Function at 0x14023ba50
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov qword [rbp - 0x68], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov r13, r8
mov rbx, rdx
mov r14, rcx
mov rax, qword [rdx]
xor r15d, r15d
cmp dword [rax - 0x10], r15d
je 0x14023c3b5
lea rcx, section..data
mov rax, qword [section..data]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
mov rax, qword [r13]
or esi, 0xffffffff
test rax, rax
je 0x14023baf9
cmp byte [rax + 0x18], r15b
jne 0x14023baf9
mov r8, r13
mov rdx, qword [rbx]
lea rcx, [rsp + 0x60]
call fcn.14023b480
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14000c244
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14023baf9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0x20]
cmp dword [rax - 0x10], r15d
jne 0x14023c310
mov rdi, qword [rbx]
mov eax, dword [0x14048cc10]
mov r12d, 1
test r12b, al
jne 0x14023bb45
or eax, r12d
mov dword [0x14048cc10], eax
lea rcx, [0x14048cbe8]
call fcn.1400675a8
mov byte [0x14048cc09], r15b
lea rcx, [0x140325b6c]
call fcn.1400bec34
nop
cmp byte [0x14048cc09], r15b
jne 0x14023bb60
lea rcx, [0x14048cbe8]
call fcn.140063e2c
mov byte [0x14048cc09], al
mov rdx, rdi
lea rcx, [0x14048cbe8]
call fcn.14023a6b0
test eax, eax
jle 0x14023bbae
mov r8, r13
mov edx, eax
lea rcx, [rbp - 0x80]
call fcn.14023b7d0
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14000c244
nop
mov rdx, qword [rbp - 0x80]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14023bbae
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0x20]
mov edi, 0x104
cmp dword [rax - 0x10], r15d
jne 0x14023c0fb
lea rdx, str.SystemDrive
mov rcx, qword [rbx]
call fcn.1400bedf4
test eax, eax
je 0x14023c08d
lea rdx, str.rootdir
mov rcx, qword [rbx]
call fcn.1400bedf4
test eax, eax
je 0x14023c08d
lea rdx, str.LocalLowAppData
mov rcx, qword [rbx]
call fcn.1400bedf4
test eax, eax
je 0x14023c067
lea rdx, str.LocalLow_AppData
mov rcx, qword [rbx]
call fcn.1400bedf4
test eax, eax
je 0x14023c067
lea rdx, str.ProgramFiles32
mov rcx, qword [rbx]
call fcn.1400bedf4
test eax, eax
jne 0x14023bd07
lea rcx, [rbp + 0xa8]
call fcn.14023dc9c
mov r9d, r12d
mov r8d, edi
lea rdx, [rsp + 0x20]
cmp dword [rbp + 0xa8], r15d
je 0x14023bcae
lea rcx, [rbp]
call fcn.14000bd14
mov r8d, edi
mov rdx, qword [rax + 8]
lea rcx, str._ProgramFiles_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [rbp + 0x10]
mov rdi, qword [rbp]
cmp eax, esi
jne 0x14023bc93
mov rcx, qword [rdi]
test rcx, rcx
jne 0x14023bc8a
mov eax, r15d
jmp 0x14023bc97
movsxd rdx, dword [rcx - 0xc]
call fcn.1400beaac
test eax, eax
js 0x14023bca3
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jle 0x14023bfa7
mov ecx, 0x80070057
call fcn.14000cbb8
int3
lea rcx, [rbp - 0x30]
call fcn.14000bd14
mov r8d, edi
mov rdx, qword [rax + 8]
lea rcx, str._ProgramFiles_x86__
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [rbp - 0x20]
mov rdi, qword [rbp - 0x30]
cmp eax, esi
jne 0x14023bcec
mov rcx, qword [rdi]
test rcx, rcx
jne 0x14023bce3
mov eax, r15d
jmp 0x14023bcf0
movsxd rdx, dword [rcx - 0xc]
call fcn.1400beaac
test eax, eax
js 0x14023bcfc
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jle 0x14023bfa7
mov ecx, 0x80070057
call fcn.14000cbb8
int3
lea rdx, str.ProgramFiles64
mov rcx, qword [rbx]
call fcn.1400bedf4
test eax, eax
jne 0x14023bdf0
lea rcx, [rbp + 0xb8]
call fcn.14023dc9c
mov r9d, r12d
mov r8d, edi
lea rdx, [rsp + 0x20]
cmp dword [rbp + 0xb8], r15d
je 0x14023bd97
lea rcx, [rbp + 0x30]
call fcn.14000bd14
mov r8d, edi
mov rdx, qword [rax + 8]
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [rbp + 0x40]
mov rdi, qword [rbp + 0x30]
cmp eax, esi
jne 0x14023bd7c
mov rcx, qword [rdi]
test rcx, rcx
jne 0x14023bd73
mov eax, r15d
jmp 0x14023bd80
movsxd rdx, dword [rcx - 0xc]
call fcn.1400beaac
test eax, eax
js 0x14023bd8c
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jle 0x14023bfa7
mov ecx, 0x80070057
call fcn.14000cbb8
int3
lea rcx, [rbp - 0x60]
call fcn.14000bd14
mov r8d, edi
mov rdx, qword [rax + 8]
lea rcx, str._ProgramFiles_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [rbp - 0x50]
mov rdi, qword [rbp - 0x60]
cmp eax, esi
jne 0x14023bdd5
mov rcx, qword [rdi]
test rcx, rcx
jne 0x14023bdcc
mov eax, r15d
jmp 0x14023bdd9
movsxd rdx, dword [rcx - 0xc]
call fcn.1400beaac
test eax, eax
js 0x14023bde5
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jle 0x14023bfa7
mov ecx, 0x80070057
call fcn.14000cbb8
int3
lea rdx, str.CommonProgramFiles32
mov rcx, qword [rbx]
call fcn.1400bedf4
test eax, eax
jne 0x14023bed5
lea rcx, [rsp + 0x2c]
call fcn.14023dc9c
mov r9d, r12d
mov r8d, edi
lea rdx, [rsp + 0x20]
cmp dword [rsp + 0x2c], r15d
je 0x14023be7c
lea rcx, [rbp - 0x48]
call fcn.14000bd14
mov r8d, edi
mov rdx, qword [rax + 8]
lea rcx, str._CommonProgramFiles_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [rbp - 0x38]
mov rdi, qword [rbp - 0x48]
cmp eax, esi
jne 0x14023be61
mov rcx, qword [rdi]
test rcx, rcx
jne 0x14023be58
mov eax, r15d
jmp 0x14023be65
movsxd rdx, dword [rcx - 0xc]
call fcn.1400beaac
test eax, eax
js 0x14023be71
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jle 0x14023bfa7
mov ecx, 0x80070057
call fcn.14000cbb8
int3
lea rcx, [rbp - 0x18]
call fcn.14000bd14
mov r8d, edi
mov rdx, qword [rax + 8]
lea rcx, str._CommonProgramFiles_x86__
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [rbp - 8]
mov rdi, qword [rbp - 0x18]
cmp eax, esi
jne 0x14023beba
mov rcx, qword [rdi]
test rcx, rcx
jne 0x14023beb1
mov eax, r15d
jmp 0x14023bebe
movsxd rdx, dword [rcx - 0xc]
call fcn.1400beaac
test eax, eax
js 0x14023beca
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jle 0x14023bfa7
mov ecx, 0x80070057
call fcn.14000cbb8
int3
lea rdx, str.CommonProgramFiles64
mov rcx, qword [rbx]
call fcn.1400bedf4
test eax, eax
jne 0x14023bfc5
lea rcx, [rsp + 0x28]
call fcn.14023dc9c
mov r9d, r12d
mov r8d, edi
lea rdx, [rsp + 0x20]
cmp dword [rsp + 0x28], r15d
je 0x14023bf5d
lea rcx, [rbp + 0x18]
call fcn.14000bd14
mov r8d, edi
mov rdx, qword [rax + 8]
lea rcx, str._CommonProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [rbp + 0x28]
mov rdi, qword [rbp + 0x18]
cmp eax, esi
jne 0x14023bf46
mov rcx, qword [rdi]
test rcx, rcx
jne 0x14023bf3d
mov eax, r15d
jmp 0x14023bf4a
movsxd rdx, dword [rcx - 0xc]
call fcn.1400beaac
test eax, eax
js 0x14023bf52
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jle 0x14023bfa7
mov ecx, 0x80070057
call fcn.14000cbb8
int3
lea rcx, [rbp + 0x48]
call fcn.14000bd14
mov r8d, edi
mov rdx, qword [rax + 8]
lea rcx, str._CommonProgramFiles_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [rbp + 0x58]
mov rdi, qword [rbp + 0x48]
cmp eax, esi
jne 0x14023bf9b
mov rcx, qword [rdi]
test rcx, rcx
jne 0x14023bf92
mov eax, r15d
jmp 0x14023bf9f
movsxd rdx, dword [rcx - 0xc]
call fcn.1400beaac
test eax, eax
js 0x14023bfba
mov rcx, qword [rdi]
cmp eax, dword [rcx - 0xc]
jg 0x14023bfba
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rdi]
mov word [rax + rcx*2], r15w
jmp 0x14023c0fb
mov ecx, 0x80070057
call fcn.14000cbb8
int3
lea rdx, str.SystemDirectory
mov rcx, qword [rbx]
call fcn.1400bedf4
test eax, eax
jne 0x14023bfff
lea rcx, [rsp + 0x50]
call fcn.140239780
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14000c244
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
jmp 0x14023c0e5
lea rdx, str.SystemDirectory32
mov rcx, qword [rbx]
call fcn.1400bedf4
test eax, eax
jne 0x14023c030
lea rcx, [rbp - 0x70]
call fcn.14023e4dc
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14000c244
nop
mov rdx, qword [rbp - 0x70]
jmp 0x14023bff6
lea rdx, str.SystemDirectory64
mov rcx, qword [rbx]
call fcn.1400bedf4
test eax, eax
jne 0x14023c0fb
lea rcx, [rsp + 0x78]
call fcn.140239780
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14000c244
nop
mov rdx, qword [rsp + 0x78]
jmp 0x14023bff6
mov rdx, r13
lea rcx, [rsp + 0x68]
call fcn.14023b6b0
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14000c244
nop
mov rdx, qword [rsp + 0x68]
jmp 0x14023bff6
lea rcx, [rsp + 0x30]
call fcn.140239780
nop
mov rax, qword [rsp + 0x30]
cmp dword [rax - 0x10], r15d
je 0x14023c0e1
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14023a4d0
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14000c244
nop
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14023c0dc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0x30]
lea rdx, [rax - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14023c0fb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rsp + 0x20]
cmp dword [rax - 0x10], r15d
jne 0x14023c165
mov rsi, qword [r13]
test rsi, rsi
je 0x14023c162
xor eax, eax
lea rdi, [0x140330de8]
mov rsi, qword [rsi + 0x10]
mov rcx, r12
repe cmpsw word [rsi], word [rdi]
je 0x14023c12f
sbb eax, eax
mov esi, 0xffffffff
sbb eax, esi
jmp 0x14023c132
or esi, 0xffffffff
test eax, eax
setne al
test al, al
je 0x14023c165
lea rdx, str.userprofile
mov rcx, qword [rbx]
call fcn.1400bedf4
test eax, eax
jne 0x14023c165
mov rdx, qword [r13]
add rdx, 0x10
lea rcx, [rsp + 0x20]
call fcn.14000c244
jmp 0x14023c165
or esi, 0xffffffff
mov rax, qword [rsp + 0x20]
cmp dword [rax - 0x10], r15d
jne 0x14023c1d3
mov rax, qword [r13]
test rax, rax
je 0x14023c1d3
cmp byte [rax + 0x19], r15b
jne 0x14023c1d3
call fcn.14023df3c
test al, al
je 0x14023c1d3
lea rdx, str.userprofile
mov rcx, qword [rbx]
call fcn.1400bedf4
test eax, eax
jne 0x14023c1d3
lea rcx, [rsp + 0x58]
call fcn.1402396c0
nop
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14000c244
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14023c1d3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x20]
cmp dword [rcx - 0x10], r15d
jne 0x14023c2b9
sub r12d, dword [rcx - 8]
mov eax, dword [rcx - 0xc]
mov ecx, 0x104
sub eax, ecx
or eax, r12d
jge 0x14023c201
mov edx, ecx
lea rcx, [rsp + 0x20]
call fcn.14000c998
mov rdi, qword [rsp + 0x20]
mov r8, rbx
lea rdx, [0x14035a040]
lea rcx, [rsp + 0x70]
call fcn.14000d30c
nop
lea r8, [0x14035a040]
mov rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14001c3e0
mov r8d, 0x104
mov rdx, rdi
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14023c261
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14023c280
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rcx, qword [rsp + 0x20]
movsxd rdx, dword [rcx - 0xc]
call fcn.1400beaac
test eax, eax
js 0x14023c2ae
mov rcx, qword [rsp + 0x20]
cmp eax, dword [rcx - 0xc]
jg 0x14023c2ae
mov dword [rcx - 0x10], eax
movsxd rcx, eax
mov rax, qword [rsp + 0x20]
mov word [rax + rcx*2], r15w
jmp 0x14023c2b9
mov ecx, 0x80070057
call fcn.14000cbb8
int3
mov rax, qword [r13]
test rax, rax
je 0x14023c310
cmp byte [rax + 0x18], r15b
jne 0x14023c310
mov rcx, qword [rsp + 0x20]
mov eax, dword [rcx - 0x10]
test eax, eax
je 0x14023c310
js 0x14023c2f3
lea rdx, [0x14035a040]
call fcn.1400bee84
test rax, rax
je 0x14023c2f3
sub rax, qword [rsp + 0x20]
sar rax, 1
cmp eax, esi
jne 0x14023c310
mov rcx, qword [r13]
add rcx, 0x40
mov rdx, rbx
call fcn.140063c38
mov rcx, rax
lea rdx, [rsp + 0x20]
call fcn.14000c244
mov rax, qword [rsp + 0x20]
cmp dword [rax - 0x10], r15d
jle 0x14023c396
mov r8, rbx
lea rdx, [0x14035a040]
lea rcx, [rsp + 0x48]
call fcn.14000d30c
nop
lea r8, [0x14035a040]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14001c3e0
nop
mov r8, qword [rsp + 0x20]
mov rdx, qword [rax]
mov rcx, r14
call fcn.14000b658
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14023c376
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14023c396
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
add eax, esi
test eax, eax
jg 0x14023c3b5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x1a0]
add rsp, 0x160
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret