Function at 0x43ddb0
Capabilities:
Query environment variable

Disassembly:
mov r11, rsp
sub rsp, 0x5b8
mov rax, qword [0x00507af8]
xor rax, rsp
mov qword [rsp + 0x570], rax
mov qword [r11 + 0x20], rbx
mov qword [r11 - 0x10], rsi
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x20], r12
mov qword [r11 - 0x28], r13
mov qword [r11 - 0x38], r15
mov rsi, rcx
xor r15d, r15d
mov ecx, 0x208
mov r13d, r8d
mov rbx, rdx
mov edi, r15d
call fcn.0048efe0
test rax, rax
mov r12, rax
je 0x43e08b
mov qword [rsp + 0x588], r14
lea r14, [rbx + 8]
mov rcx, r14
call fcn.00488a60
lea r11, [rsp + 0x48]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], r11
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
lea r9, [rsp + 0x44]
lea rdx, [rsp + 0x360]
mov r8d, 0x104
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.00488a70
test eax, eax
je 0x43e079
mov qword [rsp + 0x5b0], rbp
nop
mov eax, dword [rsp + 0x40]
cmp eax, 1
je 0x43de82
cmp eax, 2
jne 0x43e028
cmp word [rsp + 0x50], r15w
je 0x43e028
cmp eax, 2
jne 0x43dec5
lea rcx, [rsp + 0x50]
mov r8d, 0x104
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rcx, [rsp + 0x50]
mov r11, r12
sub rcx, r12
movzx eax, word [r11]
add r11, 2
test ax, ax
mov word [rcx + r11 - 2], ax
jne 0x43deb2
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test rax, rax
mov rbp, rax
je 0x43df93
lea r8, [rsp + 0x260]
mov r9d, 0x100
mov edx, r13d
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x43df93
mov edi, dword [rsi + 8]
mov ecx, 0x18
lea eax, [rdi + 1]
mov dword [rsi + 8], eax
call fcn.004910b0
test rax, rax
mov rbx, rax
je 0x43df72
lea rax, [0x004d6368]
mov qword [rbx + 0x10], r15
lea rcx, [rsp + 0x50]
mov qword [rbx], rax
mov dword [rbx + 8], edi
call fcn.004941d0
test rax, rax
mov qword [rbx + 0x10], rax
je 0x43df75
lea rcx, [rsi + 0x18]
mov r8, rbx
xor edx, edx
call fcn.0043dbc0
test rax, rax
je 0x43df75
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x260]
mov r8, rdi
xor edx, edx
call qword [sym.imp.USER32.dll_AppendMenuW]
jmp 0x43e01a
mov rbx, r15
add dword [rsi + 8], 0xffffffff
test rbx, rbx
je 0x43df8b
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov edi, r15d
jmp 0x43e01a
mov edi, dword [rsi + 8]
mov ecx, 0x18
lea eax, [rdi + 1]
mov dword [rsi + 8], eax
call fcn.004910b0
test rax, rax
mov rbx, rax
je 0x43dffe
lea rax, [0x004d6368]
mov qword [rbx + 0x10], r15
lea rcx, [rsp + 0x50]
mov qword [rbx], rax
mov dword [rbx + 8], edi
call fcn.004941d0
test rax, rax
mov qword [rbx + 0x10], rax
je 0x43e001
lea rcx, [rsi + 0x18]
mov r8, rbx
xor edx, edx
call fcn.0043dbc0
test rax, rax
je 0x43e001
mov rcx, qword [rsi + 0x10]
lea r9, [rsp + 0x360]
mov r8, rdi
xor edx, edx
call qword [sym.imp.USER32.dll_AppendMenuW]
jmp 0x43e01a
mov rbx, r15
add dword [rsi + 8], 0xffffffff
test rbx, rbx
je 0x43e017
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov edi, r15d
test rbp, rbp
je 0x43e028
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rax, [rsp + 0x48]
lea r9, [rsp + 0x44]
lea rdx, [rsp + 0x360]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r8d, 0x104
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.00488a70
test eax, eax
jne 0x43de70
mov rbp, qword [rsp + 0x5b0]
mov rcx, r12
call fcn.00491a30
mov r14, qword [rsp + 0x588]
mov eax, edi
mov r15, qword [rsp + 0x580]
mov r13, qword [rsp + 0x590]
mov r12, qword [rsp + 0x598]
mov rdi, qword [rsp + 0x5a0]
mov rsi, qword [rsp + 0x5a8]
mov rbx, qword [rsp + 0x5d8]
mov rcx, qword [rsp + 0x570]
xor rcx, rsp
call fcn.004902e0
add rsp, 0x5b8
ret