Function at 0x164e4fc90
Capabilities:
Query environment variable

Disassembly:
mov r11, rsp
mov dword [r11 + 0x18], r8d
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rbx
push r12
push r15
sub rsp, 0x880
mov rax, qword [0x16514b200]
xor rax, rsp
mov qword [rsp + 0x850], rax
mov r12, rdx
mov r15, rcx
lea rdx, [rsp + 0x40]
mov ebx, 1
call fcn.164e6f460
test eax, eax
jne 0x164e4ff51
movsxd rcx, dword [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x878], rsi
xor r8d, r8d
mov qword [rsp + 0x868], r13
mov edx, 0x80000000
mov qword [rsp + 0x860], r14
xor r13d, r13d
mov qword [rsp + 0x30], r13
lea r14, str.._aswSnx
mov rcx, qword [r14 + rcx*8]
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x164e4fd45
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, r13d
test eax, eax
jne 0x164e4ff1a
lea rax, [rsi + 1]
mov qword [rsp + 0x870], rdi
mov dword [rsp + 0x40], r13d
mov rdi, rsi
test rax, 0xfffffffffffffffe
jne 0x164e4fdbc
lea rdx, [rsp + 0x44]
call fcn.164e6f460
test eax, eax
jne 0x164e4fef5
movsxd rcx, dword [rsp + 0x44]
xor r9d, r9d
mov qword [rsp + 0x30], r13
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
mov rcx, qword [r14 + rcx*8]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x164e4fdbc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, r13
test eax, eax
jne 0x164e4fef5
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x44]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x82ac0070
mov qword [rsp + 0x8b8], rbp
mov rcx, rdi
mov dword [rsp + 0x44], r13d
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov r14d, dword [rsp + 0x44]
test eax, eax
jne 0x164e4fe15
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
test eax, eax
je 0x164e4fe18
jmp 0x164e4fe21
mov ebp, r13d
test r14d, r14d
jne 0x164e4fe21
lea ebp, [r14 + 0x57]
mov r14d, dword [rsp + 0x40]
cmp rdi, rsi
je 0x164e4fe43
test rdi, rdi
je 0x164e4fe43
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x164e4fe43
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebp, ebp
mov rbp, qword [rsp + 0x8b8]
jne 0x164e4fef5
test r14d, r14d
je 0x164e4fef5
mov ecx, 0x800
call fcn.1650164a0
mov rdi, rax
test rax, rax
je 0x164e4fef5
lea rcx, [r15 - 0x10]
xor r9d, r9d
mov r8, rax
mov rdx, r12
call fcn.164e4ff60
test eax, eax
jne 0x164e4feed
lea edx, [rax + 0x25]
mov rcx, rdi
call fcn.165003050
test rax, rax
je 0x164e4fed0
mov r8d, 0x400
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x164e4fed0
lea rax, [rsp + 0x50]
mov rdx, rdi
sub rdx, rax
lea rcx, [rsp + 0x50]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x164e4fec0
lea r8, [rsp + 0x40]
mov rdx, rdi
mov rcx, rsi
call fcn.164e6f2b0
test eax, eax
jne 0x164e4feed
cmp dword [rsp + 0x40], r13d
cmovne ebx, r13d
mov rcx, rdi
call fcn.165015e80
mov rdi, qword [rsp + 0x870]
lea rax, [rsi - 1]
cmp rax, 0xfffffffffffffffd
ja 0x164e4ff1a
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x164e4ff1a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13, qword [rsp + 0x868]
mov eax, ebx
mov rsi, qword [rsp + 0x878]
mov r14, qword [rsp + 0x860]
mov rcx, qword [rsp + 0x850]
xor rcx, rsp
call fcn.165001080
add rsp, 0x880
pop r15
pop r12
pop rbx
ret
mov eax, ebx
jmp 0x164e4ff34