Function at 0x1400062a8
Capabilities:
Get common file path
Query or enumerate registry key
Query or enumerate registry value
Set environment variable

Disassembly:
mov r11, rsp
push r13
push r14
push r15
sub rsp, 0x4f0
mov qword [r11 - 0x468], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
mov rax, qword [0x1400da318]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rcx, qword [0x1400dadd0]
xor esi, esi
lea rax, [0x140050a00]
test rcx, rcx
je 0x140006303
cmp rcx, rax
jne 0x140006d68
mov qword [0x1400dadd0], rax
mov r14d, 1
mov dword [rsp + 0x68], r14d
lea ebx, [r14 + 3]
mov r8d, ebx
lea rdx, [rsp + 0x68]
lea ecx, [rbx - 2]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
nop dword [rax + rax]
mov dword [rsp + 0x48], 2
mov r8d, ebx
lea rdx, [rsp + 0x48]
lea r12d, [r14 + 8]
mov ecx, r12d
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
nop dword [rax + rax]
mov dword [rsp + 0x58], r14d
mov r8d, ebx
lea rdx, [rsp + 0x58]
lea ecx, [rbx + 6]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_1.dll_SetProcessMitigationPolicy]
nop dword [rax + rax]
mov r15d, esi
mov dword [rsp + 0x48], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
nop dword [rax + rax]
test eax, eax
jns 0x140006394
mov eax, 0x800401f0
jmp 0x140006d35
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l1_1_0.dll_HeapSetInformation]
nop dword [rax + rax]
mov rdi, rsi
mov qword [rsp + 0x78], rsi
call fcn.14000796c
test al, al
je 0x14000655b
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r12d
lea r8, str.SOFTWAREMicrosoftWindows_SearchGatherWindowsSystemIndexProtocols
mov rdx, 0xffffffff80000002
call fcn.14000a928
test eax, eax
jne 0x14000655b
mov r12d, 0xff
mov ebx, esi
xor edx, edx
jmp 0x14000650a
mov rcx, r12
lea rax, [rsp + 0xd0]
cmp word [rax], si
je 0x140006412
add rax, 2
sub rcx, r14
jne 0x140006404
test rcx, rcx
je 0x14000641f
mov rax, r12
sub rax, rcx
jmp 0x140006422
mov rax, rsi
test rcx, rcx
je 0x14000647d
mov rdx, r12
sub rdx, rax
lea rcx, [rsp + 0xd0]
lea rcx, [rcx + rax*2]
je 0x14000646f
lea r8, [rax + 0x7ffffeff]
add r8, rdx
lea rax, [0x1400a7c30]
sub rax, rcx
test r8, r8
je 0x14000646f
movzx r9d, word [rax + rcx]
test r9w, r9w
je 0x14000646f
mov word [rcx], r9w
add rcx, 2
sub r8, r14
sub rdx, r14
jne 0x14000644f
lea rax, [rcx - 2]
test rdx, rdx
cmovne rax, rcx
mov word [rax], si
lea rax, [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r14d
lea r8, [rsp + 0xd0]
mov rdx, qword [rsp + 0x60]
call fcn.14000a928
test eax, eax
jne 0x140006505
mov dword [rsp + 0x68], r12d
mov dword [rsp + 0x50], r14d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
xor r8d, r8d
lea rdx, str.ProgIdHandler
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
nop dword [rax + rax]
test eax, eax
jne 0x1400064f4
lea rcx, [rsp + 0x2d0]
call fcn.140007910
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
add ebx, r14d
mov edx, ebx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov dword [rsp + 0x58], r12d
lea r9, [rsp + 0x58]
lea r8, [rsp + 0xd0]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegEnumKeyExW]
nop dword [rax + rax]
test eax, eax
je 0x1400063f9
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
nop dword [rax + rax]
nop
call fcn.14002649c
nop
jmp 0x140006571
call fcn.140028300
test byte [0x1400dc882], 8
je 0x1400065a2
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea rdx, [0x1400a7768]
lea rcx, [0x1400d9440]
call fcn.1400293b4
test byte [0x1400dc881], 8
je 0x1400065cd
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
nop dword [rax + rax]
mov r8d, eax
lea rdx, [0x1400b43f8]
lea rcx, [0x1400d9440]
call fcn.14004c7c8
call fcn.140003464
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
nop dword [rax + rax]
mov rcx, rax
mov edx, 0x20
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_SetPriorityClass]
nop dword [rax + rax]
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140002af0]
lea rcx, [0x1400db2c8]
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_InitOnceExecuteOnce]
nop dword [rax + rax]
cmp byte [0x1400dadf8], sil
je 0x140006620
call fcn.140051028
mov byte [rsp + 0x59], r14b
mov qword [rsp + 0x68], rsi
lea rcx, [rsp + 0x68]
call fcn.140027508
nop
lea rcx, [rsp + 0xd0]
call fcn.14001e538
nop
lea rcx, [rsp + 0x60]
call fcn.14001d798
nop
lea rcx, [rsp + 0x70]
call fcn.14001d764
nop
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x801c
xor ecx, ecx
call qword [sym.imp.ext_ms_win_shell32_shellfolders_l1_1_0.dll_SHGetFolderPathW]
nop dword [rax + rax]
test eax, eax
jns 0x1400066f8
mov rcx, qword [rsp + 0x508]
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0xf7
call fcn.14004a398
mov r15d, r14d
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400066ba
mov rax, qword [0x14009d348]
call qword [case.0x1400244c5.0]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400066d2
mov rax, qword [0x14009d348]
call qword [case.0x1400244c5.0]
nop
lea rcx, [rsp + 0xd0]
call fcn.14001e2ec
nop
mov rcx, qword [rsp + 0x68]
mov rax, qword [0x14009d348]
call qword [case.0x1400244c5.0]
nop
jmp 0x140006c65
lea rdx, [rsp + 0x2d0]
lea rcx, str.LOCALAPPDATA
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_SetEnvironmentVariableW]
nop dword [rax + rax]
test eax, eax
jne 0x140006789
mov rcx, qword [rsp + 0x508]
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x101
call fcn.140051450
mov r15d, r14d
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14000674b
mov rax, qword [0x14009d348]
call qword [case.0x1400244c5.0]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140006763
mov rax, qword [0x14009d348]
call qword [case.0x1400244c5.0]
nop
lea rcx, [rsp + 0xd0]
call fcn.14001e2ec
nop
mov rcx, qword [rsp + 0x68]
mov rax, qword [0x14009d348]
call qword [case.0x1400244c5.0]
nop
jmp 0x140006c65
lea rcx, [rsp + 0xd0]
call fcn.140026988
mov byte [rsp + 0x40], sil
mov ebx, 0xc0100000
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb0]
mov edx, r14d
lea rcx, [rsp + 0x68]
call fcn.140026d00
mov byte [rsp + 0x40], sil
mov dword [rsp + 0x50], ebx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xb0]
mov edx, r14d
lea rcx, [rsp + 0x68]
call fcn.140026d00
mov rbx, qword [rsp + 0x68]
mov r8, rbx
lea rcx, [rsp + 0xd0]
call fcn.14001e5ac
mov dword [rsp + 0x80], SafeArrayPutElement
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x88], rax
mov dword [rsp + 0x90], esi
mov r12d, esi
cmp r12d, 0xf
jae 0x140006997
lea r8, str.SearchServiceMUT
mov edx, r14d
lea rcx, [rsp + 0x80]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateMutexW]
nop dword [rax + rax]
mov rdx, rax
lea rcx, [0x1400db440]
call fcn.14000c778
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r13d, eax
mov rcx, qword [0x1400db440]
dec rcx
cmp rcx, 0xfffffffffffffffd
ja 0x1400068b1
test eax, eax
je 0x140006997
xor edx, edx
lea rcx, [0x1400db440]
call fcn.14000c778
cmp r13d, 0xb7
je 0x14000691f
mov r15d, r14d
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400068e3
mov rax, qword [0x14009d348]
call qword [case.0x1400244c5.0]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400068fb
mov rax, qword [0x14009d348]
call qword [case.0x1400244c5.0]
nop
lea rcx, [rsp + 0xd0]
call fcn.14001e2ec
nop
mov rcx, rbx
mov rax, qword [0x14009d348]
call qword [case.0x1400244c5.0]
nop
jmp 0x140006c65
cmp r12d, 0xe
jne 0x14000697e
lea r15d, [r12 - 0xc]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x140006942
mov rax, qword [0x14009d348]
call qword [case.0x1400244c5.0]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x14000695a
mov rax, qword [0x14009d348]
call qword [case.0x1400244c5.0]
nop
lea rcx, [rsp + 0xd0]
call fcn.14001e2ec
nop
mov rcx, rbx
mov rax, qword [0x14009d348]
call qword [case.0x1400244c5.0]
nop
jmp 0x140006c65
mov ecx, 0x7d0
call qword [sym.imp.api_ms_win_core_synch_l1_2_0.dll_Sleep]
nop dword [rax + rax]
add r12d, r14d
jmp 0x140006853
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1400069af
mov rax, qword [0x14009d348]
call qword [case.0x1400244c5.0]
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400069c7
mov rax, qword [0x14009d348]
call qword [case.0x1400244c5.0]
nop
lea rcx, [rsp + 0xd0]
call fcn.14001e2ec
nop
mov rcx, rbx
mov rax, qword [0x14009d348]
call qword [case.0x1400244c5.0]
nop
lea rcx, [rsp + 0x68]
call fcn.140024e80
mov rdi, rax
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x140006a0a
mov r15d, r14d
mov dword [rsp + 0x48], r14d
jmp 0x140006c65
cmp dword [rsp + 0x68], 2
jne 0x140006a6c
mov ebx, r14d
cmp ebx, dword [rsp + 0x68]
jge 0x140006a6c
movsxd rax, ebx
mov rcx, qword [rdi + rax*8]
movzx eax, word [rcx]
sub ax, 0x2d
mov edx, 0xfffd
test dx, ax
je 0x140006a3f
mov r15d, r14d
mov dword [rsp + 0x48], r14d
jmp 0x140006c65
add rcx, 2
lea rdx, str.Embedding
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140006a5f
add ebx, r14d
jmp 0x140006a14
mov r15d, r14d
mov dword [rsp + 0x48], r14d
jmp 0x140006c65
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoInitializeEx]
nop dword [rax + rax]
mov ebx, eax
mov dword [rsp + 0x50], eax
mov r12d, eax
mov rcx, qword [rsp + 0x508]
test eax, eax
jns 0x140006aaa
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x16c
call fcn.1400427b0
jmp 0x140006b7c
mov qword [rsp + 0x60], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [0x1400a5418]
mov r8d, r14d
xor edx, edx
lea rcx, [0x1400a6d88]
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoCreateInstance]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x508]
test eax, eax
jns 0x140006af8
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x173
call fcn.1400427b0
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140006b37
mov rax, qword [rcx]
mov r8, r14
mov edx, 5
mov rax, qword [rax + 0x18]
call qword [case.0x1400244c5.0]
mov rcx, qword [rsp + 0x508]
test eax, eax
jns 0x140006b37
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x176
call fcn.1400427b0
call fcn.14001e5d8
mov r12d, eax
mov rcx, qword [rsp + 0x508]
test eax, eax
jns 0x140006b60
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x17a
call fcn.1400427b0
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x140006b77
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x1400244c5.0]
test r12d, r12d
jns 0x140006b9a
mov r15d, r12d
mov dword [rsp + 0x48], r12d
test ebx, ebx
js 0x140006b95
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop dword [rax + rax]
nop
jmp 0x140006c65
mov bl, sil
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x8c], xmm0
mov dword [rsp + 0x9c], esi
mov r12d, 3
mov dword [rsp + 0x88], r12d
lea rax, str.AllowWindowsIndexer
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0xb0], xmm0
movups xmm1, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0xc0], xmm1
xor edx, edx
lea rcx, [rsp + 0xb0]
call fcn.140019664
test eax, eax
jne 0x140006c08
mov bl, r14b
call fcn.140050fa4
mov dl, bl
call fcn.140028050
call fcn.140053e88
mov rcx, qword [rsp + 0x508]
test eax, eax
jns 0x140006c34
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_servicemain.cxx
mov edx, 0x191
call fcn.1400427b0
mov dword [rsp + 0x50], r12d
lea rcx, [rsp + 0x50]
call fcn.14004cad4
nop
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop dword [rax + rax]
nop
jmp 0x140006c65
call qword [sym.imp.MSSRCH.DLL_public:_static_void___cdecl_CSearchServiceObj::Cleanup_void_]
nop dword [rax + rax]
call fcn.14000796c
test al, al
je 0x140006c94
lea rdx, [0x14004c950]
call fcn.1400079ac
mov r8b, r14b
mov edx, dword [0x1400dca08]
call fcn.140050e84
test byte [0x1400dc881], 8
je 0x140006cbf
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcessId]
nop dword [rax + rax]
mov r8d, eax
lea rdx, [0x1400b4778]
lea rcx, [0x1400d9440]
call fcn.14004c7c8
test byte [0x1400dc882], 8
je 0x140006ceb
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x20], rax
mov r9d, r14d
lea rdx, [0x1400b43a8]
lea rcx, [0x1400d9440]
call fcn.1400293b4
call fcn.1400551e4
call qword [sym.imp.api_ms_win_core_com_l1_1_0.dll_CoUninitialize]
nop dword [rax + rax]
nop
cmp byte [rsp + 0x59], sil
je 0x140006d1c
mov ecx, dword [0x1400da388]
cmp ecx, 0xffffffff
je 0x140006d1c
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TlsFree]
nop dword [rax + rax]
nop
test rdi, rdi
je 0x140006d32
mov rcx, rdi
mov rax, qword [0x14009d348]
call qword [case.0x1400244c5.0]
nop
mov eax, r15d
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.14002a310
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
xor edx, edx
mov r8d, SysAllocStringByteLen
lea rcx, [r11 - 0x438]
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0xd0]
call fcn.14004229c
int3