Function at 0x140015650
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov r14, rdx
mov rbx, rcx
mov rax, qword [rcx]
call qword [rax]
mov rdx, r14
mov rcx, rbx
call fcn.140021d38
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
xor ebp, ebp
test eax, eax
setne byte [rsp + 0x40]
call fcn.1400027c4
mov rcx, rax
test rax, rax
je 0x140015772
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
mov edi, 0x208
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1400156d2
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.140002b54
mov rbx, qword [rsp + 0x50]
mov r8d, edi
mov rdx, rbx
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, eax
test eax, eax
jne 0x1400156fb
xor r8d, r8d
mov edx, 0x80004005
lea rcx, str.Error_while_expanding_environment_variables.
call fcn.140043d74
cmp esi, edi
jbe 0x140015707
mov edi, esi
test esi, esi
js 0x140015781
jmp 0x1400156b0
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
test eax, eax
js 0x140015781
cmp eax, dword [rbx - 0xc]
jg 0x140015781
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], bp
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.140006324
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14001574e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp byte [rsp + 0x40], bpl
je 0x14001575b
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, r14
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
jmp 0x140015790
mov ecx, 0x80004005
call fcn.1400312f0
nop
jmp 0x140015780
nop
mov ecx, 0x80070057
call fcn.1400312f0
int3
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x48
mov rsi, rcx
xor edi, edi
mov rdx, qword [rcx]
cmp dword [rdx - 0x10], edi
jle 0x1400159f2
or r15d, 0xffffffff
test edi, edi
js 0x1400159f2
cmp edi, dword [rdx - 0x10]
jg 0x1400159f2
movsxd rax, edi
lea rcx, [rdx + rax*2]
lea rdx, [0x14006adcc]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rbx, rax
test rax, rax
je 0x1400159f2
mov rcx, qword [rsi]
sub rbx, rcx
sar rbx, 1
test ebx, ebx
js 0x1400159f2
lea r14d, [rbx + 2]
cmp r14d, dword [rcx - 0x10]
jg 0x1400159f2
movsxd rax, r14d
lea rcx, [rcx + rax*2]
lea rdx, [0x1400789f8]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rdi, rax
test rax, rax
je 0x1400159f2
sub rdi, qword [rsi]
sar rdi, 1
test edi, edi
js 0x1400159f2
mov r9d, edi
sub r9d, ebx
sub r9d, 2
mov r8d, r14d
lea rdx, [rbp + 0x38]
mov rcx, rsi
call fcn.140008c50
lea rdx, [0x1400789f8]
lea rcx, [rbp + 0x48]
call fcn.140002cec
lea r8, str._t_n_v_f_r
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.14001aca0
mov rdx, qword [rax]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcspbrk]
mov rbx, rax
test rax, rax
jne 0x140015889
mov ebx, r15d
jmp 0x140015890
sub rbx, qword [rbp + 0x38]
sar rbx, 1
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400158b1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400158d1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test ebx, ebx
jns 0x1400159c3
lea r8, [rbp + 0x38]
lea rdx, [0x140078a10]
lea rcx, [rbp - 0x18]
call fcn.14000c38c
nop
nop
lea r8, [0x140078a10]
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.14001aca0
mov rbx, rax
lea r8, [rbp + 0x38]
lea rdx, [0x14006adcc]
lea rcx, [rbp - 0x28]
call fcn.14000c38c
nop
lea r8, [0x1400789f8]
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.14001aca0
nop
mov r8, qword [rbx]
mov rdx, qword [rax]
mov rcx, rsi
call fcn.140003390
nop
mov rdx, qword [rbp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14001595f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x140015980
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400159a1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400159c6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400159c6
mov edi, r14d
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400159e6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsi]
cmp edi, dword [rdx - 0x10]
jl 0x1400157b5
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret