Function at 0x18002fa58
Capabilities:
Query environment variable

Disassembly:
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x3a0
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x398], rbx
mov qword [rbp + 0x3a0], rsi
mov qword [rbp + 0x3a8], rdi
mov rax, qword [0x18008ab58]
xor rax, rbp
mov qword [rbp + 0x350], rax
mov esi, 0x232
mov qword [rbp + 0x10], rcx
xor ebx, ebx
mov r12, rcx
cmp qword [0x18008b2d8], rsi
mov r13d, 0x6b637453
lea r14d, [rsi + 0xe]
jb 0x18002faed
mov rcx, qword [0x18008b2e8]
add rcx, 0x23a
cmp rcx, rsi
jb 0x18002faed
call fcn.1800019b0
test eax, eax
je 0x18002faed
mov eax, dword [rsp]
sub rsp, r14
lea r15, [rsp + 0x40]
mov eax, dword [r15]
test r15, r15
je 0x18002faed
mov dword [r15], r13d
add r15, 8
jne 0x18002fb11
mov rax, qword [0x18008b2e0]
mov ecx, 0x23a
call qword [0x180071c20]
mov r15, rax
test rax, rax
je 0x18002fb11
mov dword [rax], 0x70616548
add r15, 8
mov eax, 0x25a
cmp qword [0x18008b2d8], rax
jb 0x18002fb5b
mov rcx, qword [0x18008b2e8]
add rcx, 0x262
cmp rcx, rax
jb 0x18002fb5b
call fcn.1800019b0
test eax, eax
je 0x18002fb5b
mov eax, dword [rsp]
mov eax, 0x270
sub rsp, rax
lea rdi, [rsp + 0x40]
mov eax, dword [rdi]
test rdi, rdi
je 0x18002fb5b
mov dword [rdi], r13d
add rdi, 8
jne 0x18002fb7f
mov rax, qword [0x18008b2e0]
mov ecx, 0x262
call qword [0x180071c20]
mov rdi, rax
test rax, rax
je 0x18002fb7f
mov dword [rax], 0x70616548
add rdi, 8
cmp qword [0x18008b2d8], rsi
jb 0x18002fbc0
mov rcx, qword [0x18008b2e8]
add rcx, 0x23a
cmp rcx, rsi
jb 0x18002fbc0
call fcn.1800019b0
test eax, eax
je 0x18002fbc0
mov eax, dword [rsp]
sub rsp, r14
lea r14, [rsp + 0x40]
mov eax, dword [r14]
test r14, r14
je 0x18002fbc0
mov dword [r14], r13d
add r14, 8
jne 0x18002fbe4
mov rax, qword [0x18008b2e0]
mov ecx, 0x23a
call qword [0x180071c20]
mov r14, rax
test rax, rax
je 0x18002fbe4
mov dword [rax], 0x70616548
add r14, 8
cmp qword [0x18008b2d8], rsi
jb 0x18002fc29
mov rcx, qword [0x18008b2e8]
add rcx, 0x23a
cmp rcx, rsi
jb 0x18002fc29
call fcn.1800019b0
test eax, eax
je 0x18002fc29
mov ecx, dword [rsp]
mov eax, 0x240
sub rsp, rax
lea rsi, [rsp + 0x40]
mov eax, dword [rsi]
test rsi, rsi
je 0x18002fc29
mov dword [rsi], r13d
add rsi, 8
jne 0x18002fc4d
mov rax, qword [0x18008b2e0]
mov ecx, 0x23a
call qword [0x180071c20]
mov rsi, rax
test rax, rax
je 0x18002fc4d
mov dword [rax], 0x70616548
add rsi, 8
test r15, r15
je 0x1800300fe
test rdi, rdi
je 0x1800300e5
test rsi, rsi
je 0x1800300e5
test r14, r14
je 0x1800300e5
lea rcx, str.SceSrv
mov dword [rbp], 1
mov qword [rbp + 0x18], rbx
mov r13b, bl
mov qword [rbp + 8], rbx
call fcn.18000c6d0
test r12, r12
jne 0x18002fcb6
mov rcx, qword [0x18008b378]
lea edx, [r12 + 3]
mov r9d, 0x1d2e
mov r8d, 0xc00006aa
call fcn.18000c740
jmp 0x1800300e5
mov word [rsi], bx
lea rcx, [rbp + 0x140]
mov edx, 0x105
mov word [rbp + 0x140], bx
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemWindowsDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x18002fd0a
mov rcx, qword [0x18008b378]
lea rax, str._windir_
mov edx, 3
mov qword [rsp + 0x20], rax
mov r9d, 0x1d2f
mov r8d, 0xc00006ab
call fcn.18000c740
jmp 0x1800300e5
lea r8, [rbp + 0x140]
mov word [r15], bx
mov edx, 0x119
mov rcx, r15
call qword [sym.imp.msvcrt.dll_wcscpy_s]
nop dword [rax + rax]
lea r8, str._securitylogsconvert.log
mov edx, 0x119
mov rcx, r15
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
mov ecx, 1
call fcn.1800385f8
mov ecx, 3
call fcn.180038f4c
mov rcx, r15
call fcn.1800386b0
cmp eax, 0x7b
jne 0x18002fd78
mov r9, r15
lea ecx, [rax - 0x7a]
xor edx, edx
mov r8d, 0x1c85
call fcn.180038d90
mov r8d, 0x104
lea rcx, str.SYSTEMDRIVE
mov rdx, rsi
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
test eax, eax
jne 0x18002fdcb
lea r9, str._SYSTEMDRIVE_
xor edx, edx
xor ecx, ecx
mov r8d, 0x1d32
call fcn.180038d90
lea rax, str._systemdrive_
mov r9d, 0x1d2f
mov qword [rsp + 0x20], rax
mov r8d, 0xc00006ab
jmp 0x1800300cf
lea rcx, [rbp + 0x20]
mov dword [rbp + 0x20], 0x11c
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetVersionExW]
nop dword [rax + rax]
test eax, eax
je 0x1800300b5
movzx ebx, byte [rbp + 0x13a]
lea r8, [rbp + 0x140]
xor ecx, ecx
mov edx, 0x12d
mov word [rdi], cx
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcscpy_s]
nop dword [rax + rax]
mov ecx, ebx
sub ecx, 1
je 0x18002fe24
lea r8, str._security_templatesDC_security.inf
cmp ecx, 1
je 0x18002fe2b
lea r8, str._security_templates_setup_security.inf
mov edx, 0x12d
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
xor eax, eax
lea r8, [rbp + 0x140]
mov ebx, 0x119
mov word [r14], ax
mov edx, ebx
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcscpy_s]
nop dword [rax + rax]
lea r8, str._securitydatabaseconvert.sdb
mov edx, ebx
mov rcx, r14
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
mov rbx, r12
xor eax, eax
cmp word [rbx], ax
je 0x18003008a
lea rdx, [rbp]
mov rcx, r12
call fcn.180030194
xor ecx, ecx
mov ebx, eax
test eax, eax
jne 0x180030065
cmp dword [rbp], ecx
jne 0x18002feb1
mov dword [rbp], 1
jmp 0x180030065
mov r9, r12
xor edx, edx
mov r8d, 0x1d1d
call fcn.180038d90
mov rcx, r12
call fcn.180030608
mov rdx, r12
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x18002ff1a
mov r8, r15
mov rdx, r14
mov rcx, rdi
call fcn.1800579a8
xor edx, edx
xor ecx, ecx
mov ebx, eax
test eax, eax
je 0x18002ff0c
mov r9d, eax
mov qword [rsp + 0x20], r12
mov r8d, 0x1d20
call fcn.180038d90
jmp 0x18002ff1a
mov r9, r12
mov r8d, 0x1d21
call fcn.180038d90
mov rdx, r12
lea rcx, [rbp + 0x140]
call fcn.180030428
xor eax, eax
test ebx, ebx
jne 0x180030045
mov dword [rbp + 4], eax
mov ebx, eax
test r13b, r13b
jne 0x18002ff79
lea r8, [rbp + 4]
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x18]
call fcn.1800302f0
mov ebx, eax
xor edx, edx
lea rax, str.D:_A_OICI_GA___BA__A_OICI_GA___SY__A_OICI_SDGXGWGR___AU__A_OICI_GXGR___BU_
mov r9d, ebx
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov r8d, 0x1d22
call fcn.180038d90
test ebx, ebx
jne 0x180030045
mov ebx, dword [rbp + 4]
xor edx, edx
lea rcx, [rbp + 0x140]
mov r8d, 0x20a
call sub.msvcrt.dll_memset
mov r13d, 0x105
lea rcx, [rbp + 0x140]
mov edx, r13d
mov r9d, 5
mov r8, r12
call qword [sym.imp.msvcrt.dll_wcsncpy_s]
nop dword [rax + rax]
lea r8, [0x18007a640]
mov edx, r13d
lea rcx, [rbp + 0x140]
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
mov rax, qword [rbp + 8]
xor ecx, ecx
mov qword [rsp + 0x30], rcx
xor r9d, r9d
mov qword [rsp + 0x28], rax
mov r8d, ebx
mov qword [rsp + 0x20], rcx
mov r13b, 1
lea edx, [rcx + 1]
lea rcx, [rbp + 0x140]
call qword [sym.imp.api_ms_win_security_provider_l1_1_0.dll_SetNamedSecurityInfoW]
nop dword [rax + rax]
xor edx, edx
xor ecx, ecx
mov ebx, eax
test eax, eax
je 0x180030029
lea rax, [rbp + 0x140]
mov r9d, ebx
mov r8d, 0x1d23
mov qword [rsp + 0x20], rax
call fcn.180038d90
jmp 0x18003003b
lea r9, [rbp + 0x140]
mov r8d, 0x1d2b
call fcn.180038d90
mov r8d, 0x400006ad
test ebx, ebx
je 0x18003004b
mov r8d, 0x400006ac
mov rcx, qword [0x18008b378]
xor r9d, r9d
mov qword [rsp + 0x20], r12
lea edx, [r9 + 1]
call fcn.18000c740
xor ecx, ecx
or rax, 0xffffffffffffffff
inc rax
cmp word [r12 + rax*2], cx
jne 0x180030069
lea r12, [r12 + rax*2]
add r12, 2
cmp word [r12], cx
jne 0x18002fe88
mov rbx, qword [rbp + 0x10]
call fcn.180010acc
mov rcx, qword [rbp + 0x18]
test rcx, rcx
je 0x1800300a4
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
jmp 0x1800300e0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r9d, 0x1d31
mov dword [rsp + 0x20], eax
lea r8d, [r9 + 5]
mov rcx, qword [0x18008b378]
mov edx, 3
call fcn.18000c740
call fcn.180038654
lea rcx, [r15 - 8]
cmp dword [rcx], 0x70616548
jne 0x1800300fe
mov rax, qword [0x18008b2f0]
call qword [0x180071c20]
test rdi, rdi
je 0x18003011c
lea rcx, [rdi - 8]
cmp dword [rcx], 0x70616548
jne 0x18003011c
mov rax, qword [0x18008b2f0]
call qword [0x180071c20]
test r14, r14
je 0x18003013a
lea rcx, [r14 - 8]
cmp dword [rcx], 0x70616548
jne 0x18003013a
mov rax, qword [0x18008b2f0]
call qword [0x180071c20]
test rsi, rsi
je 0x180030158
lea rcx, [rsi - 8]
cmp dword [rcx], 0x70616548
jne 0x180030158
mov rax, qword [0x18008b2f0]
call qword [0x180071c20]
mov rcx, qword [rbp + 0x350]
xor rcx, rbp
call fcn.180002a90
mov rbx, qword [rbp + 0x398]
mov rsi, qword [rbp + 0x3a0]
mov rdi, qword [rbp + 0x3a8]
lea rsp, [rbp + 0x360]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret