Function at 0x180005b00
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov r9d, dword [rsp + 0x58]
mov rbx, rcx
xor edi, edi
xor ecx, ecx
xor r8d, r8d
mov qword [rsp + 0x20], rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_ReadConsoleOutputAttribute]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_HeapSize]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_QueryUnbiasedInterruptTime]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalFlags]
call qword [sym.imp.KERNEL32.dll_CreateTimerQueue]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DlgDirSelectComboBoxExW]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDlgCtrlID]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetThreadExecutionState]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_PowerCreateRequest]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetNumaNodeProcessorMask]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_SwitchToThisWindow]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_InterlockedFlushSList]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessWorkingSetSize]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_DdeCmpStringHandles]
mov dword [rsp + 0x38], edi
xor r9d, r9d
mov dword [rsp + 0x30], edi
xor r8d, r8d
mov qword [rsp + 0x28], rdi
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.USER32.dll_PrivateExtractIconsW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnableMouseInPointer]
call qword [sym.imp.USER32.dll_SetProcessDPIAware]
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov qword [rsp + 0x28], rdi
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], edi
xor ecx, ecx
call qword [sym.imp.USER32.dll_TrackPopupMenu]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_AddScopedPolicyIDAce]
call qword [sym.imp.KERNEL32.dll_FlushProcessWriteBuffers]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor edx, edx
lea r8, str.Zxl8u8nNdRT2cijoz1AxtPPx2PK
lea rcx, str.ocb5yl5KkWRznKnPA
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetProcessIoCounters]
xor ecx, ecx
call qword [sym.imp.USER32.dll_UnloadKeyboardLayout]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_CalculatePopupWindowPosition]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CallbackMayRunLong]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
xor r9d, r9d
mov dword [rsp + 0x20], edi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MsgWaitForMultipleObjectsEx]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetSubMenu]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_IsValidLanguageGroup]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetFinalPathNameByHandleW]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CopyIcon]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_MapWindowPoints]
mov ecx, 0x3968
inc ecx
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea edx, [rdx + rdx*2]
cmp ecx, edx
jne 0x180005cd0
lea eax, [rcx + rcx]
cmp eax, 0x72d2
jne 0x180005d06
cmp ecx, 0x3969
jne 0x180005d06
mov eax, dword [rbx]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov rbx, qword [rsp + 0x50]
mov eax, 1
add rsp, 0x40
pop rdi
ret