Function at 0x10000a35c
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x8c0
mov rax, qword [0x100012110]
xor rax, rsp
mov qword [rsp + 0x8b0], rax
mov rax, qword [0x100001a88]
xor r12d, r12d
mov rbp, rcx
lea rcx, [rsp + 0x60]
mov esi, 0x20019
lea rdx, [rsp + 0x60]
mov qword [rcx], rax
movzx eax, word [0x100001a90]
xor r8d, r8d
mov word [rcx + 8], ax
lea rax, [rsp + 0x50]
mov r9d, esi
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x20], rax
mov edi, r12d
lea ebx, [r12 + 1]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r12d
je 0x10000a3ee
xor eax, eax
jmp 0x10000a716
call qword [sym.imp.KERNEL32.dll_GetACP]
lea r8, [0x100001a94]
lea rcx, [rsp + 0x70]
mov r9d, eax
mov edx, 8
call fcn.100002258
cmp eax, r12d
jl 0x10000a6f1
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x48]
lea rdx, [rsp + 0x70]
mov r9d, esi
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r12d
jne 0x10000a6f4
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x6a0]
lea r8, [rsp + 0x290]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
xor edx, edx
mov qword [rsp + 0x28], rax
mov esi, r12d
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x44], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, r12d
jne 0x10000a6f4
lea rax, [0x100001938]
mov r13d, 0x104
or dword [rsp + 0x28], 0xffffffff
lea r8, [rsp + 0x290]
or r9d, 0xffffffff
mov edx, ebx
mov ecx, 0x7f
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x10000a4db
cmp edi, r12d
jne 0x10000a68d
mov edi, ebx
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x6a0]
mov r8d, r13d
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, 2
jb 0x10000a6f1
cmp word [rsp + 0x82], 0x3a
jne 0x10000a526
lea rdx, [0x100001a9c]
lea rcx, [rsp + 0x80]
call qword [sym.imp.msvcrt.dll_wcsstr]
cmp rax, r12
jne 0x10000a5d8
lea r8, [rsp + 0x80]
lea rax, [rsp + 0x490]
mov rdx, r13
lea rcx, [rsp + 0x490]
mov r9d, r12d
sub r8, rax
lea rax, [rdx + 0x7ffffefa]
cmp rax, r12
je 0x10000a56a
movzx eax, word [r8 + rcx]
cmp ax, r12w
je 0x10000a56a
mov word [rcx], ax
add rcx, 2
sub rdx, rbx
jne 0x10000a547
cmp rdx, r12
jne 0x10000a579
sub rcx, 2
mov r9d, 0x8007007a
cmp r9d, r12d
mov word [rcx], r12w
jl 0x10000a6f1
lea rcx, [rsp + 0x80]
mov edx, r13d
call qword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
lea r8, [0x100001aa0]
lea rcx, [rsp + 0x80]
mov rdx, r13
call fcn.100009ed8
cmp eax, r12d
jl 0x10000a6f1
lea r8, [rsp + 0x490]
lea rcx, [rsp + 0x80]
mov rdx, r13
call fcn.100009ed8
cmp eax, r12d
jl 0x10000a6f1
lea rdx, [rsp + 0x5c]
lea rcx, [rsp + 0x80]
call fcn.100009804
lea r8, [rsp + 0x290]
mov r11, rax
cmp rax, r12
jne 0x10000a62b
or dword [rsp + 0x28], 0xffffffff
lea rax, [0x100001938]
or r9d, 0xffffffff
mov edx, ebx
mov ecx, 0x7f
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CompareStringW]
cmp eax, 2
jne 0x10000a68d
cmp edi, r12d
je 0x10000a68d
mov edi, r12d
jmp 0x10000a68d
lea rcx, [rbp + 0x1c]
mov edx, 0x20
mov r9d, r12d
sub r8, rcx
lea rax, [rdx + 0x7fffffde]
cmp rax, r12
je 0x10000a65d
movzx eax, word [r8 + rcx]
cmp ax, r12w
je 0x10000a65d
mov word [rcx], ax
add rcx, 2
sub rdx, rbx
jne 0x10000a63a
cmp rdx, r12
jne 0x10000a66c
sub rcx, 2
mov r9d, 0x8007007a
cmp r9d, r12d
mov word [rcx], r12w
jl 0x10000a6f1
mov r9d, dword [rsp + 0x5c]
mov r8, r11
mov edx, 0x10000004
dec r9d
mov rcx, rbp
call fcn.10000a88c
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x44]
add esi, ebx
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x6a0]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x58]
lea r8, [rsp + 0x290]
mov qword [rsp + 0x28], rax
mov edx, esi
mov dword [rsp + 0x40], 0x100
mov qword [rsp + 0x20], r12
mov dword [rsp + 0x44], 0x208
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, r12d
lea rax, [0x100001938]
je 0x10000a4a8
jmp 0x10000a6f4
mov ebx, r12d
mov rcx, qword [rsp + 0x48]
cmp rcx, r12
je 0x10000a704
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x50]
cmp rcx, r12
je 0x10000a714
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x8b0]
xor rcx, rsp
call fcn.10000f2c0
lea r11, [rsp + 0x8c0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret