Function at 0x1000154fc
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rsi
push rdi
push r13
sub rsp, 0x70
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov rsi, r8
mov rbx, rdx
lea r13, [0x1000074e0]
mov qword [rax - 0x30], r13
xor ebp, ebp
mov qword [rax - 0x28], rbp
mov edi, 0x20a
mov rcx, rdi
call fcn.10001e6e0
mov qword [rsp + 0x48], rax
mov dword [rsp + 0xa8], 0x208
mov rcx, rdi
call fcn.10001e6e0
mov qword [rsp + 0x40], rax
mov rcx, rdi
call fcn.10001e6e0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x28], rbx
lea rax, [0x1000059e8]
mov qword [rsp + 0x20], rax
lea r9, [0x100006db0]
lea r8, [0x100006e08]
mov edi, 0x104
mov rdx, rdi
mov rcx, qword [rsp + 0x48]
call fcn.100010764
mov ebx, eax
cmp eax, ebp
jge 0x1000155df
lea rax, [0x10002d220]
mov rcx, qword [0x10002d220]
cmp rcx, rax
je 0x1000155cc
test byte [rcx + 0x1c], 1
je 0x1000155cc
lea edx, [rbp + 0x29]
mov r9d, ebx
lea r8, [0x100001a28]
mov rcx, qword [rcx + 0x10]
call fcn.10000f078
mov edx, ebx
lea rcx, [0x1000066a0]
call fcn.10000eea8
jmp 0x10001584c
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
mov rdx, qword [rsp + 0x48]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, ebp
cmovle ebx, eax
cmp ebx, ebp
jge 0x10001565a
lea rax, [0x10002d220]
mov rcx, qword [0x10002d220]
cmp rcx, rax
je 0x100015647
test byte [rcx + 0x1c], 1
je 0x100015647
mov edx, 0x2a
mov r9d, ebx
lea r8, [0x100001a28]
mov rcx, qword [rcx + 0x10]
call fcn.10000f078
mov edx, ebx
lea rcx, [0x100006e20]
call fcn.10000eea8
jmp 0x10001584c
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
lea rdx, [0x100006e68]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, ebp
cmovle ebx, eax
cmp ebx, ebp
jge 0x1000156e1
lea rax, [0x10002d220]
mov rcx, qword [0x10002d220]
cmp rcx, rax
je 0x1000156ce
test byte [rcx + 0x1c], 1
je 0x1000156ce
mov edx, 0x2b
mov r9d, ebx
lea r8, [0x100001a28]
mov rcx, qword [rcx + 0x10]
call fcn.10000f078
mov edx, ebx
lea rcx, [0x100006e90]
call fcn.10000eea8
jmp 0x10001584c
mov rax, qword [rsp + 0x40]
mov word [rax + 0x208], bp
cmp dword [rsp + 0x30], 2
jne 0x10001575a
mov r8d, edi
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebp
jne 0x1000157e1
call fcn.10001e9f0
mov ebx, eax
lea rax, [0x10002d220]
mov rcx, qword [0x10002d220]
cmp rcx, rax
je 0x100015747
test byte [rcx + 0x1c], 1
je 0x100015747
mov edx, 0x2c
mov r9d, ebx
lea r8, [0x100001a28]
mov rcx, qword [rcx + 0x10]
call fcn.10000f078
mov edx, ebx
lea rcx, [0x100006ee0]
call fcn.10000eea8
jmp 0x10001584c
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
mov ebx, ebp
lea rax, [rdi + 0x7ffffefa]
cmp rax, rbp
je 0x10001578b
movzx eax, word [rdx]
cmp ax, bp
je 0x10001578b
mov word [rcx], ax
add rcx, 2
add rdx, 2
sub rdi, 1
jne 0x100015766
cmp rdi, rbp
jne 0x100015799
sub rcx, 2
mov ebx, 0x8007007a
mov word [rcx], bp
cmp ebx, ebp
jge 0x1000157e1
lea rax, [0x10002d220]
mov rcx, qword [0x10002d220]
cmp rcx, rax
je 0x1000157d1
test byte [rcx + 0x1c], 1
je 0x1000157d1
mov edx, 0x2d
mov r9d, ebx
lea r8, [0x100001a28]
mov rcx, qword [rcx + 0x10]
call fcn.10000f078
mov edx, ebx
lea rcx, [0x100006870]
call fcn.10000eea8
jmp 0x10001584c
mov rax, qword [rsp + 0x38]
mov word [rax + 0x208], bp
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [rsi], rax
cmp rax, rbp
jne 0x10001584c
call fcn.10001e9f0
mov ebx, eax
lea rax, [0x10002d220]
mov rcx, qword [0x10002d220]
cmp rcx, rax
je 0x10001583e
test byte [rcx + 0x1c], 1
je 0x10001583e
mov edx, 0x2e
mov r9d, ebx
lea r8, [0x100001a28]
mov rcx, qword [rcx + 0x10]
call fcn.10000f078
mov edx, ebx
lea rcx, [0x100006f40]
call fcn.10000eea8
mov rcx, rbp
xchg qword [rsp + 0x38], rcx
cmp rcx, rbp
je 0x100015860
call qword [sym.imp.msvcrt.dll_free]
nop
mov rcx, rbp
xchg qword [rsp + 0x40], rcx
cmp rcx, rbp
je 0x100015874
call qword [sym.imp.msvcrt.dll_free]
nop
mov rcx, rbp
xchg qword [rsp + 0x48], rcx
cmp rcx, rbp
je 0x100015888
call qword [sym.imp.msvcrt.dll_free]
nop
mov qword [rsp + 0x58], r13
mov rcx, qword [rsp + 0x60]
cmp rcx, rbp
je 0x10001589d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r13
pop rdi
pop rsi
ret