Function at 0x180050680
Capabilities:
Query environment variable

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1f]
sub rsp, 0x88
mov rax, qword [0x180083330]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov r12, r9
mov qword [rbp - 0x19], r9
mov r15, r8
mov r13, rcx
xor r14d, r14d
mov qword [r9], r14
mov ebx, r14d
lea rsi, [rdx + 8]
mov rax, qword [rsi]
test rax, rax
jne 0x1800506ff
mov qword [rsi], r14
mov r8, rsi
lea rdx, [0x180070a80]
call fcn.18002668c
nop
mov edi, eax
test eax, eax
jns 0x1800506fc
mov rcx, qword [rbp + 0x5f]
mov r9d, eax
lea r8, str.pcshell_shell_appresolverunifiedtilemodelreconcilermigrationcontext.cpp
lea edx, [r14 + 0x1c]
call fcn.18000a0f0
nop
jmp 0x180050723
mov rax, qword [rsi]
mov rbx, rax
test rax, rax
je 0x18005071a
mov rax, qword [rax]
mov rcx, rbx
mov rax, qword [rax + 8]
call qword [case.0x18004bf34.0]
nop
jmp 0x18005071d
mov rbx, r14
mov edi, r14d
mov r14, rbx
test edi, edi
jns 0x18005077a
mov rcx, qword [rbp + 0x5f]
mov r9d, edi
lea r8, str.pcshell_shell_appresolverunifiedtilemodelreconciler_applifecyclereconciler.cpp
mov edx, 0x25f
call fcn.18000a0f0
nop
test r14, r14
je 0x180050756
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
mov rcx, rbx
call qword [case.0x18004bf34.0]
nop
mov eax, edi
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.180062960
nop
add rsp, 0x88
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsDeleteString]
nop dword [rax + rax]
nop
xor edi, edi
mov qword [rbp - 0x39], rdi
lea rcx, str._AumId
or rsi, 0xffffffffffffffff
mov rax, rsi
inc rax
cmp word [rcx + rax*2], di
jne 0x18005079d
mov edx, 0xffffffff
cmp rax, rdx
ja 0x180050de8
lea edx, [rax + 1]
cmp edx, eax
jb 0x180050ddd
dec edx
lea r9, [rbp + 7]
lea r8, [rbp - 0x11]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsCreateStringReference]
nop dword [rax + rax]
nop
test eax, eax
js 0x180050df3
lea r9, [rbp - 0x39]
mov r8, qword [rbp + 7]
mov rdx, r15
call fcn.180050e40
nop
mov edi, eax
test eax, eax
jns 0x18005083a
mov rcx, qword [rbp + 0x5f]
mov r9d, eax
lea r8, str.pcshell_shell_appresolverunifiedtilemodelreconciler_applifecyclereconciler.cpp
mov edx, 0x277
call fcn.18000a0f0
nop
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsDeleteString]
nop dword [rax + rax]
nop
xor eax, eax
mov qword [rbp - 0x39], rax
test rbx, rbx
je 0x180050756
mov rax, qword [rbx]
mov rax, qword [rax + 0x10]
jmp 0x18005074c
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x180050950
xor edx, edx
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsGetStringRawBuffer]
nop dword [rax + rax]
nop
mov rdi, rax
call fcn.1800037c4
nop
cmp dword [rax], 5
jbe 0x180050881
mov qword [rbp - 0x21], rdi
lea rcx, [rbp - 0x21]
mov qword [rsp + 0x20], rcx
lea rdx, [0x180077bb3]
mov rcx, rax
call fcn.18000252c
nop
xor esi, esi
mov qword [rbp - 0x29], rsi
mov rax, qword [rbx]
mov rdi, qword [rax + 0x40]
xor edx, edx
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsGetStringRawBuffer]
nop dword [rax + rax]
nop
lea r8, [rbp - 0x29]
mov rdx, rax
mov rcx, rbx
mov rax, rdi
call qword [case.0x18004bf34.0]
nop
test eax, eax
js 0x180050929
mov rcx, qword [r13 + 0x48]
mov rax, qword [rcx]
mov r8, r12
mov rdx, qword [rbp - 0x39]
mov rax, qword [rax + 0x30]
call qword [case.0x18004bf34.0]
nop
mov edi, eax
xor r12d, r12d
test eax, eax
jns 0x18005092c
mov rcx, qword [rbp + 0x5f]
mov r9d, eax
lea r8, str.pcshell_shell_appresolverunifiedtilemodelreconciler_applifecyclereconciler.cpp
mov edx, 0x281
call fcn.18000a0f0
nop
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x18005090f
mov qword [rbp - 0x29], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x18004bf34.0]
nop
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsDeleteString]
nop dword [rax + rax]
nop
mov qword [rbp - 0x39], r12
jmp 0x18005082e
xor r12d, r12d
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x180050d88
mov qword [rbp - 0x29], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x18004bf34.0]
nop
jmp 0x180050d88
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsDeleteString]
nop dword [rax + rax]
nop
xor r12d, r12d
mov qword [rbp - 0x31], r12
lea rcx, str._ShortcutPath
mov rax, rsi
inc rax
cmp word [rcx + rax*2], r12w
jne 0x18005096e
mov edx, 0xffffffff
cmp rax, rdx
ja 0x180050e2c
lea edx, [rax + 1]
cmp edx, eax
jb 0x180050e21
dec edx
lea r9, [rbp + 7]
lea r8, [rbp - 0x11]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsCreateStringReference]
nop dword [rax + rax]
nop
test eax, eax
js 0x180050dfb
lea r9, [rbp - 0x31]
mov r8, qword [rbp + 7]
mov rdx, r15
call fcn.180050e40
nop
mov edi, eax
test eax, eax
jns 0x180050a0f
mov rcx, qword [rbp + 0x5f]
mov r9d, eax
lea r8, str.pcshell_shell_appresolverunifiedtilemodelreconciler_applifecyclereconciler.cpp
mov edx, 0x287
call fcn.18000a0f0
nop
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsDeleteString]
nop dword [rax + rax]
nop
mov qword [rbp - 0x31], r12
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsDeleteString]
nop dword [rax + rax]
nop
mov qword [rbp - 0x39], r12
jmp 0x180050825
mov rcx, qword [rbp - 0x31]
test rcx, rcx
jne 0x180050a65
mov edi, 0x8000ffff
mov edx, 0x28a
lea r8, str.pcshell_shell_appresolverunifiedtilemodelreconciler_applifecyclereconciler.cpp
mov r9d, edi
mov rcx, qword [rbp + 0x5f]
call fcn.18000a0f0
nop
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsDeleteString]
nop dword [rax + rax]
nop
mov qword [rbp - 0x31], r12
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsDeleteString]
nop dword [rax + rax]
nop
mov qword [rbp - 0x39], r12
jmp 0x180050740
xor edx, edx
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsGetStringRawBuffer]
nop dword [rax + rax]
nop
mov rdi, rax
call fcn.1800037c4
nop
cmp dword [rax], 5
jbe 0x180050a9f
mov qword [rbp - 0x21], rdi
lea rcx, [rbp - 0x21]
mov qword [rsp + 0x20], rcx
lea rdx, [0x180077b58]
mov rcx, rax
call fcn.18000252c
nop
xor edx, edx
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsGetStringRawBuffer]
nop dword [rax + rax]
nop
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
nop
mov r15d, eax
test eax, eax
jne 0x180050aeb
mov rcx, qword [rbp + 0x5f]
lea r8, str.pcshell_shell_appresolverunifiedtilemodelreconciler_applifecyclereconciler.cpp
mov edx, 0x28f
call fcn.18001016c
nop
mov edi, eax
jmp 0x180050a36
mov eax, 2
mul r15
cmovo rax, rsi
lea rdx, [0x180084288]
mov rcx, rax
call fcn.1800642e0
nop
mov rdi, rax
test rax, rax
jne 0x180050b1e
mov edi, 0x8007000e
mov edx, 0x291
jmp 0x180050a22
xor edx, edx
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsGetStringRawBuffer]
nop dword [rax + rax]
nop
mov r8d, r15d
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
nop
test eax, eax
jne 0x180050bb3
mov rcx, qword [rbp + 0x5f]
lea r8, str.pcshell_shell_appresolverunifiedtilemodelreconciler_applifecyclereconciler.cpp
mov edx, 0x292
call fcn.18001016c
nop
mov esi, eax
mov rcx, rdi
call fcn.180062da4
nop
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsDeleteString]
nop dword [rax + rax]
nop
mov qword [rbp - 0x31], r12
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsDeleteString]
nop dword [rax + rax]
nop
mov qword [rbp - 0x39], r12
test r14, r14
je 0x180050bac
mov rcx, qword [rbx]
mov rax, qword [rcx + 0x10]
mov rcx, rbx
call qword [case.0x18004bf34.0]
nop
mov eax, esi
jmp 0x180050758
mov rcx, rdi
call qword [sym.imp.SHCORE.dll_Ordinal_170]
nop dword [rax + rax]
nop
test eax, eax
jne 0x180050dba
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathIsURLW]
nop dword [rax + rax]
nop
test eax, eax
jne 0x180050dba
mov qword [rbp - 0x29], r12
lea rcx, [rbp - 0x29]
call fcn.180009204
nop
mov r9, rax
lea r8, [0x18006e950]
xor edx, edx
mov rcx, rdi
call qword [sym.imp.api_ms_win_shell_namespace_l1_1_0.dll_SHCreateItemFromParsingName]
nop dword [rax + rax]
nop
test eax, eax
js 0x180050d53
mov rax, qword [rbx]
mov qword [rbp - 0x21], r12
lea r8, [rbp - 0x21]
mov rdx, qword [rbp - 0x29]
mov rcx, rbx
mov rax, qword [rax + 0x18]
call qword [case.0x18004bf34.0]
nop
test eax, eax
js 0x180050d3d
mov r15, qword [r13 + 0x48]
mov rax, qword [r15]
mov r12, qword [rax + 0x30]
xor r13d, r13d
mov qword [rbp + 7], r13
mov rcx, qword [rbp - 0x21]
inc rsi
cmp word [rcx + rsi*2], r13w
jne 0x180050c50
mov eax, 0xffffffff
cmp rsi, rax
ja 0x180050e16
lea edx, [rsi + 1]
cmp edx, esi
jb 0x180050e0b
dec edx
lea r9, [rbp + 7]
lea r8, [rbp - 0x11]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsCreateStringReference]
nop dword [rax + rax]
nop
test eax, eax
js 0x180050e03
mov r8, qword [rbp - 0x19]
mov rdx, qword [rbp + 7]
mov rcx, r15
mov rax, r12
call qword [case.0x18004bf34.0]
nop
mov esi, eax
xor r12d, r12d
test eax, eax
jns 0x180050d3d
mov rcx, qword [rbp + 0x5f]
mov r9d, eax
lea r8, str.pcshell_shell_appresolverunifiedtilemodelreconciler_applifecyclereconciler.cpp
mov edx, 0x2a1
call fcn.18000a0f0
nop
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x180050ce3
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
nop
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x180050cfe
mov qword [rbp - 0x29], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x18004bf34.0]
nop
mov rcx, rdi
call fcn.180062da4
nop
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsDeleteString]
nop dword [rax + rax]
nop
mov qword [rbp - 0x31], r12
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsDeleteString]
nop dword [rax + rax]
nop
mov qword [rbp - 0x39], r12
mov rax, qword [rbx]
mov rax, qword [rax + 0x10]
jmp 0x180050ba2
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x180050d53
call qword [sym.imp.ole32.dll_CoTaskMemFree]
nop dword [rax + rax]
nop
mov rcx, qword [rbp - 0x29]
test rcx, rcx
je 0x180050d6e
mov qword [rbp - 0x29], r12
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [case.0x18004bf34.0]
nop
mov rcx, rdi
call fcn.180062da4
nop
mov rcx, qword [rbp - 0x31]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsDeleteString]
nop dword [rax + rax]
nop
mov rcx, qword [rbp - 0x39]
call qword [sym.imp.api_ms_win_core_winrt_string_l1_1_0.dll_WindowsDeleteString]
nop dword [rax + rax]
nop
mov qword [rbp - 0x39], r12
test r14, r14
je 0x180050db3
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x10]
call qword [case.0x18004bf34.0]
nop
xor eax, eax
jmp 0x180050758
mov rcx, qword [rbp + 0x5f]
mov esi, 0x80070005
mov r9d, esi
lea r8, str.pcshell_shell_appresolverunifiedtilemodelreconciler_applifecyclereconciler.cpp
mov edx, 0x297
call fcn.18000a0f0
nop
jmp 0x180050b63
mov ecx, 0x80070216
call fcn.18000d430
nop
mov ecx, 0x80070216
call fcn.18000d430
nop
mov ecx, eax
call fcn.18000d430
nop
mov ecx, eax
call fcn.18000d430
nop
mov ecx, eax
call fcn.18000d430
nop
mov ecx, 0x80070216
call fcn.18000d430
nop
mov ecx, 0x80070216
call fcn.18000d430
nop
mov ecx, 0x80070216
call fcn.18000d430
nop
mov ecx, 0x80070216
call fcn.18000d430
nop
int3