Function at 0x140031920
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x60
mov r12, r8
lea rsi, [rsp + 0x88]
mov r15, rdx
lea r8, [fcn.14004b690]
mov r13, rcx
lea rdx, [rsp + 0x48]
add rsi, 0xfffffffffffffff8
mov edi, r9d
mov rcx, rsi
call fcn.140028f10
lea r8, [0x1400322c0]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140028f10
mov ebx, dword [rsp + 0xb8]
xor ebp, ebp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbp
test ebx, ebx
je 0x1400319be
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ecx, eax
lea rdx, [rsp + 0x58]
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
jne 0x1400319be
lea rdx, str.failed_getting_active_user_token
mov ecx, 0x480003
call fcn.14002d250
jmp 0x140031bfa
test r12, r12
je 0x1400319cb
cmp qword [r12], rbp
cmove r12, rbp
mov edx, 1
mov rcx, r12
call fcn.1400322f0
test eax, eax
je 0x1400319fa
mov rax, qword gs:[0x58]
lea rdx, str.invalid_redir:__s
mov r8d, 0x1690
add r8, qword [rax]
jmp 0x140031be2
test r15, r15
je 0x140031a06
cmp qword [r15], rbp
cmove r15, rbp
test edi, edi
je 0x140031b89
test r15, r15
jne 0x140031a38
test ebx, ebx
je 0x140031b89
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x40]
xor r8d, r8d
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x140031a49
mov qword [rsp + 0x40], rbp
jmp 0x140031a9a
test ebx, ebx
jne 0x140031a1b
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov qword [rsp + 0x40], rax
jmp 0x140031a4e
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x140031a9a
cmp word [rax], bp
je 0x140031a9a
mov rdx, rax
mov rcx, rsi
call fcn.140029360
mov rcx, qword [rsp + 0x48]
xor r8d, r8d
mov rdx, qword [rax]
call fcn.14004abd0
mov rcx, qword [rsp + 0x40]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], bp
jne 0x140031a80
inc rax
lea rax, [rcx + rax*2]
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x140031a53
test r15, r15
je 0x140031b81
mov qword [rsp + 0x90], r14
nop dword [rax + rax]
mov rdi, qword [r15]
test rdi, rdi
je 0x140031b79
mov r14, qword [rsp + 0x48]
xor bpl, bpl
cmp qword [r14], 0
jne 0x140031ad2
mov rcx, r14
call fcn.14004b6f0
mov edx, 0x3d
mov rcx, rdi
call fcn.140174a7c
mov rcx, rax
test rax, rax
je 0x140031aeb
sub ecx, edi
jmp 0x140031afe
or rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rdi + rax], 0
jne 0x140031af0
mov ecx, eax
mov bpl, 1
mov rbx, qword [r14]
mov rax, qword [rbx]
test rax, rax
je 0x140031b5c
movsxd rsi, ecx
nop dword [rax]
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call fcn.14017db90
test eax, eax
jne 0x140031b2b
mov rax, qword [rbx]
cmp byte [rsi + rax], 0x3d
je 0x140031b38
mov rax, qword [rbx + 8]
add rbx, 8
test rax, rax
jne 0x140031b10
test rax, rax
je 0x140031b5c
test bpl, bpl
jne 0x140031b4f
mov rdx, rdi
mov rcx, rbx
call fcn.14002a080
jmp 0x140031b6f
mov rdx, rbx
mov rcx, r14
call fcn.14004b640
jmp 0x140031b6f
test bpl, bpl
jne 0x140031b6f
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call fcn.14004abd0
add r15, 8
jne 0x140031ab0
mov r14, qword [rsp + 0x90]
mov rax, qword [rsp + 0x48]
mov r15, qword [rax]
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov rdx, r13
call fcn.140049930
mov rax, qword [rsp + 0x58]
mov r9, r12
mov rcx, qword [rsp + 0x50]
mov r8, r15
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x28], eax
mov rcx, qword [rcx]
mov dword [rsp + 0x20], 1
call fcn.140031e50
mov rbx, rax
test rax, rax
jne 0x140031bee
mov r8, qword [rsp + 0x50]
lea rdx, str.failed_CreateProcess__s_:__m
mov r8, qword [r8]
mov ecx, 0x480003
call fcn.14002d250
mov ebx, eax
lea rcx, [rsp + 0x58]
call fcn.1400536e0
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret