Function at 0x140001f90
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x3e0]
sub rsp, 0x4e0
mov rax, qword [0x14002b018]
xor rax, rsp
mov qword [rbp + 0x3d0], rax
mov r14, rdx
mov rbx, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x140001fdb
cmp eax, 0x80010106
jne 0x1400021b1
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 6
xor r9d, r9d
xor r8d, r8d
mov edi, 0xffffffff
mov edx, edi
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jns 0x140002021
cmp eax, 0x80010106
jne 0x1400021ab
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x1c0]
call fcn.140006350
mov r8d, 0x104
lea rdx, [rbp + 0x1c0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
mov qword [rsp + 0x70], r15
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea r9, [0x14001f400]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x14001f410]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1400021ab
lea rcx, [rbp + 0x70]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm0, xmmword [rbp + 0x70]
movups xmmword [rbp + 0x18], xmm0
movsd xmm0, qword [rbp + 0x80]
movsd qword [rbp - 0x80], xmm0
lea rcx, [rbp + 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm0, xmmword [rbp + 0x58]
movups xmmword [rbp + 8], xmm0
movsd xmm0, qword [rbp + 0x68]
movsd qword [rbp - 0x68], xmm0
lea rcx, [rbp + 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm0, xmmword [rbp + 0x40]
movups xmmword [rbp - 8], xmm0
movsd xmm0, qword [rbp + 0x50]
movsd qword [rsp + 0x68], xmm0
lea rcx, [rbp + 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm0, xmmword [rbp + 0x18]
movaps xmmword [rbp + 0xe0], xmm0
movsd xmm0, qword [rbp - 0x80]
movsd qword [rbp + 0xf0], xmm0
movups xmm0, xmmword [rbp + 8]
movaps xmmword [rbp + 0x100], xmm0
movsd xmm0, qword [rbp - 0x68]
movsd qword [rbp + 0x110], xmm0
movups xmm0, xmmword [rbp - 8]
movaps xmmword [rbp + 0x120], xmm0
movsd xmm0, qword [rsp + 0x68]
movsd qword [rbp + 0x130], xmm0
movups xmm0, xmmword [rbp + 0x28]
movaps xmmword [rbp + 0x140], xmm0
movsd xmm1, qword [rbp + 0x38]
movsd qword [rbp + 0x150], xmm1
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea rdx, [rbp + 0xe0]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x100]
lea r8, [rbp + 0x120]
lea rdx, [rbp + 0x140]
call qword [rax + 0x50]
mov ebx, eax
lea rcx, [rbp + 0x28]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0x40]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0x58]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0x70]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test ebx, ebx
jns 0x1400021d9
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov rcx, qword [rbp + 0x3d0]
xor rcx, rsp
call fcn.1400049b0
mov rbx, qword [rsp + 0x520]
add rsp, 0x4e0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov qword [rsp + 0x58], r15
mov ecx, 0x18
call fcn.140004c74
mov rbx, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14000221b
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, [0x1400280e0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140002a62
jmp 0x14000221e
mov rbx, r15
mov qword [rbp + 0xc8], rbx
test rbx, rbx
je 0x140002aaf
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea r8, [rsp + 0x58]
mov rdx, qword [rbx]
call qword [rax + 0x38]
mov esi, eax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x14000227f
mov rcx, qword [rbx]
test rcx, rcx
je 0x140002260
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140002272
call fcn.1400049d0
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.1400049d0
test esi, esi
js 0x1400021a0
mov ecx, 0x18
call fcn.140004c74
mov rbx, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1400022c5
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1400022c8
test r14, r14
jne 0x140002a6d
jmp 0x1400022c8
mov rbx, r15
mov qword [rbp + 0xd0], rbx
test rbx, rbx
je 0x140002aaf
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
xor r8d, r8d
mov rdx, qword [rbx]
call qword [rax + 0x78]
nop
mov eax, edi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140002326
mov rcx, qword [rbx]
test rcx, rcx
je 0x140002307
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140002319
call fcn.1400049d0
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.1400049d0
mov qword [rsp + 0x50], r15
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
xor edx, edx
call qword [rax + 0x48]
mov ebx, eax
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test ebx, ebx
jns 0x140002358
mov rcx, qword [rsp + 0x58]
jmp 0x1400021a5
mov qword [rbp - 0x60], r15
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
lea rdx, [rbp - 0x60]
call qword [rax + 0x38]
test eax, eax
jns 0x140002384
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
jmp 0x1400021a5
mov rcx, qword [rbp - 0x60]
mov rax, qword [rcx]
lea rdx, str.Microsoft
call qword [rax + 0x50]
mov ebx, eax
mov rcx, qword [rbp - 0x60]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test ebx, ebx
js 0x14000236f
mov qword [rbp - 0x70], r15
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
lea rdx, [rbp - 0x70]
call qword [rax + 0x78]
test eax, eax
js 0x14000236f
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx]
mov edx, 3
call qword [rax + 0x70]
test eax, eax
js 0x14000236f
mov rcx, qword [rbp - 0x70]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x90]
mov ebx, eax
mov rcx, qword [rbp - 0x70]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test ebx, ebx
js 0x14000236f
mov qword [rsp + 0x60], r15
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
lea rdx, [rsp + 0x60]
call qword [rax + 0x58]
test eax, eax
js 0x14000236f
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x80]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x90]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov edx, edi
call qword [rax + 0x40]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
mov edx, edi
call qword [rax + 0xb0]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x70]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0x150]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0xd0]
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
lea rdx, str.PT0S
call qword [rax + 0xe0]
mov ebx, eax
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test ebx, ebx
js 0x14000236f
mov qword [rbp - 0x58], r15
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
lea rdx, [rbp - 0x58]
call qword [rax + 0x88]
test eax, eax
js 0x14000236f
mov qword [rbp - 0x50], r15
mov rcx, qword [rbp - 0x58]
mov rax, qword [rcx]
lea r8, [rbp - 0x50]
xor edx, edx
call qword [rax + 0x60]
mov ebx, eax
mov rcx, qword [rbp - 0x58]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test ebx, ebx
js 0x14000236f
mov qword [rbp - 0x48], r15
mov rcx, qword [rbp - 0x50]
mov rax, qword [rcx]
lea r8, [rbp - 0x48]
lea rdx, str.MbLk
call qword [rax]
mov ebx, eax
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test ebx, ebx
js 0x14000236f
mov rcx, qword [rbp - 0x48]
mov rax, qword [rcx]
lea rdx, [rbp + 0x1c0]
call qword [rax + 0x58]
mov ebx, eax
mov rcx, qword [rbp - 0x48]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test ebx, ebx
js 0x14000236f
mov qword [rbp - 0x40], r15
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
lea rdx, [rbp - 0x40]
call qword [rax + 0x48]
test eax, eax
js 0x14000236f
mov qword [rbp - 0x38], r15
mov rcx, qword [rbp - 0x40]
mov rax, qword [rcx]
lea r8, [rbp - 0x38]
mov edx, 2
call qword [rax + 0x50]
mov ebx, eax
mov rcx, qword [rbp - 0x40]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test ebx, ebx
js 0x14000236f
mov qword [rsp + 0x78], r15
mov rcx, qword [rbp - 0x38]
mov rax, qword [rcx]
lea r8, [rsp + 0x78]
lea rdx, [0x14001f3f0]
call qword [rax]
mov ebx, eax
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test ebx, ebx
js 0x14000236f
mov ecx, 0x18
call fcn.140004c74
mov rbx, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1400025e7
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, str.2023_09_05T00:00:00
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140002a78
jmp 0x1400025ea
mov rbx, r15
mov qword [rbp + 0xd8], rbx
test rbx, rbx
je 0x140002aaf
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
mov rdx, qword [rbx]
call qword [rax + 0x78]
nop
mov eax, edi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140002645
mov rcx, qword [rbx]
test rcx, rcx
je 0x140002626
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140002638
call fcn.1400049d0
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.1400049d0
mov ecx, 0x18
call fcn.140004c74
mov rbx, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x140002682
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, str.2023_12_31T23:59:59
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140002a83
jmp 0x140002685
mov rbx, r15
mov qword [rbp - 8], rbx
test rbx, rbx
je 0x140002aaf
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
mov rdx, qword [rbx]
call qword [rax + 0x88]
nop
mov eax, edi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1400026e0
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400026c1
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400026d3
call fcn.1400049d0
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.1400049d0
mov ecx, 0x18
call fcn.140004c74
mov rbx, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14000271d
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, str.PT0S
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140002a8e
jmp 0x140002720
mov rbx, r15
mov qword [rbp + 8], rbx
test rbx, rbx
je 0x140002aaf
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
mov rdx, qword [rbx]
call qword [rax + 0x68]
nop
mov eax, edi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140002778
mov rcx, qword [rbx]
test rcx, rcx
je 0x140002759
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000276b
call fcn.1400049d0
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.1400049d0
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + 0xa8]
mov qword [rbp - 0x30], r15
mov rcx, qword [rsp + 0x78]
mov rax, qword [rcx]
lea rdx, [rbp - 0x30]
call qword [rax + 0x50]
mov ebx, eax
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
test ebx, ebx
js 0x14000236f
mov ecx, 0x18
call fcn.140004c74
mov rbx, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1400027ed
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
lea rcx, str.PT2H
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140002a99
jmp 0x1400027f0
mov rbx, r15
mov qword [rbp + 0x18], rbx
test rbx, rbx
je 0x140002aaf
mov rcx, qword [rbp - 0x30]
mov rax, qword [rcx]
mov rdx, qword [rbx]
call qword [rax + 0x40]
mov esi, eax
mov ecx, edi
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x140002848
mov rcx, qword [rbx]
test rcx, rcx
je 0x140002829
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000283b
call fcn.1400049d0
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.1400049d0
mov rcx, qword [rbp - 0x30]
mov rax, qword [rcx]
call qword [rax + 0x10]
test esi, esi
js 0x14000236f
mov qword [rbp - 0x28], r15
mov eax, 8
mov word [rbp - 0x20], ax
lea rcx, [0x1400280dc]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp - 0x18], rax
test rax, rax
je 0x140002aba
movups xmm0, xmmword [rbp - 0x20]
movups xmmword [rbp - 0x80], xmm0
movsd xmm0, qword [rbp - 0x10]
movsd qword [rsp + 0x68], xmm0
lea rcx, [rbp + 0xa0]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm0, xmmword [rbp + 0xa0]
movups xmmword [rbp + 0xb8], xmm0
movsd xmm0, qword [rbp + 0xb0]
movsd qword [rbp - 0x68], xmm0
lea rcx, [rbp + 0x88]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
nop
movups xmm0, xmmword [rbp - 0x80]
movaps xmmword [rbp + 0x160], xmm0
movsd xmm0, qword [rsp + 0x68]
movsd qword [rbp + 0x170], xmm0
movups xmm0, xmmword [rbp + 0xb8]
movaps xmmword [rbp + 0x180], xmm0
movsd xmm0, qword [rbp - 0x68]
movsd qword [rbp + 0x190], xmm0
movups xmm0, xmmword [rbp + 0x88]
movaps xmmword [rbp + 0x1a0], xmm0
movsd xmm1, qword [rbp + 0x98]
movsd qword [rbp + 0x1b0], xmm1
mov ecx, 0x18
call fcn.140004c74
mov rbx, rax
mov qword [rsp + 0x68], rax
test rax, rax
je 0x14000295b
mov qword [rax + 8], r15
mov dword [rax + 0x10], 1
mov rcx, r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x14000295e
test r14, r14
jne 0x140002aa4
jmp 0x14000295e
mov rbx, r15
mov qword [rbp - 0x68], rbx
test rbx, rbx
je 0x140002a57
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
lea rdx, [rbp - 0x28]
mov qword [rsp + 0x40], rdx
lea rdx, [rbp + 0x160]
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], 3
lea rdx, [rbp + 0x180]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp + 0x1a0]
mov qword [rsp + 0x20], rdx
mov r9d, 6
mov r8, qword [rsp + 0x50]
mov rdx, qword [rbx]
call qword [rax + 0x88]
mov esi, eax
lock xadd dword [rbx + 0x10], edi
cmp edi, 1
jne 0x1400029f9
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400029d9
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r15
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400029eb
call fcn.1400049d0
mov qword [rbx + 8], r15
mov edx, 0x18
mov rcx, rbx
call fcn.1400049d0
nop
lea rcx, [rbp + 0x88]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp + 0xa0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
nop
lea rcx, [rbp - 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rcx, qword [rsp + 0x58]
test esi, esi
js 0x140002374
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rbp - 0x28]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
jmp 0x1400021b3
mov ecx, 0x8007000e
call fcn.140004810
nop
mov ecx, 0x8007000e
call fcn.140004810
nop
mov ecx, 0x8007000e
call fcn.140004810
nop
mov ecx, 0x8007000e
call fcn.140004810
nop
mov ecx, 0x8007000e
call fcn.140004810
nop
mov ecx, 0x8007000e
call fcn.140004810
nop
mov ecx, 0x8007000e
call fcn.140004810
nop
mov ecx, 0x8007000e
call fcn.140004810
nop
mov ecx, 0x8007000e
call fcn.140004810
int3
mov ecx, 0x8007000e
call fcn.140004810
int3