Function at 0x18000ce50
Capabilities:
Query environment variable

Disassembly:
add rcx, 0x10
jmp 0x18000ce50
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x110
mov qword [rsp + 0xf8], 0xfffffffffffffffe
mov r12, r9
mov rsi, r8
mov rdi, rcx
call fcn.180011c10
test al, al
jne 0x18000ce99
mov eax, 0x80004005
jmp 0x18000d59d
test rsi, rsi
je 0x18000d598
test r12, r12
je 0x18000d598
mov r8b, 3
mov edx, 2
lea ecx, [rdx + 4]
call fcn.1800698a0
test eax, eax
je 0x18000cf91
xor ebx, ebx
mov dword [rsp + 0x20], ebx
nop dword [rax]
cmp ebx, 1
jg 0x18000cf8a
mov rcx, rdi
call fcn.180011980
test eax, eax
js 0x18000cf8a
lea rcx, [rsp + 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
lea rax, [rsp + 0x40]
mov qword [rsp + 0x100], rax
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.180015710
nop
mov rcx, qword [rdi + 0x168]
test rcx, rcx
jne 0x18000cf27
mov ecx, 0x80004003
call fcn.1800bf320
nop
lea r8, [rsp + 0x28]
mov rdx, rax
call fcn.180005100
test eax, eax
je 0x18000cf4b
test r12, r12
je 0x18000cf4b
mov rdx, r12
lea rcx, [rsp + 0x28]
call fcn.1800140e0
nop
jmp 0x18000cf7f
lea rcx, [rsp + 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
xor eax, eax
jmp 0x18000d59d
lea rcx, [rsp + 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
mov r14d, 8
mov rcx, r14
call fcn.1800c0db0
test rax, rax
je 0x18000cfbf
lea rcx, [rsp + 0x80]
mov qword [rax], rcx
xor ebx, ebx
jmp 0x18000cfc4
xor ebx, ebx
mov rax, rbx
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0xd0], 7
mov qword [rsp + 0xc8], rbx
mov word [rsp + 0xb8], bx
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rsi
lea rcx, [rsp + 0xb0]
call fcn.180014810
nop
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0xb0]
call fcn.180069b60
mov edi, eax
cmp qword [rsp + 0xd0], 8
jb 0x18000d053
mov rcx, qword [rsp + 0xb8]
call fcn.1800bf8b4
test edi, edi
je 0x18000d505
mov r13, qword [rsp + 0xa0]
mov rax, r13
sub rax, qword [rsp + 0x98]
je 0x18000d505
test rax, rax
jne 0x18000d086
call fcn.1800c1088
mov r13, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x98]
sub r13d, esi
dec edi
cmp edi, 0xa
ja case.0x18000d0ad.6
lea rdx, [0x180000000]
mov ecx, dword [rdx + rdi*4 + 0xd5b0]
add rcx, rdx
jmp rcx
lea rcx, [rsp + 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
jns 0x18000d0c5
mov ecx, eax
call fcn.1800bf320
mov word [rsp + 0x28], r14w
test rsi, rsi
jne 0x18000d0da
mov qword [rsp + 0x30], rbx
jmp 0x18000d505
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x18000d505
mov ecx, 0x8007000e
call fcn.1800bf320
lea rcx, [rsp + 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
jns 0x18000d111
mov ecx, eax
call fcn.1800bf320
mov word [rsp + 0x28], r14w
test rsi, rsi
jne 0x18000d123
mov qword [rsp + 0x30], rbx
jmp 0x18000d140
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x18000d140
mov ecx, 0x8007000e
call fcn.1800bf320
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, eax
test eax, eax
je 0x18000d505
mov word [rsp + 0x20], bx
mov rcx, r14
call fcn.1800c0db0
test rax, rax
je 0x18000d174
lea rcx, [rsp + 0x50]
mov qword [rax], rcx
jmp 0x18000d177
mov rax, rbx
mov qword [rsp + 0x50], rax
lea edx, [rdi + 1]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.180012740
nop
mov rax, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
sub rax, rdx
sar rax, 1
jne 0x18000d1ab
call fcn.1800c1088
mov rdx, qword [rsp + 0x68]
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x18000d21d
mov rax, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x68]
sub rax, rdi
sar rax, 1
jne 0x18000d1d7
call fcn.1800c1088
mov rdi, qword [rsp + 0x68]
lea rcx, [rsp + 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
jns 0x18000d1ed
mov ecx, eax
call fcn.1800bf320
mov word [rsp + 0x28], r14w
test rdi, rdi
jne 0x18000d1ff
mov qword [rsp + 0x30], rbx
jmp 0x18000d21d
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0x30], rax
test rax, rax
jne 0x18000d21d
mov ecx, 0x8007000e
call fcn.1800bf320
nop
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x18000d22c
call fcn.1800bf8b4
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
mov rcx, qword [rsp + 0x50]
call fcn.1800bf8b4
jmp 0x18000d505
mov rax, qword [rsp + 0x98]
mov edi, dword [rax]
cmp word [rsp + 0x28], 0x13
je 0x18000d27c
lea rcx, [rsp + 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
jns 0x18000d272
mov ecx, eax
call fcn.1800bf320
mov eax, reloc.OLEAUT32.dll_SafeArrayGetLBound
mov word [rsp + 0x28], ax
mov dword [rsp + 0x30], edi
jmp 0x18000d505
mov rax, qword [rsp + 0x98]
mov rdi, qword [rax]
cmp word [rsp + 0x28], 0x15
je 0x18000d2b8
lea rcx, [rsp + 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
jns 0x18000d2ae
mov ecx, eax
call fcn.1800bf320
mov eax, reloc.OLEAUT32.dll_SafeArrayUnlock
mov word [rsp + 0x28], ax
mov qword [rsp + 0x30], rdi
jmp 0x18000d505
mov dword [rsp + 0x20], r13d
mov dword [rsp + 0x24], ebx
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x20]
lea edx, [rcx - 0xb]
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov r14, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x18000d2f2
mov eax, 0x8007000e
jmp 0x18000d2ff
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnlock]
test eax, eax
jns 0x18000d307
mov ecx, eax
call fcn.180018720
nop
mov edi, ebx
mov r15d, SafeArrayAccessData
nop
cmp edi, r13d
jae 0x18000d37d
mov esi, edi
mov rax, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x98]
sub rax, rcx
cmp rsi, rax
jb 0x18000d33c
call fcn.1800c1088
mov rcx, qword [rsp + 0x98]
movzx eax, byte [rcx + rsi]
mov word [rsp + 0xd8], r15w
mov byte [rsp + 0xe0], al
mov r9d, 1
lea r8, [rsp + 0xd8]
mov edx, edi
lea rcx, [rsp + 0x40]
call fcn.180004680
nop
lea rcx, [rsp + 0xd8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
inc edi
jmp 0x18000d310
lea rcx, [rsp + 0x50]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov r11d, 0x200c
mov word [rsp + 0x50], r11w
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SafeArrayAccessData]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x58], r14
lea rcx, [rsp + 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
jns 0x18000d3bd
mov ecx, eax
call fcn.1800bf320
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetElement
lea r8, [rsp + 0x50]
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.1800c10a8
nop
jmp 0x18000d505
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x44], ebx
mov ecx, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea r8, [rsp + 0x40]
lea edx, [rcx - 0xb]
call qword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
mov rdi, rax
mov qword [rsp + 0x20], rax
test rax, rax
jne 0x18000d40a
mov eax, 0x8007000e
jmp 0x18000d417
mov rcx, rax
call qword [sym.imp.OLEAUT32.dll_SafeArrayUnlock]
test eax, eax
jns 0x18000d41f
mov ecx, eax
call fcn.180018720
nop
nop
cmp word [rsi], 0
je 0x18000d491
mov word [rsp + 0xb0], r14w
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rsp + 0xb8], rax
test rax, rax
jne 0x18000d450
mov ecx, 0x8007000e
call fcn.1800bf320
nop
mov r8d, 1
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x20]
call fcn.180011770
nop
lea rcx, [rsp + 0xb0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
lea rsi, [rsi + rcx*2]
mov rdi, qword [rsp + 0x20]
jmp 0x18000d420
lea rcx, [rsp + 0x50]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
mov r11d, 0x200c
mov word [rsp + 0x50], r11w
mov rcx, rdi
call qword [sym.imp.OLEAUT32.dll_SafeArrayAccessData]
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x58], rdi
lea rcx, [rsp + 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
jns 0x18000d4d1
mov ecx, eax
call fcn.1800bf320
mov r9d, reloc.OLEAUT32.dll_SafeArrayGetElement
lea r8, [rsp + 0x50]
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.1800c10a8
nop
jmp 0x18000d505
mov dword [rsp + 0x48], 0xffffffff
lea rdx, [0x18013ad60]
lea rcx, [rsp + 0x48]
call fcn.1800c3e40
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x28]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rdx + 0x10], rax
mov word [rsp + 0x28], bx
lea rcx, [rsp + 0xb0]
mov rax, qword [rcx]
mov qword [r12], rax
mov rax, qword [rcx + 8]
mov qword [r12 + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [r12 + 0x10], rax
mov rsi, qword [rsp + 0x98]
test rsi, rsi
je 0x18000d563
mov rcx, rsi
call fcn.1800bf8b4
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], rbx
mov qword [rsp + 0xa8], rbx
mov rcx, qword [rsp + 0x80]
call fcn.1800bf8b4
nop
lea rcx, [rsp + 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
xor eax, eax
jmp 0x18000d59d
mov eax, 0x80004003
add rsp, 0x110
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret