Function at 0x1400597a8
Capabilities:
Query environment variable

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a0
mov qword [rsp + 0xc0], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rax, qword [0x140099938]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov r12, r8
mov qword [rsp + 0x20], r8
mov r15, rdx
mov qword [rsp + 0x60], rcx
mov eax, 7
mov qword [r11 - 0xc8], rax
xor esi, esi
mov qword [r11 - 0xd0], rsi
mov word [rsp + 0xf8], si
mov qword [r11 - 0xa0], rax
mov qword [r11 - 0xa8], rsi
mov word [rsp + 0x120], si
lea ecx, [rax + 1]
call fcn.14005b298
cmp rax, rsi
je 0x140059839
lea rcx, [rsp + 0x70]
mov qword [rax], rcx
jmp 0x14005983c
mov rax, rsi
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rsi
lea rcx, [rsp + 0xa0]
call fcn.14004a428
nop
lea rcx, [rsp + 0xb0]
call fcn.14004a428
nop
lea rcx, [rsp + 0x140]
call fcn.14004a92c
nop
mov r14d, esi
mov r13, rsi
mov ebx, 0x2000000
mov r9d, ebx
lea r8, str.SOFTWAREMicrosoftWindows_NTCurrentVersionProfileList
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0xa0]
call fcn.14004a460
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xa0]
call fcn.14004ab28
mov r9d, ebx
lea r8, [0x140077480]
mov rdx, 0xffffffff80000003
lea rcx, [rsp + 0xb0]
call fcn.14004a460
mov qword [rsp + 0x68], rax
mov rdx, qword [rsp + 0x88]
mov rdi, rdx
mov rbx, qword [rsp + 0x90]
cmp rdx, rbx
jbe 0x14005990e
call fcn.14005c2f8
mov rbx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rdi
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
cmp rdx, rbx
jbe 0x14005993c
call fcn.14005c2f8
cmp rbp, rsi
je 0x140059948
cmp rbp, qword [rsp + 0x70]
je 0x14005994d
call fcn.14005c2f8
cmp rdi, rbx
je 0x14005a04d
cmp rbp, rsi
jne 0x140059965
call fcn.14005c2f8
mov r11, rsi
jmp 0x140059969
mov r11, qword [rbp]
cmp rdi, qword [r11 + 0x20]
jb 0x140059974
call fcn.14005c2f8
cmp qword [rdi + 0x20], 8
jb 0x140059984
lea rsi, [rdi + 8]
mov rdx, qword [rsi]
jmp 0x14005998b
lea rsi, [rdi + 8]
mov rdx, rsi
lea rcx, [rsp + 0xb0]
call fcn.14004a4c4
xor ebx, ebx
cmp eax, ebx
je 0x140059c76
cmp rbp, rbx
jne 0x1400599b1
call fcn.14005c2f8
mov r11, rbx
jmp 0x1400599b5
mov r11, qword [rbp]
cmp rdi, qword [r11 + 0x20]
jb 0x1400599c0
call fcn.14005c2f8
cmp qword [rdi + 0x20], 8
jb 0x1400599ca
mov rsi, qword [rsi]
mov rcx, rsi
call fcn.14005b1c0
mov r8, rax
mov rdx, rsi
lea rcx, [rsp + 0xf0]
call fcn.140002280
lea rcx, [0x1400778f0]
call fcn.14005b1c0
mov r8, rax
lea rdx, [0x1400778f0]
lea rcx, [rsp + 0xf0]
call fcn.14000362c
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call fcn.14005b1c0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0xf0]
call fcn.14000362c
lea r8, [rsp + 0xf8]
cmp qword [rsp + 0x110], 8
cmovae r8, qword [rsp + 0xf8]
mov r9d, 0x2000000
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x140]
call fcn.14004a460
xor esi, esi
cmp rax, rsi
je 0x14005a014
mov rdx, r15
lea rcx, [rsp + 0x140]
call fcn.14004a55c
cmp eax, esi
je 0x140059c64
mov rdx, r15
lea rcx, [rsp + 0x140]
call fcn.14004a58c
cmp eax, 2
jne 0x140059bff
mov ebx, esi
mov rcx, r13
call fcn.140048b24
lea esi, [rbx + 1]
mov r12d, esi
lea rcx, [rsi + rsi]
mov r8d, 0x513
lea rdx, str...CommonW32_CommonFunctions.cpp
call fcn.140048afc
mov r13, rax
xor eax, eax
cmp r13, rax
je 0x140059be0
mov qword [rsp + 0xe8], 7
xor r14d, r14d
mov qword [rsp + 0xe0], r14
mov word [rsp + 0xd0], r14w
mov rdx, r15
lea rcx, [rsp + 0x140]
call fcn.14004a6b0
mov rbx, rax
mov rcx, rax
call fcn.14005b1c0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0xc8]
call fcn.140002280
lea rcx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae rcx, qword [rsp + 0xd0]
mov r8d, esi
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
cmp eax, r14d
je 0x140059bb0
mov rdx, r12
mov rcx, r13
call fcn.14005ca00
cmp rax, r14
je 0x140059ba9
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], r14
mov word [rsp + 0x30], r14w
mov rcx, r13
call fcn.14005b1c0
mov r8, rax
mov rdx, r13
lea rcx, [rsp + 0x28]
call fcn.140002280
nop
lea rdx, [rsp + 0x28]
mov r12, qword [rsp + 0x20]
mov rcx, r12
call fcn.14001a3a4
nop
cmp qword [rsp + 0x48], 8
jb 0x140059bb5
mov rcx, qword [rsp + 0x30]
call fcn.14005ab0c
jmp 0x140059bb5
mov r12, qword [rsp + 0x20]
jmp 0x140059bb5
mov r12, qword [rsp + 0x20]
mov r14d, 1
cmp qword [rsp + 0xe8], 8
jb 0x140059bd3
mov rcx, qword [rsp + 0xd0]
call fcn.14005ab0c
cmp ebx, esi
jb 0x140059c64
jmp 0x140059a98
lea r8, str.AllocMem_failed._n
lea rdx, str.GetUsersRegistryStringsW
mov ecx, 4
call fcn.140009480
mov r12, qword [rsp + 0x20]
jmp 0x140059c64
mov rdx, r15
lea rcx, [rsp + 0x140]
call fcn.14004a6b0
mov rbx, rax
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rsi
mov word [rsp + 0x30], si
mov rcx, rax
call fcn.14005b1c0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140002280
nop
lea rdx, [rsp + 0x28]
mov rcx, r12
call fcn.14001a3a4
nop
cmp qword [rsp + 0x48], 8
jb 0x140059c5e
mov rcx, qword [rsp + 0x30]
call fcn.14005ab0c
mov r14d, 1
lea rcx, [rsp + 0x140]
call fcn.14004a43c
jmp 0x14005a014
mov edx, 1
lea rcx, str.SeRestorePrivilege
call fcn.140056dec
cmp eax, ebx
je 0x14005a014
cmp rbp, rbx
jne 0x140059c9e
call fcn.14005c2f8
mov r11, rbx
jmp 0x140059ca2
mov r11, qword [rbp]
cmp rdi, qword [r11 + 0x20]
jb 0x140059cad
call fcn.14005c2f8
cmp qword [rdi + 0x20], 8
jb 0x140059cb9
mov rcx, qword [rsi]
jmp 0x140059cbc
mov rcx, rsi
call fcn.1400575d4
cmp eax, ebx
je 0x14005a006
cmp rbp, rbx
jne 0x140059cd8
call fcn.14005c2f8
mov r11, rbx
jmp 0x140059cdc
mov r11, qword [rbp]
cmp rdi, qword [r11 + 0x20]
jb 0x140059ce7
call fcn.14005c2f8
cmp qword [rdi + 0x20], 8
jb 0x140059cf3
mov rbx, qword [rsi]
jmp 0x140059cf6
mov rbx, rsi
mov rcx, rbx
call fcn.14005b1c0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0xf0]
call fcn.140002280
lea rcx, [0x1400778f0]
call fcn.14005b1c0
mov r8, rax
lea rdx, [0x1400778f0]
lea rcx, [rsp + 0xf0]
call fcn.14000362c
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call fcn.14005b1c0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0xf0]
call fcn.14000362c
lea r8, [rsp + 0xf8]
cmp qword [rsp + 0x110], 8
cmovae r8, qword [rsp + 0xf8]
mov r9d, 0x2000000
mov rdx, qword [rsp + 0x68]
lea rcx, [rsp + 0x140]
call fcn.14004a460
xor ebx, ebx
cmp rax, rbx
je 0x140059fd6
mov rdx, r15
lea rcx, [rsp + 0x140]
call fcn.14004a55c
cmp eax, ebx
je 0x140059fc9
mov rdx, r15
lea rcx, [rsp + 0x140]
call fcn.14004a58c
cmp eax, 2
jne 0x140059f59
mov rcx, r13
call fcn.140048b24
lea r12d, [rbx + 1]
mov ecx, r12d
add rcx, rcx
mov r8d, 0x535
lea rdx, str...CommonW32_CommonFunctions.cpp
call fcn.140048afc
mov r13, rax
xor ebx, ebx
cmp rax, rbx
je 0x140059f3a
lea r14d, [rbx + 7]
mov qword [rsp + 0xe8], r14
mov qword [rsp + 0xe0], rbx
mov word [rsp + 0xd0], bx
mov rdx, r15
lea rcx, [rsp + 0x140]
call fcn.14004a6b0
mov rbx, rax
mov rcx, rax
call fcn.14005b1c0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0xc8]
call fcn.140002280
lea rcx, [rsp + 0xd0]
cmp qword [rsp + 0xe8], 8
cmovae rcx, qword [rsp + 0xd0]
mov r8d, r12d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
xor eax, eax
cmp ebx, eax
je 0x140059ebb
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rax
mov word [rsp + 0x30], ax
mov rcx, r13
call fcn.14005b1c0
mov r8, rax
mov rdx, r13
lea rcx, [rsp + 0x28]
call fcn.140002280
nop
lea rdx, [rsp + 0x28]
mov r14, qword [rsp + 0x20]
mov rcx, r14
call fcn.14001a3a4
nop
cmp qword [rsp + 0x48], 8
jb 0x140059ec0
mov rcx, qword [rsp + 0x30]
call fcn.14005ab0c
jmp 0x140059ec0
mov r14, qword [rsp + 0x20]
cmp qword [rsp + 0xe8], 8
jb 0x140059ed8
mov rcx, qword [rsp + 0xd0]
call fcn.14005ab0c
mov qword [rsp + 0x48], 7
xor eax, eax
mov qword [rsp + 0x40], rax
mov word [rsp + 0x30], ax
mov rcx, r13
call fcn.14005b1c0
mov r8, rax
mov rdx, r13
lea rcx, [rsp + 0x28]
call fcn.140002280
nop
lea rdx, [rsp + 0x28]
mov rcx, r14
call fcn.14001a3a4
nop
cmp qword [rsp + 0x48], 8
jb 0x140059f26
mov rcx, qword [rsp + 0x30]
call fcn.14005ab0c
mov r14d, 1
cmp ebx, r12d
jb 0x140059fc2
jmp 0x140059dc2
lea r8, str.AllocMem_failed._n
lea rdx, str.GetUsersRegistryStringsW
mov ecx, 4
call fcn.140009480
mov r12, qword [rsp + 0x20]
jmp 0x140059fc9
mov rdx, r15
lea rcx, [rsp + 0x140]
call fcn.14004a6b0
mov rbx, rax
mov qword [rsp + 0x48], 7
xor eax, eax
mov qword [rsp + 0x40], rax
mov word [rsp + 0x30], ax
mov rcx, rbx
call fcn.14005b1c0
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140002280
nop
lea rdx, [rsp + 0x28]
mov rcx, r12
call fcn.14001a3a4
nop
cmp qword [rsp + 0x48], 8
jb 0x140059fba
mov rcx, qword [rsp + 0x30]
call fcn.14005ab0c
xor ebx, ebx
lea r14d, [rbx + 1]
jmp 0x140059fc9
mov r12, qword [rsp + 0x20]
xor ebx, ebx
lea rcx, [rsp + 0x140]
call fcn.14004a43c
cmp rbp, rbx
jne 0x140059fe5
call fcn.14005c2f8
mov r11, rbx
jmp 0x140059fe9
mov r11, qword [rbp]
cmp rdi, qword [r11 + 0x20]
jb 0x140059ff4
call fcn.14005c2f8
cmp qword [rdi + 0x20], 8
jb 0x140059ffe
mov rsi, qword [rsi]
mov rcx, rsi
call fcn.140056eb8
xor edx, edx
lea rcx, str.SeRestorePrivilege
call fcn.140056dec
xor esi, esi
cmp rbp, rsi
jne 0x14005a025
call fcn.14005c2f8
mov r11, rsi
jmp 0x14005a029
mov r11, qword [rbp]
cmp rdi, qword [r11 + 0x20]
jb 0x14005a034
call fcn.14005c2f8
add rdi, 0x28
mov rbx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
jmp 0x140059932
lea rcx, [rsp + 0x140]
call fcn.14004a960
nop
lea rcx, [rsp + 0xb0]
call fcn.14004a8ec
nop
lea rcx, [rsp + 0xa0]
call fcn.14004a8ec
nop
lea rcx, [rsp + 0x70]
call fcn.140005204
mov rcx, qword [rsp + 0x70]
call fcn.14005ab0c
nop
cmp qword [rsp + 0x138], 8
jb 0x14005a0a4
mov rcx, qword [rsp + 0x120]
call fcn.14005ab0c
mov qword [rsp + 0x138], 7
mov qword [rsp + 0x130], rsi
mov word [rsp + 0x120], si
cmp qword [rsp + 0x110], 8
jb 0x14005a0d8
mov rcx, qword [rsp + 0xf8]
call fcn.14005ab0c
mov eax, r14d
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.14005bad0
mov rbx, qword [rsp + 0x1f8]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret