Function at 0x140028020
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x148]
sub rsp, 0x210
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov rax, qword [0x14008b020]
xor rax, rsp
mov qword [rbp + 0xe8], rax
mov rbx, r9
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], rdx
xor edi, edi
mov dword [rsp + 0x40], edi
mov eax, 0x5c
mov word [rsp + 0x48], ax
mov rax, qword [r8 + 0x10]
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
je 0x140028b70
cmp qword [r8 + 0x18], 8
jb 0x140028097
mov r8, qword [r8]
mov qword [rsp + 0x30], 1
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov r9, r8
lea rcx, [rbp + 0x68]
call fcn.14001e1d0
mov r13d, 0x20
mov dword [rsp + 0x40], r13d
mov r8, rbx
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0xa8]
call fcn.14001bea0
nop
and r13d, 0xffffffdf
mov dword [rsp + 0x40], r13d
mov rdx, qword [rbp + 0x80]
cmp rdx, 8
jb 0x140028126
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028121
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140028b76
call fcn.14003d1f0
movdqa xmm0, xmmword [0x14007dc60]
movdqu xmmword [rbp + 0x78], xmm0
mov word [rbp + 0x68], di
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x18], xmm1
mov r8d, 0xc
lea rdx, str.ShortcutPath
lea rcx, [rbp + 8]
call fcn.140004560
nop
lea r9, [rbp + 8]
lea r8, [rbp + 0xa8]
mov rdx, 0xffffffff80000002
lea rcx, [rbp + 0xc8]
call fcn.14002ed80
nop
mov rdx, rax
lea rcx, [rsp + 0x68]
call fcn.1400038b0
nop
mov rdx, qword [rbp + 0xe0]
cmp rdx, 8
jb 0x1400281d0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400281cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140028b7c
call fcn.14003d1f0
movdqa xmm0, xmmword [0x14007dc60]
movdqu xmmword [rbp + 0xd8], xmm0
mov word [rbp + 0xc8], di
mov rdx, qword [rbp + 0x20]
cmp rdx, 8
jb 0x140028227
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028222
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140028b82
call fcn.14003d1f0
movdqa xmm0, xmmword [0x14007dc60]
movdqu xmmword [rbp + 0x18], xmm0
mov word [rbp + 8], di
lea rdi, [0x14008e120]
mov qword [rsp + 0x50], rdi
lea r12, [0x14008e140]
lea r10, [0x14008e5e0]
mov rcx, qword [r12 + 0x10]
test rcx, rcx
je 0x14002830e
cmp rcx, qword [rsp + 0x78]
ja 0x14002830e
lea r9, [rcx + rcx]
cmp qword [r12 + 0x18], 8
jb 0x140028284
mov rax, qword [r12]
add rax, r9
mov r15, qword [r12]
jmp 0x14002828b
lea rax, [r12 + r9]
mov r15, r12
lea rbx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rbx, qword [rsp + 0x68]
add rbx, r9
lea r14, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae r14, qword [rsp + 0x68]
mov rcx, rbx
sub rcx, r14
sub rax, r15
xor rcx, rax
test rcx, 0xfffffffffffffffe
je 0x1400282c7
xor al, al
jmp 0x140028306
cmp r14, rbx
je 0x1400282f8
sub r15, r14
nop
movzx edi, word [r14]
movzx ecx, word [r14 + r15]
call fcn.140049650
mov esi, eax
mov ecx, edi
call fcn.140049650
cmp eax, esi
jne 0x14002848c
add r14, 2
cmp r14, rbx
jne 0x1400282d0
mov al, 1
mov rdi, qword [rsp + 0x50]
lea r10, [0x14008e5e0]
test al, al
jne 0x140028493
add rdi, 0x40
mov qword [rsp + 0x50], rdi
add r12, 0x40
cmp rdi, r10
jne 0x140028252
xor r14d, r14d
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
movdqa xmm0, xmmword [0x14007dc60]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r14w
or r13d, 8
mov dword [rsp + 0x40], r13d
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rcx, qword [rsp + 0x68]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
movsxd rbx, eax
test eax, eax
je 0x1400283bb
xor r8d, r8d
mov rdx, rbx
lea rcx, [rbp - 0x78]
call fcn.140003d80
lea rdx, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rdx, qword [rbp - 0x78]
lea rcx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rcx, qword [rsp + 0x68]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor r8d, r8d
lea eax, [rbx - 1]
movsxd rdx, eax
lea rcx, [rbp - 0x78]
call fcn.140003d80
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x1400283fc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400283f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140028b88
call fcn.14003d1f0
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r14w
movups xmm0, xmmword [rbp - 0x78]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rbp - 0x68]
movups xmmword [rsp + 0x78], xmm1
movdqa xmm0, xmmword [0x14007dc60]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r14w
and r13d, 0xfffffff7
mov dword [rsp + 0x40], r13d
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], r14w
mov rbx, qword [rsp + 0x78]
xorps xmm0, xmm0
test rbx, rbx
jne 0x140028881
movups xmmword [rbp - 0x18], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 8], xmm1
lea r8d, [rbx + 4]
lea rdx, str.none
lea rcx, [rbp - 0x18]
call fcn.140004560
lea rax, [rbp - 0x18]
or r13d, 1
lea rcx, [rbp - 8]
lea rdx, [rbp]
jmp 0x140028989
xor al, al
jmp 0x1400282fa
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x38], xmm1
mov r8d, 0x45
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerUser_Shell_Folders
lea rcx, [rbp + 0x28]
call fcn.140004560
nop
mov r9, rdi
lea r8, [rbp + 0x28]
mov rdx, 0xffffffff80000001
lea rcx, [rbp - 0x58]
call fcn.14002ed80
nop
mov rdx, qword [rbp + 0x40]
cmp rdx, 8
jb 0x140028511
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002850c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140028b8e
call fcn.14003d1f0
movdqa xmm0, xmmword [0x14007dc60]
movdqu xmmword [rbp + 0x38], xmm0
xor r14d, r14d
mov word [rbp + 0x28], r14w
mov rsi, qword [rbp - 0x48]
test rsi, rsi
jne 0x140028585
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x14002856f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002856a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140028b64
call fcn.14003d1f0
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], 7
mov word [rbp - 0x58], r14w
jmp 0x140028327
mov r9, qword [rdi + 0x30]
mov r8, qword [rsp + 0x78]
cmp r8, r9
jbe 0x1400287ea
lea rax, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rax, qword [rsp + 0x68]
lea r8, [rax + r8*2]
lea rdx, [rsp + 0x68]
cmovae rdx, qword [rsp + 0x68]
add rdx, 0xfffffffffffffffe
lea rdx, [rdx + r9*2]
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], r14
cmp rdx, r8
jne 0x1400285e9
mov rbx, r14
mov qword [rbp - 0x68], rbx
mov edi, 7
mov qword [rbp - 0x60], rdi
mov word [rbp - 0x78], r14w
jmp 0x140028600
sub r8, rdx
sar r8, 1
lea rcx, [rbp - 0x78]
call fcn.140004560
mov rdi, qword [rbp - 0x60]
mov rbx, qword [rbp - 0x68]
mov eax, 0x5c
mov word [rsp + 0x48], ax
mov rax, qword [rbp - 0x48]
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
je 0x140028b94
lea r9, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
cmovae r9, qword [rbp - 0x58]
mov qword [rsp + 0x30], 1
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x88]
call fcn.14001e1d0
bts r13d, 7
mov dword [rsp + 0x40], r13d
lea rdx, [rbp - 0x78]
cmp rdi, 8
cmovae rdx, qword [rbp - 0x78]
mov r8, rbx
lea rcx, [rbp + 0x88]
call fcn.140003e10
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x58], xmm0
movups xmm6, xmmword [rax]
movups xmmword [rbp + 0x48], xmm6
movups xmm7, xmmword [rax + 0x10]
movdqu xmmword [rbp + 0x58], xmm7
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
bts r13d, 8
mov dword [rsp + 0x40], r13d
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x1400286ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400286e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140028b9a
call fcn.14003d1f0
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r14w
movups xmmword [rsp + 0x68], xmm6
movups xmmword [rsp + 0x78], xmm7
movdqa xmm0, xmmword [0x14007dc60]
movdqu xmmword [rbp + 0x58], xmm0
mov word [rbp + 0x48], r14w
btr r13d, 8
mov dword [rsp + 0x40], r13d
movdqu xmmword [rbp + 0x58], xmm0
mov word [rbp + 0x48], r14w
btr r13d, 7
mov dword [rsp + 0x40], r13d
mov rdx, qword [rbp + 0xa0]
cmp rdx, 8
jb 0x14002877f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002877a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140028ba0
call fcn.14003d1f0
movdqa xmm0, xmmword [0x14007dc60]
movdqu xmmword [rbp + 0x98], xmm0
mov word [rbp + 0x88], r14w
mov rdx, qword [rbp - 0x60]
cmp rdx, 8
jb 0x1400287d7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400287d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140028ba6
call fcn.14003d1f0
mov qword [rbp - 0x68], r14
mov qword [rbp - 0x60], 7
mov word [rbp - 0x78], r14w
jmp 0x140028839
lea r9, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
cmovae r9, qword [rbp - 0x58]
mov rax, qword [rbp - 0x80]
cmp rsi, rax
ja 0x14002882b
lea rbx, [rsp + 0x68]
cmp rax, 8
cmovae rbx, qword [rsp + 0x68]
mov qword [rsp + 0x78], rsi
lea r8, [rsi + rsi]
mov rdx, r9
mov rcx, rbx
call fcn.14003f3a0
mov word [rbx + rsi*2], r14w
jmp 0x140028839
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.14001cf70
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 8
jb 0x14002856f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002856a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140028b64
jmp 0x14002856a
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x20], r14
lea rdi, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rdi, qword [rsp + 0x68]
movabs rsi, 0x7ffffffffffffffe
cmp rbx, rsi
ja 0x140028bac
mov qword [rbp - 0x20], 7
cmp rbx, 8
jae 0x1400288ce
mov qword [rbp - 0x28], rbx
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x38], xmm0
jmp 0x140028979
mov rax, rbx
or rax, 7
cmp rax, rsi
jbe 0x1400288ea
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14002891c
mov rsi, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x140028b6a
add rcx, rcx
cmp rcx, 0x1000
jb 0x14002894b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140028b6a
mov rcx, rax
call fcn.14003d910
mov rcx, rax
test rax, rax
je 0x140028bb8
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14002895a
test rcx, rcx
je 0x140028957
call fcn.14003d910
jmp 0x14002895a
mov rax, r14
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], rsi
lea r8, [rbx*2 + 2]
mov rdx, rdi
mov rcx, rax
call fcn.14003f3a0
lea rax, [rbp - 0x38]
or r13d, 2
lea rcx, [rbp - 0x28]
lea rdx, [rbp - 0x20]
mov dword [rsp + 0x40], r13d
mov rbx, qword [rsp + 0x58]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rcx], r14
mov qword [rdx], 7
mov word [rax], r14w
or r13d, 4
mov dword [rsp + 0x40], r13d
test r13b, 2
je 0x140028a18
and r13d, 0xfffffffd
mov dword [rsp + 0x40], r13d
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x140028a07
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028a02
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140028bb2
call fcn.14003d1f0
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x20], 7
mov word [rbp - 0x38], r14w
test r13b, 1
je 0x140028a79
and r13d, 0xfffffffe
mov dword [rsp + 0x40], r13d
mov rdx, qword [rbp]
cmp rdx, 8
jb 0x140028a67
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028a62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140028bb8
call fcn.14003d1f0
movdqa xmm0, xmmword [0x14007dc60]
movdqu xmmword [rbp - 8], xmm0
mov word [rbp - 0x18], r14w
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140028aba
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028ab5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140028bbe
call fcn.14003d1f0
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], 7
mov word [rsp + 0x68], r14w
mov rdx, qword [rbp + 0xc0]
cmp rdx, 8
jb 0x140028b0f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028b0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140028b5e
call fcn.14003d1f0
movdqa xmm0, xmmword [0x14007dc60]
movdqu xmmword [rbp + 0xb8], xmm0
mov word [rbp + 0xa8], r14w
mov rax, rbx
mov rcx, qword [rbp + 0xe8]
xor rcx, rsp
call fcn.14003d1d0
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14004930c
nop
call fcn.14004930c
int3
call fcn.140002950
nop
call fcn.140002a10
nop
call fcn.14004930c
nop
call fcn.14004930c
nop
call fcn.14004930c
nop
call fcn.14004930c
nop
call fcn.14004930c
nop
call fcn.140002a10
nop
call fcn.14004930c
nop
call fcn.14004930c
nop
call fcn.14004930c
nop
call fcn.140002a10
nop
call fcn.14004930c
nop
call fcn.14004930c
nop
call fcn.14004930c
int3