
movzx edx, bl
call fcn.140026318
mov rbx, qword [0x1400c9cb8]
test rbx, rbx
je 0x140024e1c
cmp qword [rbx], 0
je 0x140024e1c
mov rax, qword [rbx + 0x38]
call qword [case.0x140006f84.0]
mov rdx, rax
mov rcx, qword [rbx]
call fcn.14002ae54
test eax, eax
js 0x140024e88
xor ecx, ecx
mov rax, qword [rbx + 8]
call qword [case.0x140006f84.0]
test eax, eax
js 0x140024e88
add rbx, 0x48
cmp qword [rbx], 0
jne 0x140024de5
mov rax, qword [0x1400cb790]
test rax, rax
je 0x140024e32
call qword [case.0x140006f84.0]
test eax, eax
js 0x140024e88
mov eax, esi
mov rbx, qword [0x1400cb470]
mov rcx, qword [0x1400cb478]
cmp rbx, rcx
jae 0x140024e88
mov rsi, qword [rbx]
test rsi, rsi
je 0x140024e7f
mov rax, qword [rsi + 0x38]
call qword [case.0x140006f84.0]
mov rdx, rax
mov rcx, qword [rsi]
call fcn.14002ae54
test eax, eax
js 0x140024e88
xor ecx, ecx
mov rax, qword [rsi + 8]
call qword [case.0x140006f84.0]
test eax, eax
js 0x140024e88
mov rcx, qword [0x1400cb478]
add rbx, 8
cmp rbx, rcx
jb 0x140024e47
mov rcx, qword [rsp + 0x568]
test eax, eax
jns 0x140024ea8
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x16f
call fcn.14002c058
mov dword [rsp + 0x48], 3
lea rcx, [rsp + 0x48]
call fcn.1400294e0
nop
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop
jmp 0x140024ece
call qword [sym.imp.MSSRCH.DLL_public:_static_void___cdecl_CSearchServiceObj::Cleanup_void_]
mov byte [rsp + 0x40], 1
lea rdx, [rsp + 0x40]
call fcn.140028f60
mov eax, dword [0x1400ca100]
bt eax, 0xb
jae 0x140024f11
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
mov r8d, eax
lea rdx, [0x140097b68]
lea rcx, [0x1400c8290]
call fcn.140053178
mov eax, dword [0x1400ca100]
bt eax, 0x13
jae 0x140024f2a
lea rdx, [0x140097c58]
lea rcx, [0x1400c8290]
call fcn.1400218f4
call fcn.14002c090
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop
lea rcx, [rsp + 0x60]
call fcn.14002f6fc
nop
test rdi, rdi
je 0x140024f4e
mov rcx, rdi
call fcn.14000abd8
mov eax, r15d
mov rcx, qword [rsp + 0x540]
xor rcx, rsp
call fcn.14002cdb0
lea r11, [rsp + 0x550]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop r12
ret