Function at 0x1000ac39c
Capabilities:
Delete file
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4e0
mov rax, qword [0x10010f190]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
mov rax, qword [rsp + 0x548]
and qword [rsp + 0x70], 0
mov rdi, qword [rsp + 0x580]
mov ebp, dword [rsp + 0x588]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x578]
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0x590]
xor esi, esi
and qword [rsp + 0x98], rsi
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x598]
xor r15d, r15d
mov qword [rsp + 0x90], rax
mov eax, dword [rsp + 0x550]
mov r12, rcx
mov rcx, qword [rsp + 0x540]
mov r14, r9
mov r13d, edx
mov dword [rsp + 0x68], edx
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x60], r15
cmp eax, 3
je 0x1000ac48e
test eax, eax
je 0x1000ac48e
lea r9, [rsp + 0x70]
mov r8d, ebp
mov rdx, rdi
call fcn.1000a8e20
test eax, eax
je 0x1000ac484
xor r9d, r9d
mov r8d, eax
mov edx, 0x119a00ca
xor ecx, ecx
call fcn.1000b51b8
mov rbx, qword [rsp + 0x70]
test rbx, rbx
jne 0x1000ac4eb
mov r8d, ebp
mov rdx, rdi
mov ecx, 1
call qword [sym.imp.CRYPT32.dll_CertCreateCertificateContext]
mov rbx, rax
test rax, rax
jne 0x1000ac4e9
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
and qword [rsp + 0x38], rsi
and qword [rsp + 0x30], rsi
mov r9d, reloc.certcli.dll_Ordinal_256
xor r8d, r8d
mov edx, r13d
mov rcx, r12
mov dword [rsp + 0x28], 0x20000010
mov edi, eax
mov dword [rsp + 0x20], eax
call fcn.1000af608
mov edx, 0x11ad00ca
jmp 0x1000ac5ff
xor edi, edi
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.1000c1bb0
mov r15d, dword [rsp + 0x560]
mov r13d, dword [rsp + 0x558]
test eax, eax
je 0x1000ac581
xor r9d, r9d
mov r8d, eax
mov edx, 0x11b300ca
xor ecx, ecx
call fcn.1000b51b8
mov eax, dword [rsp + 0x550]
mov r9, qword [rsp + 0xa0]
mov edx, dword [rsp + 0x68]
mov qword [rsp + 0x58], rbx
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x38], r13d
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x88]
xor r8d, r8d
mov rcx, r12
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
call fcn.1000abfdc
mov edi, eax
test eax, eax
je 0x1000ac611
mov r8d, eax
mov edx, 0x11dc00ca
jmp 0x1000ac926
mov eax, r15d
shl eax, 0x10
or eax, r13d
cmp eax, dword [rsp + 0x70]
je 0x1000ac51e
lea rax, [rsp + 0x60]
mov r9d, r13d
mov r8, r14
mov qword [rsp + 0x28], rax
xor edx, edx
mov rcx, r12
mov dword [rsp + 0x20], r15d
call fcn.1000a29b0
test eax, eax
je 0x1000ac5c5
xor r9d, r9d
mov r8d, eax
mov edx, 0x11bf00ca
xor ecx, ecx
call fcn.1000b51b8
and qword [rsp + 0x38], rsi
mov r15, qword [rsp + 0x60]
mov edx, dword [rsp + 0x68]
mov qword [rsp + 0x30], r15
mov edi, 0x8007000d
mov r9d, reloc.certcli.dll_Ordinal_253
xor r8d, r8d
mov rcx, r12
mov dword [rsp + 0x28], 0x20000010
mov dword [rsp + 0x20], edi
call fcn.1000af608
mov edx, 0x11ca00ca
mov r8d, edi
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
jmp 0x1000ac935
mov r9, rbx
mov r8d, r13d
xor edx, edx
mov rcx, r14
call fcn.1000dc9e8
mov edi, eax
test eax, eax
je 0x1000ac634
mov r8d, eax
mov edx, 0x11e100ca
jmp 0x1000ac926
mov ebp, dword [rsp + 0x568]
test ebp, ebp
je 0x1000ac6cd
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x70], 1
call fcn.1000cb330
test eax, eax
je 0x1000ac66b
xor r9d, r9d
mov r8d, eax
mov edx, 0x11e800ca
xor ecx, ecx
call fcn.1000b51b8
mov rax, qword [rsp + 0x90]
mov r9d, dword [rsp + 0x70]
mov r8, qword [rsp + 0x88]
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x570]
mov qword [rsp + 0x40], rbx
mov dword [rsp + 0x38], eax
mov eax, dword [rsp + 0x550]
mov dword [rsp + 0x30], r15d
mov rdx, r14
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], eax
call fcn.1000aaf84
mov edi, eax
test eax, eax
je 0x1000ac6cd
mov r8d, eax
mov edx, 0x11f600ca
jmp 0x1000ac926
mov rax, qword [rsp + 0x78]
mov edi, 0x80070002
test rax, rax
je 0x1000ac751
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1000ac70a
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov rcx, qword [rsp + 0x78]
mov r9d, edi
mov r8d, eax
mov edx, 0x120400ca
call fcn.1000b51b8
mov eax, dword [rsp + 0x68]
mov r8d, dword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, qword [rsp + 0x78]
and qword [rsp + 0x28], rsi
mov r9, r12
mov dword [rsp + 0x20], eax
call fcn.1000a7c08
test eax, eax
jne 0x1000ac751
call sub.KERNEL32.dll_GetLastError
mov ecx, eax
call fcn.1000b7bec
mov rcx, qword [rsp + 0x78]
xor r9d, r9d
mov r8d, eax
mov edx, 0x120f00ca
call fcn.1000b51b8
lea rdx, [rsp + 0xb0]
lea rcx, [0x100026cd0]
mov r8d, reloc.certcli.dll_Ordinal_260
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1000ac8f3
mov edx, reloc.certcli.dll_Ordinal_260
cmp eax, edx
jae 0x1000ac8f3
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0xb0]
repne scasw ax, word [rdi]
not rcx
add rcx, 0x1c
cmp rcx, rdx
jbe 0x1000ac7ad
mov edi, 0x80070003
mov edx, 0x122700ca
jmp 0x1000ac923
mov edi, 0x208
lea r8, [rsp + 0xb0]
lea rcx, [rsp + 0x2c0]
mov rdx, rdi
call fcn.10005f390
lea r8, [0x100026ce8]
lea rcx, [rsp + 0x2c0]
mov rdx, rdi
call fcn.100056234
and qword [rsp + 0x38], rsi
mov eax, dword [rsp + 0x68]
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x80]
lea r8, [0x100012378]
lea rcx, [rsp + 0x2c0]
mov r9d, r13d
mov rdx, r14
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call fcn.1000a89f8
mov edi, eax
test eax, eax
je 0x1000ac83f
xor r9d, r9d
mov r8d, eax
mov edx, 0x123600ca
xor ecx, ecx
call fcn.1000b51b8
mov rsi, qword [rsp + 0x80]
jmp 0x1000ac930
mov rsi, qword [rsp + 0x80]
mov r8d, dword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, rsi
mov r9d, reloc.certcli.dll_Ordinal_258
call sub.certcli.dll_Ordinal_225
mov edi, eax
test eax, eax
je 0x1000ac899
and qword [rsp + 0x38], 0
mov edx, dword [rsp + 0x68]
mov qword [rsp + 0x30], rsi
mov r9d, 0x11d
xor r8d, r8d
mov rcx, r12
mov dword [rsp + 0x28], 0x20000010
mov dword [rsp + 0x20], eax
call fcn.1000af608
mov edx, 0x124600ca
jmp 0x1000ac923
cmp dword [rsp + 0x570], 0
jne 0x1000ac930
lea r9, [rsp + 0x98]
or r8d, 0xffffffff
mov edx, r15d
mov rcx, r14
call fcn.1000b3020
mov edi, eax
test eax, eax
je 0x1000ac8ce
mov r8d, eax
mov edx, 0x125200ca
jmp 0x1000ac926
mov r9, qword [rsp + 0x90]
mov r8d, ebp
mov edx, ebp
mov rcx, r14
call fcn.1000ad3e0
mov edi, eax
test eax, eax
je 0x1000ac930
mov r8d, eax
mov edx, 0x125900ca
jmp 0x1000ac926
and qword [rsp + 0x38], rsi
and qword [rsp + 0x30], rsi
mov edx, dword [rsp + 0x68]
mov r9d, 0x107
xor r8d, r8d
mov rcx, r12
mov dword [rsp + 0x28], 0x20000010
mov dword [rsp + 0x20], edi
call fcn.1000af608
mov edx, 0x122000ca
mov r8d, edi
xor r9d, r9d
xor ecx, ecx
call fcn.1000b51b8
mov r15, qword [rsp + 0x60]
test rbx, rbx
je 0x1000ac943
mov rcx, rbx
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
test r15, r15
je 0x1000ac951
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rsp + 0x98]
test rcx, rcx
je 0x1000ac964
call qword [sym.imp.KERNEL32.dll_LocalFree]
test rsi, rsi
je 0x1000ac972
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.1000ef870
mov rbx, qword [rsp + 0x530]
add rsp, 0x4e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret