Function at 0x615f02
Capabilities:
Query environment variable

Disassembly:
push 0x16c
mov eax, 0x6bf3a7
call fcn.0064d018
mov edi, dword [ebp + 0xc]
xor eax, eax
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x178], edi
mov dword [ebp - 0x174], eax
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x16c], eax
push eax
push eax
push str.PROCESSOR_ARCHITECTURE
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
jne 0x6160f4
and dword [ebp - 0x98], eax
lea ecx, [ebp - 0xa8]
push 0x7aa754
mov dword [ebp - 0x94], 7
mov word [ebp - 0xa8], ax
call fcn.0040d510
mov byte [ebp - 4], 1
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push 7
mov dword [ebp - 0x168], eax
lea edi, [ebp - 0xdc]
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xa8]
push eax
push 0x81e0fc
lea ecx, [ebp - 0x60]
call fcn.005e97cc
mov dword [ebp - 0x60], vtable.C2R::ContextDataMsg.0
push 7
xor edx, edx
xor ecx, ecx
pop eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
mov word [ebp - 0x2c], cx
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x7c], eax
mov word [ebp - 0x90], cx
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x64], eax
mov word [ebp - 0x78], cx
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x34], edx
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 6
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x168]
push eax
lea ecx, [ebp - 0x164]
call fcn.005b30c3
and dword [ebp - 0xc8], 0
xor ecx, ecx
mov word [ebp - 0xd8], cx
mov edx, 0x3ae
lea ecx, [ebp - 0x60]
mov dword [ebp - 0xdc], vtable.C2R::CommonTelemetry.0
push ecx
push eax
lea eax, [ebp - 0xdc]
mov dword [ebp - 0xc4], 7
push eax
push str.MachineHardwareProperties::GetProcessorArchitecture
push 0xa
mov ecx, 0x2302301
call fcn.00411ea6
lea ecx, [ebp - 0xd8]
call fcn.0040d475
lea ecx, [ebp - 0x164]
call fcn.00413b8b
lea ecx, [ebp - 0x44]
call fcn.0040d475
lea ecx, [ebp - 0x78]
call fcn.0040d475
lea ecx, [ebp - 0x90]
call fcn.0040d475
lea ecx, [ebp - 0x2c]
call fcn.0040d475
lea ecx, [ebp - 0x5c]
call fcn.0040d475
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 0
call fcn.0040d475
push ecx
call esi
mov esi, dword [ebp - 0x178]
mov ecx, esi
push eax
push str.Error
call fcn.0045455e
mov ecx, eax
call fcn.0042fcf4
push 4
push str.failed
push str.GetEnvironmentVariable
mov ecx, esi
call fcn.0045455e
mov ecx, eax
call fcn.004137e0
mov ecx, esi
call fcn.00454580
mov ecx, eax
mov byte [ecx + 1], 0
cmp byte [ecx], 0
jne 0x6165e1
mov byte [ecx], 1
jmp 0x6165e1
lea eax, [ebp - 0x174]
push eax
push esi
mov ecx, eax
call fcn.00616752
push esi
push dword [ebp - 0x174]
push str.PROCESSOR_ARCHITECTURE
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x61644c
cmp eax, esi
ja 0x61644c
push dword [ebp - 0x174]
lea ecx, [ebp - 0x2c]
call fcn.0040d412
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x2c]
cmp dword [0x81a044], 8
mov edx, 0x81a030
push 0
cmovae edx, dword [0x81a030]
cmp dword [ebp - 0x18], 8
push 0xffffffffffffffff
cmovae ecx, dword [ebp - 0x2c]
call fcn.0040bf20
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
mov esi, eax
call fcn.0040d475
test esi, esi
jne 0x6161b3
push 4
sub esp, 0x18
mov ecx, esp
push 0x81a030
and dword [ecx + 0x10], esi
and dword [ecx + 0x14], esi
call fcn.0040d595
push str.GetEnvironmentVariable
mov ecx, edi
call fcn.0045455e
mov ecx, eax
call fcn.004266cb
push 0x8199e8
and dword [ebx + 0x10], 0
mov ecx, ebx
and dword [ebx + 0x14], 0
call fcn.0040d595
jmp 0x6165ed
push dword [ebp - 0x174]
lea ecx, [ebp - 0x2c]
call fcn.0040d412
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x2c]
cmp dword [0x819ef4], 8
mov edx, 0x819ee0
push 0
cmovae edx, dword [0x819ee0]
cmp dword [ebp - 0x18], 8
push 0xffffffffffffffff
cmovae ecx, dword [ebp - 0x2c]
call fcn.0040bf20
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
mov esi, eax
call fcn.0040d475
test esi, esi
jne 0x61622f
push 4
sub esp, 0x18
mov ecx, esp
and dword [ecx + 0x10], esi
and dword [ecx + 0x14], esi
mov esi, 0x819ee0
push esi
call fcn.0040d595
push str.GetEnvironmentVariable
mov ecx, edi
call fcn.0045455e
mov ecx, eax
call fcn.004266cb
push esi
jmp 0x61619f
push dword [ebp - 0x174]
lea ecx, [ebp - 0xd8]
call fcn.0040d412
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x44]
and dword [ebp - 0x34], 0
xor eax, eax
push str.Platform_returned:
mov dword [ebp - 0x30], 7
mov word [ebp - 0x44], ax
call fcn.0040d510
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0xa8]
and dword [ebp - 0x98], 0
xor eax, eax
push str.Value_returned_from_GetEnvironmentVariableW_is_an_unknown_architecture.
mov dword [ebp - 0x94], 7
mov word [ebp - 0xa8], ax
call fcn.0040d510
mov byte [ebp - 4], 0x11
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push 7
mov dword [ebp - 0x168], eax
lea edi, [ebp - 0x60]
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0xa8]
push eax
push ecx
lea ecx, [ebp - 0xf8]
call fcn.005e9850
mov dword [ebp - 0xf8], vtable.C2R::ContextDataMsg.0
push 7
xor edx, edx
xor ecx, ecx
pop eax
mov dword [ebp - 0xb0], edx
mov dword [ebp - 0xac], eax
mov word [ebp - 0xc0], cx
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x64], eax
mov word [ebp - 0x78], cx
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x7c], eax
mov word [ebp - 0x90], cx
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x1c], edx
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0xc0]
mov byte [ebp - 4], 0x16
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x168]
push eax
lea ecx, [ebp - 0x164]
call fcn.005b30c3
and dword [ebp - 0x4c], 0
xor ecx, ecx
mov dword [ebp - 0x60], vtable.C2R::CommonTelemetry.0
mov dword [ebp - 0x48], 7
mov word [ebp - 0x5c], cx
lea ecx, [ebp - 0xf8]
mov edx, 0x3ae
push ecx
push eax
lea eax, [ebp - 0x60]
mov ecx, 0x2302303
push eax
push str.MachineHardwareProperties::GetProcessorArchitecture
push 0xa
call fcn.00411ea6
lea ecx, [ebp - 0x5c]
call fcn.0040d475
lea ecx, [ebp - 0x164]
call fcn.00413b8b
lea ecx, [ebp - 0x2c]
call fcn.0040d475
lea ecx, [ebp - 0x90]
call fcn.0040d475
lea ecx, [ebp - 0x78]
call fcn.0040d475
lea ecx, [ebp - 0xc0]
call fcn.0040d475
lea ecx, [ebp - 0xf4]
call fcn.0040d475
lea ecx, [ebp - 0xa8]
call fcn.0040d475
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0xf
call fcn.0040d475
push ecx
call esi
mov esi, dword [ebp - 0x178]
mov ecx, esi
push eax
push str.Error
call fcn.0045455e
mov ecx, eax
call fcn.0042fcf4
push 4
sub esp, 0x18
lea eax, [ebp - 0xd8]
mov ecx, esp
push eax
and dword [ecx + 0x10], 0
and dword [ecx + 0x14], 0
call fcn.0040d595
push str.GetEnvironmentVariable
mov ecx, esi
call fcn.0045455e
mov ecx, eax
call fcn.004266cb
mov ecx, esi
call fcn.00454580
mov byte [eax + 1], 0
cmp byte [eax], 0
jne 0x616430
mov byte [eax], 1
push 0x6f513c
mov ecx, ebx
call fcn.0040d412
lea ecx, [ebp - 0xd8]
call fcn.0040d475
jmp 0x6165ed
and dword [ebp - 0x34], 0
lea ecx, [ebp - 0x44]
xor eax, eax
mov dword [ebp - 0x30], 7
push 0x7aa754
mov word [ebp - 0x44], ax
call fcn.0040d510
mov byte [ebp - 4], 7
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push 7
mov dword [ebp - 0x168], eax
lea edi, [ebp - 0x60]
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
push eax
push 0x81e0fc
lea ecx, [ebp - 0xf8]
call fcn.005e97cc
mov dword [ebp - 0xf8], vtable.C2R::ContextDataMsg.0
push 7
xor edx, edx
xor ecx, ecx
pop eax
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x64], eax
mov word [ebp - 0x78], cx
mov dword [ebp - 0x80], edx
mov dword [ebp - 0x7c], eax
mov word [ebp - 0x90], cx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
mov word [ebp - 0x2c], cx
mov dword [ebp - 0xac], eax
xor eax, eax
mov dword [ebp - 0xb0], edx
mov word [ebp - 0xc0], ax
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0x168]
push eax
lea ecx, [ebp - 0x164]
call fcn.005b30c3
and dword [ebp - 0x4c], 0
xor ecx, ecx
mov word [ebp - 0x5c], cx
mov edx, 0x3ae
lea ecx, [ebp - 0xf8]
mov dword [ebp - 0x60], vtable.C2R::CommonTelemetry.0
push ecx
push eax
lea eax, [ebp - 0x60]
mov dword [ebp - 0x48], 7
push eax
push str.MachineHardwareProperties::GetProcessorArchitecture
push 0xa
mov ecx, 0x2302302
call fcn.00411ea6
lea ecx, [ebp - 0x5c]
call fcn.0040d475
lea ecx, [ebp - 0x164]
call fcn.00413b8b
lea ecx, [ebp - 0xc0]
call fcn.0040d475
lea ecx, [ebp - 0x2c]
call fcn.0040d475
lea ecx, [ebp - 0x90]
call fcn.0040d475
lea ecx, [ebp - 0x78]
call fcn.0040d475
lea ecx, [ebp - 0xf4]
call fcn.0040d475
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 0
call fcn.0040d475
push ecx
call esi
mov esi, dword [ebp - 0x178]
mov ecx, esi
push eax
push str.Error
call fcn.0045455e
mov ecx, eax
call fcn.0042fcf4
push 4
push str.failed
push str.GetEnvironmentVariable
mov ecx, esi
call fcn.0045455e
mov ecx, eax
call fcn.004137e0
mov ecx, esi
call fcn.00454580
mov byte [eax + 1], 0
cmp byte [eax], 0
jne 0x6165e1
mov byte [eax], 1
push str.error
mov ecx, ebx
call fcn.0040d412
lea ecx, [ebp - 0x174]
call fcn.00417a33
mov eax, ebx
call fcn.0064cfc2
ret 8