Function at 0x140109e20
Capabilities:
Query environment variable

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x368]
sub rsp, 0x468
mov rax, qword [0x140148058]
xor rax, rsp
mov qword [rbp + 0x350], rax
mov rsi, rcx
mov rdi, r8
mov r14d, edx
mov ebx, 0x206
lea rcx, [rbp + 0x142]
xor r12d, r12d
xor edx, edx
mov r8d, ebx
mov r15, r9
mov word [rbp + 0x140], r12w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x32]
mov r8d, ebx
xor edx, edx
mov word [rsp + 0x30], r12w
call sub.msvcrt.dll_memset
mov ebx, 0x80070057
test rsi, rsi
jne 0x140109ebe
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp rcx, rax
je 0x14010a1ad
test byte [rcx + 0x1c], 1
je 0x14010a1ad
lea edx, [rsi + 0x11]
jmp 0x140109ee7
test rdi, rdi
jne 0x140109efc
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp rcx, rax
je 0x14010a1ad
test byte [rcx + 0x1c], 1
je 0x14010a1ad
lea edx, [rdi + 0x12]
mov rcx, qword [rcx + 0x10]
lea r8, [0x140001318]
call fcn.14000fcb0
jmp 0x14010a1ad
mov r13d, 0x104
cmp dword [rdi], r12d
jne 0x140109fc9
lea r8, [0x140001510]
lea rcx, [rbp + 0x140]
mov r9, rsi
mov edx, r13d
call fcn.1400780b0
mov ebx, eax
test eax, eax
jns 0x140109f55
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp rcx, rax
je 0x14010a1ad
test byte [rcx + 0x1c], 1
je 0x14010a1ad
mov edx, SafeArrayAccessData
jmp 0x14010a174
mov eax, r14d
lea r8, [0x140001588]
lea rdx, [rbp + 0x140]
neg eax
mov r9, rdi
sbb rcx, rcx
neg rcx
add rcx, 0xffffffff80000001
call fcn.1401152e0
test eax, eax
jne 0x140109f86
cmp dword [rdi], r12d
jne 0x140109fc9
mov ebx, 0x90070a02
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp rcx, rax
je 0x14010a1ad
test byte [rcx + 0x1c], 4
je 0x14010a1ad
mov rcx, qword [rcx + 0x10]
lea r8, [0x140001318]
mov edx, reloc.Cabinet.dll_FDICreate
mov r9, rsi
call fcn.14000fcd0
jmp 0x14010a1ad
test r15, r15
je 0x14010a189
mov r8d, r13d
lea rdx, [rsp + 0x30]
test r14d, r14d
je 0x14010a019
lea rcx, [0x140001598]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
dec eax
cmp eax, 0x103
jbe 0x14010a032
call sub.KERNEL32.dll_GetLastError
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14010a1ad
mov ebx, 0x80004005
jmp 0x14010a1ad
lea rcx, [0x14010a1d8]
call sub.KERNEL32.dll_ExpandEnvironmentStringsW
dec eax
cmp eax, 0x103
ja 0x14010a18e
lea rdx, [0x140006370]
lea rcx, [rsp + 0x30]
call fcn.14010ccb4
mov ebx, eax
test eax, eax
jns 0x14010a074
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp rcx, rax
je 0x14010a1ad
test byte [rcx + 0x1c], 1
je 0x14010a1ad
mov edx, reloc.OLEAUT32.dll_SafeArrayUnlock
jmp 0x14010a174
lea rcx, [rsp + 0x30]
mov rdx, rsi
call fcn.14010ccb4
mov ebx, eax
test eax, eax
jns 0x14010a0b2
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp rcx, rax
je 0x14010a1ad
test byte [rcx + 0x1c], 1
je 0x14010a1ad
mov edx, reloc.OLEAUT32.dll_SafeArrayAccessData
jmp 0x14010a174
lea rdx, [0x14010a1f8]
lea rcx, [rsp + 0x30]
call fcn.14010ccb4
mov ebx, eax
test eax, eax
jns 0x14010a0f4
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp rcx, rax
je 0x14010a1ad
test byte [rcx + 0x1c], 1
je 0x14010a1ad
mov edx, reloc.Cabinet.dll_FDIDestroy
jmp 0x14010a174
lea rdx, [0x14010a200]
lea rcx, [rsp + 0x30]
call fcn.14010ccb4
mov ebx, eax
test eax, eax
jns 0x14010a133
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp rcx, rax
je 0x14010a1ad
test byte [rcx + 0x1c], 1
je 0x14010a1ad
mov edx, DispGetParam
jmp 0x14010a174
mov eax, dword [rdi]
lea r9, [rsp + 0x30]
lea r8, [0x14010a218]
mov rdx, r13
mov rcx, r15
mov dword [rsp + 0x20], eax
call fcn.1400780b0
mov ebx, eax
test eax, eax
jns 0x14010a189
mov rcx, qword [0x140148ea8]
lea rax, [0x140148ea8]
cmp rcx, rax
je 0x14010a1ad
test byte [rcx + 0x1c], 1
je 0x14010a1ad
mov edx, DispGetParam
mov rcx, qword [rcx + 0x10]
lea r8, [0x140001318]
mov r9d, ebx
call fcn.14000fd64
jmp 0x14010a1ad
mov ebx, r12d
jmp 0x14010a1ad
call sub.KERNEL32.dll_GetLastError
mov ebx, 0x80004005
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
test ecx, ecx
cmovns ecx, ebx
mov ebx, ecx
mov eax, ebx
mov rcx, qword [rbp + 0x350]
xor rcx, rsp
call fcn.140001000
add rsp, 0x468
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret