Function at 0x1800167c0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x310
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov rax, qword [0x180059e80]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov dword [rsp + 0x30], 0
mov edx, 1
lea rcx, [rsp + 0xb8]
call fcn.180014b40
lea rcx, [rsp + 0xb8]
call fcn.180006980
nop
mov edx, 0x100
mov ecx, 0x1000
call fcn.180016220
mov qword [rsp + 0x28], 0
lea rcx, [rsp + 0xb8]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
mov r8d, 0x28
mov edx, eax
lea rcx, [0x180041fb8]
call fcn.180016ec0
mov dword [rsp + 0x38], eax
cmp dword [rsp + 0x38], 0
jl 0x180016891
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0x320]
call fcn.180006870
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0xb8]
call fcn.180011170
mov rax, qword [rsp + 0x320]
jmp 0x180016b18
mov edx, 1
lea rcx, [rsp + 0xd0]
call fcn.180014b40
lea rcx, [rsp + 0xd0]
call fcn.180006980
nop
xor eax, eax
mov word [rsp + 0xf0], ax
lea rax, [rsp + 0xf2]
mov rdi, rax
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov r8d, 0x103
lea rdx, [rsp + 0xf0]
lea rcx, str.USERPROFILE
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jbe 0x180016916
mov r8, 0xffffffffffffffff
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0xb8]
call fcn.180010130
jmp 0x180016ad5
mov r8d, 0x103
lea rdx, [rsp + 0xf0]
lea rcx, str.USERNAME
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jbe 0x1800169cb
lea rcx, str.C:Users
call fcn.180016b40
movzx eax, al
test eax, eax
je 0x180016961
lea rax, str.C:Users
mov qword [rsp + 0x48], rax
jmp 0x18001696d
lea rax, str.C:Documents_and_Settings
mov qword [rsp + 0x48], rax
mov r8, 0xffffffffffffffff
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0xd0]
call fcn.180010130
mov r8, 0xffffffffffffffff
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x88]
call fcn.180006930
nop
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0xb8]
call fcn.180010510
nop
lea rcx, [rsp + 0x88]
call fcn.180011170
jmp 0x180016ad5
lea rcx, str.C:Users
call fcn.180016b40
movzx eax, al
test eax, eax
je 0x1800169ec
lea rax, str.C:Users
mov qword [rsp + 0x40], rax
jmp 0x1800169f8
lea rax, str.C:Documents_and_Settings
mov qword [rsp + 0x40], rax
mov r8, 0xffffffffffffffff
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0xb8]
call fcn.180010130
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0xd0]
call fcn.1800111f0
mov r8, 0xffffffffffffffff
lea rdx, str.User
lea rcx, [rsp + 0x70]
call fcn.180006930
nop
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0xa0]
call fcn.180006870
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x58], rax
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
call fcn.180010510
mov rcx, rax
call fcn.1800072d0
mov rcx, rax
call fcn.180016b40
movzx eax, al
test eax, eax
je 0x180016a97
lea rax, str.User
mov qword [rsp + 0x50], rax
jmp 0x180016aa3
lea rax, str.Default_User
mov qword [rsp + 0x50], rax
mov r8, 0xffffffffffffffff
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0xb8]
call fcn.18000fdf0
nop
lea rcx, [rsp + 0xa0]
call fcn.180011170
nop
lea rcx, [rsp + 0x70]
call fcn.180011170
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0x320]
call fcn.180006870
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0xd0]
call fcn.180011170
nop
lea rcx, [rsp + 0xb8]
call fcn.180011170
mov rax, qword [rsp + 0x320]
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.1800326e0
add rsp, 0x310
pop rdi
ret