Function at 0x140061fb0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x21a0]
mov eax, 0x22a0
call fcn.1400be950
sub rsp, rax
mov rax, qword [0x140396c80]
xor rax, rsp
mov qword [rbp + 0x2190], rax
xor r12d, r12d
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
lea r9d, [r12 + 1]
xor r8d, r8d
lea rdx, str.SOFTWAREMicrosoftWindows_NTCurrentVersionFonts
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400620ea
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohl
mov qword [rbp - 0x30], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.ofTrueTypeFont]
movsd qword [rbp - 0x48], xmm0
mov eax, dword [0x14029b560]
mov dword [rbp - 0x40], eax
movzx eax, word [0x14029b564]
mov word [rbp - 0x3c], ax
mov byte [rbp - 0x3a], r12b
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x60]
call fcn.14006c490
nop
lea rcx, [rax + 0x40]
lea rdx, str.initWindows__:_couldnt_find_fonts_registery_key
call fcn.140006d80
mov rbx, rax
call fcn.14006ce70
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x14006208f
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.1400072b0
nop
lea rcx, [rbp + 0x60]
call fcn.14006c6d0
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x1400629f0
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400629eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400629eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x50], r12
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x64]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x140062202
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohl
mov qword [rbp - 0x30], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.ofTrueTypeFont]
movsd qword [rbp - 0x48], xmm0
mov eax, dword [0x14029b560]
mov dword [rbp - 0x40], eax
movzx eax, word [0x14029b564]
mov word [rbp - 0x3c], ax
mov byte [rbp - 0x3a], r12b
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x60]
call fcn.14006c490
nop
lea rcx, [rax + 0x40]
lea rdx, str.initWindows__:_couldnt_query_registery_for_fonts
call fcn.140006d80
mov rbx, rax
call fcn.14006ce70
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x1400621a7
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.1400072b0
nop
lea rcx, [rbp + 0x60]
call fcn.14006c6d0
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x1400629f0
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400629eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400629eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp dword [rsp + 0x64], r12d
jne 0x1400622d8
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohl
mov qword [rbp - 0x30], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.ofTrueTypeFont]
movsd qword [rbp - 0x48], xmm0
mov eax, dword [0x14029b560]
mov dword [rbp - 0x40], eax
movzx eax, word [0x14029b564]
mov word [rbp - 0x3c], ax
mov byte [rbp - 0x3a], r12b
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x60]
call fcn.14006c490
nop
lea rcx, [rax + 0x40]
lea rdx, str.initWindows__:_couldnt_find_any_fonts_in_registery
call fcn.140006d80
mov rbx, rax
call fcn.14006ce70
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x14006227d
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.1400072b0
nop
lea rcx, [rbp + 0x60]
call fcn.14006c6d0
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x1400629f0
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400629eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400629eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ebx, dword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
mov qword [rbp - 0x78], rax
test rax, rax
je 0x1400629f0
lea rcx, str.windir
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], r12
mov qword [rbp + 0x10], r12
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r12b
jne 0x140062326
mov rdx, rax
lea rcx, [rbp - 8]
call fcn.1400043c0
nop
mov rcx, qword [rbp + 8]
mov rdx, qword [rbp + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 7
jb 0x140062383
lea rax, [rcx + 7]
mov qword [rbp + 8], rax
lea rbx, [rbp - 8]
cmp rdx, 0xf
cmova rbx, qword [rbp - 8]
add rbx, rcx
mov r8d, 7
lea rdx, str.Fonts_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 7], 0
jmp 0x1400623a3
mov qword [rsp + 0x20], 7
lea r9, str.Fonts_
xor r8d, r8d
lea edx, [r8 + 7]
lea rcx, [rbp - 8]
call fcn.14005d4c0
mov ecx, r12d
mov dword [rsp + 0x6c], ecx
cmp dword [rsp + 0x64], ecx
jbe 0x140062968
nop dword [rax]
nop dword [rax + rax]
mov dword [rsp + 0x70], 0x800
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x74], eax
lea rax, [rsp + 0x74]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0x70]
lea r8, [rbp + 0x1190]
mov edx, ecx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x1400624d4
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], reloc.WS2_32.dll_ntohl
mov qword [rbp - 0x50], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.ofTrueTypeFont]
movsd qword [rbp - 0x68], xmm0
mov eax, dword [0x14029b560]
mov dword [rbp - 0x60], eax
movzx eax, word [0x14029b564]
mov word [rbp - 0x5c], ax
mov byte [rbp - 0x5a], 0
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x60]
call fcn.14006c490
nop
lea rcx, [rax + 0x40]
lea rdx, str.initWindows__:_couldnt_read_registry_key_for_font_type
call fcn.140006d80
mov rbx, rax
call fcn.14006ce70
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x14006247a
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.1400072b0
nop
lea rcx, [rbp + 0x60]
call fcn.14006c6d0
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x140062954
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400624ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400629c1
call fcn.1400be46c
jmp 0x140062954
mov r8d, 0x800
lea rdx, [rbp + 0x1190]
lea rcx, [rbp + 0x190]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs]
mov r8d, 0x800
mov rdx, rdi
lea rcx, [rbp + 0x990]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs]
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], r12
lea rax, [rbp + 0x190]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140062521
lea rdx, [rbp + 0x190]
lea rcx, [rbp - 0x28]
call fcn.1400043c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x28], r12
mov qword [rbp + 0x30], r12
lea rax, [rbp + 0x990]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140062560
lea rdx, [rbp + 0x990]
lea rcx, [rbp + 0x18]
call fcn.1400043c0
nop
lea rbx, [rbp - 0x28]
cmp qword [rbp - 0x10], 0xf
seta r14b
mov rsi, qword [rbp - 0x28]
cmova rbx, rsi
mov rdi, qword [rbp - 0x18]
test rdi, rdi
je 0x1400625b3
mov r8, rdi
mov edx, Ordinal_41
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x1400625b3
sub rax, rbx
jmp 0x1400625ba
mov rax, 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], r12
lea r8, [rax - 1]
cmp rdi, r8
cmovb r8, rdi
lea rdx, [rbp - 0x28]
test r14b, r14b
cmovne rdx, rsi
lea rcx, [rbp - 0x68]
call fcn.1400043c0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x140062623
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006261e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400629d6
call fcn.1400be46c
movups xmm0, xmmword [rbp - 0x68]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rbp - 0x58]
movups xmmword [rbp - 0x18], xmm1
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x68], 0
lea r8, [rbp - 0x68]
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x38]
call fcn.14006b4e0
mov rbx, rax
lea rax, [rbp - 0x28]
cmp rax, rbx
je 0x1400626d0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x1400626a2
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14006269d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400629c8
call fcn.1400be46c
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x28], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rbp + 0x50]
cmp rdx, 0xf
jbe 0x14006270b
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062706
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400629c8
call fcn.1400be46c
mov qword [rbp + 0x48], r12
mov qword [rbp + 0x50], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x38], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x140062756
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062751
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400629cf
call fcn.1400be46c
mov r14, qword [rbp + 8]
movabs rdx, 0x7fffffffffffffff
mov rax, rdx
sub rax, r14
mov r15, qword [rbp + 0x28]
cmp rax, r15
jb 0x140062a20
lea rax, [rbp - 8]
cmp qword [rbp + 0x10], 0xf
cmova rax, qword [rbp - 8]
mov qword [rbp - 0x80], rax
lea rcx, [rbp + 0x18]
mov r13, qword [rbp + 0x30]
cmp r13, 0xf
seta byte [rsp + 0x60]
mov rsi, qword [rbp + 0x18]
cmova rcx, rsi
mov qword [rbp - 0x70], rcx
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], r12
lea r12, [r15 + r14]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rbp - 0x68]
cmp r12, rbx
jbe 0x14006284d
mov rbx, r12
or rbx, 0xf
cmp rbx, rdx
jbe 0x1400627ea
mov rbx, rdx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140062811
cmp rbx, 0x16
mov ecx, reloc.WS2_32.dll_shutdown
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140062834
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140062a26
mov rcx, rax
call fcn.1400be430
test rax, rax
je 0x1400629d6
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov rax, qword [rbp - 0x80]
jmp 0x140062849
test rcx, rcx
je 0x140062847
call fcn.1400be430
mov rdi, rax
mov rax, qword [rbp - 0x80]
jmp 0x140062849
xor edi, edi
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], rbx
mov r8, r14
mov rdx, rax
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rdi + r14]
mov r8, r15
mov rdx, qword [rbp - 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r12], 0
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x48]
lea rcx, [0x1403ac640]
call fcn.14005df90
mov rcx, qword [rax]
add rcx, 0x30
lea rdx, [rbp - 0x68]
call fcn.14001baa0
nop
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x1400628d9
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400628d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400629d6
call fcn.1400be46c
nop
cmp byte [rsp + 0x60], 0
je 0x140062912
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140062909
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400629dd
mov rcx, rsi
call fcn.1400be46c
nop
mov rdx, qword [rbp - 0x10]
cmp rdx, 0xf
jbe 0x14006294d
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140062948
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400629e4
call fcn.1400be46c
xor r12d, r12d
mov rdi, qword [rbp - 0x78]
mov ecx, dword [rsp + 0x6c]
inc ecx
mov dword [rsp + 0x6c], ecx
cmp ecx, dword [rsp + 0x64]
jb 0x1400623c0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 0xf
jbe 0x1400629f0
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400629eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400629eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400be46c
mov rcx, qword [rbp + 0x2190]
xor rcx, rsp
call fcn.1400be7c0
lea r11, [rsp + 0x22a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140004d20
nop
call fcn.140004c10
int3