Function at 0x140016eb8
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x14007b108]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor edi, edi
mov qword [rbp - 0x38], r8
mov r14d, edx
mov rsi, rcx
test rcx, rcx
je 0x140017192
cmp qword [rcx + 0x40], rdi
mov rax, rcx
cmovne rax, qword [rcx + 0x40]
mov r13d, dword [rax + 0x24]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
lea edx, [rdi + 8]
lea r8d, [rdi + 0x38]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rbx, rax
test rax, rax
jne 0x140016f50
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
mov ebx, 0x80070000
movzx eax, ax
or eax, ebx
test ecx, ecx
cmovle eax, ecx
test eax, eax
jmp 0x1400171af
lea rdx, [rax + 0x28]
mov qword [rax], rsi
lea rcx, [rax + 0x24]
mov r8, rsi
call fcn.140007540
mov r15d, 1
cmp r14d, r15d
ja 0x140016f7e
mov rcx, rsi
call fcn.1400076f4
test eax, eax
je 0x140017172
xorps xmm0, xmm0
mov dword [rbx + 0x2c], r14d
mov edi, 0x80
lea rdx, [rbp - 0x30]
lea rcx, str.WIM_MetaData_Queue_Length
movups xmmword [rbp - 0x30], xmm0
lea r12d, [rdi - 0x70]
mov r8d, r12d
movups xmmword [rbp - 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
mov dword [rbp - 0x40], eax
dec eax
cmp eax, 0xf
ja 0x140016fdb
lea r8, [rbp - 0x40]
lea rdx, [0x14006e0ec]
lea rcx, [rbp - 0x30]
call qword [sym.imp.msvcrt.dll_swscanf_s]
nop dword [rax + rax]
test eax, eax
cmovg edi, dword [rbp - 0x40]
lea rax, [rbx + 8]
mov r9d, edi
mov r8d, r15d
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rsi
call fcn.140006b60
mov edi, eax
test eax, eax
jns 0x140017005
mov r8d, 0xfa8
jmp 0x1400170cc
xorps xmm0, xmm0
lea rdx, [rbp - 0x30]
mov r8d, r12d
lea rcx, str.WIM_FileData_Queue_Length
movups xmmword [rbp - 0x30], xmm0
mov edi, 0x400
movups xmmword [rbp - 0x20], xmm0
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
mov dword [rbp - 0x40], eax
dec eax
cmp eax, 0xf
ja 0x14001705a
lea r8, [rbp - 0x40]
lea rdx, [0x14006e0ec]
lea rcx, [rbp - 0x30]
call qword [sym.imp.msvcrt.dll_swscanf_s]
nop dword [rax + rax]
test eax, eax
cmovg edi, dword [rbp - 0x40]
mov r8d, r12d
lea rdx, [rbp - 0x30]
lea rcx, str.WIM_FileData_Number_Workers
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
mov dword [rbp - 0x40], eax
dec eax
cmp eax, 0xf
ja 0x1400170a0
lea r8, [rbp - 0x40]
lea rdx, [0x14006e0ec]
lea rcx, [rbp - 0x30]
call qword [sym.imp.msvcrt.dll_swscanf_s]
nop dword [rax + rax]
test eax, eax
cmovg r15d, dword [rbp - 0x40]
mov edx, r13d
lea r12, [rbx + 0x10]
shr edx, 0xc
mov r9d, edi
and edx, 4
mov qword [rsp + 0x20], r12
mov r8d, r15d
mov rcx, rsi
call fcn.140006b60
mov edi, eax
test eax, eax
jns 0x1400170ed
mov r8d, 0xfca
mov r9d, eax
lea rcx, str.CreateRestoreInfo
call fcn.1400064e0
mov rdx, rbx
mov rcx, rsi
call fcn.140016e4c
mov eax, edi
jmp 0x1400171d0
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
nop dword [rax + rax]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
nop dword [rax + rax]
mov rcx, qword [r12]
lea edx, [r14 - 1]
mov rcx, qword [rcx + 0x38]
call qword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
nop dword [rax + rax]
bt r13d, 0xc
jae 0x14001716a
mov ecx, 4
lea rax, [rbx + 0x18]
cmp r14d, ecx
mov qword [rsp + 0x20], rax
cmova r14d, ecx
xor edx, edx
lea r9d, [rcx + 6]
mov r8d, r14d
mov rcx, rsi
call fcn.140006b60
mov edi, eax
test eax, eax
jns 0x140017172
mov r9d, eax
lea rcx, str.CreateRestoreInfo
mov r8d, 0xfdb
call fcn.1400064e0
test edi, edi
js 0x1400170db
mov eax, dword [0x14007ba38]
and dword [rbx + 0x34], 0
mov dword [rbx + 0x30], eax
mov rax, qword [rbp - 0x38]
mov qword [rax], rbx
mov qword [rsi + 0xf0], rbx
jmp 0x1400170e6
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
mov ebx, 0x80070000
or ecx, ebx
test eax, eax
cmovle ecx, eax
test ecx, ecx
jns 0x1400171c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ecx, ax
or ecx, ebx
test eax, eax
cmovle ecx, eax
jmp 0x1400171ce
mov ecx, 0x80004005
mov eax, ecx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140068870
mov rbx, qword [rsp + 0xc8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret