Function at 0x1400365dc
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov r14, rdx
mov rbx, rcx
mov rax, qword [rcx]
call qword [rax]
mov rdx, r14
mov rcx, rbx
call fcn.1400367a8
mov rcx, qword [rbx + 0x50]
call qword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
xor ebp, ebp
test eax, eax
setne byte [rsp + 0x40]
call fcn.140002dfc
mov rcx, rax
test rax, rax
je 0x140036702
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x50], rbx
mov edi, 0x208
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x14003665e
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.1400028a0
mov rbx, qword [rsp + 0x50]
mov r8d, edi
mov rdx, rbx
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esi, eax
test eax, eax
jne 0x140036687
xor r8d, r8d
mov edx, 0x80004005
lea rcx, str.Error_while_expanding_environment_variables.
call fcn.140032190
cmp esi, edi
jbe 0x140036693
mov edi, esi
test esi, esi
js 0x14003670d
jmp 0x14003663c
movsxd rdx, dword [rbx - 0xc]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
test eax, eax
js 0x14003670d
cmp eax, dword [rbx - 0xc]
jg 0x14003670d
mov dword [rbx - 0x10], eax
cdqe
mov word [rbx + rax*2], bp
lea rdx, [rsp + 0x50]
mov rcx, r14
call fcn.140009900
nop
lea rdx, [rbx - 0x18]
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400366db
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
cmp byte [rsp + 0x40], bpl
je 0x1400366e8
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, r14
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
jmp 0x14003716c
mov ecx, 0x80004005
call fcn.140002fa4
nop
mov ecx, 0x80070057
call fcn.140002fa4
int3
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x48
mov rsi, rcx
xor edi, edi
mov rdx, qword [rcx]
cmp dword [rdx - 0x10], edi
jle 0x1400373ce
or r15d, 0xffffffff
test edi, edi
js 0x1400373ce
cmp edi, dword [rdx - 0x10]
jg 0x1400373ce
movsxd rax, edi
lea rcx, [rdx + rax*2]
lea rdx, [0x14007a310]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rbx, rax
test rax, rax
je 0x1400373ce
mov rcx, qword [rsi]
sub rbx, rcx
sar rbx, 1
test ebx, ebx
js 0x1400373ce
lea r14d, [rbx + 2]
cmp r14d, dword [rcx - 0x10]
jg 0x1400373ce
movsxd rax, r14d
lea rcx, [rcx + rax*2]
lea rdx, [0x14007a318]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
mov rdi, rax
test rax, rax
je 0x1400373ce
sub rdi, qword [rsi]
sar rdi, 1
test edi, edi
js 0x1400373ce
mov r9d, edi
sub r9d, ebx
sub r9d, 2
mov r8d, r14d
lea rdx, [rbp + 0x38]
mov rcx, rsi
call fcn.140009428
nop
lea rdx, [0x14007a318]
lea rcx, [rbp + 0x48]
call fcn.140009580
nop
lea r8, str._t_n_v_f_r
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.1400315dc
mov rdx, qword [rax]
mov rcx, qword [rbp + 0x38]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcspbrk]
mov rbx, rax
test rax, rax
jne 0x140037267
mov ebx, r15d
jmp 0x14003726e
sub rbx, qword [rbp + 0x38]
sar rbx, 1
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14003728f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400372af
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test ebx, ebx
jns 0x14003739f
lea r8, [rbp + 0x38]
lea rdx, [0x14007a330]
lea rcx, [rbp - 0x18]
call fcn.14003151c
nop
lea r8, [0x14007a330]
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.1400315dc
mov rbx, rax
lea r8, [rbp + 0x38]
lea rdx, [0x14007a310]
lea rcx, [rbp - 0x28]
call fcn.14003151c
nop
lea r8, [0x14007a318]
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.1400315dc
nop
mov r8, qword [rbx]
mov rdx, qword [rax]
mov rcx, rsi
call fcn.140037a20
nop
mov rdx, qword [rbp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14003733b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14003735c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x20]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x14003737d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400373a2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x1400373a2
mov edi, r14d
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
add eax, r15d
test eax, eax
jg 0x1400373c2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rdx, qword [rsi]
cmp edi, dword [rdx - 0x10]
jl 0x140037191
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret