Function at 0x10000a720
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
xor r13d, r13d
mov rbp, rdx
lea rax, [r11 - 0x38]
mov esi, 0x20019
lea rdx, str.SOFTWAREMicrosoftAssistanceClient1.0LocalReg
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov r9d, esi
mov qword [r11 - 0x68], rax
mov rdi, r13
mov qword [r11 - 0x38], r13
mov qword [r11 - 0x50], r13
mov qword [r11 - 0x30], r13
mov qword [r11 - 0x48], r13
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov r12, qword [rsp + 0xb8]
mov r14d, 0x8007000e
cmp eax, r13d
jne 0x100022097
mov rcx, qword [rsp + 0x50]
cmp rcx, r13
je 0x100022097
lea rax, [rsp + 0x38]
lea rdx, str.CLSID
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r13d
jne 0x10002208d
cmp qword [rsp + 0x38], r13
je 0x10002208d
lea rdx, [rsp + 0x48]
mov rcx, rbp
mov qword [rsp + 0x48], r13
call qword [sym.imp.ole32.dll_StringFromCLSID]
mov ebx, eax
cmp eax, r13d
jne 0x10000a999
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x58]
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call qword [sym.imp.ole32.dll_CoTaskMemFree]
cmp ebx, r13d
jne 0x10002208d
mov rcx, qword [rsp + 0x58]
cmp rcx, r13
je 0x10002208d
lea rax, [rsp + 0x40]
lea rdx, str.InprocServer32
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r13d
jne 0x10002208d
mov rcx, qword [rsp + 0x40]
cmp rcx, r13
je 0x10002208d
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x34]
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov dword [rsp + 0x34], r13d
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x30], r13d
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
cmp eax, r13d
jne 0x100022097
mov esi, dword [rsp + 0x30]
lea ebx, [r13 + 2]
lea r15, [r13 - 1]
shr rsi, 1
mov rax, rbx
mul rsi
cmovo rax, r15
mov rcx, rax
call fcn.100008150
mov rdi, rax
cmp rax, r13
je 0x10002204a
mov word [rax], r13w
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
cmp eax, r13d
jne 0x100022097
mov eax, dword [rsp + 0x34]
sub eax, 1
je 0x10000a95a
cmp eax, 1
jne 0x100022052
lea rcx, [rsi + 0x104]
mov rax, rbx
mul rcx
cmovo rax, r15
mov rcx, rax
call fcn.100008150
mov rbx, rax
cmp rax, r13
je 0x10002204a
lea r8d, [rsi + 0x104]
mov rdx, rax
mov rcx, rdi
mov word [rax], r13w
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, r13d
je 0x100022074
mov rcx, rdi
call sub.msvcrt.dll_free
mov rdi, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp rax, r13
je 0x100022074
lea rdx, str.DllGetClassObject
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
cmp rax, r13
je 0x100022074
lea rdx, [0x10006a868]
mov r8, r12
mov rcx, rbp
call rax
jmp 0x10000a995
mov ebx, eax
jmp 0x10000a999
mov rcx, qword [rsp + 0x50]
cmp rcx, r13
je 0x10000a9a9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x38]
cmp rcx, r13
je 0x10000a9b9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x58]
cmp rcx, r13
je 0x10000a9c9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x40]
cmp rcx, r13
je 0x10000a9d9
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp rdi, r13
je 0x10000a9e6
mov rcx, rdi
call sub.msvcrt.dll_free
cmp ebx, r14d
je 0x1000220a1
cmp ebx, r13d
jl 0x1000220a9
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ebx, r14d
jmp 0x10000a999
xor r8d, r8d
lea r9, [0x10006a868]
mov rcx, rbp
lea edx, [r8 + 1]
mov qword [rsp + 0x20], r12
call qword [sym.imp.ole32.dll_CoGetClassObject]
nop
jmp 0x10000a995
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r13d
cmovle ebx, eax
jmp 0x10000a999
mov ebx, 0x80040154
jmp 0x10000a999
mov ebx, 0x80040150
jmp 0x10000a999
mov eax, r14d
jmp 0x10000a9fa
xor r8d, r8d
lea r9, [0x10006a868]
mov rcx, rbp
lea edx, [r8 + 1]
mov qword [rsp + 0x20], r12
call qword [sym.imp.ole32.dll_CoGetClassObject]
cmp eax, r13d
jge 0x1000220d3
cmp eax, r14d
jne 0x10000a9f8
mov ebx, eax
jmp 0x10000a9f8