Function at 0x140008ad0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140036150]
xor rax, rsp
mov qword [rbp - 8], rax
and qword [rbp - 0x20], 0
mov esi, 0x40
and qword [rbp - 0x18], 0
mov r12, rcx
mov edx, esi
mov qword [rbp - 0x10], rsi
lea rcx, [rbp - 0x20]
mov edi, esi
call fcn.140007fe4
mov ebx, eax
test eax, eax
jns 0x140008b42
lea r9, str.Failed_to_allocate_space_for_expanded_path.
mov edx, eax
mov ecx, 0x4000000
mov r8d, 1
call fcn.1400066ac
mov r14, qword [rbp - 0x20]
jmp 0x140008e31
mov r14, qword [rbp - 0x20]
lea r15, str._windir__servicing_trustedinstaller.exe
mov rdx, r14
mov rcx, r15
mov r8d, esi
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
mov ecx, eax
test eax, eax
jne 0x140008bb0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140008b83
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
mov qword [rsp + 0x20], r15
mov eax, 0x80004005
lea r9, str.Failed_to_expand_environment_variables_in_string:__S
cmovns ebx, eax
mov r8d, 1
mov edx, ebx
mov ecx, 0x4000000
call fcn.1400066ac
jmp 0x140008e31
cmp rcx, rsi
jbe 0x140008c46
mov rdi, rcx
mov qword [rbp - 0x10], rcx
mov rdx, rcx
lea rcx, [rbp - 0x20]
call fcn.140007fe4
mov ebx, eax
test eax, eax
jns 0x140008bde
lea r9, str.Failed_to_re_allocate_more_space_for_expanded_path.
jmp 0x140008b27
mov eax, 0xffffffff
cmp rdi, rax
jbe 0x140008bfb
mov edx, 0x80070216
lea r9, str.Failed_to_convert_cchExpandedPath_to_DWORD
mov ebx, edx
jmp 0x140008b29
mov r14, qword [rbp - 0x20]
mov r8d, edi
mov rdx, r14
mov rcx, r15
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
mov ecx, eax
test eax, eax
je 0x140008b68
cmp rdi, rcx
jae 0x140008c46
mov edx, 0x8007007a
lea r9, str.Failed_to_allocate_buffer_for_expanded_path.
mov ebx, edx
mov r8d, 1
mov ecx, 0x4000000
call fcn.1400066ac
jmp 0x140008e31
cmp ecx, 0x104
jbe 0x140008c95
lea rcx, [rbp - 0x20]
call fcn.140008f40
mov ebx, eax
cmp eax, 0x80070057
je 0x140008c70
test eax, eax
jns 0x140008c70
lea r9, str.Failed_to_prefix_long_path_after_expanding_environment_variables.
jmp 0x140008b27
mov r14, qword [rbp - 0x20]
lea rdx, [rbp - 0x10]
mov rcx, r14
call fcn.140008a68
mov ebx, eax
test eax, eax
jns 0x140008c91
lea r9, str.Failed_to_get_max_length_of_expanded_path.
mov edx, eax
jmp 0x140008c31
mov rdi, qword [rbp - 0x10]
and qword [rbp - 0x10], 0
test r14, r14
cmovne r15, r14
cmp rdi, rsi
jbe 0x140008cc1
mov eax, 0xffffffff
cmp rdi, rax
jbe 0x140008cc4
mov edx, 0x80070216
lea r9, str.Failed_to_convert_cchExpandedPath_to_DWORD
jmp 0x140008c2f
mov rdi, rsi
mov edx, edi
lea rcx, [rbp - 0x18]
call fcn.140007fe4
mov ebx, eax
test eax, eax
jns 0x140008cf7
lea r9, str.Failed_to_allocate_space_for_full_path.
mov r8d, 1
mov edx, eax
mov ecx, 0x4000000
call fcn.1400066ac
mov rsi, qword [rbp - 0x18]
jmp 0x140008e23
mov rsi, qword [rbp - 0x18]
lea r9, [rbp - 0x10]
mov r8, rsi
mov edx, edi
mov rcx, r15
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFullPathNameW]
nop dword [rax + rax]
test eax, eax
jne 0x140008d5f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x140008d32
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
mov qword [rsp + 0x20], r15
mov eax, 0x80004005
lea r9, str.Failed_to_get_full_path_for_string:__S
cmovns ebx, eax
mov r8d, 1
mov edx, ebx
mov ecx, 0x4000000
call fcn.1400066ac
jmp 0x140008e23
cmp edi, eax
jae 0x140008dc4
mov edi, eax
cmp eax, 0x104
jb 0x140008d6f
lea edi, [rax + 7]
mov edx, edi
lea rcx, [rbp - 0x18]
call fcn.140007fe4
mov ebx, eax
test eax, eax
jns 0x140008d8c
lea r9, str.Failed_to_re_allocate_more_space_for_full_path.
jmp 0x140008cdc
mov rsi, qword [rbp - 0x18]
lea r9, [rbp - 0x10]
mov r8, rsi
mov edx, edi
mov rcx, r15
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFullPathNameW]
nop dword [rax + rax]
test eax, eax
je 0x140008d17
cmp edi, eax
jae 0x140008dc4
mov edx, 0x8007007a
lea r9, str.Failed_to_allocate_buffer_for_full_path.
mov ebx, edx
jmp 0x140008e13
cmp eax, 0x104
jbe 0x140008dea
lea rcx, [rbp - 0x18]
call fcn.140008f40
mov ebx, eax
test eax, eax
jns 0x140008de6
lea r9, str.Failed_to_prefix_long_path_after_expanding.
jmp 0x140008cdc
mov rsi, qword [rbp - 0x18]
test rsi, rsi
je 0x140008df5
mov qword [r12], rsi
jmp 0x140008e31
lea rdx, str._windir__servicing_trustedinstaller.exe
mov rcx, r12
call fcn.140008700
mov ebx, eax
test eax, eax
jns 0x140008e31
lea r9, str.Failed_to_copy_relative_path_into_full_path.
mov edx, eax
mov r8d, 1
mov ecx, 0x4000000
call fcn.1400066ac
test rsi, rsi
je 0x140008e31
lea rcx, [rsi - 8]
call fcn.1400010cc
test r14, r14
je 0x140008e3f
lea rcx, [r14 - 8]
call fcn.1400010cc
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140001450
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret