Function at 0x1400267f0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x28]
sub rsp, 0x120
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x14003c4b8]
xor rax, rsp
mov qword [rbp + 0x18], rax
mov rdi, rcx
lea rdx, [0x1400308d0]
lea rcx, [rbp - 0x68]
call fcn.140011c54
nop
lea rdx, str.MicrosoftCryptoPCPKSPWindowsAIK
lea rcx, [rbp - 8]
call fcn.140011c54
nop
lea rdx, str.SystemDrive
lea rcx, [rsp + 0x78]
call fcn.140011c54
nop
lea rdx, str.ProgramData
lea rcx, [rbp - 0x28]
call fcn.140011c54
nop
xor esi, esi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], si
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rcx, qword [rbp - 0x68]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
mov ebx, eax
test eax, eax
je 0x1400268e9
mov edx, ebx
lea rcx, [rsp + 0x38]
call fcn.140027588
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rdx, qword [rsp + 0x38]
lea rcx, [rbp - 0x68]
cmp qword [rbp - 0x50], 8
cmovae rcx, qword [rbp - 0x68]
mov r8d, ebx
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
mov rdx, qword [rsp + 0x48]
dec rdx
lea rcx, [rsp + 0x38]
call fcn.140027588
jmp 0x1400269e9
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 0xcb
jne 0x140026b03
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
mov ebx, eax
test eax, eax
je 0x140026b1f
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], 7
mov word [rsp + 0x58], si
mov edx, ebx
lea rcx, [rsp + 0x58]
call fcn.140027588
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rcx, qword [rsp + 0x78]
mov r8d, ebx
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
mov rdx, qword [rsp + 0x68]
add rdx, qword [rbp - 0x18]
mov edx, edx
lea rcx, [rsp + 0x38]
call fcn.140027588
lea r9, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae r9, qword [rbp - 0x28]
lea r8, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae r8, qword [rsp + 0x58]
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
mov dword [rsp + 0x20], 1
mov rdx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchCombineEx]
mov rcx, qword [rbp + 0x28]
test eax, eax
js 0x140026b3e
mov rdx, qword [rsp + 0x48]
dec rdx
lea rcx, [rsp + 0x38]
call fcn.140027588
nop
lea rcx, [rsp + 0x58]
call fcn.1400106cc
lea r8, [rbp - 8]
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x48]
call fcn.14002760c
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x104
jae 0x140026b53
mov rax, rdx
shr rax, 0x20
test eax, eax
je 0x140026a46
mov rcx, rax
add rcx, rcx
je 0x140026a46
mov rax, rcx
shr rax, 0x20
test eax, eax
jne 0x140026b6e
mov eax, edx
add rax, rax
shl rcx, 0x20
add rcx, rax
cmp rcx, rax
jb 0x140026afd
jmp 0x140026a4b
mov ecx, edx
add rcx, rcx
mov eax, 0xffffffff
cmp rcx, rax
ja 0x140026b74
lea r8, [rbp - 0x48]
cmp qword [rbp - 0x30], 8
cmovae r8, qword [rbp - 0x48]
mov dword [rsp + 0x20], esi
mov r9d, ecx
lea rdx, str.PCP_ALTERNATE_KEY_STORAGE_LOCATION
mov rcx, rdi
call qword [sym.imp.ncrypt.dll_NCryptSetProperty]
mov rcx, qword [rbp + 0x28]
test eax, eax
js 0x140026ae8
lea rcx, [rbp - 0x48]
call fcn.1400106cc
nop
lea rcx, [rsp + 0x38]
call fcn.1400106cc
nop
lea rcx, [rbp - 0x28]
call fcn.1400106cc
nop
lea rcx, [rsp + 0x78]
call fcn.1400106cc
nop
lea rcx, [rbp - 8]
call fcn.1400106cc
nop
lea rcx, [rbp - 0x68]
call fcn.1400106cc
mov rcx, qword [rbp + 0x18]
xor rcx, rsp
call fcn.1400281d0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov r9d, eax
lea r8, str.onecore_amcoreoctagoncommon_tpmattestation_attesttpm.cpp
mov edx, 0x70
call fcn.1400169a8
int3
call fcn.140024704
nop
mov rcx, qword [rbp + 0x28]
mov r9d, 0x139f
lea r8, str.onecore_amcoreoctagoncommon_tpmattestation_attesttpm.cpp
mov edx, 0x45
call fcn.14001de2c
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov r9d, eax
mov rcx, qword [rbp + 0x28]
lea r8, str.onecore_amcoreoctagoncommon_tpmattestation_attesttpm.cpp
mov edx, 0x4d
call fcn.14001de2c
nop
mov r9d, eax
lea r8, str.onecore_amcoreoctagoncommon_tpmattestation_attesttpm.cpp
mov edx, 0x5f
call fcn.1400169a8
nop
mov rcx, qword [rbp + 0x28]
mov r9d, 0x32
lea r8, str.onecore_amcoreoctagoncommon_tpmattestation_attesttpm.cpp
lea edx, [r9 + 0x36]
call fcn.14001de2c
int3
call fcn.140024704
int3
call fcn.140024704
int3