Function at 0x140031b20
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x60
mov r12, r8
lea rsi, [rsp + 0x88]
mov r15, rdx
lea r8, [fcn.14004b890]
mov r13, rcx
lea rdx, [rsp + 0x48]
add rsi, 0xfffffffffffffff8
mov edi, r9d
mov rcx, rsi
call fcn.140029110
lea r8, [0x1400324c0]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.140029110
mov ebx, dword [rsp + 0xb8]
xor ebp, ebp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbp
test ebx, ebx
je 0x140031bbe
call qword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
mov ecx, eax
lea rdx, [rsp + 0x58]
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
jne 0x140031bbe
lea rdx, str.failed_getting_active_user_token
mov ecx, 0x480003
call fcn.14002d450
jmp 0x140031dfa
test r12, r12
je 0x140031bcb
cmp qword [r12], rbp
cmove r12, rbp
mov edx, 1
mov rcx, r12
call fcn.1400324f0
test eax, eax
je 0x140031bfa
mov rax, qword gs:[0x58]
lea rdx, str.invalid_redir:__s
mov r8d, 0x1690
add r8, qword [rax]
jmp 0x140031de2
test r15, r15
je 0x140031c06
cmp qword [r15], rbp
cmove r15, rbp
test edi, edi
je 0x140031d89
test r15, r15
jne 0x140031c38
test ebx, ebx
je 0x140031d89
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x40]
xor r8d, r8d
call sub.USERENV.dll_CreateEnvironmentBlock
test eax, eax
jne 0x140031c49
mov qword [rsp + 0x40], rbp
jmp 0x140031c9a
test ebx, ebx
jne 0x140031c1b
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov qword [rsp + 0x40], rax
jmp 0x140031c4e
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x140031c9a
cmp word [rax], bp
je 0x140031c9a
mov rdx, rax
mov rcx, rsi
call fcn.140029560
mov rcx, qword [rsp + 0x48]
xor r8d, r8d
mov rdx, qword [rax]
call fcn.14004add0
mov rcx, qword [rsp + 0x40]
or rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], bp
jne 0x140031c80
inc rax
lea rax, [rcx + rax*2]
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x140031c53
test r15, r15
je 0x140031d81
mov qword [rsp + 0x90], r14
nop dword [rax + rax]
mov rdi, qword [r15]
test rdi, rdi
je 0x140031d79
mov r14, qword [rsp + 0x48]
xor bpl, bpl
cmp qword [r14], 0
jne 0x140031cd2
mov rcx, r14
call fcn.14004b8f0
mov edx, 0x3d
mov rcx, rdi
call fcn.140174c6c
mov rcx, rax
test rax, rax
je 0x140031ceb
sub ecx, edi
jmp 0x140031cfe
or rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rdi + rax], 0
jne 0x140031cf0
mov ecx, eax
mov bpl, 1
mov rbx, qword [r14]
mov rax, qword [rbx]
test rax, rax
je 0x140031d5c
movsxd rsi, ecx
nop dword [rax]
mov r8, rsi
mov rdx, rdi
mov rcx, rax
call fcn.14017dd80
test eax, eax
jne 0x140031d2b
mov rax, qword [rbx]
cmp byte [rsi + rax], 0x3d
je 0x140031d38
mov rax, qword [rbx + 8]
add rbx, 8
test rax, rax
jne 0x140031d10
test rax, rax
je 0x140031d5c
test bpl, bpl
jne 0x140031d4f
mov rdx, rdi
mov rcx, rbx
call fcn.14002a280
jmp 0x140031d6f
mov rdx, rbx
mov rcx, r14
call fcn.14004b840
jmp 0x140031d6f
test bpl, bpl
jne 0x140031d6f
xor r8d, r8d
mov rdx, rdi
mov rcx, r14
call fcn.14004add0
add r15, 8
jne 0x140031cb0
mov r14, qword [rsp + 0x90]
mov rax, qword [rsp + 0x48]
mov r15, qword [rax]
mov rcx, qword [rsp + 0x50]
xor r8d, r8d
mov rdx, r13
call fcn.140049b30
mov rax, qword [rsp + 0x58]
mov r9, r12
mov rcx, qword [rsp + 0x50]
mov r8, r15
mov qword [rsp + 0x30], rax
xor edx, edx
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x28], eax
mov rcx, qword [rcx]
mov dword [rsp + 0x20], 1
call fcn.140032050
mov rbx, rax
test rax, rax
jne 0x140031dee
mov r8, qword [rsp + 0x50]
lea rdx, str.failed_CreateProcess__s_:__m
mov r8, qword [r8]
mov ecx, 0x480003
call fcn.14002d450
mov ebx, eax
lea rcx, [rsp + 0x58]
call fcn.1400538e0
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret