Function at 0x140108670
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
lea rcx, str.DEBUGSCOPE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov r9, qword [sym.imp.CoreFoundation.dll_kCFAllocatorNull]
lea rdx, [0x14029a93b]
mov rcx, qword [sym.imp.CoreFoundation.dll_kCFAllocatorDefault]
test rax, rax
mov r8d, 0x8000100
cmovne rdx, rax
mov r9, qword [r9]
mov rcx, qword [rcx]
call qword [sym.imp.CoreFoundation.dll_CFStringCreateWithCStringNoCopy]
mov rcx, rax
mov rbx, rax
call fcn.140108be0
mov rdx, rax
xor ecx, ecx
mov rdi, rax
call fcn.140108db0
test rdi, rdi
je 0x1401086e0
mov rcx, rdi
call qword [sym.imp.CoreFoundation.dll_CFRelease]
test rbx, rbx
je 0x1401086ee
mov rcx, rbx
call qword [sym.imp.CoreFoundation.dll_CFRelease]
lea rcx, str.com.apple.security.logging.plist
call qword [sym.imp.CoreFoundation.dll___CFStringMakeConstantString]
mov rcx, rax
call fcn.14011adc0
mov rsi, rax
test rax, rax
je 0x1401087a5
mov rcx, qword [sym.imp.CoreFoundation.dll_kCFAllocatorDefault]
mov rdx, rax
xor ebx, ebx
mov rcx, qword [rcx]
call qword [sym.imp.CoreFoundation.dll_CFReadStreamCreateWithFile]
mov rdi, rax
test rax, rax
je 0x14010879c
mov rcx, rax
call qword [sym.imp.CoreFoundation.dll_CFReadStreamOpen]
test al, al
je 0x14010875f
mov rcx, qword [sym.imp.CoreFoundation.dll_kCFAllocatorDefault]
xor r9d, r9d
mov qword [rsp + 0x28], rbx
xor r8d, r8d
mov rdx, rdi
mov qword [rsp + 0x20], rbx
mov rcx, qword [rcx]
call qword [sym.imp.CoreFoundation.dll_CFPropertyListCreateWithStream]
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.CoreFoundation.dll_CFRelease]
test rbx, rbx
je 0x14010879c
lea rcx, [0x14029abf8]
call qword [sym.imp.CoreFoundation.dll___CFStringMakeConstantString]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.CoreFoundation.dll_CFDictionaryGetValue]
mov rcx, rax
mov edx, 2
call fcn.140108ae0
mov rcx, rbx
call qword [sym.imp.CoreFoundation.dll_CFRelease]
mov rcx, rsi
call qword [sym.imp.CoreFoundation.dll_CFRelease]
mov rax, qword [sym.imp.CoreFoundation.dll_kCFPreferencesAnyHost]
lea rcx, [0x14029ac08]
mov rsi, qword [rax]
mov rax, qword [sym.imp.CoreFoundation.dll_kCFPreferencesCurrentUser]
mov rdi, qword [rax]
call qword [sym.imp.CoreFoundation.dll___CFStringMakeConstantString]
lea rcx, str.Logging
mov rbx, rax
call qword [sym.imp.CoreFoundation.dll___CFStringMakeConstantString]
mov r9, rsi
mov r8, rdi
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.CoreFoundation.dll_CFPreferencesCopyValue]
mov rcx, rax
mov edx, 1
mov rbx, rax
call fcn.140108ae0
test rbx, rbx
je 0x140108806
mov rcx, rbx
call qword [sym.imp.CoreFoundation.dll_CFRelease]
mov rax, qword [sym.imp.CoreFoundation.dll_kCFPreferencesCurrentHost]
lea rcx, [0x14029ac28]
mov rsi, qword [rax]
mov rax, qword [sym.imp.CoreFoundation.dll_kCFPreferencesAnyUser]
mov rdi, qword [rax]
call qword [sym.imp.CoreFoundation.dll___CFStringMakeConstantString]
lea rcx, str.Circle_Logging
mov rbx, rax
call qword [sym.imp.CoreFoundation.dll___CFStringMakeConstantString]
mov r9, rsi
mov r8, rdi
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.CoreFoundation.dll_CFPreferencesCopyValue]
mov rcx, rax
mov edx, 1
mov rbx, rax
call fcn.140108ae0
test rbx, rbx
je 0x140108867
mov rcx, rbx
call qword [sym.imp.CoreFoundation.dll_CFRelease]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret