Function at 0x1400352a8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x48]
sub rsp, 0x130
mov rax, qword [0x140059b08]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov rdi, rcx
xor esi, esi
mov qword [rbp + 0x10], rsi
lea r15d, [rsi + 7]
mov qword [rbp + 0x18], r15
mov word [rbp], si
lea rdx, [0x14004b358]
lea rcx, [rbp]
call fcn.1400070e8
nop
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], r15
mov word [rbp - 0x40], si
lea rdx, str.MicrosoftCryptoPCPKSPWindowsAIK
lea rcx, [rbp - 0x40]
call fcn.1400070e8
nop
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], r15
mov word [rsp + 0x60], si
lea rdx, str.SystemDrive
lea rcx, [rsp + 0x60]
call fcn.1400070e8
nop
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], r15
mov word [rbp - 0x60], si
lea rdx, str.ProgramData
lea rcx, [rbp - 0x60]
call fcn.1400070e8
nop
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r15
mov word [rsp + 0x40], si
lea rcx, [rbp]
lea r14d, [rsi + 8]
cmp qword [rbp + 0x18], r14
cmovae rcx, qword [rbp]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x1400353dc
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.140032a04
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], r14
cmovae rdx, qword [rsp + 0x40]
lea rcx, [rbp]
cmp qword [rbp + 0x18], r14
cmovae rcx, qword [rbp]
mov r8d, ebx
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
mov rdx, qword [rsp + 0x50]
dec rdx
lea rcx, [rsp + 0x40]
call fcn.140032a04
jmp 0x1400354ed
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0xcb
jne 0x1400356fa
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], r14
cmovae rcx, qword [rsp + 0x60]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x140035716
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], r15
mov word [rbp - 0x80], si
mov edx, ebx
lea rcx, [rbp - 0x80]
call fcn.140032a04
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], r14
cmovae rdx, qword [rbp - 0x80]
lea rcx, [rsp + 0x60]
cmp qword [rsp + 0x78], r14
cmovae rcx, qword [rsp + 0x60]
mov r8d, ebx
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
mov edx, dword [rbp - 0x50]
add edx, dword [rbp - 0x70]
lea rcx, [rsp + 0x40]
call fcn.140032a04
lea r9, [rbp - 0x60]
cmp qword [rbp - 0x48], r14
cmovae r9, qword [rbp - 0x60]
lea r8, [rbp - 0x80]
cmp qword [rbp - 0x68], r14
cmovae r8, qword [rbp - 0x80]
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], r14
cmovae rcx, qword [rsp + 0x40]
mov dword [rsp + 0x20], 1
mov rdx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchCombineEx]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x48]
test eax, eax
js 0x14003573b
mov rdx, qword [rsp + 0x50]
dec rdx
lea rcx, [rsp + 0x40]
call fcn.140032a04
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, r14
jb 0x1400354ed
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
call fcn.140007850
movabs rax, 0x7ffffffffffffffe
mov rcx, qword [rsp + 0x50]
sub rax, rcx
mov rdx, qword [rbp - 0x30]
cmp rax, rdx
jb 0x140035750
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], r14
cmovae r9, qword [rsp + 0x40]
lea rax, [rbp - 0x40]
cmp qword [rbp - 0x28], r14
cmovae rax, qword [rbp - 0x40]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp - 0x20]
call fcn.14001c900
nop
mov rax, qword [rbp - 0x10]
cmp rax, 0x104
jae 0x140035756
shr rax, 0x20
test eax, eax
je 0x140035589
mov rcx, rax
add rcx, rcx
je 0x140035589
mov rax, rcx
shr rax, 0x20
test eax, eax
jne 0x1400356f4
mov eax, dword [rbp - 0x10]
add rax, rax
shl rcx, 0x20
add rcx, rax
cmp rcx, rax
jb 0x1400356f4
jmp 0x14003558f
mov ecx, dword [rbp - 0x10]
add rcx, rcx
mov eax, 0xffffffff
cmp rcx, rax
ja 0x1400356f4
lea r8, [rbp - 0x20]
cmp qword [rbp - 8], r14
cmovae r8, qword [rbp - 0x20]
mov dword [rsp + 0x20], esi
mov r9d, ecx
lea rdx, str.PCP_ALTERNATE_KEY_STORAGE_LOCATION
mov rcx, rdi
call qword [sym.imp.ncrypt.dll_NCryptSetProperty]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x48]
test eax, eax
js 0x1400356df
mov rdx, qword [rbp - 8]
cmp rdx, r14
jb 0x1400355ed
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x20]
call fcn.140007850
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], r15
mov word [rbp - 0x20], si
mov rdx, qword [rsp + 0x58]
cmp rdx, r14
jb 0x140035615
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x40]
call fcn.140007850
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r15
mov word [rsp + 0x40], si
mov rdx, qword [rbp - 0x48]
cmp rdx, r14
jb 0x14003563e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
call fcn.140007850
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], r15
mov word [rbp - 0x60], si
mov rdx, qword [rsp + 0x78]
cmp rdx, r14
jb 0x140035666
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
call fcn.140007850
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], r15
mov word [rsp + 0x60], si
mov rdx, qword [rbp - 0x28]
cmp rdx, r14
jb 0x14003568f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
call fcn.140007850
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], r15
mov word [rbp - 0x40], si
mov rdx, qword [rbp + 0x18]
cmp rdx, r14
jb 0x1400356b5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp]
call fcn.140007850
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.14003f700
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov r9d, eax
lea r8, str.onecore_amcoreoctagoncommon_tpmattestation_attesttpm.cpp
mov edx, 0x70
call fcn.14001603c
int3
call fcn.14002de18
nop
mov rcx, qword [rbp + 0x48]
mov r9d, 0x139f
lea r8, str.onecore_amcoreoctagoncommon_tpmattestation_attesttpm.cpp
mov edx, 0x45
call fcn.140022a00
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r9d, eax
mov rcx, qword [rbp + 0x48]
lea r8, str.onecore_amcoreoctagoncommon_tpmattestation_attesttpm.cpp
mov edx, 0x4d
call fcn.140022a00
nop
mov r9d, eax
lea r8, str.onecore_amcoreoctagoncommon_tpmattestation_attesttpm.cpp
mov edx, 0x5f
call fcn.14001603c
nop
call fcn.140005c80
nop
mov rcx, qword [rbp + 0x48]
mov r9d, 0x32
lea r8, str.onecore_amcoreoctagoncommon_tpmattestation_attesttpm.cpp
lea edx, [r9 + 0x36]
call fcn.140022a00
int3