Function at 0x140003514
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140036150]
xor rax, rsp
mov qword [rbp - 8], rax
xor r14d, r14d
mov qword [rbp - 0x18], rcx
mov esi, r14d
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x10], r14
mov r12d, r14d
mov qword [rbp - 0x30], r14
or rbx, 0xffffffffffffffff
mov r13, rdx
inc rbx
cmp word [rdx + rbx*2], r14w
jne 0x140003559
inc rbx
mov eax, 0xffffffff
cmp rbx, rax
ja 0x14000373f
mov edx, ebx
lea rcx, [rbp - 0x30]
call fcn.140007fe4
mov edi, eax
mov r15d, 0x4000000
test eax, eax
js 0x1400035da
mov r14, qword [rbp - 0x30]
mov r8d, ebx
mov rdx, r14
mov rcx, r13
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
mov r12d, eax
test eax, eax
je 0x140003629
cmp r12d, ebx
jbe 0x140003621
test r14, r14
je 0x1400035c2
lea rcx, [r14 - 8]
call fcn.1400010cc
and qword [rbp - 0x30], rsi
mov rdx, r12
lea rcx, [rbp - 0x30]
mov ebx, r12d
call fcn.140007fe4
mov edi, eax
test eax, eax
jns 0x14000358b
mov r12, rsi
lea r9, str.Failed_to_allocate_memory_for_expand_string:__S
mov qword [rsp + 0x20], r13
mov r8d, 1
mov edx, edi
mov ecx, r15d
call fcn.1400066ac
mov r14, qword [rbp - 0x30]
test r14, r14
je 0x140003608
lea rcx, [r14 - 8]
call fcn.1400010cc
xor r14d, r14d
mov ebx, edi
test edi, edi
js 0x140003763
mov edi, 0x104
mov edx, edi
jmp 0x1400036ac
mov r12, r14
xor r14d, r14d
jmp 0x1400035fa
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
test eax, eax
jle 0x140003644
movzx edi, ax
or edi, 0x80070000
test edi, edi
mov qword [rsp + 0x20], r13
mov eax, 0x80004005
lea r9, [0x140019360]
cmovns edi, eax
mov r8d, 1
mov edx, edi
mov ecx, r15d
call fcn.1400066ac
mov r12, rsi
jmp 0x1400035fa
mov rsi, qword [rbp - 0x28]
lea r9, [rbp - 0x10]
mov r8, rsi
mov edx, edi
mov rcx, r12
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFullPathNameW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x140003701
cmp ebx, edi
jbe 0x1400036db
mov edi, ebx
test rsi, rsi
je 0x1400036a9
lea rcx, [rsi - 8]
call fcn.1400010cc
mov qword [rbp - 0x28], r14
mov rdx, rbx
lea rcx, [rbp - 0x28]
call fcn.140007fe4
mov ebx, eax
test eax, eax
jns 0x14000366f
lea r9, str.Failed_allocating_buffer_for_path_expansion
mov r8d, 1
mov edx, eax
mov ecx, r15d
call fcn.1400066ac
mov rsi, qword [rbp - 0x28]
jmp 0x14000377f
mov rcx, qword [rbp - 0x18]
mov rdx, rsi
call fcn.140008700
mov ebx, eax
test eax, eax
jns 0x14000377f
mov qword [rsp + 0x20], rsi
lea r9, str.Failed_allocating_memory_for_full_directory_path__S
mov edx, eax
jmp 0x140003771
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14000371c
movzx ebx, ax
or ebx, 0x80070000
test ebx, ebx
lea r9, str.Failed_getting_the_full_path_name
mov eax, 0x80004005
mov r8d, 1
cmovns ebx, eax
mov ecx, r15d
mov edx, ebx
call fcn.1400066ac
jmp 0x14000377f
mov edi, 0x80070216
lea r9, str.Failed_to_convert_from_size_t_to_DWORD
mov r15d, 0x4000000
mov edx, edi
mov ecx, r15d
mov r8d, 1
call fcn.1400066ac
mov ebx, edi
mov qword [rsp + 0x20], r13
lea r9, [0x140019360]
mov edx, edi
mov r8d, 1
mov ecx, r15d
call fcn.1400066ac
test r12, r12
je 0x14000378e
lea rcx, [r12 - 8]
call fcn.1400010cc
test rsi, rsi
je 0x14000379c
lea rcx, [rsi - 8]
call fcn.1400010cc
mov eax, ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140001450
mov rbx, qword [rsp + 0xb0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret