Function at 0x14002d080
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x60
mov r12, r8
lea rsi, [rsp + 0x88]
mov r15, rdx
lea r8, [fcn.140039600]
mov r13, rcx
lea rdx, [rsp + 0x48]
add rsi, 0xfffffffffffffff8
mov edi, r9d
mov rcx, rsi
call fcn.140025270
lea r8, [0x14002da20]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140025270
mov ebx, dword [rsp + 0xb8]
xor ebp, ebp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbp
test ebx, ebx
je 0x14002d11e
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ecx, eax
lea rdx, [rsp + 0x58]
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
jne 0x14002d11e
lea rdx, str.failed_getting_active_user_token
mov ecx, 0x550003
call fcn.140028e10
jmp 0x14002d35a
test r12, r12
je 0x14002d12b
cmp qword [r12], rbp
cmove r12, rbp
mov edx, 1
mov rcx, r12
call fcn.14002da50
test eax, eax
je 0x14002d15a
mov rax, qword gs:[0x58]
lea rdx, str.invalid_redir:__s
mov r8d, 0x15c0
add r8, qword [rax]
jmp 0x14002d342
test r15, r15
je 0x14002d166
cmp qword [r15], rbp
cmove r15, rbp
test edi, edi
je 0x14002d2e9
test r15, r15
jne 0x14002d198
test ebx, ebx
je 0x14002d2e9
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x40]
xor r8d, r8d
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x14002d1a9
mov qword [rsp + 0x40], rbp
jmp 0x14002d1fa
test ebx, ebx
jne 0x14002d17b
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov qword [rsp + 0x40], rax
jmp 0x14002d1ae
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x14002d1fa
cmp word [rax], bp
je 0x14002d1fa
mov rdx, rax
mov rcx, rsi
call fcn.1400256c0
mov rcx, qword [rsp + 0x48]
xor r8d, r8d
mov rdx, qword [rax]
call fcn.140038b40
mov rcx, qword [rsp + 0x40]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], bp
jne 0x14002d1e0
inc rax
lea rax, [rcx + rax*2]
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x14002d1b3
test r15, r15
je 0x14002d2e1
mov qword [rsp + 0x90], r14
nop dword [rax + rax]
mov rdi, qword [r15]
test rdi, rdi
je 0x14002d2d9
mov r14, qword [rsp + 0x48]
xor bpl, bpl
cmp qword [r14], 0
jne 0x14002d232
mov rcx, r14
call fcn.140039660
mov edx, 0x3d
mov rcx, rdi
call fcn.140173a2c
mov rcx, rax
test rax, rax
je 0x14002d24b
sub ecx, edi
jmp 0x14002d25e
or rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rdi + rax], 0
jne 0x14002d250
mov ecx, eax
mov bpl, 1
mov rbx, qword [r14]
mov rax, qword [rbx]
test rax, rax
je 0x14002d2bc
movsxd rsi, ecx
nop dword [rax]
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call fcn.140180590
test eax, eax
jne 0x14002d28b
mov rax, qword [rbx]
cmp byte [rsi + rax], 0x3d
je 0x14002d298
mov rax, qword [rbx + 8]
add rbx, 8
test rax, rax
jne 0x14002d270
test rax, rax
je 0x14002d2bc
test bpl, bpl
jne 0x14002d2af
mov rdx, rdi
mov rcx, rbx
call fcn.140026210
jmp 0x14002d2cf
mov rdx, rbx
mov rcx, r14
call fcn.1400395b0
jmp 0x14002d2cf
test bpl, bpl
jne 0x14002d2cf
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call fcn.140038b40
add r15, 8
jne 0x14002d210
mov r14, qword [rsp + 0x90]
mov rax, qword [rsp + 0x48]
mov r15, qword [rax]
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov rdx, r13
call fcn.140056260
mov rax, qword [rsp + 0x58]
mov r9, r12
mov rcx, qword [rsp + 0x50]
mov r8, r15
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x28], eax
mov rcx, qword [rcx]
mov dword [rsp + 0x20], 1
call fcn.14002d5b0
mov rbx, rax
test rax, rax
jne 0x14002d34e
mov r8, qword [rsp + 0x50]
lea rdx, str.failed_CreateProcess__s_:__m
mov r8, qword [r8]
mov ecx, 0x550003
call fcn.140028e10
mov ebx, eax
lea rcx, [rsp + 0x58]
call fcn.14003e170
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret