Function at 0x14004fa80
Capabilities:
Query environment variable

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2c0]
sub rsp, 0x3c0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x400], rbx
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
mov rsi, rdx
mov rdi, rcx
xor r14d, r14d
mov qword [rdx], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x41
mov word [rsp + 0x60], r14w
lea r15, fcn.140008d70
mov qword [rsp + 0x48], r15
lea rax, [0x14008b078]
mov qword [rsp + 0x40], rax
mov dword [rbp - 0x18], r14d
mov qword [rbp - 0x10], r14
mov qword [rsp + 0x20], r14
mov r9d, 0x20019
lea r8, str.SOFTWAREMicrosoftWindows_Search
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x40]
call fcn.1400177b0
mov ebx, eax
test eax, eax
jns 0x14004fb47
mov rcx, qword [rbp + 0x2e8]
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
mov edx, 0x88e
call fcn.1400025a0
jmp 0x14004fd92
lea rax, [rbp + 0x18]
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], 0x41
mov word [rbp + 0x18], r14w
mov qword [rbp], r15
lea r8, [rbp]
lea rdx, str.DataDirectory
lea rcx, [rsp + 0x40]
call fcn.1400178f0
test eax, eax
jne 0x14004fb98
mov rcx, qword [rbp + 0x2e8]
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
mov edx, 0x891
call fcn.140048770
mov ebx, eax
jmp 0x14004fd88
cmp dword [rbp + 0x14], 0
ja 0x14004fbc3
mov rcx, qword [rbp + 0x2e8]
mov ebx, 0x8000ffff
mov r9d, ebx
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
mov edx, 0x892
call fcn.1400025a0
jmp 0x14004fd88
mov r8d, 0x104
lea rdx, [rbp + 0xa0]
mov rcx, qword [rbp + 8]
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
lea ecx, [rax - 1]
cmp ecx, 0x103
jbe 0x14004fc0a
mov rcx, qword [rbp + 0x2e8]
mov ebx, 0x8007007a
mov r9d, ebx
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
mov edx, 0x895
call fcn.1400025a0
jmp 0x14004fd88
add eax, 0xfffffffe
cmp word [rbp + rax*2 + 0xa0], 0x5c
je 0x14004fcdc
mov ecx, 0x104
lea rax, [rbp + 0xa0]
cmp word [rax], 0
je 0x14004fc38
add rax, 2
sub rcx, 1
jne 0x14004fc28
mov ebx, 0x80070057
test rcx, rcx
cmovne ebx, r14d
mov eax, 0x104
sub rax, rcx
mov r8, r14
test rcx, rcx
cmovne r8, rax
je 0x14004fcbc
mov ecx, 0x104
sub rcx, r8
lea rdx, [rbp + 0xa0]
lea rdx, [rdx + r8*2]
je 0x14004fca2
lea rax, [r8 + 0x7ffffefa]
add rax, rcx
lea r8, [0x140095aa4]
sub r8, rdx
test rax, rax
je 0x14004fca2
movzx r9d, word [r8 + rdx]
test r9w, r9w
je 0x14004fca2
mov word [rdx], r9w
add rdx, 2
dec rax
sub rcx, 1
jne 0x14004fc81
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], r14w
mov ebx, 0x8007007a
cmovne ebx, r14d
jne 0x14004fcdc
mov rcx, qword [rbp + 0x2e8]
mov r9d, ebx
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
mov edx, 0x899
call fcn.1400025a0
jmp 0x14004fd88
lea r8, str.ApplicationsWindowsProjectsSystemIndexPropMap
mov edx, 0x104
lea rcx, [rbp + 0xa0]
call fcn.140025900
mov ebx, eax
test eax, eax
jns 0x14004fd17
mov rcx, qword [rbp + 0x2e8]
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
mov edx, 0x89d
call fcn.1400025a0
jmp 0x14004fd88
lea rdx, str.CreatePropMapperStorage
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test rax, rax
jne 0x14004fd48
mov rcx, qword [rbp + 0x2e8]
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
mov edx, 0x8a0
call fcn.140048770
mov ebx, eax
jmp 0x14004fd88
mov dword [rsp + 0x30], r14d
mov r8, rsi
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0xa0]
call qword [case.0x14000702c.0]
mov ebx, eax
test eax, eax
jns 0x14004fd85
mov rcx, qword [rbp + 0x2e8]
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
mov edx, 0x8a4
call fcn.1400025a0
jmp 0x14004fd88
mov ebx, r14d
lea rcx, [rbp]
call fcn.140029258
nop
lea rcx, [rsp + 0x40]
call fcn.140017740
mov eax, ebx
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.14002dd40
mov rbx, qword [rsp + 0x400]
add rsp, 0x3c0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret