Function at 0x14001603c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov r14, rdx
mov rbx, rcx
mov rax, qword [rcx]
call qword [rax]
mov rdx, r14
mov rcx, rbx
call fcn.1400224b0
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
xor ebp, ebp
test eax, eax
setne byte [rsp + 0x40]
call fcn.140002950
mov rcx, rax
test rax, rax
je 0x140016161
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
mov edi, 0x208
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400160be
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.140002d40
mov rbx, qword [rsp + 0x50]
mov r8d, edi
mov rdx, rbx
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, eax
test eax, eax
jne 0x1400160e7
xor r8d, r8d
mov edx, 0x80004005
lea rcx, str.Error_while_expanding_environment_variables.
call fcn.140045c88
cmp esi, edi
jbe 0x1400160f3
mov edi, esi
test esi, esi
js 0x14001616f
jmp 0x14001609c
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
test eax, eax
js 0x14001616f
cmp eax, dword [rbx - 0xc]
jg 0x14001616f
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], bp
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.1400068a0
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001613d
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp byte [rsp + 0x40], bpl
je 0x14001614a
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, r14
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
jmp 0x14001617c
mov ecx, 0x80004005
call fcn.1400327c0
nop
jmp 0x14001616e
nop
mov ecx, 0x80070057
call fcn.1400327c0
int3
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x48
mov rsi, rcx
xor edi, edi
mov rdx, qword [rcx]
cmp dword [rdx - 0x10], edi
jle 0x140016401
or r15d, 0xffffffff
test edi, edi
js 0x140016401
cmp edi, dword [rdx - 0x10]
jg 0x140016401
movsxd rax, edi
lea rcx, [rdx + rax*2]
lea rdx, [0x14006f284]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rbx, rax
test rax, rax
je 0x140016401
mov rax, qword [rsi]
sub rbx, rax
sar rbx, 1
test ebx, ebx
js 0x140016401
lea r14d, [rbx + 2]
cmp r14d, dword [rax - 0x10]
jg 0x140016401
lfence
movsxd rcx, r14d
mov rax, qword [rsi]
lea rcx, [rax + rcx*2]
lea rdx, [0x14007b8c8]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rdi, rax
test rax, rax
je 0x140016401
sub rdi, qword [rsi]
sar rdi, 1
test edi, edi
js 0x140016401
lfence
and qword [rbp + 0x38], 0
mov r9d, edi
sub r9d, ebx
sub r9d, 2
mov r8d, r14d
lea rdx, [rbp + 0x38]
mov rcx, rsi
call fcn.1400093f0
lea rdx, [0x14007b8c8]
lea rcx, [rbp + 0x48]
call fcn.140002f00
lea r8, str._t_n_v_f_r
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.14001ba30
mov rdx, qword [rax]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcspbrk]
mov rbx, rax
test rax, rax
jne 0x140016283
mov ebx, r15d
jmp 0x14001628a
sub rbx, qword [rbp + 0x38]
sar rbx, 1
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400162b0
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
nop
mov rdx, qword [rbp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400162d3
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test ebx, ebx
jns 0x1400163cf
lea r8, [rbp + 0x38]
lea rdx, [0x14007b8e0]
lea rcx, [rbp - 0x18]
call fcn.14000c3c0
nop
lea r8, [0x14007b8e0]
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.14001ba30
mov rbx, rax
lea r8, [rbp + 0x38]
lea rdx, [0x14006f284]
lea rcx, [rbp - 0x28]
call fcn.14000c3c0
nop
lea r8, [0x14007b8c8]
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.14001ba30
nop
mov r8, qword [rbx]
mov rdx, qword [rax]
mov rcx, rsi
call fcn.1400036c0
nop
mov rdx, qword [rbp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140016362
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140016386
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400163aa
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400163d2
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400163d2
mov edi, r14d
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400163f5
lfence
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsi]
cmp edi, dword [rdx - 0x10]
jl 0x1400161a1
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret