Function at 0x180016c88
Capabilities:
Query environment variable

Disassembly:
push rdi
push r12
push r13
mov eax, 0x203d0
call fcn.1800f12f0
sub rsp, rax
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x203f8], rbx
mov qword [rsp + 0x20400], rbp
mov qword [rsp + 0x20408], rsi
mov rax, qword [0x1801563c0]
xor rax, rsp
mov qword [rsp + 0x203c0], rax
mov edi, ecx
xor r13d, r13d
mov dword [rsp + 0x30], r13d
mov qword [rsp + 0x38], r13
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtQueryInformationProcess
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
cmp rax, r13
jne 0x180016d09
xor eax, eax
jmp 0x1800170ed
xor edx, edx
mov r8d, 0x2001c
lea rcx, [rsp + 0x3a0]
call fcn.1800d7640
xor edx, edx
mov r8d, 0x2c8
lea rcx, [rsp + 0xd0]
call fcn.1800d7640
xor edx, edx
mov r8d, 0x80
lea rcx, [rsp + 0x50]
call fcn.1800d7640
mov dword [rsp + 0x3a0], edi
mov r8d, edi
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x180016d6c
xor eax, eax
jmp 0x1800170ed
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rbp, rax
mov r12d, 0x18
mov r8, r12
lea edx, [r12 - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
cmp rax, r13
jne 0x180016da4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1800170ed
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, r12d
mov r8, rsi
xor edx, edx
mov rcx, rdi
call rbx
cmp eax, r13d
jl 0x1800170d4
cmp dword [rsp + 0x30], r12d
jbe 0x180016e1d
mov r8, rsi
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8d, dword [rsp + 0x30]
mov edx, 8
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rsi, rax
cmp rax, r13
jne 0x180016e04
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1800170ed
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x30]
mov r8, rsi
xor edx, edx
mov rcx, rdi
call rbx
cmp eax, r13d
jl 0x1800170d4
mov eax, dword [rsi + 0x14]
mov dword [rsp + 0x3a4], eax
mov eax, dword [rsi + 0xc]
mov dword [rsp + 0x3b4], eax
mov eax, dword [rsi]
mov dword [rsp + 0x3b8], eax
mov eax, dword [rsi + 4]
mov dword [rsp + 0x3ac], eax
mov eax, dword [rsi + 8]
mov dword [rsp + 0x3b0], eax
mov ebx, 0xfffe
cmp dword [rsi + 4], r13d
je 0x1800170b2
mov edx, dword [rsi + 4]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x2c8
lea r8, [rsp + 0xd0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp eax, r13d
je 0x1800170b2
mov eax, dword [rsp + 0x390]
mov dword [rsp + 0x3a8], eax
mov al, byte [rsp + 0xd2]
mov byte [rsp + 0x3bc], al
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 0x80
lea r8, [rsp + 0x50]
mov rdx, qword [rsp + 0xf0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp eax, r13d
je 0x1800170b2
movzx eax, word [rsp + 0xc0]
cmp ax, r13w
jbe 0x1800170b2
movzx r8d, ax
mov edx, 8
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r12, rax
cmp rax, r13
je 0x1800170b2
movzx r9d, word [rsp + 0xc0]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov r8, r12
mov rdx, qword [rsp + 0xc8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
cmp eax, r13d
je 0x18001709f
cmp word [rsp + 0xc0], bx
jb 0x180016f52
lea eax, [rbx - 2]
jmp 0x180016f5a
movzx eax, word [rsp + 0xc0]
mov ecx, eax
shr rcx, 1
cmp rcx, 0x7ffffffe
jbe 0x180016f73
mov word [rsp + 0x103bc], r13w
jmp 0x180016fbe
mov edx, 0x7fff
lea rax, [rsp + 0x103bc]
lea r8, [rsp + 0x103bc]
mov r9, r12
sub r9, r8
cmp rcx, r13
je 0x180016fb1
movzx r8d, word [r9 + rax]
cmp r8w, r13w
je 0x180016fb1
mov word [rax], r8w
add rax, 2
dec rdx
dec rcx
cmp rdx, r13
jne 0x180016f8e
cmp rdx, r13
jne 0x180016fba
sub rax, 2
mov word [rax], r13w
lea rdx, [rsp + 0x103bc]
lea rcx, [rsp + 0x40]
call fcn.1800041c0
nop
lea rcx, [rsp + 0x40]
call fcn.180003f8c
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharLowerW]
mov r8, rbx
lea rdx, str.RunDll_cpmmand_line_:__s
lea rcx, [0x18015f578]
call fcn.1800098e8
cmp dword [rbx - 8], r13d
jl 0x180017069
lea rdx, str.inetcpl.cpl
mov rcx, rbx
call fcn.1800d1f00
cmp rax, r13
je 0x180017069
sub rax, rbx
sar rax, 1
cmp eax, 0xffffffff
je 0x180017069
mov r8, rsi
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbx - 0xc]
lea rax, [0x18015f758]
cmp rcx, rax
je 0x18001705f
or edx, 0xffffffff
lock xadd dword [rcx], edx
dec edx
cmp edx, r13d
jg 0x18001705f
call fcn.1800d1434
mov eax, 1
jmp 0x1800170ed
lea rcx, [rbx - 0xc]
lea rax, [0x18015f758]
cmp rcx, rax
je 0x180017093
or eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, r13d
jg 0x18001709a
call fcn.1800d1434
mov ebx, 0xfffe
jmp 0x18001709f
mov ebx, 0xfffe
jmp 0x18001709f
mov ebx, 0xfffe
mov r8, r12
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp eax, r13d
je 0x1800170d4
cmp dword [rsp + 0x3a0], 4
jne 0x1800170d4
mov r8d, ebx
lea rdx, [rsp + 0x3be]
lea rcx, str._SystemRoot_System32_ntoskrnl.exe
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r8, rsi
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x203c0]
xor rcx, rsp
call fcn.1800d12b0
lea r11, [rsp + 0x203d0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret