Function at 0x140003920
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x100]
sub rsp, 0x200
lea rcx, str.TEMP
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
lea rcx, str.USERPROFILE
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rbx, rbx
je 0x140003b59
test rax, rax
je 0x140003b59
mov r9, rbx
lea r8, str._s_auth.txt
mov edx, 0x104
lea rcx, [rbp - 0x10]
call fcn.140002d90
test eax, eax
jns 0x1400039d8
lea rcx, [rbp + 0x110]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea rdx, [rbp + 0x110]
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
lea r9, [rsp + 0x38]
mov edx, 0x14
lea r8, str._Y__m__d__H:_M:_S
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
lea rdx, [rsp + 0x20]
lea rcx, str.ERROR
call fcn.140003590
lea rdx, str.Failed_to_create_absolute_path
jmp 0x140003bac
lea rdx, [0x140060000]
lea rcx, str.C:HyperV.ini
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
test rax, rax
jne 0x140003a49
lea rcx, [rbp + 0x110]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea rdx, [rbp + 0x110]
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
lea r9, [rsp + 0x38]
mov edx, 0x14
lea r8, str._Y__m__d__H:_M:_S
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
lea rdx, [rsp + 0x20]
lea rcx, str.ERROR
call fcn.140003590
lea rdx, str.401_Unauthorized
jmp 0x140003bac
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rdx, [rbp - 0x48]
lea rcx, [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
je 0x140003abc
lea rcx, [rbp + 0x110]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea rdx, [rbp + 0x110]
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
lea r9, [rsp + 0x38]
mov edx, 0x14
lea r8, str._Y__m__d__H:_M:_S
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
lea rdx, [rsp + 0x20]
lea rcx, str.ERROR
call fcn.140003590
lea rdx, str.Error:_Unable_to_connect_with_authorization_system_n
jmp 0x140003bac
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x70]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
lea r9, [rbp - 0x70]
mov edx, 0x14
lea r8, str._Y__m__d__H:_M:_S
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov ebx, eax
xor ecx, ecx
mov eax, 0x68db8bad
imul ebx
sar edx, 0xc
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x2710
sub ebx, eax
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov r9d, ebx
lea rdx, str._ld__d
mov r8, rax
lea rcx, [rsp + 0x78]
call fcn.140003f70
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x78]
call fcn.140003590
lea rcx, [0x1400c7710]
call fcn.14000b180
call fcn.140052070
mov eax, dword [rax + 0x70]
mov rbx, qword [rsp + 0x218]
add rsp, 0x200
pop rbp
ret
lea rcx, [rbp + 0x110]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
lea rdx, [rbp + 0x110]
lea rcx, [rsp + 0x38]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
lea r9, [rsp + 0x38]
mov edx, 0x14
lea r8, str._Y__m__d__H:_M:_S
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
lea rdx, [rsp + 0x20]
lea rcx, str.ERROR
call fcn.140003590
lea rdx, str.Failed_to_retrieve_environment_variables.
lea rcx, [0x14005ff74]
call fcn.140002d30
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbx, qword [rsp + 0x218]
mov eax, 1
add rsp, 0x200
pop rbp
ret