Function at 0x14000b780
Capabilities:
Query environment variable
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x48
call fcn.14000b1a0
test eax, eax
jne 0x14000b7aa
call fcn.14000b1b0
test eax, eax
je 0x14000b7c0
lea rax, [0x1401db170]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x6188
jmp 0x14000b7d4
lea rax, [0x140069f80]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x6f20
mov r8d, dword [rsp + 0x68]
mov rdx, qword [rsp + 0x58]
lea rcx, str.Temp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x58]
mov byte [rcx + rax], 0
cmp dword [rsp + 0x24], 0
jne 0x14000b817
mov dword [0x1403a4988], 6
mov eax, 2
jmp 0x14000bcbd
mov eax, dword [rsp + 0x24]
dec eax
mov eax, eax
mov rcx, qword [rsp + 0x58]
movsx eax, byte [rcx + rax]
cmp eax, 0x5c
je 0x14000b85b
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x58]
mov byte [rcx + rax], 0x5c
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x58]
mov byte [rcx + rax], 0
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
mov eax, dword [rsp + 0x68]
mov r8, qword [rsp + 0x58]
mov edx, eax
mov rcx, qword [rsp + 0x60]
call fcn.14003e178
mov r8, qword [rsp + 0x58]
mov edx, 0x104
lea rcx, [0x1403a4bb0]
call fcn.14003e178
mov r8, qword [rsp + 0x58]
mov edx, 0x104
lea rcx, [0x1403a4cc0]
call fcn.14003e178
mov eax, dword [rsp + 0x68]
lea r8, str.DBUtilDrv2.Sys
mov edx, eax
mov rcx, qword [rsp + 0x58]
call fcn.1400412dc
mov eax, dword [rsp + 0x68]
lea r8, str.DBUtilDrv2.inf
mov edx, eax
mov rcx, qword [rsp + 0x60]
call fcn.1400412dc
lea r8, str.DBUtilDrv2.cat
mov edx, 0x104
lea rcx, [0x1403a4bb0]
call fcn.1400412dc
lea r8, str.WdfCoinstaller01009.dll
mov edx, 0x104
lea rcx, [0x1403a4cc0]
call fcn.1400412dc
mov eax, dword [rsp + 0x20]
mov ecx, eax
call fcn.14003df48
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14000b926
mov dword [0x1403a4988], 0xd
mov eax, 5
jmp 0x14000bcbd
mov eax, dword [rsp + 0x20]
mov r8d, eax
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call fcn.14003b080
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
call fcn.140009df0
mov dword [rsp + 0x24], 0
lea r8, [0x1400547e4]
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x38]
call fcn.140041454
test eax, eax
jne 0x14000b995
mov eax, dword [rsp + 0x20]
mov r9, qword [rsp + 0x38]
mov r8d, eax
mov edx, 1
mov rcx, qword [rsp + 0x28]
call fcn.1400417e4
mov dword [rsp + 0x24], eax
mov rcx, qword [rsp + 0x38]
call fcn.140041530
mov rcx, qword [rsp + 0x28]
call fcn.140040b68
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x24], eax
je 0x14000b9bd
mov dword [0x1403a4988], 8
mov eax, 2
jmp 0x14000bcbd
call fcn.14000b1a0
test eax, eax
jne 0x14000b9cf
call fcn.14000b1b0
test eax, eax
je 0x14000b9e5
lea rax, [0x1401da7a0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x9c3
jmp 0x14000b9f9
lea rax, [0x1400695c0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x9bf
mov eax, dword [rsp + 0x20]
mov ecx, eax
call fcn.14003df48
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14000ba25
mov dword [0x1403a4988], 0xd
mov eax, 5
jmp 0x14000bcbd
mov eax, dword [rsp + 0x20]
mov r8d, eax
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call fcn.14003b080
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
call fcn.140009df0
mov dword [rsp + 0x24], 0
lea r8, [0x14005481c]
mov rdx, qword [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.140041454
test eax, eax
jne 0x14000ba94
mov eax, dword [rsp + 0x20]
mov r9, qword [rsp + 0x38]
mov r8d, eax
mov edx, 1
mov rcx, qword [rsp + 0x28]
call fcn.1400417e4
mov dword [rsp + 0x24], eax
mov rcx, qword [rsp + 0x38]
call fcn.140041530
mov rcx, qword [rsp + 0x28]
call fcn.140040b68
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x24], eax
je 0x14000babc
mov dword [0x1403a4988], 8
mov eax, 2
jmp 0x14000bcbd
call fcn.14000b1a0
test eax, eax
jne 0x14000bace
call fcn.14000b1b0
test eax, eax
je 0x14000bae4
lea rax, [0x1401d7f20]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x2876
jmp 0x14000baf8
lea rax, [0x140066d40]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x2876
mov eax, dword [rsp + 0x20]
mov ecx, eax
call fcn.14003df48
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14000bb24
mov dword [0x1403a4988], 0xd
mov eax, 5
jmp 0x14000bcbd
mov eax, dword [rsp + 0x20]
mov r8d, eax
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call fcn.14003b080
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
call fcn.140009df0
mov dword [rsp + 0x24], 0
lea r8, [0x140054820]
lea rdx, [0x1403a4bb0]
lea rcx, [rsp + 0x38]
call fcn.140041454
test eax, eax
jne 0x14000bb95
mov eax, dword [rsp + 0x20]
mov r9, qword [rsp + 0x38]
mov r8d, eax
mov edx, 1
mov rcx, qword [rsp + 0x28]
call fcn.1400417e4
mov dword [rsp + 0x24], eax
mov rcx, qword [rsp + 0x38]
call fcn.140041530
mov rcx, qword [rsp + 0x28]
call fcn.140040b68
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x24], eax
je 0x14000bbbd
mov dword [0x1403a4988], 8
mov eax, 2
jmp 0x14000bcbd
call fcn.14000b1a0
test eax, eax
jne 0x14000bbcf
call fcn.14000b1b0
test eax, eax
je 0x14000bbe5
lea rax, [0x1401e1300]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x1a6678
jmp 0x14000bbf9
lea rax, [0x140070ea0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x167080
mov eax, dword [rsp + 0x20]
mov ecx, eax
call fcn.14003df48
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
jne 0x14000bc25
mov dword [0x1403a4988], 0xd
mov eax, 5
jmp 0x14000bcbd
mov eax, dword [rsp + 0x20]
mov r8d, eax
mov rdx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call fcn.14003b080
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
call fcn.140009df0
mov dword [rsp + 0x24], 0
lea r8, [0x140054824]
lea rdx, [0x1403a4cc0]
lea rcx, [rsp + 0x38]
call fcn.140041454
test eax, eax
jne 0x14000bc96
mov eax, dword [rsp + 0x20]
mov r9, qword [rsp + 0x38]
mov r8d, eax
mov edx, 1
mov rcx, qword [rsp + 0x28]
call fcn.1400417e4
mov dword [rsp + 0x24], eax
mov rcx, qword [rsp + 0x38]
call fcn.140041530
mov rcx, qword [rsp + 0x28]
call fcn.140040b68
mov eax, dword [rsp + 0x20]
cmp dword [rsp + 0x24], eax
je 0x14000bcbb
mov dword [0x1403a4988], 8
mov eax, 2
jmp 0x14000bcbd
xor eax, eax
add rsp, 0x48
ret