Function at 0x1400b3ec0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, dword [0x14026ed50]
add eax, 0xffffdc84
cmp eax, 1
ja 0x1400b2cb3
test byte [0x14026ed5c], 7
je 0x1400b2cb3
mov edx, 1
jmp 0x1400b3ec0
ret
push rbp
push rsi
push r12
push r15
lea rbp, [rsp - 0x6d8]
sub rsp, 0x7d8
xor esi, esi
mov r12d, edx
mov r15, rcx
mov qword [rcx + 0x18], rsi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x48], rsi
mov qword [rcx + 0x40], rsi
mov qword [rcx + 0x20], rsi
mov dword [rcx + 0x28], esi
lea r8, [rsp + 0x38]
lea rdx, str.SoftwareSynapticsSynTPInstall
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1400b462f
lea rcx, [rbp - 0x40]
xor edx, edx
mov r8d, 0x100
mov dword [rsp + 0x40], 0x100
call fcn.1400e4220
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x34]
lea rdx, str.ProgDir
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x40]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1400b3f79
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x7d8
pop r15
pop r12
pop rsi
pop rbp
ret
lea rcx, [rbp + 0xc2]
xor edx, edx
mov r8d, 0x1fe
mov qword [rsp + 0x7c8], r13
mov word [rbp + 0xc0], si
call fcn.1400e4220
cmp dword [rsp + 0x34], 2
jne 0x1400b3fbc
lea rdx, [rbp + 0xc0]
lea rcx, [rbp - 0x40]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x1400b3fd6
mov rcx, rsi
nop
movzx eax, word [rbp + rcx - 0x40]
lea rcx, [rcx + 2]
mov word [rbp + rcx + 0xbe], ax
test ax, ax
jne 0x1400b3fc0
lea rcx, [rbp + 0xc0]
sub rcx, 2
cmp word [rcx + 2], si
lea rcx, [rcx + 2]
jne 0x1400b3fe1
mov eax, dword [0x140122f58]
mov dword [rcx], eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rsi
lea rdx, [0x1401379d8]
nop dword [rax + rax]
movzx eax, word [rcx + rdx]
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400b4010
lea rcx, [rbp + 0xc0]
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], si
lea rcx, [rcx + 2]
jne 0x1400b4030
movups xmm0, xmmword [str.tp4table.dat]
movsd xmm1, qword [0x140137648]
movzx eax, word [0x140137650]
lea rdx, [0x1401379e0]
movups xmmword [rcx], xmm0
movsd qword [rcx + 0x10], xmm1
mov word [rcx + 0x18], ax
lea rcx, [rbp + 0xc0]
call fcn.1400ebe38
mov r13, rax
test rax, rax
je 0x1400b4627
mov qword [rsp + 0x808], rbx
lea rcx, [rbp + 0x2c0]
mov r8, rax
mov edx, 0x400
mov qword [rsp + 0x7d0], rdi
mov qword [rsp + 0x7c0], r14
call fcn.1400ebc28
mov r14d, 1
test rax, rax
je 0x1400b43fb
lea edi, [r14 + 2]
nop word [rax + rax]
movzx ecx, word [rbp + 0x2c0]
cmp cx, 0x3b
je 0x1400b43de
cmp cx, 0x23
je 0x1400b43de
cmp cx, 0x5b
je 0x1400b43fb
mov r9d, esi
mov rdx, rsi
lea rax, [rbp + 0x2c0]
lea r8, [rbp + 0x2c0]
test cx, cx
je 0x1400b43de
movzx ecx, word [rax]
cmp cx, 0x2c
je 0x1400b4117
cmp cx, 0xa
je 0x1400b4117
add rax, 2
jmp 0x1400b4132
mov qword [rsp + rdx*8 + 0x50], r8
inc rdx
inc r9d
mov word [rax], si
cmp rdx, 9
je 0x1400b4138
add rax, 2
mov r8, rax
cmp word [rax], 0
jne 0x1400b4102
cmp r9d, 9
jl 0x1400b43de
mov rcx, qword [rbp - 0x70]
call fcn.1400e66ac
mov r14d, eax
test r12d, r12d
je 0x1400b4157
test al, 8
jmp 0x1400b4159
test al, 4
je 0x1400b43d8
mov rbx, qword [rbp - 0x80]
lea rdx, str.Standard
mov rcx, rbx
call fcn.1400e9b3c
test eax, eax
jne 0x1400b417e
movzx ebx, si
jmp 0x1400b4298
lea rdx, str.StandardP
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1400b419a
lea ebx, [rax + 0xb]
jmp 0x1400b4298
lea rdx, str.WheelVkey
mov rcx, rbx
call fcn.1400e9b3c
test eax, eax
jne 0x1400b41b5
lea ebx, [rax + 1]
jmp 0x1400b4298
lea rdx, str.WheelStd
mov rcx, rbx
call fcn.1400e9b3c
test eax, eax
jne 0x1400b41d0
lea ebx, [rax + 2]
jmp 0x1400b4298
lea rdx, str.TwoParents
mov rcx, rbx
call fcn.1400e9b3c
test eax, eax
jne 0x1400b41eb
movzx ebx, di
jmp 0x1400b4298
lea rdx, str.TwoParentsP
mov rcx, rbx
call fcn.1400e9b3c
test eax, eax
jne 0x1400b4206
lea ebx, [rax + 0xa]
jmp 0x1400b4298
lea rdx, str.VkKeys
mov rcx, rbx
call fcn.1400e9b3c
test eax, eax
jne 0x1400b421e
lea ebx, [rax + 5]
jmp 0x1400b4298
lea rdx, str.Fine
mov rcx, rbx
call fcn.1400e9b3c
test eax, eax
jne 0x1400b4236
lea ebx, [rax + 4]
jmp 0x1400b4298
lea rdx, str.None
mov rcx, rbx
call fcn.1400e9b3c
test eax, eax
jne 0x1400b424e
lea ebx, [rax + 6]
jmp 0x1400b4298
lea rdx, str.Wheel
mov rcx, rbx
call fcn.1400e9b3c
test eax, eax
jne 0x1400b4266
lea ebx, [rax + 7]
jmp 0x1400b4298
lea rdx, str.WheelP
mov rcx, rbx
call fcn.1400e9b3c
test eax, eax
jne 0x1400b427e
lea ebx, [rax + 8]
jmp 0x1400b4298
lea rdx, [0x140137ac8]
mov rcx, rbx
call fcn.1400e9b3c
test eax, eax
jne 0x1400b43d8
lea ebx, [rax + 0xd]
mov rcx, qword [rbp - 0x78]
call fcn.1400e66ac
movsxd rsi, eax
cmp esi, 1
ja 0x1400b43d6
inc dword [r15 + rsi*4 + 0x24]
mov ecx, 0x40c
call fcn.1400eb5d8
mov rdi, rax
test rax, rax
je 0x1400b460f
mov rdx, qword [rsp + 0x60]
mov r8, rax
sub r8, rdx
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rdx]
lea rdx, [rdx + 2]
mov word [rdx + r8 + 0x302], cx
test cx, cx
jne 0x1400b42e0
mov rcx, qword [rsp + 0x68]
mov rdx, rax
sub rdx, rcx
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rcx + rdx + 2], ax
test ax, ax
jne 0x1400b4300
mov rcx, qword [rsp + 0x70]
mov rdx, rdi
sub rdx, rcx
nop dword [rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rcx + rdx + 0x102], ax
test ax, ax
jne 0x1400b4320
mov rcx, qword [rsp + 0x78]
mov rdx, rdi
sub rdx, rcx
nop
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rcx + rdx + 0x202], ax
test ax, ax
jne 0x1400b4340
mov word [rdi + 0x404], bx
mov dword [rdi], esi
mov dword [rdi + 0x408], r14d
movzx eax, word [rdi + 0x304]
cmp ax, word [0x14012b748]
jne 0x1400b4384
movzx eax, word [rdi + 0x306]
cmp ax, word [0x14012b74a]
je 0x1400b4390
mov r14d, 1
mov dword [r15 + 0x20], r14d
jmp 0x1400b4396
mov r14d, 1
mov ecx, 0x10
call fcn.1400eb5d8
test rax, rax
je 0x1400b4475
xor esi, esi
mov qword [rax + 8], rdi
mov qword [rax], rsi
mov rcx, qword [r15 + 0x18]
test rcx, rcx
je 0x1400b43c7
mov qword [rcx], rax
lea edi, [rsi + 3]
mov qword [r15 + 0x18], rax
jmp 0x1400b43de
mov qword [r15 + 0x10], rax
mov qword [r15 + 0x18], rax
mov edi, 3
jmp 0x1400b43de
xor esi, esi
mov r14d, 1
lea rcx, [rbp + 0x2c0]
mov r8, r13
mov edx, 0x400
call fcn.1400ebc28
test rax, rax
jne 0x1400b40c0
lea rcx, [rbp + 0x2c0]
mov r8, r13
mov edx, 0x400
mov qword [r15 + 0x48], rsi
mov qword [r15 + 0x40], rsi
call fcn.1400ebc28
test rax, rax
je 0x1400b4607
movzx edx, word [rbp + 0x2c0]
cmp dx, 0x3b
je 0x1400b45ea
cmp dx, 0x23
je 0x1400b45ea
mov r8d, esi
mov rcx, rsi
lea rax, [rbp + 0x2c0]
lea r9, [rbp + 0x2c0]
test dx, dx
je 0x1400b45ea
nop dword [rax + rax]
movzx edx, word [rax]
cmp dx, 0x2c
je 0x1400b4482
cmp dx, 0xa
je 0x1400b4482
add rax, 2
jmp 0x1400b449d
mov rcx, rdi
call fcn.1400e9dd0
jmp 0x1400b460f
mov qword [rsp + rcx*8 + 0x50], r9
inc rcx
inc r8d
mov word [rax], si
cmp rcx, 5
je 0x1400b44a3
add rax, 2
mov r9, rax
cmp word [rax], 0
jne 0x1400b4460
cmp r8d, 5
jl 0x1400b45ea
mov ecx, 0x214
call fcn.1400eb5d8
mov rbx, rax
test rax, rax
je 0x1400b460f
mov rdi, qword [rsp + 0x70]
lea rdx, str.smooth
mov rcx, rdi
call fcn.1400e9b3c
test eax, eax
jne 0x1400b44e0
mov r8d, r14d
jmp 0x1400b44f5
lea rdx, str.standard
mov rcx, rdi
call fcn.1400e9b3c
mov r8d, 2
mov rcx, qword [rsp + 0x60]
mov rdx, rbx
sub rdx, rcx
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rcx + rdx - 2], ax
test ax, ax
jne 0x1400b4500
mov rcx, qword [rsp + 0x68]
mov rdx, rbx
sub rdx, rcx
nop dword [rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rcx + rdx + 0xfe], ax
test ax, ax
jne 0x1400b4520
mov dword [rbx + 0x210], r8d
lea rcx, [rbx + 0x100]
mov eax, esi
mov dword [rsp + 0x30], esi
mov dword [rbp + 0x718], esi
mov dword [rbp + 0x710], esi
mov dword [rbp + 0x700], eax
cmp word [rcx], 0x2a
je 0x1400b4596
lea rax, [rsp + 0x30]
lea r9, [rbp + 0x710]
lea r8, [rbp + 0x700]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x718]
lea rdx, str._d._d._d._d
mov qword [rsp + 0x20], rax
call fcn.1400e9cb0
mov eax, dword [rbp + 0x700]
mov dword [rbx + 0x200], eax
mov eax, dword [rbp + 0x710]
mov ecx, 0x10
mov dword [rbx + 0x204], eax
mov eax, dword [rbp + 0x718]
mov dword [rbx + 0x208], eax
mov eax, dword [rsp + 0x30]
mov dword [rbx + 0x20c], eax
call fcn.1400eb5d8
test rax, rax
je 0x1400b463d
mov qword [rax + 8], rbx
mov qword [rax], rsi
mov rcx, qword [r15 + 0x48]
test rcx, rcx
je 0x1400b45e2
mov qword [rcx], rax
jmp 0x1400b45e6
mov qword [r15 + 0x40], rax
mov qword [r15 + 0x48], rax
lea rcx, [rbp + 0x2c0]
mov r8, r13
mov edx, 0x400
call fcn.1400ebc28
test rax, rax
jne 0x1400b4420
mov rcx, r13
call fcn.1400e9e8c
mov rbx, qword [rsp + 0x808]
mov rdi, qword [rsp + 0x7d0]
mov r14, qword [rsp + 0x7c0]
mov r13, qword [rsp + 0x7c8]
add rsp, 0x7d8
pop r15
pop r12
pop rsi
pop rbp
ret
mov rcx, rbx
call fcn.1400e9dd0
jmp 0x1400b460f