Function at 0x180038780
Capabilities:
Query environment variable

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x138]
sub rsp, 0x238
mov rax, qword [0x1800b2220]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov rax, qword [rbp + 0x1a0]
mov ebx, ecx
mov r14, qword [rbp + 0x1b0]
or rsi, 0xffffffffffffffff
mov r12, qword [rbp + 0x1c0]
xor ecx, ecx
mov r13, qword [rbp + 0x1f0]
mov rdi, r8
mov qword [rbp - 0x80], rax
mov r15d, 1
mov rax, qword [rbp + 0x1a8]
mov r8d, 0xc000012f
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0x1b8]
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x1c8]
mov qword [rbp - 0x38], rax
mov rax, qword [rbp + 0x1d0]
mov qword [rbp - 0x58], rax
mov rax, qword [rbp + 0x1d8]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp + 0x1e0]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp + 0x1e8]
mov qword [rbp - 0x68], rax
mov rax, qword [rbp + 0x1f8]
mov qword [rbp - 0x78], rax
mov rax, qword [rbp + 0x200]
mov qword [rbp - 0x60], rax
mov rax, qword [rbp + 0x208]
mov qword [rbp - 0x70], rax
mov rax, qword [rbp + 0x210]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp + 0x218]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x220]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x70], r9
mov qword [rsp + 0x58], rdx
mov qword [rbp - 0x40], 0x100
test rdx, rdx
je 0x180038b9c
cmp ebx, 0xc000011b
je 0x1800388c0
lea eax, [rbx + 0x3ffffed0]
cmp eax, r15d
jbe 0x1800388c0
cmp ebx, r8d
jne 0x180038b9c
mov edx, r8d
mov rcx, r12
call sym.KERNEL32.dll_BaseIsDosApplication
xor ecx, ecx
test eax, eax
je 0x180038e09
mov qword [rsp + 0x28], rcx
lea r8, [rbp - 0x40]
mov qword [rsp + 0x20], rcx
lea rdx, [rbp + 0x20]
mov rcx, qword [rsp + 0x58]
xor r9d, r9d
call qword [sym.imp.ntdll.dll_RtlQueryPackageIdentity]
nop dword [rax + rax]
test eax, eax
jns 0x180038b23
mov rcx, qword [rsp + 0x58]
lea rax, [rbp - 0x50]
mov r9d, 4
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x60]
lea edx, [r9 + 8]
call qword [sym.imp.ntdll.dll_NtQueryInformationToken]
nop dword [rax + rax]
test eax, eax
jns 0x180038922
mov ecx, eax
jmp 0x180038ec7
mov rax, qword gs:[0x60]
mov ecx, dword [rax + 0x2c0]
cmp dword [rsp + 0x60], ecx
je 0x180038b94
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov r8d, 0x208
mov edx, dword [rax]
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov r8d, 0xef
lea rcx, str.SystemRoot
mov rdx, rax
mov rbx, rax
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
mov edi, eax
mov r8, rbx
lea ecx, [rax - 1]
cmp ecx, 0xed
ja 0x180038b6f
mov ecx, 0x104
xor r15d, r15d
mov edx, ecx
cmp word [r8], r15w
je 0x1800389b5
add r8, 2
sub rdx, 1
jne 0x1800389a5
test rdx, rdx
je 0x1800389c2
mov rax, rcx
sub rax, rdx
jmp 0x1800389c5
mov rax, r15
test rdx, rdx
je 0x180038a17
lea rdx, [rbx + rax*2]
sub rcx, rax
je 0x180038a08
lea r8, [rax + 0x7ffffefa]
add r8, rcx
lea rax, str._system32csrstub.exe
sub rax, rdx
test r8, r8
je 0x180038a08
movzx r9d, word [rax + rdx]
test r9w, r9w
je 0x180038a08
mov word [rdx], r9w
dec r8
add rdx, 2
sub rcx, 1
jne 0x1800389e7
test rcx, rcx
lea rax, [rdx - 2]
cmovne rax, rdx
mov word [rax], r15w
call qword [sym.imp.KERNELBASE.dll_KernelBaseGetGlobalData]
nop dword [rax + rax]
mov rcx, qword gs:[0x60]
mov edx, dword [rax]
lea eax, [rdi + 0x119]
mov rcx, qword [rcx + 0x30]
lea r8, [rax + rax]
mov esi, eax
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
nop dword [rax + rax]
mov rdi, rax
test rax, rax
jne 0x180038a7a
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov ecx, 0xc0000017
jmp 0x180038ec7
mov r12, qword [rbp - 0x80]
lea r8, str._ws__d__P__ws
mov r9, rbx
mov rdx, rsi
mov rcx, rdi
mov rax, qword [r12]
mov qword [rsp + 0x28], rax
mov eax, dword [r14]
mov dword [rsp + 0x20], eax
call fcn.180039600
mov rcx, qword gs:[0x60]
mov r8, rbx
xor edx, edx
mov esi, eax
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
test esi, esi
jns 0x180038aec
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov ecx, esi
jmp 0x180038ec7
mov rdx, rdi
lea rcx, [rbp]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeStringEx]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jns 0x180038b2a
mov rcx, qword gs:[0x60]
mov r8, rdi
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov ecx, ebx
jmp 0x180038ec7
mov rcx, r13
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
nop dword [rax + rax]
movups xmm0, xmmword [rbp]
movdqu xmmword [r13], xmm0
mov rcx, qword [r13 + 8]
mov qword [r12], rcx
mov rcx, qword [rsp + 0x70]
mov qword [rcx], r15
mov ecx, dword [r14]
and ecx, 0x404
or ecx, 0xc000000
mov dword [r14], ecx
mov eax, 1
jmp 0x180038ece
mov rcx, qword gs:[0x60]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
nop dword [rax + rax]
mov ecx, 0xc0000103
jmp 0x180038ec7
xor ecx, ecx
mov r8d, 0xc000012f
cmp ebx, 0xc0000020
je 0x180038eaf
cmp ebx, 0xc000011b
je 0x180038e24
cmp ebx, r8d
je 0x180038e09
cmp ebx, 0xc0000130
je 0x180038e24
cmp ebx, 0xc0000131
je 0x180038c02
cmp ebx, 0xc0000267
je 0x180038bfb
cmp ebx, 0xc0000428
jne 0x180038b23
mov ecx, 0x241
call qword [sym.imp.ntdll.dll_RtlSetLastWin32Error]
nop dword [rax + rax]
jmp 0x180038ecc
mov ecx, 0x10fe
jmp 0x180038bea
mov qword [rbp + 0x10], rdi
mov rax, rsi
inc rax
cmp word [rdi + rax*2], cx
jne 0x180038c09
add eax, eax
mov dword [rbp + 0x1c], ecx
lea rcx, [0x180088708]
mov dword [rbp + 0x18], eax
lea r9, [rbp + 0x10]
mov r8d, r15d
lea rdx, [0x1800886f8]
call qword [sym.imp.ntdll.dll_EtwEventWriteNoRegistration]
nop dword [rax + rax]
test dword [r14], 0x2000
jne 0x180038e09
mov rax, qword [rbp - 0x38]
lea r9, [rbp - 0x48]
mov rbx, qword [rsp + 0x58]
lea rdx, [rsp + 0x64]
mov r8, rbx
mov dword [rsp + 0x64], r15d
mov rcx, rdi
mov byte [rax], r15b
lea rax, [rbp - 0x4c]
mov qword [rsp + 0x20], rax
call sym.KERNEL32.dll_CheckElevation
test eax, eax
je 0x180038c81
mov ecx, eax
jmp 0x180038bea
mov rax, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x78]
mov rcx, qword [rax]
call fcn.18003f108
test eax, eax
je 0x180038ecc
mov eax, dword [r14]
mov rdi, qword [rbp - 0x30]
and eax, 0x800
