Function at 0x180031c3c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
jne 0x180031c6a
xor eax, eax
jmp 0x180031f54
cmp word [rdx], 0x25
jne 0x180031f11
mov r12d, 0x5c
mov rcx, rbx
mov edx, r12d
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
je 0x180031f11
lea rcx, [rbx + 2]
lea r8d, [r12 - 0x4c]
lea rdx, [rsp + 0x68]
call qword [sym.imp.msvcrt.dll_wcstoul]
mov rcx, qword [rsp + 0x68]
mov r15d, eax
cmp word [rcx], r12w
je 0x180031d0f
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebp, eax
test eax, eax
je 0x180031c63
mov r8d, ebp
lea edx, [r12 - 0x54]
mov rcx, rsi
add r8, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x180031c63
mov r8d, ebp
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, ebp
ja 0x180031cfc
test eax, eax
jne 0x180031e00
mov r8, rdi
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180031c63
lea rcx, str.Shlwapi.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbp, rax
test rax, rax
je 0x180031c63
lea rdx, str.PathAppendW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
test rax, rax
jne 0x180031d4e
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x180031c63
lea rcx, str.Shell32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov r12, rax
test rax, rax
je 0x180031d40
lea rdx, str.SHGetFolderPathW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r13, rax
test rax, rax
jne 0x180031d86
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x180031d40
mov edx, 8
mov r8d, 0x800
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x180031c63
xor r9d, r9d
xor r8d, r8d
mov edx, r15d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call r13
test eax, eax
je 0x180031dcd
mov r8, rdi
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180031d7b
mov edx, 0x5c
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcschr]
mov rcx, rdi
mov rdx, rax
call r14
test eax, eax
je 0x180031dbd
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r12d, 0x5c
mov edx, 0x7e
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcschr]
test rax, rax
je 0x180031ef5
mov edx, 8
mov r8d, 0x800
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x180031cfc
mov edx, r12d
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcslen]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.msvcrt.dll_wcslen]
mov rdx, rdi
sub rax, rbx
mov rcx, rbp
mov r8, rax
call qword [sym.imp.msvcrt.dll_wcsncpy]
mov edx, 8
mov r8d, 0x800
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
test rax, rax
jne 0x180031e99
mov r8, rbp
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180031cfc
mov r8d, 0x800
mov rdx, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jne 0x180031ebf
mov r8, rbx
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180031e86
mov edx, r12d
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_wcsrchr]
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.msvcrt.dll_wcscat]
mov r8, rbp
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, rdi
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180031ef8
mov rbx, rdi
lea rdx, [0x18003a400]
mov r8, rbx
mov ecx, 0x3b4
call fcn.180030818
mov rax, rbx
jmp 0x180031f54
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcslen]
mov edx, 8
mov rcx, rsi
lea r8, [rax + rax + 2]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
je 0x180031c63
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcslen]
mov rdx, rbx
mov rcx, rdi
mov r8, rax
call qword [sym.imp.msvcrt.dll_wcsncpy]
mov rax, rdi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret