Function at 0x140003924
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
xor r12d, r12d
mov r14d, r8d
mov dword [rbp + 0x40], r12d
mov eax, r12d
mov qword [rbp + 0x48], rax
mov rsi, rdx
mov qword [rbp - 0x10], r12
mov r15, rcx
lea edi, [r12 + 0x40]
mov r9d, r12d
test r8b, 1
je 0x140003a6c
mov edx, edi
mov dword [rbp + 0x40], edi
lea rcx, [rbp + 0x48]
call fcn.140004b20
mov ebx, eax
test eax, eax
js 0x140003b60
mov r8d, dword [rbp + 0x40]
mov rcx, rsi
mov rdx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x1400039ce
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, pe_nt_image_headers64
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov r8d, ebx
lea rcx, str.c:_agent_work35_swix_srclibsdutilpathutil.cpp
call fcn.140005e7c
jmp 0x140003b60
mov r9d, dword [rbp + 0x40]
cmp r9d, eax
jae 0x140003a2a
mov edx, eax
lea rcx, [rbp + 0x48]
mov dword [rbp + 0x40], eax
call fcn.140004b20
mov ebx, eax
test eax, eax
js 0x140003b60
mov r8d, dword [rbp + 0x40]
mov rcx, rsi
mov rdx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x140003a11
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x113
jmp 0x1400039a2
mov r9d, dword [rbp + 0x40]
cmp r9d, eax
jae 0x140003a2a
mov r8d, 0x8007007a
mov edx, 0x118
mov ebx, r8d
jmp 0x1400039bd
cmp eax, 0x104
jbe 0x140003a68
lea rcx, [rbp + 0x48]
call fcn.140003d10
cmp eax, 0x80070057
mov ebx, eax
cmove ebx, r12d
test ebx, ebx
js 0x140003b60
mov rcx, qword [rbp + 0x48]
lea rdx, [rbp + 0x40]
call fcn.1400052ac
mov ebx, eax
test eax, eax
js 0x140003b60
mov r9d, dword [rbp + 0x40]
mov rax, qword [rbp + 0x48]
test r14b, 2
je 0x140003b41
test rax, rax
mov qword [rbp - 8], r12
mov r14, rsi
lea rcx, [rbp - 0x10]
cmovne r14, rax
cmp r9d, edi
cmova edi, r9d
mov edx, edi
call fcn.140004b20
mov ebx, eax
test eax, eax
js 0x140003b60
mov r8, qword [rbp - 0x10]
lea r9, [rbp - 8]
mov edx, edi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x140003ac7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x139
jmp 0x1400039a2
cmp edi, eax
jae 0x140003b25
cmp eax, 0x104
lea edi, [rax + 7]
lea rcx, [rbp - 0x10]
cmovb edi, eax
mov edx, edi
call fcn.140004b20
mov ebx, eax
test eax, eax
js 0x140003b60
mov r8, qword [rbp - 0x10]
lea r9, [rbp - 8]
mov edx, edi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x140003b0e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x144
jmp 0x1400039a2
cmp edi, eax
jae 0x140003b25
mov r8d, 0x8007007a
mov edx, 0x149
mov ebx, r8d
jmp 0x1400039bd
cmp eax, 0x104
jbe 0x140003b3b
lea rcx, [rbp - 0x10]
call fcn.140003d10
mov ebx, eax
test eax, eax
js 0x140003b60
mov rax, qword [rbp - 0x10]
jmp 0x140003b49
mov qword [rbp - 0x10], rax
mov qword [rbp + 0x48], r12
test rax, rax
mov rcx, r15
cmovne rsi, rax
xor r8d, r8d
mov rdx, rsi
call fcn.140004cdc
mov ebx, eax
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140003b6e
call fcn.1400052a4
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x140003b7c
call fcn.1400052a4
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret