Function at 0x14004fd40
Capabilities:
Query environment variable

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2c0]
sub rsp, 0x3c0
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x400], rbx
mov rax, qword [0x1400c9158]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
mov rsi, rdx
mov rdi, rcx
xor r14d, r14d
mov qword [rdx], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 0x41
mov word [rsp + 0x60], r14w
lea r15, fcn.140019f80
mov qword [rsp + 0x48], r15
lea rax, [0x14008bba0]
mov qword [rsp + 0x40], rax
mov dword [rbp - 0x18], r14d
mov qword [rbp - 0x10], r14
mov qword [rsp + 0x20], r14
mov r9d, 0x20019
lea r8, str.SOFTWAREMicrosoftWindows_Search
mov rdx, 0xffffffff80000002
lea rcx, [rsp + 0x40]
call fcn.140013ea0
mov ebx, eax
test eax, eax
jns 0x14004fe07
mov rcx, qword [rbp + 0x2e8]
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
mov edx, 0x88e
call fcn.1400069dc
jmp 0x140050052
lea rax, [rbp + 0x18]
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], 0x41
mov word [rbp + 0x18], r14w
mov qword [rbp], r15
lea r8, [rbp]
lea rdx, str.DataDirectory
lea rcx, [rsp + 0x40]
call fcn.140013fe0
test eax, eax
jne 0x14004fe58
mov rcx, qword [rbp + 0x2e8]
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
mov edx, 0x891
call fcn.1400489d0
mov ebx, eax
jmp 0x140050048
cmp dword [rbp + 0x14], 0
ja 0x14004fe83
mov rcx, qword [rbp + 0x2e8]
mov ebx, 0x8000ffff
mov r9d, ebx
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
mov edx, 0x892
call fcn.1400069dc
jmp 0x140050048
mov r8d, 0x104
lea rdx, [rbp + 0xa0]
mov rcx, qword [rbp + 8]
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
lea ecx, [rax - 1]
cmp ecx, 0x103
jbe 0x14004feca
mov rcx, qword [rbp + 0x2e8]
mov ebx, 0x8007007a
mov r9d, ebx
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
mov edx, 0x895
call fcn.1400069dc
jmp 0x140050048
add eax, 0xfffffffe
cmp word [rbp + rax*2 + 0xa0], 0x5c
je 0x14004ff9c
mov ecx, 0x104
lea rax, [rbp + 0xa0]
cmp word [rax], 0
je 0x14004fef8
add rax, 2
sub rcx, 1
jne 0x14004fee8
mov ebx, 0x80070057
test rcx, rcx
cmovne ebx, r14d
mov eax, 0x104
sub rax, rcx
mov r8, r14
test rcx, rcx
cmovne r8, rax
je 0x14004ff7c
mov ecx, 0x104
sub rcx, r8
lea rdx, [rbp + 0xa0]
lea rdx, [rdx + r8*2]
je 0x14004ff62
lea rax, [r8 + 0x7ffffefa]
add rax, rcx
lea r8, [0x140094bd4]
sub r8, rdx
test rax, rax
je 0x14004ff62
movzx r9d, word [r8 + rdx]
test r9w, r9w
je 0x14004ff62
mov word [rdx], r9w
add rdx, 2
dec rax
sub rcx, 1
jne 0x14004ff41
lea rax, [rdx - 2]
test rcx, rcx
cmovne rax, rdx
mov word [rax], r14w
mov ebx, 0x8007007a
cmovne ebx, r14d
jne 0x14004ff9c
mov rcx, qword [rbp + 0x2e8]
mov r9d, ebx
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
mov edx, 0x899
call fcn.1400069dc
jmp 0x140050048
lea r8, str.ApplicationsWindowsProjectsSystemIndexPropMap
mov edx, 0x104
lea rcx, [rbp + 0xa0]
call fcn.140025314
mov ebx, eax
test eax, eax
jns 0x14004ffd7
mov rcx, qword [rbp + 0x2e8]
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
mov edx, 0x89d
call fcn.1400069dc
jmp 0x140050048
lea rdx, str.CreatePropMapperStorage
mov rcx, rdi
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
test rax, rax
jne 0x140050008
mov rcx, qword [rbp + 0x2e8]
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
mov edx, 0x8a0
call fcn.1400489d0
mov ebx, eax
jmp 0x140050048
mov dword [rsp + 0x30], r14d
mov r8, rsi
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0xa0]
call qword [case.0x140006f84.0]
mov ebx, eax
test eax, eax
jns 0x140050045
mov rcx, qword [rbp + 0x2e8]
mov r9d, eax
lea r8, str.onecoreuap_base_appmodel_search_search_search_service_setup.cxx
mov edx, 0x8a4
call fcn.1400069dc
jmp 0x140050048
mov ebx, r14d
lea rcx, [rbp]
call fcn.1400282a4
nop
lea rcx, [rsp + 0x40]
call fcn.140013e30
mov eax, ebx
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.14002cdb0
mov rbx, qword [rsp + 0x400]
add rsp, 0x3c0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret