Function at 0x1400318c0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x60
mov r12, r8
lea rsi, [rsp + 0x88]
mov r15, rdx
lea r8, [fcn.14004b630]
mov r13, rcx
lea rdx, [rsp + 0x48]
add rsi, 0xfffffffffffffff8
mov edi, r9d
mov rcx, rsi
call fcn.140028eb0
lea r8, [0x140032260]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140028eb0
mov ebx, dword [rsp + 0xb8]
xor ebp, ebp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbp
test ebx, ebx
je 0x14003195e
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ecx, eax
lea rdx, [rsp + 0x58]
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
jne 0x14003195e
lea rdx, str.failed_getting_active_user_token
mov ecx, 0x480003
call fcn.14002d1f0
jmp 0x140031b9a
test r12, r12
je 0x14003196b
cmp qword [r12], rbp
cmove r12, rbp
mov edx, 1
mov rcx, r12
call fcn.140032290
test eax, eax
je 0x14003199a
mov rax, qword gs:[0x58]
lea rdx, str.invalid_redir:__s
mov r8d, 0x1690
add r8, qword [rax]
jmp 0x140031b82
test r15, r15
je 0x1400319a6
cmp qword [r15], rbp
cmove r15, rbp
test edi, edi
je 0x140031b29
test r15, r15
jne 0x1400319d8
test ebx, ebx
je 0x140031b29
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x40]
xor r8d, r8d
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x1400319e9
mov qword [rsp + 0x40], rbp
jmp 0x140031a3a
test ebx, ebx
jne 0x1400319bb
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov qword [rsp + 0x40], rax
jmp 0x1400319ee
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x140031a3a
cmp word [rax], bp
je 0x140031a3a
mov rdx, rax
mov rcx, rsi
call fcn.140029300
mov rcx, qword [rsp + 0x48]
xor r8d, r8d
mov rdx, qword [rax]
call fcn.14004ab70
mov rcx, qword [rsp + 0x40]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], bp
jne 0x140031a20
inc rax
lea rax, [rcx + rax*2]
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x1400319f3
test r15, r15
je 0x140031b21
mov qword [rsp + 0x90], r14
nop dword [rax + rax]
mov rdi, qword [r15]
test rdi, rdi
je 0x140031b19
mov r14, qword [rsp + 0x48]
xor bpl, bpl
cmp qword [r14], 0
jne 0x140031a72
mov rcx, r14
call fcn.14004b690
mov edx, 0x3d
mov rcx, rdi
call fcn.140174a1c
mov rcx, rax
test rax, rax
je 0x140031a8b
sub ecx, edi
jmp 0x140031a9e
or rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rdi + rax], 0
jne 0x140031a90
mov ecx, eax
mov bpl, 1
mov rbx, qword [r14]
mov rax, qword [rbx]
test rax, rax
je 0x140031afc
movsxd rsi, ecx
nop dword [rax]
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call fcn.14017db30
test eax, eax
jne 0x140031acb
mov rax, qword [rbx]
cmp byte [rsi + rax], 0x3d
je 0x140031ad8
mov rax, qword [rbx + 8]
add rbx, 8
test rax, rax
jne 0x140031ab0
test rax, rax
je 0x140031afc
test bpl, bpl
jne 0x140031aef
mov rdx, rdi
mov rcx, rbx
call fcn.14002a020
jmp 0x140031b0f
mov rdx, rbx
mov rcx, r14
call fcn.14004b5e0
jmp 0x140031b0f
test bpl, bpl
jne 0x140031b0f
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call fcn.14004ab70
add r15, 8
jne 0x140031a50
mov r14, qword [rsp + 0x90]
mov rax, qword [rsp + 0x48]
mov r15, qword [rax]
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov rdx, r13
call fcn.1400498d0
mov rax, qword [rsp + 0x58]
mov r9, r12
mov rcx, qword [rsp + 0x50]
mov r8, r15
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x28], eax
mov rcx, qword [rcx]
mov dword [rsp + 0x20], 1
call fcn.140031df0
mov rbx, rax
test rax, rax
jne 0x140031b8e
mov r8, qword [rsp + 0x50]
lea rdx, str.failed_CreateProcess__s_:__m
mov r8, qword [r8]
mov ecx, 0x480003
call fcn.14002d1f0
mov ebx, eax
lea rcx, [rsp + 0x58]
call fcn.140053680
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret