Function at 0x140001a20
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x1ff50]
mov eax, 0x20050
call fcn.14001a5e0
sub rsp, rax
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x20090], rbx
mov qword [rsp + 0x20098], rsi
mov rax, qword [0x14002b460]
xor rax, rsp
mov qword [rbp + 0x1ff40], rax
mov rsi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
mov r12d, 8
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
or r15, 0xffffffffffffffff
xor r14d, r14d
mov eax, dword [r12 + rdi]
cmp dword [0x14002db30], eax
jle 0x140001ae7
lea rcx, [0x14002db30]
call fcn.140011850
cmp dword [0x14002db30], r15d
jne 0x140001ae7
call fcn.140006704
mov rcx, rax
test rax, rax
je 0x140001e02
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x14002db38], rax
lea rcx, [0x140021934]
call fcn.140011bd0
lea rcx, [0x14002db30]
call fcn.1400117a0
mov eax, dword [r12 + rdi]
cmp dword [0x14002db40], eax
jle 0x140001b42
lea rcx, [0x14002db40]
call fcn.140011850
cmp dword [0x14002db40], r15d
jne 0x140001b42
call fcn.140006704
mov rcx, rax
test rax, rax
je 0x140001df7
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x14002db48], rax
lea rcx, [0x140021908]
call fcn.140011bd0
lea rcx, [0x14002db40]
call fcn.1400117a0
lea r12, str._programfiles_
cmp dword [0x14002b488], r14d
je 0x140001c33
call fcn.140001850
test eax, eax
je 0x140001c33
mov dword [0x14002b488], r14d
mov rdx, r12
lea rcx, [rsp + 0x30]
call fcn.140001a20
nop
mov rdx, rax
lea rcx, [0x14002db38]
call fcn.140005114
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140001ba9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
lea rdx, str._commonprogramfiles_
lea rcx, [rsp + 0x28]
call fcn.140001a20
nop
mov rdx, rax
lea rdi, [0x14002db48]
mov rcx, rdi
call fcn.140005114
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140001bef
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
lea rcx, [0x14002db38]
call fcn.140004db8
lea r8, [0x140024d74]
lea rdx, str.__x86_
lea rcx, [0x14002db38]
call fcn.140004e30
mov rcx, rdi
call fcn.140004db8
lea r8, [0x140024d74]
lea rdx, str.__x86_
mov rcx, rdi
call fcn.140004e30
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.140005224
nop
call fcn.140001980
test eax, eax
je 0x140001c8c
lea rcx, [rsp + 0x20]
call fcn.140004db8
mov r8, qword [0x14002db38]
cmp dword [r8 - 0x10], r14d
je 0x140001c6e
mov rdx, r12
lea rcx, [rsp + 0x20]
call fcn.140004e30
mov r8, qword [0x14002db48]
cmp dword [r8 - 0x10], r14d
je 0x140001c8c
lea rdx, str._commonprogramfiles_
lea rcx, [rsp + 0x20]
call fcn.140004e30
mov word [rsp + 0x40], r14w
mov esi, 0x8000
mov r8d, esi
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, 0x25
mov edx, edi
lea rcx, [rsp + 0x40]
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
je 0x140001d9a
mov edx, edi
lea rcx, [rax + 2]
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
je 0x140001d9a
lea rcx, [rsp + 0x40]
mov rax, r15
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140001ce2
mov r8d, eax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.14000580c
call fcn.140001980
test eax, eax
je 0x140001d49
lea rcx, [rsp + 0x20]
call fcn.140004db8
mov r8, qword [0x14002db38]
cmp dword [r8 - 0x10], r14d
je 0x140001d2b
mov rdx, r12
lea rcx, [rsp + 0x20]
call fcn.140004e30
mov r8, qword [0x14002db48]
cmp dword [r8 - 0x10], r14d
je 0x140001d49
lea rdx, str._commonprogramfiles_
lea rcx, [rsp + 0x20]
call fcn.140004e30
mov word [rbp + 0xff40], r14w
mov r8d, esi
lea rdx, [rbp + 0xff40]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rbp + 0xff40]
mov rcx, rbx
call fcn.140005224
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
mov ecx, r15d
lock xadd dword [rdx + 0x10], ecx
add ecx, r15d
test ecx, ecx
jg 0x140001dc9
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rVariantCopy + 8]
jmp 0x140001dc9
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140005224
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140001dc9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rax, rbx
mov rcx, qword [rbp + 0x1ff40]
xor rcx, rsp
call fcn.14001a4a0
lea r11, [rsp + 0x20050]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov ecx, 0x80004005
call fcn.140006934
int3
mov ecx, 0x80004005
call fcn.140006934
int3