Function at 0x100053eb0
Capabilities:
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x4a0
mov rax, qword [0x100086110]
xor rax, rsp
mov qword [rsp + 0x490], rax
xor ebx, ebx
lea rax, [rsp + 0x58]
mov ebp, edx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rax
mov r12, rcx
mov qword [rsp + 0x30], rbx
lea r15d, [rbx + 1]
mov rsi, 0xffffffff80000002
lea rdx, [0x100029498]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], 3
mov edi, r15d
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
je 0x100053f6f
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x58]
lea rdx, [0x100029498]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], ebx
mov edi, ebx
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
je 0x100053f6f
xor eax, eax
jmp 0x1000541a2
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
lea rdx, [0x100029b10]
xor r8d, r8d
mov dword [rsp + 0x60], 0x208
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [rsp + 0x50], 2
mov esi, eax
mov r14d, 0x104
jne 0x10005401d
cmp eax, ebx
jne 0x10005402c
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x70]
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdi, [rsp + 0x280]
lea rax, [rsp + 0x70]
sub rdi, rax
mov rdx, r14
lea rcx, [rsp + 0x70]
lea rax, [rdx + 0x7ffffefa]
cmp rax, rbx
je 0x10005400c
movzx eax, word [rdi + rcx]
cmp ax, bx
je 0x10005400c
mov word [rcx], ax
add rcx, 2
sub rdx, r15
jne 0x100053feb
cmp rdx, rbx
jne 0x100054015
sub rcx, 2
mov word [rcx], bx
jmp 0x100054161
cmp dword [rsp + 0x50], r15d
jne 0x10005402c
cmp eax, ebx
je 0x100054161
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
lea rdx, [0x100029b40]
xor r8d, r8d
mov dword [rsp + 0x60], 0x208
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov word [rsp + 0x276], bx
mov esi, eax
cmp dword [rsp + 0x50], r15d
jne 0x100054077
cmp eax, ebx
je 0x1000540dd
lea rax, [rsp + 0x70]
cmp rax, rbx
je 0x1000540d5
lea rcx, [rsp + 0x70]
mov edx, r14d
call fcn.10006ae74
cmp eax, ebx
jne 0x1000540d5
lea rcx, [rsp + 0x70]
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
mov rcx, qword [0x100088070]
lea r8, [rsp + 0x280]
mov r9d, r14d
mov edx, 0x26fd
call qword [sym.imp.USER32.dll_LoadStringW]
cmp eax, ebx
je 0x1000540d5
lea r8, [rsp + 0x280]
lea rcx, [rsp + 0x70]
mov rdx, r14
call fcn.100039ee4
mov esi, ebx
cmp esi, ebx
jne 0x100054190
cmp edi, ebx
je 0x10005415d
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
lea rdx, [0x100029b10]
mov r9d, r15d
not rcx
xor r8d, r8d
sub rcx, r15
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x70]
lea rdx, [0x100029b58]
repne scasw ax, word [rdi]
mov r9d, r15d
xor r8d, r8d
not rcx
sub rcx, r15
lea eax, [rcx + rcx + 2]
mov rcx, qword [rsp + 0x58]
mov dword [rsp + 0x28], eax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp esi, ebx
jne 0x100054190
mov word [rsp + 0x276], bx
cmp ebp, ebx
jne 0x100054180
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x70]
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea r8, [rsp + 0x70]
mov rdx, r14
mov rcx, r12
call fcn.100039df8
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
sete bl
mov eax, ebx
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.10007fa70
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret