Function at 0x18001a770
Capabilities:
Query environment variable

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov r8d, dword [rdx]
mov rbx, rdx
mov rdx, rcx
mov rsi, rcx
xor r12d, r12d
lea rcx, str._CLUSTER_NETWORK_NAME_
mov qword [rbp + 0x58], r12
mov dword [rbp + 0x48], r12d
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
mov r14d, eax
test eax, eax
jne 0x18003386c
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
mov rcx, qword [rax + 0xa0]
test rcx, rcx
je 0x18001a839
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
mov ecx, dword [rax + 0xa8]
lea eax, [rcx + 1]
cmp dword [rbx], eax
jb 0x18001a822
mov dword [rbx], ecx
mov ebx, eax
add rbx, rbx
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
mov r8, rbx
mov rcx, rsi
mov rdx, qword [rax + 0xa0]
call sub.ntdll.dll_memcpy
lea eax, [r12 + 1]
add rsp, 0x70
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x6f
mov dword [rbx], eax
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
xor eax, eax
jmp 0x18001a812
mov rax, qword [0x1800b2e30]
test rax, rax
jne 0x180033894
lea rdx, str.RegistryMachineSystemCurrentControlSetControlComputerName
lea rcx, [rbp - 0x40]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
nop dword [rax + rax]
lea rax, [rbp - 0x40]
mov dword [rbp - 0x30], 0x30
xorps xmm0, xmm0
mov qword [rbp - 0x20], rax
lea r8, [rbp - 0x30]
mov qword [rbp - 0x28], r12
mov edx, 0x20019
mov dword [rbp - 0x18], 0x40
lea rcx, [rbp + 0x58]
movdqu xmmword [rbp - 0x10], xmm0
call qword [sym.imp.ntdll.dll_NtOpenKey]
nop dword [rax + rax]
mov edi, 0xc0000034
mov ecx, eax
cmp eax, edi
je 0x1800338b9
test eax, eax
js 0x180033912
mov rcx, qword [rbp + 0x58]
lea rdx, str.ActiveComputerName
mov r9, rbx
mov r8, rsi
call fcn.18001aa90
cmp eax, 0x80000005
je 0x18001a91e
test eax, eax
js 0x1800338ca
or r14, 0xffffffffffffffff
test rsi, rsi
je 0x18001a8f4
cmp dword [rbx], r12d
je 0x18001a8f4
mov rax, r14
inc rax
cmp word [rsi + rax*2], r12w
jne 0x18001a8e8
mov dword [rbx], eax
cmp dword [0x1800b2308], r12d
mov edi, 1
jne 0x18001a934
mov rcx, qword [rbp + 0x58]
test rcx, rcx
je 0x18001a917
call qword [sym.imp.ntdll.dll_NtClose]
nop dword [rax + rax]
mov eax, edi
jmp 0x18001a812
mov ecx, 0x6f
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
mov edi, r12d
jmp 0x18001a902
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
lea rcx, [rax + 0xb0]
call qword [sym.imp.ntdll.dll_RtlEnterCriticalSection]
nop dword [rax + rax]
lea rax, [rbp + 0x50]
mov r15d, 4
lea r9, [rbp + 0x48]
mov qword [rsp + 0x20], rax
lea r8, str.OOBEInProgress
mov dword [rbp + 0x50], r15d
lea rdx, str.RegistryMachineSystemSetup
xor ecx, ecx
call fcn.18001ac1c
test eax, eax
js 0x18001a98a
mov ecx, dword [rbp + 0x48]
test ecx, ecx
jne 0x18001a9b3
lea rax, [rbp + 0x50]
mov dword [rbp + 0x50], r15d
lea r9, [rbp + 0x48]
mov qword [rsp + 0x20], rax
lea r8, str.SystemSetupInProgress
xor ecx, ecx
lea rdx, str.RegistryMachineSystemSetup
call fcn.18001ac1c
mov ecx, dword [rbp + 0x48]
test eax, eax
mov eax, dword [0x1800b2308]
js 0x18001a9c9
test ecx, ecx
cmovne eax, r12d
mov dword [0x1800b2308], eax
test eax, eax
je 0x18001aa5d
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
mov rcx, qword [rax + 0xa0]
test rcx, rcx
jne 0x18001aa5d
mov r8d, dword [rbx]
xor edx, edx
mov rcx, qword gs:[0x60]
add r8d, edi
add r8, r8
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov r15, rax
test rax, rax
je 0x18001aa81
mov r8d, dword [rbx]
mov rdx, rsi
add r8, r8
mov rcx, rax
call sub.ntdll.dll_memcpy
mov ecx, dword [rbx]
mov word [r15 + rcx*2], r12w
inc r14
cmp word [r15 + r14*2], r12w
jne 0x18001aa2d
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
mov dword [rax + 0xa8], r14d
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
mov qword [rax + 0xa0], r15
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
lea rcx, [rax + 0xb0]
call qword [sym.imp.ntdll.dll_RtlLeaveCriticalSection]
nop dword [rax + rax]
jmp 0x18001a902
mov dword [0x1800b2308], r12d
jmp 0x18001aa5d
cmp dword [rbx], r14d
jb 0x180033878
mov edi, 1
jmp 0x18003388c
mov ecx, 0x6f
mov edi, r12d
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
mov dword [rbx], r14d
jmp 0x18001a917
mov rdx, rbx
mov rcx, rsi
call qword [case.0x1800532bc.0]
cmp eax, 0x4d5
je 0x18001a849
cmp eax, 0x6f
jne 0x18001a8d7
jmp 0x18001a92f
test rsi, rsi
je 0x1800338c2
mov word [rsi], r12w
mov dword [rbx], r12d
jmp 0x18001a8d7
mov rcx, qword [rbp + 0x58]
lea rdx, str.ComputerName
mov r9, rbx
mov r8, rsi
call fcn.18001aa90
mov ecx, eax
cmp eax, edi
je 0x1800338be
test eax, eax
js 0x180033912
mov rdx, rbx
mov rcx, rsi
call fcn.18007d624
mov edx, 0x80000000
mov ecx, eax
add eax, edx
test edx, eax
jne 0x18001a8d7
cmp ecx, 0xc0000022
je 0x18001a8d7
call sym.KERNEL32.dll_BaseSetLastNTError
nop
jmp 0x18001a92f