Function at 0x140003570
Capabilities:
Query environment variable
Set environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x159e0
call fcn.140014430
sub rsp, rax
xor r12d, r12d
mov rbx, rdx
mov rdi, rcx
cmp dword [rdx + 0x5910], r12d
mov esi, 1
jne 0x1400036e2
cmp dword [rdx + 0x4ec8], esi
jne 0x1400036e2
lea rax, [0x140017670]
lea rcx, [rsp + 0x3b0]
xor r8d, r8d
mov qword [rsp + 0x3b0], rax
mov eax, 0x100
mov edx, esi
mov word [rsp + 0x3c0], r12w
mov word [rsp + 0x5ca], r12w
mov dword [rsp + 0x7f8], 0x400
mov dword [rsp + 0x7fc], eax
mov dword [rsp + 0xa24], eax
mov dword [rsp + 0x7d8], r12d
mov dword [rsp + 0x7dc], r12d
mov qword [rsp + 0x7e8], r12
mov qword [rsp + 0x7f0], r12
mov dword [rsp + 0x800], r12d
mov dword [rsp + 0x7e0], r12d
mov dword [rsp + 0xa1c], r12d
mov qword [rsp + 0xa28], r12
mov dword [rsp + 0xa20], r12d
mov dword [rsp + 0xa18], r12d
mov word [rsp + 0x808], r12w
call fcn.140011e68
lea rdx, [rsp + 0x3b0]
mov r9d, esi
mov r8d, esi
mov rcx, rbx
call fcn.140001f68
mov rax, qword [rsp + 0xa28]
lea rdx, [0x140015910]
cmp rax, r12
lea rcx, [0x140021ae8]
cmovne rdx, rax
or r8d, 0xffffffff
call fcn.14000a99c
lea rdx, [rbx + 0x4ecc]
lea rcx, [0x1400214e4]
mov r8d, 0xff
call fcn.140009bc4
lea rcx, [0x1400214b0]
call fcn.1400129d8
lea rcx, [rsp + 0xa18]
mov ebx, eax
call fcn.14000a970
lea rcx, [rsp + 0x7d8]
call fcn.14000a81c
mov eax, ebx
jmp 0x1400043d5
xor edx, edx
mov word [rcx], r12w
lea rcx, [rsp + 0x138]
lea r8d, [rdx + 0x60]
mov r15, r12
call sub.msvcrt.dll_memset
xor eax, eax
mov r13d, 0x208
lea rcx, [rsp + 0xdb2]
xor edx, edx
mov r8, r13
mov qword [rsp + 0xc0], r12
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rax
mov dword [rsp + 0xdc], r12d
mov qword [rsp + 0xe8], r12
mov dword [rsp + 0xe0], r12d
mov dword [rsp + 0xe4], 0x100
mov dword [rsp + 0xd8], r12d
mov word [rsp + 0xdb0], r12w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x1a2]
mov r8, r13
xor edx, edx
mov word [rsp + 0x1a0], r12w
call sub.msvcrt.dll_memset
mov r14d, 0x104
lea rdx, [rbx + 8]
lea rcx, [rsp + 0x1a0]
mov r8d, r14d
mov word [rsp + 0x59e0], r12w
mov dword [rsp + 0x130], 0x68
call fcn.140009bc4
lea rcx, [rbx + 8]
mov dx, 0x25
call sub.msvcrt.dll_wcschr
cmp rax, r12
je 0x1400037d2
lea rdx, [rsp + 0x1a0]
lea rcx, [rbx + 8]
mov r8d, r14d
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp dword [rbx + 0x50e8], r12d
lea rbp, [0x140015910]
je 0x1400038e4
lea rcx, [rsp + 0x1a0]
mov dx, 0x5c
call sub.msvcrt.dll_wcschr
cmp rax, r12
jne 0x1400038e4
lea rcx, [rsp + 0xfc2]
mov r8, r13
xor edx, edx
mov qword [rsp + 0x15a28], r12
mov word [rsp + 0xfc0], r12w
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x15a28]
lea rax, [rsp + 0xfc0]
lea rdx, [rsp + 0x1a0]
mov qword [rsp + 0x28], r11
mov r9d, r14d
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_SearchPathW]
cmp word [rsp + 0xfc0], r12w
jne 0x1400038cc
lea rcx, [rsp + 0xbb2]
xor edx, edx
mov r8d, 0x1fe
mov word [rsp + 0xbb0], r12w
call sub.msvcrt.dll_memset
lea r9, [rsp + 0x1a0]
lea r8, str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_s
lea rcx, [rsp + 0xbb0]
mov edx, 0xff
call sub.msvcrt.dll__snwprintf
lea r9, [rsp + 0xfc0]
lea rdx, [rsp + 0xbb0]
mov r8, rbp
mov rcx, 0xffffffff80000002
mov dword [rsp + 0x20], r14d
call fcn.140011548
cmp word [rsp + 0xfc0], r12w
je 0x1400038e4
lea rdx, [rsp + 0xfc0]
lea rcx, [rsp + 0x1a0]
mov r8d, r14d
call fcn.140009bc4
cmp word [rbx + 0x4214], r12w
je 0x14000392f
lea rcx, [rbx + 0x4214]
mov dx, 0x25
lea r14, [rbx + 0x4214]
call sub.msvcrt.dll_wcschr
cmp rax, r12
je 0x140003959
lea rdx, [rsp + 0xdb0]
lea rcx, [rbx + 0x4214]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea r14, [rsp + 0xdb0]
jmp 0x140003959
lea rdx, [rsp + 0xdb0]
lea rcx, [rsp + 0x1a0]
call fcn.140009de0
cmp word [rsp + 0xdb0], r12w
lea r14, [rsp + 0xdb0]
cmove r14, r12
cmp dword [rbx + 0x462c], esi
je 0x140003977
movzx eax, word [rbx + 0x462c]
or dword [rsp + 0x16c], esi
mov word [rsp + 0x170], ax
cmp dword [rbx + 0x4630], r12d
mov r13d, 0x1f
je 0x140003a8b
cmp word [rbx + 0x4634], r12w
je 0x140003a8b
lea r8d, [r13 + 0x1f]
lea rcx, [rsp + 0xf2]
xor edx, edx
mov word [rsp + 0xf0], r12w
call sub.msvcrt.dll_memset
lea r8d, [r13 + 0x1f]
lea rcx, [rsp + 0x82]
xor edx, edx
mov word [rsp + 0x80], r12w
call sub.msvcrt.dll_memset
cmp word [rbx + 0x4634], r12w
mov r11d, r12d
mov dword [rsp + 0x15a28], r12d
je 0x140003a1d
lea rax, [0x140015fd0]
lea r9, [rsp + 0x15a28]
lea r8, [rbx + 0x4634]
lea rcx, [rsp + 0xf0]
mov edx, r13d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call fcn.14000a5d0
mov r11d, dword [rsp + 0x15a28]
movsxd rax, r11d
cmp word [rbx + rax*2 + 0x4634], r12w
je 0x140003a5b
lea rax, [0x140015fd0]
mov dword [rsp + 0x28], r11d
lea r9, [rsp + 0x15a28]
lea r8, [rbx + 0x4634]
lea rcx, [rsp + 0x80]
mov edx, r13d
mov qword [rsp + 0x20], rax
call fcn.14000a5d0
or dword [rsp + 0x16c], 4
lea rcx, [rsp + 0xf0]
call sub.msvcrt.dll__wtoi
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x150], eax
call sub.msvcrt.dll__wtoi
mov dword [rsp + 0x154], eax
cmp dword [rbx + 0x4674], r12d
je 0x140003b99
cmp word [rbx + 0x4678], r12w
je 0x140003b99
xor edx, edx
lea rcx, [rsp + 0xf2]
mov word [rsp + 0xf0], r12w
lea r8d, [rdx + 0x3e]
call sub.msvcrt.dll_memset
xor edx, edx
lea rcx, [rsp + 0x82]
lea r8d, [rdx + 0x3e]
mov word [rsp + 0x80], r12w
call sub.msvcrt.dll_memset
cmp word [rbx + 0x4678], r12w
mov r11d, r12d
mov dword [rsp + 0x15a28], r12d
je 0x140003b2b
lea rax, [0x140015fd0]
lea r9, [rsp + 0x15a28]
lea r8, [rbx + 0x4678]
lea rcx, [rsp + 0xf0]
mov edx, r13d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
call fcn.14000a5d0
mov r11d, dword [rsp + 0x15a28]
movsxd rax, r11d
cmp word [rbx + rax*2 + 0x4678], r12w
je 0x140003b69
lea rax, [0x140015fd0]
mov dword [rsp + 0x28], r11d
lea r9, [rsp + 0x15a28]
lea r8, [rbx + 0x4678]
lea rcx, [rsp + 0x80]
mov edx, r13d
mov qword [rsp + 0x20], rax
call fcn.14000a5d0
or dword [rsp + 0x16c], 2
lea rcx, [rsp + 0xf0]
call sub.msvcrt.dll__wtoi
lea rcx, [rsp + 0x80]
mov dword [rsp + 0x158], eax
call sub.msvcrt.dll__wtoi
mov dword [rsp + 0x15c], eax
lea r13, [rbx + 0x212]
cmp word [r13], r12w
je 0x140003c39
cmp dword [rbx + 0x50ec], r12d
je 0x140003c09
mov dx, 0x25
mov rcx, r13
call sub.msvcrt.dll_wcschr
cmp rax, r12
je 0x140003c09
lea rcx, [rsp + 0x19d2]
xor edx, edx
mov r8d, 0x4000
mov word [rsp + 0x19d0], r12w
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x19d0]
mov r8d, 0x2000
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea r11, [rsp + 0x19d0]
mov qword [rsp + 0x20], r11
jmp 0x140003c0e
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x1a0]
lea r8, str.__s___s
lea rcx, [rsp + 0x59e0]
mov edx, 0x7fff
call sub.msvcrt.dll__snwprintf
lea rsi, [rsp + 0x59e0]
jmp 0x140003c3c
mov rsi, r12
mov eax, dword [rbx + 0x4628]
cmp eax, 0x20
cmovne r12d, eax
cmp dword [rbx + 0x46b8], 2
jne 0x140003c61
lea rdx, str.RunAsInvoker
mov rcx, rdi
call fcn.14000260c
mov eax, dword [rbx + 0x50cc]
lea rcx, [0x140000000]
test eax, eax
je 0x140003c8a
add eax, 0xffffffff
cmp eax, 0xc
ja 0x140003c8a
mov rdx, qword [rcx + rax*8 + 0x21b10]
mov rcx, rdi
call fcn.14000260c
mov eax, dword [rbx + 0x50d0]
cmp eax, 1
jne 0x140003c9e
lea rdx, str.256COLOR
jmp 0x140003caa
cmp eax, 2
jne 0x140003cb2
lea rdx, str.16BITCOLOR
mov rcx, rdi
call fcn.14000260c
cmp dword [rbx + 0x50d4], r15d
je 0x140003cca
lea rdx, str.640X480
mov rcx, rdi
call fcn.14000260c
cmp dword [rbx + 0x50d8], r15d
je 0x140003ce2
lea rdx, str.DISABLETHEMES
mov rcx, rdi
call fcn.14000260c
cmp dword [rbx + 0x50dc], r15d
je 0x140003cfa
lea rdx, str.DISABLEDWM
mov rcx, rdi
call fcn.14000260c
cmp dword [rbx + 0x50e0], r15d
je 0x140003d12
lea rdx, str.DISABLEDXMAXIMIZEDWINDOWEDMODE
mov rcx, rdi
call fcn.14000260c
mov eax, dword [rbx + 0x50e4]
cmp eax, 1
jne 0x140003d26
lea rdx, str.HIGHDPIAWARE
jmp 0x140003d40
cmp eax, 2
jne 0x140003d34
lea rdx, str.DPIUNAWARE
jmp 0x140003d40
cmp eax, 3
jne 0x140003d48
lea rdx, str.GDIDPISCALING
mov rcx, rdi
call fcn.14000260c
mov eax, dword [rbx + 0x58f4]
cmp eax, 3
jne 0x140003e0b
mov rax, qword [rbx + 0x5908]
mov rdx, rbp
lea rcx, [rsp + 0x80]
cmp rax, r15
mov dword [rsp + 0xa0], 0x400
mov dword [rsp + 0xa4], 0x100
cmovne rdx, rax
mov dword [rsp + 0x80], r15d
mov dword [rsp + 0x84], r15d
mov qword [rsp + 0x90], r15
mov qword [rsp + 0x98], r15
mov dword [rsp + 0xa8], r15d
mov dword [rsp + 0x88], r15d
call fcn.1400013dc
cmp word [rdi], r15w
je 0x140003dd8
lea rdx, str.__COMPAT_LAYER
lea rcx, [rsp + 0x80]
mov r8, rdi
call fcn.1400016b8
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x80]
call fcn.14000152c
mov rax, qword [rsp + 0xe8]
mov r15, rbp
xor ebp, ebp
cmp rax, rbp
cmovne r15, rax
bts r12d, 0xa
jmp 0x140003f38
cmp eax, 2
jne 0x140003f47
lea rcx, [rsp + 0x80]
mov dword [rsp + 0xa0], 0x400
mov dword [rsp + 0xa4], 0x100
mov dword [rsp + 0x80], r15d
mov dword [rsp + 0x84], r15d
mov qword [rsp + 0x90], r15
mov qword [rsp + 0x98], r15
mov dword [rsp + 0xa8], r15d
mov dword [rsp + 0x88], r15d
mov dword [rsp + 0x110], 0x400
mov dword [rsp + 0x114], 0x100
mov dword [rsp + 0xf0], r15d
mov dword [rsp + 0xf4], r15d
mov qword [rsp + 0x100], r15
mov qword [rsp + 0x108], r15
mov dword [rsp + 0x118], r15d
mov dword [rsp + 0xf8], r15d
call fcn.140001630
mov rax, qword [rbx + 0x5908]
mov rdx, rbp
lea rcx, [rsp + 0xf0]
cmp rax, r15
cmovne rdx, rax
call fcn.1400013dc
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x80]
call fcn.140001750
cmp word [rdi], r15w
je 0x140003efd
lea rdx, str.__COMPAT_LAYER
lea rcx, [rsp + 0x80]
mov r8, rdi
call fcn.1400016b8
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x80]
call fcn.14000152c
mov rax, qword [rsp + 0xe8]
mov r15, rbp
xor ebp, ebp
lea rcx, [rsp + 0xf0]
cmp rax, rbp
cmovne r15, rax
bts r12d, 0xa
call fcn.14000a81c
lea rcx, [rsp + 0x80]
call fcn.14000a81c
jmp 0x140003f62
xor ebp, ebp
lea rcx, str.__COMPAT_LAYER
cmp word [rdi], bp
je 0x140003f5a
mov rdx, rdi
jmp 0x140003f5c
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp dword [rbx], 2
jne 0x140004068
mov word [rsp + 0x3b0], bp
mov ebp, 0x7fe
lea rcx, [rsp + 0x3b2]
mov r8, rbp
xor edx, edx
call sub.msvcrt.dll_memset
and word [rsp + 0x11d0], 0
lea rcx, [rsp + 0x11d2]
mov r8, rbp
xor edx, edx
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x3b0]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [rbx + 0x462c]
lea r11, [rbx + 0x441e]
mov dword [rsp + 0x40], eax
lea rax, [rbx + 0x4214]
lea r9, [rsp + 0x3b0]
mov qword [rsp + 0x38], rax
lea rax, str._CallShellExecute
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r11
lea r8, str.__s___s___s____s____s___d
lea rcx, [rsp + 0x11d0]
mov edx, 0x3ff
mov qword [rsp + 0x20], rax
call sub.msvcrt.dll__snwprintf
lea r11, [rsp + 0xc0]
xor ebp, ebp
mov qword [rsp + 0x58], r11
lea r9, [rsp + 0x11d0]
lea r8, [rsp + 0x3b0]
lea rax, [rsp + 0x130]
mov rdx, rbx
mov rcx, rdi
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], r12d
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
call fcn.140002ad4
jmp 0x14000429c
cmp dword [rbx], 3
jne 0x140004171
mov word [rsp + 0x3b0], bp
mov qword [rsp + 0x15a28], rbp
mov ebp, 0x7fe
lea rcx, [rsp + 0x3b2]
xor edx, edx
mov r8, rbp
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x15a28]
lea rax, [rsp + 0x3b0]
mov qword [rsp + 0x28], r11
mov esi, 0x3ff
lea rdx, str.cmd.exe
xor r8d, r8d
xor ecx, ecx
mov r9d, esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_SearchPathW]
cmp word [rsp + 0x3b0], 0
je 0x140004294
and word [rsp + 0x11d0], 0
lea rcx, [rsp + 0x11d2]
mov r8, rbp
xor edx, edx
call sub.msvcrt.dll_memset
lea rcx, [0x140000000]
lea r11, [rsp + 0x60]
mov eax, dword [rcx + 0x161a8]
mov dword [r11], eax
movzx eax, word [rcx + 0x161ac]
mov word [r11 + 4], ax
xor eax, eax
cmp dword [rbx + 4], 2
mov qword [rsp + 0x66], rax
mov dword [rsp + 0x6e], eax
mov word [rsp + 0x72], ax
jne 0x14000413e
lea rdx, [0x1400161b0]
lea rcx, [rsp + 0x60]
call fcn.140014030
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x3b0]
lea r8, str.__s___s__s
lea rcx, [rsp + 0x11d0]
mov rdx, rsi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rax
call sub.msvcrt.dll__snwprintf
jmp 0x14000400f
cmp dword [rbx], 4
je 0x140004198
cmp dword [rbx], 5
je 0x140004198
lea rax, [rsp + 0xc0]
mov r9, rsi
lea r8, [rsp + 0x1a0]
mov qword [rsp + 0x58], rax
jmp 0x14000402e
mov word [rsp + 0x3b0], bp
mov qword [rsp + 0x15a28], rbp
mov ebp, 0x7fe
lea rcx, [rsp + 0x3b2]
xor edx, edx
mov r8, rbp
call sub.msvcrt.dll_memset
lea r11, [rsp + 0x15a28]
lea rax, [rsp + 0x3b0]
mov qword [rsp + 0x28], r11
mov esi, 0x3ff
lea rdx, str.powershell.exe
xor r8d, r8d
xor ecx, ecx
mov r9d, esi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_SearchPathW]
cmp word [rsp + 0x3b0], 0
je 0x140004294
and word [rsp + 0x11d0], 0
lea rcx, [rsp + 0x11d2]
mov r8, rbp
xor edx, edx
call sub.msvcrt.dll_memset
xor eax, eax
cmp dword [rbx + 4], 2
movdqu xmm5, xmmword [str._NoExit]
mov dword [rsp + 0x70], eax
mov ebp, 0
mov qword [rsp + 0x28], r13
movdqu xmmword [rsp + 0x60], xmm5
movzx eax, word [rsp + 0x60]
lea r9, [rsp + 0x3b0]
mov rdx, rsi
cmove ax, bp
cmp dword [rbx], 5
lea rcx, [rsp + 0x11d0]
mov word [rsp + 0x60], ax
lea rax, [rsp + 0x60]
lea r8, str.__s___s__executionpolicy_bypass__File___s_
mov qword [rsp + 0x20], rax
je 0x14000427d
lea r8, str.__s___s__s
call sub.msvcrt.dll__snwprintf
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x58], rax
jmp 0x14000401e
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebp, ebp
cmp eax, ebp
mov edi, eax
jne 0x1400043c6
mov rcx, qword [rsp + 0xc0]
cmp rcx, rbp
je 0x1400043c6
cmp dword [rbx + 0x50f0], ebp
je 0x1400043ad
xor r12d, r12d
lea rcx, [rsp + 0xbb2]
xor edx, edx
mov r8d, 0x1fe
mov rsi, r12
mov word [rsp + 0xbb0], r12w
call sub.msvcrt.dll_memset
mov r11d, r12d
mov dword [rsp + 0x15a28], r12d
movsxd rax, r11d
cmp word [rbx + rax*2 + 0x50f4], r12w
je 0x14000435b
lea rax, [0x140015de4]
mov dword [rsp + 0x28], r11d
lea r9, [rsp + 0x15a28]
lea r8, [rbx + 0x50f4]
lea rcx, [rsp + 0xbb0]
mov edx, 0xff
mov qword [rsp + 0x20], rax
call fcn.14000a5d0
cmp eax, r12d
je 0x14000435b
lea rcx, [rsp + 0xbb0]
call sub.msvcrt.dll__wtoi
mov r11d, dword [rsp + 0x15a28]
mov ecx, eax
mov eax, 1
shl rax, cl
or rsi, rax
jmp 0x1400042f2
mov rcx, qword [rsp + 0xc0]
or qword [rsp + 0x15a30], 0xffffffffffffffff
lea r8, [rsp + 0x15a30]
lea rdx, [rsp + 0x15a38]
xor ebp, ebp
mov qword [rsp + 0x15a38], rbp
call qword [sym.imp.KERNEL32.dll_GetProcessAffinityMask]
and rsi, qword [rsp + 0x15a30]
mov rcx, qword [rsp + 0xc0]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
mov rcx, qword [rsp + 0xc0]
cmp dword [rbx + 0x4620], ebp
je 0x1400043c6
cmp dword [rbx + 0x4624], ebp
je 0x1400043c6
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rcx, [rsp + 0xd8]
call fcn.14000a970
mov eax, edi
mov rbx, qword [rsp + 0x15a20]
add rsp, 0x159e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret