Function at 0x14002b580
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0xb8], rbx
mov r14d, r9d
mov r13, r8
mov rsi, rdx
mov r15, rcx
mov eax, dword [rbp + 0x70]
mov dword [rsp + 0x30], eax
mov eax, dword [rbp + 0x68]
mov dword [rsp + 0x28], eax
mov edi, dword [rbp + 0x60]
mov dword [rsp + 0x20], edi
call fcn.140026370
nop
lea rcx, vtable.CProcessListRealtime2.1.0
mov qword [r15], rcx
lea rcx, vtable.CProcessListRealtime2.2.0
mov qword [r15 + 0xc0], rcx
lea rax, vtable.CProcessListRealtime2.0
mov qword [r15 + 0xc8], rax
lea rcx, [r15 + 0xd0]
mov rdx, r13
call fcn.140069340
nop
lea rbx, [r15 + 0x120]
mov qword [rbp + 0x48], rbx
xor r12d, r12d
mov qword [rbx], r12
mov qword [rbx + 8], r12
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14000b0b0
mov qword [rbx], rax
lea rbx, [r15 + 0x130]
mov qword [rbp + 0x48], rbx
mov qword [rbx], r12
mov qword [rbx + 8], r12
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14000b0b0
mov qword [rbx], rax
lea rbx, [r15 + 0x140]
mov qword [rbp + 0x48], rbx
mov qword [rbx], r12
mov qword [rbx + 8], r12
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.140038c00
mov qword [rbx], rax
lea rbx, [r15 + 0x150]
mov qword [rbp + 0x48], rbx
mov qword [rbx], r12
mov qword [rbx + 8], r12
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.140025b70
mov qword [rbx], rax
mov qword [r15 + 0x170], r13
mov qword [r15 + 0x180], rsi
mov dword [r15 + 0x188], r14d
mov dword [r15 + 0x18c], edi
lea rdi, [r15 + 0x1a0]
mov qword [rbp + 0x48], rdi
xor r14d, r14d
mov qword [rdi], r14
mov qword [rdi + 8], r14
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.14000b0b0
mov qword [rdi], rax
lea rbx, [r15 + 0x1b0]
mov qword [rbp + 0x48], rbx
mov qword [rbx], r14
mov qword [rbx + 8], r14
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14000b0b0
mov qword [rbx], rax
lea rsi, vtable.CSABString.0
mov qword [rbp - 0x18], rsi
mov dword [rbp - 8], r14d
lea ecx, [r12 + 1]
call fcn.140247068
mov rbx, rax
mov qword [rbp - 0x10], rax
test rax, rax
je 0x14002b720
movzx ecx, byte [0x140286ae1]
mov byte [rax], cl
mov dword [rbp - 4], 1
lea r12, [r15 + 0x1d0]
lea rdx, [rbp - 0x18]
mov rcx, r12
call fcn.140026580
nop
test rbx, rbx
je 0x14002b748
mov rcx, rbx
call fcn.140247060
lea rax, vtable.CSABCriticalSectionContainer.0
mov qword [r15 + 0x270], rax
lea rcx, [r15 + 0x278]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
lea rbx, [r15 + reloc.SHELL32.dll_IsUserAnAdmin]
mov qword [rbp + 0x48], rbx
mov qword [rbx], r14
mov qword [rbx + 8], r14
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14000b0b0
mov qword [rbx], rax
lea rbx, [r15 + 0x2b8]
mov qword [rbp + 0x48], rbx
mov qword [rbx], r14
mov qword [rbx + 8], r14
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.140025b70
mov qword [rbx], rax
lea rbx, [r15 + 0x2c8]
mov qword [rbp + 0x48], rbx
mov qword [rbx], r14
mov qword [rbx + 8], r14
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14000b0b0
mov qword [rbx], rax
lea rbx, [r15 + 0x2e8]
mov qword [rbp + 0x48], rbx
mov qword [rbx], r14
mov qword [rbx + 8], r14
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.140038bb0
mov qword [rbx], rax
lea rbx, [r15 + 0x2f8]
mov qword [rbp + 0x48], rbx
mov qword [rbx], r14
mov qword [rbx + 8], r14
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14000b0b0
mov qword [rbx], rax
lea rbx, [r15 + 0x308]
mov qword [rbp + 0x48], rbx
mov qword [rbx], r14
mov qword [rbx + 8], r14
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.140038c50
mov qword [rbx], rax
lea rbx, [r15 + 0x328]
mov qword [rbp + 0x48], rbx
mov qword [rbx], r14
mov qword [rbx + 8], r14
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14000b0b0
mov qword [rbx], rax
lea rbx, [r15 + 0x338]
mov qword [rbp + 0x48], rbx
mov qword [rbx], r14
mov qword [rbx + 8], r14
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14000b0b0
mov qword [rbx], rax
lea rbx, vtable.CSABCriticalSectionContainer.0
mov qword [r15 + 0x348], rbx
lea rcx, [r15 + 0x350]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
mov qword [r15 + 0x378], rbx
lea rcx, [r15 + 0x380]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
lea rbx, [r15 + 0x6e0]
mov qword [rbp + 0x48], rbx
mov qword [rbx], r14
mov qword [rbx + 8], r14
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14002ae60
mov qword [rbx], rax
lea rax, vtable.CSABStringW.0
mov qword [r15 + 0x6f8], rax
mov qword [r15 + 0x700], r14
mov dword [r15 + 0x708], r14d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [r15 + 0x700], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [r15 + 0x70c], 1
mov qword [r15 + 0x718], rsi
mov qword [r15 + 0x720], r14
mov dword [r15 + 0x728], r14d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetDim
call fcn.140247068
mov qword [r15 + 0x720], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov dword [r15 + 0x72c], 1
lea rsi, [r15 + 0x740]
mov qword [rsi + 0x218], r13
mov qword [rsi + 0x220], r14
lea rbx, vtable.CSABSDKFunctions.0
test r13, r13
jne 0x14002b9ae
lea ecx, [r13 + 0x18]
call fcn.14018ef40
mov qword [rbp + 0x48], rax
test rax, rax
je 0x14002b982
mov qword [rax], rbx
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
jmp 0x14002b985
mov rax, r14
mov qword [rsi + 0x218], rax
xor r8d, r8d
mov edx, 0x1000
mov rcx, rax
call fcn.140011040
mov qword [rsi + 0x220], rax
mov rcx, qword [rsi + 0x218]
mov qword [rcx + 0x10], rax
mov ecx, 0x38
call fcn.14018ef40
mov qword [rbp + 0x48], rax
test rax, rax
je 0x14002b9d2
mov rdx, qword [rsi + 0x218]
mov rcx, rax
call fcn.140069340
jmp 0x14002b9d5
mov rax, r14
mov qword [rsi + 0x228], rax
mov r8d, 0x104
mov rdx, rsi
lea rcx, [0x14028c088]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov qword [rsi + 0x208], rsi
mov qword [rsi + 0x210], r14
mov r8, rsi
mov edx, 0x104
lea rcx, [rsi + 0x230]
call fcn.140251ec0
lea r8, str.System32RUNDLL32.EXE
mov edx, 0x104
lea rcx, [rsi + 0x230]
call fcn.140251e40
nop
lea rbx, [r15 + 0xb78]
mov qword [rbp + 0x48], rbx
mov qword [rbx], r14
mov qword [rbx + 8], r14
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.140038b60
mov qword [rbx], rax
lea rbx, [r15 + 0xb88]
mov qword [rbp + 0x48], rbx
mov qword [rbx], r14
mov qword [rbx + 8], r14
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14000b0b0
mov qword [rbx], rax
lea rax, vtable.CSABCriticalSectionContainer.0
mov qword [r15 + 0xb98], rax
lea rcx, [r15 + 0xba0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
lea rax, vtable.CSABDiskVolumeManager.0
mov qword [r15 + 0xbd0], rax
mov dword [r15 + 0xbd8], r14d
mov qword [r15 + 0xbe0], r14
lea rax, [r15 + 0xc0]
mov qword [r15 + 0xbe8], rax
lea rbx, [r15 + 0xcc8]
mov qword [rbp + 0x48], rbx
mov qword [rbx], r14
mov qword [rbx + 8], r14
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14000b0b0
mov qword [rbx], rax
mov qword [r15 + 0x178], r14
cmp qword [r15 + 0x170], 0
jne 0x14002bb3d
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call fcn.14018ef40
mov qword [rbp + 0x48], rax
test rax, rax
je 0x14002bb11
lea rcx, vtable.CSABSDKFunctions.0
mov qword [rax], rcx
mov qword [rax + 8], r14
mov qword [rax + 0x10], r14
jmp 0x14002bb14
mov rax, r14
mov qword [r15 + 0x170], rax
xor r8d, r8d
mov edx, 0x1000
mov rcx, rax
call fcn.140011040
mov qword [r15 + 0x178], rax
mov rcx, qword [r15 + 0x170]
mov qword [rcx + 0x10], rax
xor r9d, r9d
mov edx, 1
xor ecx, ecx
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [r15 + 0x160], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [r15 + 0x168], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [r15 + 0x320], rax
mov dword [r15 + 0x110], 0x7d0
mov dword [r15 + 0x114], 0xfa0
mov dword [r15 + 0x118], 0xc8
mov dword [r15 + 0x11c], 0xc8
mov dword [r15 + 0x3a8], PathResolve
mov dword [r15 + 0x3ac], 0x1388
mov dword [r15 + 0x3b0], 0xc8
mov dword [r15 + 0xbc8], 0x1f4
lea rax, str.CCSVCHST
mov qword [rbp + 0x48], rax
mov rsi, qword [rdi]
mov r14, qword [rsi + 8]
lea r9, [rbp + 0x48]
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call fcn.140009370
mov rdx, rax
mov rax, qword [rdi + 8]
movabs rbx, 0xaaaaaaaaaaaaaa9
mov rcx, rbx
sub rcx, rax
cmp rcx, 1
jb 0x14002be94
inc rax
mov qword [rdi + 8], rax
mov qword [rsi + 8], rdx
mov qword [r14], rdx
lea rax, str.PIFSVC
mov qword [rbp + 0x48], rax
mov rsi, qword [rdi]
mov r14, qword [rsi + 8]
lea r9, [rbp + 0x48]
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call fcn.140009370
mov rdx, rax
mov rax, qword [rdi + 8]
mov rcx, rbx
sub rcx, rax
cmp rcx, 1
jb 0x14002bea1
inc rax
mov qword [rdi + 8], rax
mov qword [rsi + 8], rdx
mov qword [r14], rdx
lea rax, str.VPROCSVC
mov qword [rbp + 0x48], rax
mov rsi, qword [rdi]
mov r14, qword [rsi + 8]
lea r9, [rbp + 0x48]
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call fcn.140009370
mov rcx, rax
mov rax, qword [rdi + 8]
sub rbx, rax
cmp rbx, 1
jb 0x14002be87
inc rax
mov qword [rdi + 8], rax
mov qword [rsi + 8], rcx
mov qword [r14], rcx
xor r14d, r14d
mov qword [r15 + 0x268], r14
mov qword [r15 + 0x318], r14
mov qword [r15 + 0x1c8], r14
mov qword [r15 + 0x1c0], r14
cmp dword [rbp + 0x68], r14d
je 0x14002bde0
lea ecx, [r14 + 0x10]
call fcn.14018ef40
mov qword [rbp + 0x48], rax
test rax, rax
je 0x14002bd07
mov qword [rax], r12
mov qword [rax + 8], r14
jmp 0x14002bd0a
mov rax, r14
mov qword [r15 + 0x1c8], rax
mov ecx, 0xd0
call fcn.14018ef40
mov rdi, rax
mov qword [rbp + 0x48], rax
test rax, rax
je 0x14002bdd6
mov rsi, qword [r15 + 0x1c8]
lea rax, vtable.CSABProcessHandleManager2.0
mov qword [rdi], rax
lea rbx, [rdi + 8]
mov qword [rbp + 0x50], rbx
mov qword [rbx], r14
mov qword [rbx + 8], r14
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.140038ca0
mov qword [rbx], rax
lea rbx, [rdi + 0x18]
mov qword [rbp + 0x50], rbx
mov qword [rbx], r14
mov qword [rbx + 8], r14
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.140038b10
mov qword [rbx], rax
lea rax, vtable.CSABString.0
mov qword [rbp - 0x18], rax
mov dword [rbp - 8], r14d
mov ecx, 1
call fcn.140247068
mov rbx, rax
mov qword [rbp - 0x10], rax
test rax, rax
je 0x14002bda8
movzx ecx, byte [0x140286ae1]
mov byte [rax], cl
mov dword [rbp - 4], 1
lea rcx, [rdi + 0x28]
lea rdx, [rbp - 0x18]
call fcn.140026580
nop
test rbx, rbx
je 0x14002bdca
mov rcx, rbx
call fcn.140247060
movups xmm0, xmmword [rsi]
movups xmmword [rdi + 0xc0], xmm0
jmp 0x14002bdd9
mov rdi, r14
mov qword [r15 + 0x1c0], rdi
mov dword [r15 + 0x2a0], 1
lea rcx, [r15 + 0x3b8]
xor edx, edx
mov r8d, 0x320
call fcn.140249b10
mov dword [r15 + 0x6d8], r14d
mov dword [r15 + 0x710], r14d
mov dword [r15 + 0x10c], r14d
mov qword [r15 + 0x730], r14
mov qword [r15 + 0x738], r14
lea rcx, [r15 + 0xbf0]
xor edx, edx
mov r8d, 0xd0
call fcn.140249b10
mov dword [r15 + 0xcc0], r14d
mov dword [r15 + 0xcd8], 0x10000
mov qword [r15 + 0xcdc], 0x4000000
mov qword [r15 + 0x2d8], r14
mov qword [r15 + 0x2e0], r14
mov dword [r15 + 0x6f0], 1
mov rax, r15
mov rbx, qword [rsp + 0xb8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, str.list_T__too_long
call fcn.1402453d0
int3
lea rcx, str.list_T__too_long
call fcn.1402453d0
int3
lea rcx, str.list_T__too_long
call fcn.1402453d0
int3