Function at 0x1400355dc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x38]
sub rsp, 0x130
mov rax, qword [0x14005ab08]
xor rax, rsp
mov qword [rbp + 0x28], rax
mov rdi, rcx
xor esi, esi
mov qword [rbp - 0x58], rsi
movdqa xmm0, xmmword [0x14004ce40]
movdqu xmmword [rbp - 0x48], xmm0
mov word [rbp - 0x58], si
lea rdx, [0x14004c408]
lea rcx, [rbp - 0x58]
call fcn.14000740c
nop
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x28], rsi
lea ebx, [rsi + 7]
mov qword [rbp - 0x20], rbx
mov word [rbp - 0x38], si
lea rdx, str.MicrosoftCryptoPCPKSPWindowsAIK
lea rcx, [rbp - 0x38]
call fcn.14000740c
nop
mov qword [rbp - 0x78], rsi
movdqa xmm0, xmmword [0x14004ce40]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], si
lea rdx, str.SystemDrive
lea rcx, [rbp - 0x78]
call fcn.14000740c
nop
mov qword [rbp - 0x18], rsi
movdqa xmm0, xmmword [0x14004ce40]
movdqu xmmword [rbp - 8], xmm0
mov word [rbp - 0x18], si
lea rdx, str.ProgramData
lea rcx, [rbp - 0x18]
call fcn.14000740c
nop
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x48], si
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
cmovae rcx, qword [rbp - 0x58]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x14003572a
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.1400328c0
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
cmovae rcx, qword [rbp - 0x58]
mov r8d, ebx
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
mov rdx, qword [rsp + 0x58]
dec rdx
lea rcx, [rsp + 0x48]
call fcn.1400328c0
jmp 0x14003583d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0xcb
jne 0x1400359a1
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rcx, qword [rbp - 0x78]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x1400359bd
mov qword [rsp + 0x68], rsi
movdqa xmm0, xmmword [0x14004ce40]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], si
mov edx, ebx
lea rcx, [rsp + 0x68]
call fcn.1400328c0
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rdx, qword [rsp + 0x68]
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rcx, qword [rbp - 0x78]
mov r8d, ebx
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
mov edx, dword [rbp - 8]
add edx, dword [rsp + 0x78]
lea rcx, [rsp + 0x48]
call fcn.1400328c0
lea r9, [rbp - 0x18]
cmp qword [rbp], 8
cmovae r9, qword [rbp - 0x18]
lea r8, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae r8, qword [rsp + 0x68]
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
mov dword [rsp + 0x20], 1
mov rdx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchCombineEx]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x38]
test eax, eax
js 0x1400359e2
mov rdx, qword [rsp + 0x58]
dec rdx
lea rcx, [rsp + 0x48]
call fcn.1400328c0
nop
lea rcx, [rsp + 0x68]
call fcn.140006df0
movabs rax, 0x7ffffffffffffffe
mov rcx, qword [rsp + 0x58]
sub rax, rcx
mov rdx, qword [rbp - 0x28]
cmp rax, rdx
jb 0x1400359f7
lea r9, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r9, qword [rsp + 0x48]
lea rax, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rax, qword [rbp - 0x38]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 8]
call fcn.14001d228
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x104
jae 0x1400359fd
mov rax, rdx
shr rax, 0x20
test eax, eax
je 0x1400358de
mov rcx, rax
add rcx, rcx
je 0x1400358de
mov rax, rcx
shr rax, 0x20
test eax, eax
jne 0x14003599b
mov eax, edx
add rax, rax
shl rcx, 0x20
add rcx, rax
cmp rcx, rax
jb 0x14003599b
jmp 0x1400358e3
mov ecx, edx
add rcx, rcx
mov eax, 0xffffffff
cmp rcx, rax
ja 0x14003599b
lea r8, [rbp + 8]
cmp qword [rbp + 0x20], 8
cmovae r8, qword [rbp + 8]
mov dword [rsp + 0x20], esi
mov r9d, ecx
lea rdx, str.PCP_ALTERNATE_KEY_STORAGE_LOCATION
mov rcx, rdi
call qword [sym.imp.ncrypt.dll_NCryptSetProperty]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x38]
test eax, eax
js 0x140035986
lea rcx, [rbp + 8]
call fcn.140006df0
nop
lea rcx, [rsp + 0x48]
call fcn.140006df0
nop
lea rcx, [rbp - 0x18]
call fcn.140006df0
nop
lea rcx, [rbp - 0x78]
call fcn.140006df0
nop
lea rcx, [rbp - 0x38]
call fcn.140006df0
nop
lea rcx, [rbp - 0x58]
call fcn.140006df0
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.140040520
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov r9d, eax
lea r8, str.onecore_amcoreoctagoncommon_tpmattestation_attesttpm.cpp
mov edx, 0x70
call fcn.1400161f4
int3
call fcn.14002e4e0
nop
mov rcx, qword [rbp + 0x38]
mov r9d, 0x139f
lea r8, str.onecore_amcoreoctagoncommon_tpmattestation_attesttpm.cpp
mov edx, 0x45
call fcn.140023610
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r9d, eax
mov rcx, qword [rbp + 0x38]
lea r8, str.onecore_amcoreoctagoncommon_tpmattestation_attesttpm.cpp
mov edx, 0x4d
call fcn.140023610
nop
mov r9d, eax
lea r8, str.onecore_amcoreoctagoncommon_tpmattestation_attesttpm.cpp
mov edx, 0x5f
call fcn.1400161f4
nop
call fcn.140005e5c
nop
mov rcx, qword [rbp + 0x38]
mov r9d, 0x32
lea r8, str.onecore_amcoreoctagoncommon_tpmattestation_attesttpm.cpp
lea edx, [r9 + 0x36]
call fcn.140023610
int3