Function at 0x1400117fc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x418]
sub rsp, 0x500
mov qword [rbp - 0x80], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140076010]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
mov rsi, rdx
mov rdi, rcx
xor r14d, r14d
mov byte [rsp + 0x58], r14b
lea eax, [r14 + 6]
mov word [rsp + 0x42], ax
mov byte [rsp + 0x40], 1
mov byte [rsp + 0x5c], r14b
mov byte [rsp + 0x60], r14b
mov byte [rsp + 0x64], r14b
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x5c]
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x64]
lea rcx, [rsp + 0x78]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2306]
lea rax, [0x140049bd0]
mov qword [rbp - 0x78], rax
lea rax, [0x14007ed00]
mov qword [rbp - 0x70], rax
lea rax, str.RefreshContainerRegistry
mov qword [rbp - 0x68], rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_162]
test rax, rax
je 0x1400118c2
mov rcx, rax
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1638]
jmp 0x1400118c9
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_92]
nop
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8, rax
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_1998_1]
mov r8d, 0x104
lea rdx, [rbp + 0x1e0]
lea rcx, str._LOCALAPPDATA_MicrosoftOfficeContainerDataReadOnlyOfficeRegKeys.reg
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp - 0x78]
call fcn.140007214
lea rcx, [rbp - 0x78]
call fcn.14000dd20
test al, al
sete bl
mov rax, qword [rbp - 0x60]
cmp rax, 8
jb 0x140011960
mov rcx, qword [rbp - 0x78]
mov rdx, rcx
lea rax, [rax*2 + 2]
cmp rax, 0x1000
jb 0x140011959
mov rcx, qword [rcx - 8]
sub rdx, rcx
lea rax, [rdx - 8]
cmp rax, 0x1f
jbe 0x140011959
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
test bl, bl
je 0x140011979
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [rsp + 0x68]
call fcn.140011260
jmp 0x140011b58
call qword [sym.imp.Mso30Win32Client.dll_Ordinal_1102]
mov r10, rax
mov rcx, qword [rax]
mov rax, qword [rcx + 8]
mov dword [rsp + 0x30], r14d
mov dword [rsp + 0x28], 0x104
lea rcx, [rbp - 0x30]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0xd5
mov rcx, r10
call qword [case.0x140044c3e.0]
test eax, eax
jne 0x1400119c5
xor edx, edx
mov ecx, 0x30303030
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_2055]
nop
mov dword [rsp + 0x40], r14d
lea r9, [rbp - 0x78]
lea r8, [rbp - 0x70]
mov edx, reloc.hlink.dll_Ordinal_25
lea rcx, str.container_import_registry
call sub.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsCreateStringReference
lea rax, [rbp - 0x30]
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], r14w
jne 0x1400119eb
lea r9, [rbp - 0x58]
lea r8, [rbp - 0x50]
lea rcx, [rbp - 0x30]
call sub.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsCreateStringReference
mov qword [rsp + 0x28], rsi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x78]
lea r8, [rbp - 0x58]
lea rdx, [rsp + 0x78]
mov rcx, rdi
call fcn.140013b78
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.14001393c
nop word [rax + rax]
cmp qword [rsp + 0x78], r14
je 0x140011a52
lea rcx, [rsp + 0x78]
call fcn.140002c60
nop
lea rcx, [rsp + 0x50]
call fcn.140013bf0
mov rcx, qword [rsp + 0x50]
test eax, eax
je 0x140011a9d
mov dword [rsp + 0x40], r14d
mov rax, qword [rcx]
lea rdx, [rsp + 0x40]
mov rax, qword [rax + 0x38]
call qword [case.0x140044c3e.0]
test eax, eax
js 0x140011b95
mov r8d, dword [rsp + 0x40]
mov edx, 1
lea rcx, [rsp + 0x68]
call fcn.140011260
jmp 0x140011b46
mov qword [rsp + 0x48], r14
mov rax, qword [rcx]
lea rdx, [rsp + 0x48]
mov rax, qword [rax + 0x40]
call qword [case.0x140044c3e.0]
test eax, eax
js 0x140011ba1
mov rcx, qword [rsp + 0x48]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [case.0x140044c3e.0]
test eax, eax
js 0x140011b8a
lea rcx, [rsp + 0x48]
call fcn.140013bf0
cmp eax, 2
jne 0x140011af7
lea edx, [rax - 1]
mov r8d, edx
lea rcx, [rsp + 0x68]
call fcn.140011260
jmp 0x140011b34
lea rcx, [rsp + 0x48]
call fcn.140013c30
test eax, eax
je 0x140011b19
lea rcx, [rsp + 0x48]
call fcn.140013c30
mov r8d, eax
mov edx, 2
jmp 0x140011aeb
lea rcx, [rsp + 0x68]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_143]
cmp byte [rax], r14b
je 0x140011b2f
mov byte [rax + 1], 1
jmp 0x140011b34
mov word [rax], 0x101
cmp qword [rsp + 0x48], r14
je 0x140011b46
lea rcx, [rsp + 0x48]
call fcn.140002c60
nop
cmp qword [rsp + 0x50], r14
je 0x140011b58
lea rcx, [rsp + 0x50]
call fcn.140002c60
nop
lea rcx, [rsp + 0x68]
call qword [sym.imp.Mso20Win32Client.dll_Ordinal_426_1]
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.1400443a0
lea r11, [rsp + 0x500]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
mov ecx, eax
call fcn.140004c00
nop
jmp 0x140011b94
nop
mov ecx, eax
call fcn.140004c00
nop
jmp 0x140011ba0
nop
mov ecx, eax
call fcn.140004c00
nop
jmp 0x140011bac
nop
nop
nop
nop