Function at 0x14000395c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
xor r12d, r12d
mov r14d, r8d
mov dword [rbp + 0x40], r12d
mov eax, r12d
mov qword [rbp + 0x48], rax
mov rsi, rdx
mov qword [rbp - 0x10], r12
mov r15, rcx
lea edi, [r12 + 0x40]
mov r9d, r12d
test r8b, 1
je 0x140003aa4
mov edx, edi
mov dword [rbp + 0x40], edi
lea rcx, [rbp + 0x48]
call fcn.140004b58
mov ebx, eax
test eax, eax
js 0x140003b98
mov r8d, dword [rbp + 0x40]
mov rcx, rsi
mov rdx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x140003a06
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x108
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov r8d, ebx
lea rcx, str.c:_agent_work36_swix_srclibsdutilpathutil.cpp
call fcn.140005eb4
jmp 0x140003b98
mov r9d, dword [rbp + 0x40]
cmp r9d, eax
jae 0x140003a62
mov edx, eax
lea rcx, [rbp + 0x48]
mov dword [rbp + 0x40], eax
call fcn.140004b58
mov ebx, eax
test eax, eax
js 0x140003b98
mov r8d, dword [rbp + 0x40]
mov rcx, rsi
mov rdx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x140003a49
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x113
jmp 0x1400039da
mov r9d, dword [rbp + 0x40]
cmp r9d, eax
jae 0x140003a62
mov r8d, 0x8007007a
mov edx, 0x118
mov ebx, r8d
jmp 0x1400039f5
cmp eax, 0x104
jbe 0x140003aa0
lea rcx, [rbp + 0x48]
call fcn.140003d48
cmp eax, 0x80070057
mov ebx, eax
cmove ebx, r12d
test ebx, ebx
js 0x140003b98
mov rcx, qword [rbp + 0x48]
lea rdx, [rbp + 0x40]
call fcn.1400052e4
mov ebx, eax
test eax, eax
js 0x140003b98
mov r9d, dword [rbp + 0x40]
mov rax, qword [rbp + 0x48]
test r14b, 2
je 0x140003b79
test rax, rax
mov qword [rbp - 8], r12
mov r14, rsi
lea rcx, [rbp - 0x10]
cmovne r14, rax
cmp r9d, edi
cmova edi, r9d
mov edx, edi
call fcn.140004b58
mov ebx, eax
test eax, eax
js 0x140003b98
mov r8, qword [rbp - 0x10]
lea r9, [rbp - 8]
mov edx, edi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x140003aff
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x139
jmp 0x1400039da
cmp edi, eax
jae 0x140003b5d
cmp eax, 0x104
lea edi, [rax + 7]
lea rcx, [rbp - 0x10]
cmovb edi, eax
mov edx, edi
call fcn.140004b58
mov ebx, eax
test eax, eax
js 0x140003b98
mov r8, qword [rbp - 0x10]
lea r9, [rbp - 8]
mov edx, edi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x140003b46
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x144
jmp 0x1400039da
cmp edi, eax
jae 0x140003b5d
mov r8d, 0x8007007a
mov edx, 0x149
mov ebx, r8d
jmp 0x1400039f5
cmp eax, 0x104
jbe 0x140003b73
lea rcx, [rbp - 0x10]
call fcn.140003d48
mov ebx, eax
test eax, eax
js 0x140003b98
mov rax, qword [rbp - 0x10]
jmp 0x140003b81
mov qword [rbp - 0x10], rax
mov qword [rbp + 0x48], r12
test rax, rax
mov rcx, r15
cmovne rsi, rax
xor r8d, r8d
mov rdx, rsi
call fcn.140004d14
mov ebx, eax
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140003ba6
call fcn.1400052dc
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x140003bb4
call fcn.1400052dc
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret