Function at 0x100008050
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
sub rsp, 0x330
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov rax, qword [0x1000390b0]
xor rax, rsp
mov qword [rsp + 0x320], rax
mov rbx, r8
mov rsi, rdx
mov r12, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, qword [r12 + 0xb0]
xor r13d, r13d
cmp rcx, r13
je 0x10001a18b
mov dword [rsp + 0x30], 0x208
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x110]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
mov edi, eax
cmp eax, r13d
jne 0x10001a19c
mov eax, 0xea
mov ecx, dword [rsp + 0x34]
cmp ecx, 1
jne 0x100010ec0
cmp dword [rsp + 0x34], 2
je 0x100008183
cmp edi, eax
je 0x10001a231
mov eax, dword [rsp + 0x30]
mov edx, eax
shr edx, 1
cmp edx, dword [rbx + 0x10]
ja 0x10001a27b
mov rcx, qword [rbx + 8]
mov r8d, eax
shr r8, 1
mov edx, r13d
je 0x10001a28c
cmp r8, 0x7fffffff
ja 0x10001a28c
cmp edx, r13d
jl 0x10001a33d
mov eax, 0x7ffffffe
lea r10, [rsp + 0x110]
mov edx, r13d
mov r11, r13
cmp r8, r13
je 0x10001a296
cmp rax, r13
je 0x10000ba11
movzx r9d, word [r10]
cmp r9w, r13w
je 0x10000ba11
mov word [rcx], r9w
add rcx, 2
add r10, 2
dec r8
dec rax
inc r11
jmp 0x10000814c
cmp edi, eax
je 0x10001a1b9
mov esi, 0x104
cmp dword [rbx + 0x10], esi
jae 0x10000819f
mov rax, qword [rbx]
mov edx, esi
mov rcx, rbx
call qword [rax]
mov r8d, esi
mov rdx, qword [rbx + 8]
lea rcx, [rsp + 0x110]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [rsp + 0x30], eax
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x10001a1f8
add eax, eax
mov dword [rsp + 0x30], eax
jmp 0x1000081cf
cmp edi, r13d
jne 0x10001a2a4
shr eax, 1
mov dword [rsp + 0x30], eax
je 0x10001a32c
lea ecx, [rax - 1]
mov eax, dword [rbx + 0x10]
dec eax
cmp ecx, eax
ja 0x10001a2ed
mov dword [rbx + 0x14], ecx
mov rax, qword [rbx + 8]
mov word [rax + rcx*2], r13w
jmp 0x100008202
mov eax, 1
jmp 0x100008209
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.100001c80
add rsp, 0x330
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov word [rcx], r13w
cmp edx, r13d
jl 0x10001a33d
mov eax, dword [rsp + 0x30]
jmp 0x1000081cf
cmp ecx, 7
je 0x1000080ec
cmp ecx, 2
je 0x1000080ec
jmp 0x10001a1aa
lea ecx, [r13 + 6]
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x100008209
mov eax, 0xea
cmp edi, eax
jne 0x10001a1aa
jmp 0x1000080df
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x100008209
mov edx, 0x80010135
lea rcx, [rsp + 0x38]
call fcn.10001c3a0
lea rcx, [rsp + 0xc8]
mov rdx, rax
mov r8d, 0x20
call sub.msvcrt.dll_memcpy
lea rdx, [0x100030eb8]
lea rcx, [rsp + 0xc8]
call sub.msvcrt.dll__CxxThrowException
nop
jmp 0x10000818b
mov edx, 0x80010135
lea rcx, [rsp + 0x38]
call fcn.10001c3a0
lea rcx, [rsp + 0x68]
mov rdx, rax
mov r8d, 0x20
call sub.msvcrt.dll_memcpy
lea rdx, [0x100030eb8]
lea rcx, [rsp + 0x68]
call sub.msvcrt.dll__CxxThrowException
nop
jmp 0x1000080f7
mov edx, dword [rsp + 0x30]
shr edx, 1
cmp edx, dword [rbx + 0x10]
jbe 0x10001a244
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 8]
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [r12 + 0xb0]
call qword [sym.imp.KERNEL32.dll_RegQueryValueExW]
mov edi, eax
mov eax, dword [rsp + 0x30]
jmp 0x1000081cf
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, dword [rsp + 0x30]
jmp 0x100008110
mov edx, 0x80070057
jmp 0x100008130
sub rcx, 2
mov edx, 0x8007007a
jmp 0x10000ba11
movzx edx, di
or edx, 0x80070000
cmp edi, r13d
cmovle edx, edi
lea rcx, [rsp + 0x38]
call fcn.10001c3a0
lea rcx, [rsp + 0xa8]
mov rdx, rax
mov r8d, 0x20
call sub.msvcrt.dll_memcpy
lea rdx, [0x100030eb8]
lea rcx, [rsp + 0xa8]
call sub.msvcrt.dll__CxxThrowException
nop
jmp 0x1000081d8
mov edx, 0x800700ce
lea rcx, [rsp + 0x38]
call fcn.10001c3a0
lea rcx, [rsp + 0xe8]
mov rdx, rax
mov r8d, 0x20
call sub.msvcrt.dll_memcpy
lea rdx, [0x100030eb8]
lea rcx, [rsp + 0xe8]
call sub.msvcrt.dll__CxxThrowException
int3
mov dword [rbx + 0x14], r13d
mov rcx, qword [rbx + 8]
mov word [rcx], r13w
jmp 0x100008202
lea rcx, [rsp + 0x38]
call fcn.10001c3a0
lea rcx, [rsp + 0x88]
mov rdx, rax
mov r8d, 0x20
call sub.msvcrt.dll_memcpy
lea rdx, [0x100030eb8]
lea rcx, [rsp + 0x88]
call sub.msvcrt.dll__CxxThrowException
nop
xor eax, eax
jmp 0x100008209