Function at 0x10012bb20
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x100165138]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rsi, r9
mov r13, r8
mov ebx, edx
mov r14, rcx
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10012bb7f
test byte [rcx + 0x1c], 1
je 0x10012bb7f
cmp byte [rcx + 0x19], 4
jb 0x10012bb7f
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002ef0]
mov edx, 0x14
call fcn.10001c7b8
test r14, r14
jne 0x10012bb9c
lea r8, [0x100008610]
lea rcx, [0x100013ee0]
mov edx, 0x1b3
call fcn.100099ad8
test r13, r13
jne 0x10012bbb9
lea r8, [0x100013f68]
lea rcx, [0x100013ee0]
mov edx, 0x1b4
call fcn.100099ad8
movdqu xmm0, xmmword [0x100001fe0]
movdqu xmmword [r13], xmm0
test rsi, rsi
je 0x10012bbd0
and qword [rsi], 0
mov rcx, qword [r14 + 0x10]
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and dword [rsp + 0x40], 0
and dword [rsp + 0x44], 0
mov rcx, qword [rcx + rbx*8]
xor edi, edi
mov r15, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov rbp, rax
test rax, rax
jne 0x10012bc0b
mov ebx, 0x8007000e
jmp 0x10012bcf8
lea rdx, [rsp + 0x38]
mov rcx, rax
call sub.VSSAPI.DLL_CreateVssExamineWriterMetadataInternal
mov ebx, eax
test eax, eax
js 0x10012bcf8
mov rcx, qword [rsp + 0x38]
lea rdx, [rsp + 0x44]
lea r9, [rsp + 0x30]
mov rax, qword [rcx]
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x20], rdx
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x58]
call qword [rax + 0x18]
mov ebx, eax
test eax, eax
js 0x10012bcf8
test rsi, rsi
je 0x10012bcea
mov rcx, qword [r14 + 0x10]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rcx + r15*8]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r12d, eax
test eax, eax
je 0x10012bcd1
mov rax, r12
mov ecx, 0xffffffff
add rax, rax
cmp rax, rcx
jbe 0x10012bc94
mov ebx, 0x80070216
jmp 0x10012bcf8
mov ecx, eax
mov ebx, eax
call qword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov rdi, rax
test rax, rax
je 0x10012bc01
mov r8, rbx
xor edx, edx
mov rcx, rax
call sub.msvcrt.dll_memset
mov rcx, qword [r14 + 0x10]
mov r8d, r12d
mov rcx, qword [rcx + r15*8]
mov rdx, rdi
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x10012bce7
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x10012bcf8
mov qword [rsi], rdi
movdqu xmm0, xmmword [rsp + 0x48]
xor edi, edi
movdqu xmmword [r13], xmm0
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x10012bd0e
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
and qword [rsp + 0x30], 0
test rbp, rbp
je 0x10012bd1c
mov rcx, rbp
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x10012bd2c
mov rax, qword [rcx]
call qword [rax + 0x10]
test rdi, rdi
je 0x10012bd3a
mov rcx, rdi
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [0x1001653b8]
lea rax, [0x1001653b8]
cmp rcx, rax
je 0x10012bd6e
test byte [rcx + 0x1c], 1
je 0x10012bd6e
cmp byte [rcx + 0x19], 4
jb 0x10012bd6e
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002ef0]
mov edx, 0x15
call fcn.10001c7b8
mov eax, ebx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.10014e480
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret