Function at 0x14002d4c0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x60
mov r12, r8
lea rsi, [rsp + 0x88]
mov r15, rdx
lea r8, [fcn.140039c40]
mov r13, rcx
lea rdx, [rsp + 0x48]
add rsi, 0xfffffffffffffff8
mov edi, r9d
mov rcx, rsi
call fcn.140025060
lea r8, [0x14002de60]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140025060
mov ebx, dword [rsp + 0xb8]
xor ebp, ebp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbp
test ebx, ebx
je 0x14002d55e
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ecx, eax
lea rdx, [rsp + 0x58]
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
jne 0x14002d55e
lea rdx, str.failed_getting_active_user_token
mov ecx, 0x550003
call fcn.140028ca0
jmp 0x14002d79a
test r12, r12
je 0x14002d56b
cmp qword [r12], rbp
cmove r12, rbp
mov edx, 1
mov rcx, r12
call fcn.14002de90
test eax, eax
je 0x14002d59a
mov rax, qword gs:[0x58]
lea rdx, str.invalid_redir:__s
mov r8d, 0x15c0
add r8, qword [rax]
jmp 0x14002d782
test r15, r15
je 0x14002d5a6
cmp qword [r15], rbp
cmove r15, rbp
test edi, edi
je 0x14002d729
test r15, r15
jne 0x14002d5d8
test ebx, ebx
je 0x14002d729
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x40]
xor r8d, r8d
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x14002d5e9
mov qword [rsp + 0x40], rbp
jmp 0x14002d63a
test ebx, ebx
jne 0x14002d5bb
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov qword [rsp + 0x40], rax
jmp 0x14002d5ee
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x14002d63a
cmp word [rax], bp
je 0x14002d63a
mov rdx, rax
mov rcx, rsi
call fcn.1400254b0
mov rcx, qword [rsp + 0x48]
xor r8d, r8d
mov rdx, qword [rax]
call fcn.140039180
mov rcx, qword [rsp + 0x40]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], bp
jne 0x14002d620
inc rax
lea rax, [rcx + rax*2]
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x14002d5f3
test r15, r15
je 0x14002d721
mov qword [rsp + 0x90], r14
nop dword [rax + rax]
mov rdi, qword [r15]
test rdi, rdi
je 0x14002d719
mov r14, qword [rsp + 0x48]
xor bpl, bpl
cmp qword [r14], 0
jne 0x14002d672
mov rcx, r14
call fcn.140039ca0
mov edx, 0x3d
mov rcx, rdi
call fcn.1401753cc
mov rcx, rax
test rax, rax
je 0x14002d68b
sub ecx, edi
jmp 0x14002d69e
or rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rdi + rax], 0
jne 0x14002d690
mov ecx, eax
mov bpl, 1
mov rbx, qword [r14]
mov rax, qword [rbx]
test rax, rax
je 0x14002d6fc
movsxd rsi, ecx
nop dword [rax]
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call fcn.140181f30
test eax, eax
jne 0x14002d6cb
mov rax, qword [rbx]
cmp byte [rsi + rax], 0x3d
je 0x14002d6d8
mov rax, qword [rbx + 8]
add rbx, 8
test rax, rax
jne 0x14002d6b0
test rax, rax
je 0x14002d6fc
test bpl, bpl
jne 0x14002d6ef
mov rdx, rdi
mov rcx, rbx
call fcn.140026000
jmp 0x14002d70f
mov rdx, rbx
mov rcx, r14
call fcn.140039bf0
jmp 0x14002d70f
test bpl, bpl
jne 0x14002d70f
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call fcn.140039180
add r15, 8
jne 0x14002d650
mov r14, qword [rsp + 0x90]
mov rax, qword [rsp + 0x48]
mov r15, qword [rax]
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov rdx, r13
call fcn.140057b00
mov rax, qword [rsp + 0x58]
mov r9, r12
mov rcx, qword [rsp + 0x50]
mov r8, r15
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x28], eax
mov rcx, qword [rcx]
mov dword [rsp + 0x20], 1
call fcn.14002d9f0
mov rbx, rax
test rax, rax
jne 0x14002d78e
mov r8, qword [rsp + 0x50]
lea rdx, str.failed_CreateProcess__s_:__m
mov r8, qword [r8]
mov ecx, 0x550003
call fcn.140028ca0
mov ebx, eax
lea rcx, [rsp + 0x58]
call fcn.14003e7b0
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret