Function at 0x180010170
Capabilities:
Query environment variable

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x220]
sub rsp, 0x320
mov rax, qword [0x18008ab58]
xor rax, rsp
mov qword [rbp + 0x210], rax
xor r15d, r15d
mov r14, r9
mov rdi, rdx
mov rsi, rcx
mov ebx, 0x57
mov qword [rsp + 0x38], r15
cmp word [rcx], r15w
jbe 0x18001020c
cmp qword [rcx + 8], r15
je 0x18001020c
movzx ebx, word [rcx]
lea ecx, [r15 + 0x40]
add ebx, 2
mov edx, ebx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov qword [r14], rax
test rax, rax
jne 0x1800101e6
lea eax, [r15 + 8]
jmp 0x180010456
movzx r9d, word [rsi]
mov rcx, rax
mov r8, qword [rsi + 8]
mov edx, ebx
shr r9, 1
shr rdx, 1
call qword [sym.imp.msvcrt.dll_wcsncpy_s]
nop dword [rax + rax]
xor eax, eax
jmp 0x180010456
test rdi, rdi
je 0x180010454
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x2c8
call sub.msvcrt.dll_memset
mov r12d, 0x164
lea r8, str.SoftwareMicrosoftWindows_NTCurrentVersionProfileList_
mov edx, r12d
lea rcx, [rsp + 0x40]
call qword [sym.imp.msvcrt.dll_swprintf_s]
nop dword [rax + rax]
lea rcx, [rsp + 0x40]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r15w
jne 0x180010251
mov rcx, rdi
mov dword [rsp + 0x30], eax
call qword [sym.imp.ntdll.dll_RtlIdentifierAuthoritySid]
nop dword [rax + rax]
mov rdx, r12
lea rcx, [rsp + 0x40]
mov rbx, rax
lea r8, str.S_1_
mov eax, dword [rsp + 0x30]
sub rdx, rax
lea rcx, [rcx + rax*2]
call qword [sym.imp.msvcrt.dll_swprintf_s]
nop dword [rax + rax]
mov ecx, r15d
mov r8, rbx
mov edx, 6
cmp byte [r8], r15b
ja 0x1800102b0
inc ecx
inc r8
cmp ecx, edx
jb 0x1800102a2
cmp ecx, edx
jae 0x1800102f7
mov eax, ecx
add rbx, rax
sub edx, ecx
mov esi, edx
mov r8d, dword [rsp + 0x30]
lea rcx, [rsp + 0x40]
movzx eax, byte [rbx]
mov rdx, r12
sub rdx, r8
mov dword [rsp + 0x20], eax
lea rcx, [rcx + r8*2]
mov r9, rcx
lea r8, str._s_d
call qword [sym.imp.msvcrt.dll_swprintf_s]
nop dword [rax + rax]
inc rbx
sub rsi, 1
jne 0x1800102bd
mov rcx, rdi
mov ebx, r15d
call qword [sym.imp.ntdll.dll_RtlSubAuthorityCountSid]
nop dword [rax + rax]
cmp byte [rax], r15b
jbe 0x18001036a
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.ntdll.dll_RtlSubAuthoritySid]
nop dword [rax + rax]
lea rcx, [rsp + 0x40]
mov rdx, r12
mov r8, rax
mov eax, dword [rsp + 0x30]
sub rdx, rax
lea rcx, [rcx + rax*2]
mov eax, dword [r8]
mov r9, rcx
mov dword [rsp + 0x20], eax
lea r8, str._s__d
call qword [sym.imp.msvcrt.dll_swprintf_s]
nop dword [rax + rax]
mov rcx, rdi
inc ebx
call qword [sym.imp.ntdll.dll_RtlSubAuthorityCountSid]
nop dword [rax + rax]
movzx ecx, byte [rax]
cmp ebx, ecx
jb 0x18001030e
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], r15
lea r9, [rsp + 0x38]
mov qword [rsp + 0x20], rax
lea r8, str.ProfileImagePath
mov rcx, 0xffffffff80000002
lea rdx, [rsp + 0x40]
call fcn.180010c40
mov ebx, eax
test eax, eax
jne 0x18001043e
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x180010454
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
mov esi, eax
test eax, eax
je 0x18001042b
lea edx, [rax + 1]
xor ecx, ecx
add rdx, rdx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov qword [r14], rax
test rax, rax
je 0x180010424
mov r8d, esi
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
test eax, eax
jne 0x180010439
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov rcx, qword [r14]
mov ebx, eax
test rcx, rcx
je 0x18001041f
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov qword [r14], r15
jmp 0x180010439
mov ebx, 8
jmp 0x180010439
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
mov rcx, rdi
jmp 0x180010448
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x180010454
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov eax, ebx
mov rcx, qword [rbp + 0x210]
xor rcx, rsp
call fcn.180002a90
add rsp, 0x320
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret