Function at 0x18005cfd0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, rdx
mov r9, rdx
mov ebp, 1
lea rdx, str._SYSTEMROOT_
mov r8d, ebp
mov rdi, rcx
call fcn.18000f300
lea ebx, [rbp + 1]
cmp eax, ebx
jne 0x18005d4b8
mov r9, rsi
lea rdx, str._SYSTEMDIRECTORY_
mov r8d, ebx
mov rcx, rdi
call fcn.18000f300
cmp eax, ebx
jne 0x18005d4b8
mov r9, rsi
lea rdx, str._SYSTEMDRIVE_
mov r8d, ebp
mov rcx, rdi
call fcn.18000f300
cmp eax, ebx
jne 0x18005d4b8
mov r9, rsi
lea r8d, [rbp + 5]
lea rdx, str._BOOTDRIVE_
mov rcx, rdi
call fcn.18000f300
cmp eax, ebx
jne 0x18005d4b8
lea ebx, [rbp + 0x24]
xor r13d, r13d
mov edx, ebx
mov rcx, rdi
mov r12d, r13d
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
or rbp, 0xffffffffffffffff
lea r14d, [r13 + 3]
mov r15, rax
test rax, rax
je 0x18005d459
cmp rax, rdi
jb 0x18005d459
mov edx, ebx
lea rcx, [rax + 2]
call qword [sym.imp.msvcrt.dll_wcschr]
nop dword [rax + rax]
mov qword [rsp + 0x98], rax
cmp rax, r15
jbe 0x18005d459
mov r14, rax
lea ebx, [rbp + 2]
sub r14, r15
mov dword [rsp + 0x90], ebx
sar r14, 1
movabs rax, 0x7fffffffffffffff
cmp r14, rax
ja 0x18005d3a8
lea rdx, [r14 + r14]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x18005d3a8
lea r9, [r14 - 1]
mov rdx, r14
lea r8, [r15 + 2]
mov rcx, rax
call qword [sym.imp.msvcrt.dll_wcsncpy_s]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x30]
lea rdx, [r14 - 1]
xor eax, eax
mov word [rcx + r14*2 - 2], ax
mov r14, rcx
call fcn.18005b2d8
xor r8d, r8d
mov qword [rsp + 0x38], rax
test rax, rax
je 0x18005d239
mov r14, r15
mov dword [rsp + 0x90], r8d
sub r14, rdi
mov rcx, rbp
sar r14, 1
inc rcx
cmp word [rax + rcx*2], r8w
jne 0x18005d15c
mov r13, qword [rsp + 0x98]
lea rdx, [rcx + r14]
cmp rdx, r14
jb 0x18005d1a5
mov rax, rbp
inc rax
cmp word [r13 + rax*2 + 2], r8w
jne 0x18005d17a
lea rcx, [rax + rdx]
mov rbx, rbp
cmp rcx, rdx
jb 0x18005d1a8
lea rax, [rcx + 1]
cmp rax, rcx
cmovae rbx, rax
sbb eax, eax
and eax, 0x80070216
jmp 0x18005d1ad
mov rbx, rbp
mov eax, 0x80070216
mov qword [rsi], r8
test eax, eax
js 0x18005d388
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x18005d388
lea rdx, [rbx + rbx]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov qword [rsi], rax
mov rcx, rax
test rax, rax
je 0x18005d388
cmp r15, rdi
je 0x18005d209
mov r9, r14
mov r8, rdi
mov rdx, rbx
call qword [sym.imp.msvcrt.dll_wcsncpy_s]
nop dword [rax + rax]
mov rcx, qword [rsi]
mov r9, qword [rsp + 0x38]
lea rax, [r13 + 2]
sub rbx, r14
mov qword [rsp + 0x20], rax
mov rdx, rbx
lea rcx, [rcx + r14*2]
lea r8, [0x18007a7e8]
call qword [sym.imp.msvcrt.dll_swprintf_s]
nop dword [rax + rax]
jmp 0x18005d38e
xor edx, edx
mov rcx, r14
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x18005d38e
inc ebx
xor ecx, ecx
mov edx, ebx
add rdx, rdx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov r13, rax
test rax, rax
je 0x18005d388
mov r8d, ebx
mov rdx, rax
mov rcx, r14
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
xor r8d, r8d
test eax, eax
je 0x18005d377
mov r14, r15
mov edx, eax
sub r14, rdi
mov dword [rsp + 0x90], r8d
sar r14, 1
add rdx, r14
cmp rdx, r14
jb 0x18005d2e6
mov rcx, qword [rsp + 0x98]
mov rax, rbp
inc rax
cmp word [rcx + rax*2 + 2], r8w
jne 0x18005d2bb
lea rcx, [rax + rdx]
mov rbx, rbp
cmp rcx, rdx
jb 0x18005d2e9
lea rax, [rcx + 1]
cmp rax, rcx
cmovae rbx, rax
sbb eax, eax
and eax, 0x80070216
jmp 0x18005d2ee
mov rbx, rbp
mov eax, 0x80070216
mov qword [rsi], r8
test eax, eax
js 0x18005d371
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x18005d371
lea rdx, [rbx + rbx]
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov qword [rsi], rax
mov rcx, rax
test rax, rax
je 0x18005d371
cmp r15, rdi
je 0x18005d33e
mov r9, r14
mov r8, rdi
mov rdx, rbx
call qword [sym.imp.msvcrt.dll_wcsncpy_s]
nop dword [rax + rax]
mov rcx, qword [rsi]
mov rax, qword [rsp + 0x98]
lea rcx, [rcx + r14*2]
sub rbx, r14
lea r8, [0x18007a7e8]
add rax, 2
mov r9, r13
mov rdx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.msvcrt.dll_swprintf_s]
nop dword [rax + rax]
jmp 0x18005d377
mov r12d, 8
mov rcx, r13
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
jmp 0x18005d38e
mov r12d, 8
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
mov ebx, dword [rsp + 0x90]
jmp 0x18005d3ae
mov r12d, 8
xor r13d, r13d
test r12d, r12d
jne 0x18005d4aa
test ebx, ebx
je 0x18005d4aa
mov ecx, dword [0x18008b2a0]
lea r14d, [r13 + 3]
mov rax, qword gs:[0x58]
mov edx, 0xc
mov rax, qword [rax + rcx*8]
cmp dword [rdx + rax], 2
jne 0x18005d43c
mov r9, rsi
lea rdx, str._DSDIT_
mov r8d, r14d
mov rcx, rdi
call fcn.18000f300
cmp eax, 2
jne 0x18005d4b8
mov r9, rsi
lea r8d, [r13 + 4]
lea rdx, str._DSLOG_
mov rcx, rdi
call fcn.18000f300
cmp eax, 2
jne 0x18005d4b8
mov r9, rsi
lea r8d, [r13 + 5]
lea rdx, str._SYSVOL_
mov rcx, rdi
call fcn.18000f300
cmp eax, 2
jne 0x18005d4b8
mov r9, rsi
lea rdx, str._PROFILES_
mov r8d, 7
mov rcx, rdi
call fcn.18000f300
cmp eax, 2
jne 0x18005d4b8
inc rbp
cmp word [rdi + rbp*2], r13w
jne 0x18005d459
inc ebp
xor ecx, ecx
mov ebx, ebp
lea rdx, [rbp*2]
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalAlloc]
nop dword [rax + rax]
mov qword [rsi], rax
test rax, rax
je 0x18005d4af
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__wcsupr]
nop dword [rax + rax]
mov rcx, qword [rsi]
mov edx, ebx
mov r8, rax
call qword [sym.imp.msvcrt.dll_wcscpy_s]
nop dword [rax + rax]
jmp 0x18005d4b5
mov eax, r12d
jmp 0x18005d4b8
mov r14d, 8
mov eax, r14d
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret