Function at 0x14004498c
Capabilities:
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x5a0
mov rax, qword [0x1403b9010]
xor rax, rsp
mov qword [rsp + 0x590], rax
mov rsi, rdx
mov rdi, rcx
mov dword [rsp + 0x70], 0x10000b
movabs rbx, 0x123456789abcdef
mov qword [rsp + 0x510], rbx
movabs rbp, 0xfedcba9876543210
mov qword [rsp + 0x518], rbp
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
cmp qword [rsp + 0x510], rbx
jne 0x140044c43
cmp qword [rsp + 0x518], rbp
jne 0x140044c43
xor ebp, ebp
cmp dword [rdi + 0x18], 2
je 0x140044a24
mov byte [0x1403e51ba], 1
jmp 0x140044a59
cmp byte [rsi + 0x2b], bpl
jne 0x140044a59
cmp dword [rsi + 0x24], 3
jne 0x140044a59
mov edx, 2
xor ecx, ecx
mov r8d, 0xdf
call fcn.140048ff8
cmp eax, 1
jne 0x140044a51
mov eax, 0x80004004
jmp 0x140044c48
test eax, eax
js 0x140044c48
lea rdx, [0x14037e910]
lea rcx, str.COMPLUS_NoGuiFromShim
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp dword [rdi + 0x18], 2
jne 0x140044a86
cmp byte [rsi + 0x2a], bpl
jne 0x140044a86
call fcn.1400499b0
test eax, eax
js 0x140044c48
mov rdx, rsi
mov rcx, rdi
call fcn.140044c7c
test eax, eax
js 0x140044c48
cmp dword [rdi + 0x18], 2
jne 0x140044ac0
cmp byte [rsi + 0x2c], bpl
jne 0x140044aae
cmp byte [rsi + 0x18], bpl
mov cl, bpl
je 0x140044ab0
mov cl, 1
mov edx, dword [rsi + 0x24]
call fcn.140039ebc
test eax, eax
js 0x140044c48
mov eax, dword [rsi + 0x24]
mov dword [rdi + 0x38], eax
mov al, byte [rsi + 0x28]
mov byte [rdi + 0x3e], al
mov eax, dword [rsi + 0x1c]
mov dword [rdi + 0x40], eax
mov rbx, qword [rsi + 0x10]
mov rcx, qword [rdi + 0x30]
cmp rbx, rcx
je 0x140044b06
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
test rbx, rbx
je 0x140044b02
mov rcx, rbx
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rdi + 0x30], rax
test rax, rax
je 0x140044c6f
jmp 0x140044b06
mov qword [rdi + 0x30], rbp
lea r14, [rdi + 0x3c]
movzx eax, word [rsi + 0x32]
mov word [r14], ax
test ax, ax
jne 0x140044b37
cmp qword [rsi + 8], rbp
je 0x140044b2e
mov rcx, r14
call fcn.1400363c0
test eax, eax
jns 0x140044b37
jmp 0x140044c48
mov eax, 0xfb8
mov word [r14], ax
mov ecx, 0x60
call fcn.14005f888
mov r15, rax
mov qword [rsp + 0x30], rax
movzx ebx, word [rsi + 0x34]
mov qword [rax], rbp
mov qword [rax + 8], rbp
mov qword [rax + 0x10], rbp
lea rcx, [rax + 0x18]
lea rax, [0x140034fec]
mov qword [rsp + 0x20], rax
lea r9, [0x140035010]
mov edx, 8
lea r8d, [rdx - 6]
call fcn.14005fb68
nop
mov qword [r15 + 0x28], rbp
mov eax, 0xfb9
test bx, bx
cmovne ax, bx
mov word [r15 + 0x50], ax
setne al
mov byte [r15 + 0x52], al
mov byte [r15 + 0x53], bpl
mov qword [r15 + 0x58], rbp
xorps xmm0, xmm0
movups xmmword [r15 + 0x30], xmm0
movups xmmword [r15 + 0x40], xmm0
mov qword [rdi], r15
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [r15 + 0x10], rax
test rax, rax
jne 0x140044bed
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
test eax, eax
cmovle ecx, eax
mov eax, 0x80004005
test ecx, ecx
cmovns ecx, eax
mov eax, ecx
jmp 0x140044c48
mov ebx, ebp
mov ecx, ebx
add rcx, 3
shl rcx, 4
add rcx, r15
call qword [sym.imp.ole32.dll_CoCreateGuid]
mov ecx, eax
test eax, eax
js 0x140044be9
inc ebx
cmp ebx, 2
jb 0x140044bef
cmp dword [rdi + 0x18], 1
je 0x140044c25
lea rdx, [rdi + 0x20]
mov rcx, qword [rdi]
call fcn.1400365b0
test eax, eax
js 0x140044c48
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140044c3f
lea r8, [rdi + 8]
movzx edx, word [r14]
call fcn.1400410d8
test eax, eax
js 0x140044c48
xor eax, eax
jmp 0x140044c48
mov eax, 0x805e0006
mov rcx, qword [rsp + 0x590]
xor rcx, rsp
call fcn.14005f5e0
mov rbx, qword [rsp + 0x5e0]
add rsp, 0x5a0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x8007000e
call fcn.140034ce8
int3