mov rsi, qword [rbp - 0x28]
neg eax
mov r15, qword [rbp - 0x20]
mov r12, qword [rbp - 0x80]
sbb ecx, ecx
and ecx, 0x20
add ecx, 0x20
mov dword [rdi], ecx
mov eax, dword [r14]
mov r9, qword [rbp - 0x18]
mov r8, qword [r12]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x40], r15
mov dword [rsp + 0x38], eax
mov rax, qword [rbp - 0x68]
mov qword [rsp + 0x30], rax
mov rax, qword [rbp - 0x78]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
mov rdx, qword [rax]
call fcn.18003d954
xor edx, edx
mov ebx, eax
test eax, eax
jns 0x180038d4f
mov ecx, eax
call sym.KERNEL32.dll_BaseSetLastNTError
cmp ebx, 0xc0000414
je 0x180038ecc
cmp dword [rdi], 0x20
jne 0x180038ecc
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 5
jne 0x180038ecc
bts dword [r14], 0xb
mov eax, 0x80
mov rbx, qword [rsp + 0x58]
mov ecx, eax
mov dword [rdi], eax
jmp 0x180038cc1
movzx ecx, word [rsi + 0xee]
and ecx, 7
sub ecx, 1
je 0x180038d8a
sub ecx, 1
je 0x180038d80
cmp ecx, 2
mov rcx, qword [rsp + 0x78]
jne 0x180038de6
mov rax, qword [rbp - 0x70]
mov dword [rax], 4
mov rax, qword [rsi + 0x58]
mov qword [rcx], rax
jmp 0x180038de6
mov ecx, 0x15
jmp 0x180038bea
mov rax, qword [rbp - 0x70]
mov r9, r13
mov dword [rax], 1
mov rax, qword [rbp - 0x68]
mov r8d, dword [rdi]
mov edx, dword [rax]
call fcn.18003f7f8
xor edx, edx
test eax, eax
jne 0x180038db5
mov ecx, 0xc0000131
jmp 0x180038ec7
mov rax, qword [rbp - 0x10]
mov rcx, qword [rsp + 0x78]
mov dword [rax], 1
mov rax, qword [r13 + 8]
mov qword [r12], rax
mov rax, qword [rsp + 0x70]
mov qword [rax], rdx
mov eax, dword [r14]
bts eax, 0x1b
and eax, 0xffffffe7
mov dword [r14], eax
or dword [r15 + 0x3c], 0x40
cmp qword [rcx], rdx
jne 0x180038b65
mov rax, qword [rbp - 8]
mov rcx, qword [rbp - 0x58]
mov dword [rax], edx
mov rax, qword [rbp - 0x60]
mov rax, qword [rax + 8]
mov qword [rcx], rax
jmp 0x180038b65
mov edx, ebx
mov rcx, r12
call sym.KERNEL32.dll_BaseIsDosApplication
mov r15d, eax
test eax, eax
jne 0x180038e24
mov ecx, 0xc1
jmp 0x180038bea
lea r8, [rsp + 0x50]
mov rcx, rdi
lea rdx, [rsp + 0x68]
call fcn.180040a0c
xor ecx, ecx
test eax, eax
je 0x180038e58
mov r9d, dword [rsp + 0x50]
lea edx, [rcx + 0x14]
mov r8d, dword [rsp + 0x68]
mov rcx, rdi
call fcn.180040fc8
mov ecx, 0xc0000102
jmp 0x180038ec7
mov qword [rbp + 0x10], rdi
inc rsi
cmp word [rdi + rsi*2], cx
jne 0x180038e5c
mov dword [rbp + 0x1c], ecx
lea r9, [rbp + 0x10]
add esi, esi
lea rcx, [0x180088708]
mov r8d, 1
mov dword [rbp + 0x18], esi
lea rdx, [0x1800886f8]
call qword [sym.imp.ntdll.dll_EtwEventWriteNoRegistration]
nop dword [rax + rax]
mov r9d, dword [rsp + 0x50]
lea edx, [r15 + 0x10]
xor r8d, r8d
mov rcx, rdi
call fcn.180040fc8
mov rcx, r12
call sym.KERNEL32.dll_RaiseInvalid16BitExeError
jmp 0x180038ecc
xor r9d, r9d
mov rcx, rdi
lea edx, [r9 + 0x14]
lea r8d, [r9 + 3]
call fcn.180040fc8
mov ecx, 0xc0000020
call sym.KERNEL32.dll_BaseSetLastNTError
xor eax, eax
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.180024680
add rsp, 0x238
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret