Function at 0x18002f5d0
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
sub rsp, 0x500
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x4f8], rbx
mov qword [rbp + 0x500], rsi
mov rax, qword [0x18008ab58]
xor rax, rbp
mov qword [rbp + 0x4b0], rax
xor r15d, r15d
mov ebx, 0x20a
cmp qword [0x18008b2d8], rbx
mov r14, rcx
mov edi, 8
mov r12d, 0x6b637453
jb 0x18002f65c
mov rcx, qword [0x18008b2e8]
add rcx, 0x212
cmp rcx, rbx
jb 0x18002f65c
call fcn.1800019b0
test eax, eax
je 0x18002f65c
mov eax, dword [rsp]
lea eax, [rbx + 0x16]
sub rsp, rax
lea rsi, [rsp + 0x40]
mov eax, dword [rsi]
test rsi, rsi
je 0x18002f65c
mov dword [rsi], r12d
add rsi, rdi
jne 0x18002f67f
mov rax, qword [0x18008b2e0]
mov ecx, 0x212
call qword [0x180071c20]
mov rsi, rax
test rax, rax
je 0x18002f67f
mov dword [rax], 0x70616548
add rsi, rdi
cmp qword [0x18008b2d8], rbx
jb 0x18002f6c3
mov rcx, qword [0x18008b2e8]
add rcx, 0x212
cmp rcx, rbx
jb 0x18002f6c3
call fcn.1800019b0
test eax, eax
je 0x18002f6c3
mov eax, dword [rsp]
mov eax, 0x220
sub rsp, rax
lea rbx, [rsp + 0x40]
mov eax, dword [rbx]
test rbx, rbx
je 0x18002f6c3
mov dword [rbx], r12d
add rbx, rdi
jne 0x18002f6e6
mov rax, qword [0x18008b2e0]
mov ecx, 0x212
call qword [0x180071c20]
mov rbx, rax
test rax, rax
je 0x18002f6e6
mov dword [rax], 0x70616548
add rbx, rdi
test rsi, rsi
je 0x18002fa03
test rbx, rbx
je 0x18002f9e5
mov r12d, 1
mov qword [rbp + 0x10], r15
lea rcx, str.SceSrv
mov dword [rbp], r12d
mov qword [rbp + 8], r15
call fcn.18000c6d0
test r14, r14
jne 0x18002f742
mov rcx, qword [0x18008b378]
lea edx, [r12 + 2]
mov r9d, 0x1d2e
mov r8d, 0xc00006aa
call fcn.18000c740
lea edi, [r12 + 0x56]
jmp 0x18002f9e5
mov word [rsi], r15w
mov edx, 0x104
mov word [rbx], r15w
mov rcx, rbx
mov word [rbp + 0x230], r15w
call qword [sym.imp.api_ms_win_core_sysinfo_l1_1_0.dll_GetSystemWindowsDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x18002f79d
mov rcx, qword [0x18008b378]
lea rax, str._windir_
mov edx, 3
mov qword [rsp + 0x20], rax
mov r9d, 0x1d2f
mov r8d, 0xc00006ab
call fcn.18000c740
mov edi, 0xcb
jmp 0x18002f9e5
mov edi, 0x13b
lea rcx, [rbp + 0x230]
mov edx, edi
mov r8, rbx
call qword [sym.imp.msvcrt.dll_wcscpy_s]
nop dword [rax + rax]
lea r8, str._securitylogsconvert.log
mov edx, edi
lea rcx, [rbp + 0x230]
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
mov ecx, r12d
call fcn.1800385f8
mov ecx, 3
call fcn.180038f4c
lea rcx, [rbp + 0x230]
call fcn.1800386b0
cmp eax, 0x7b
jne 0x18002f810
lea r9, [rbp + 0x230]
xor edx, edx
mov r8d, 0x1c85
mov ecx, r12d
call fcn.180038d90
mov r8d, 0x104
lea rcx, str.SYSTEMDRIVE
mov rdx, rsi
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
test eax, eax
jne 0x18002f879
lea r9, str._SYSTEMDRIVE_
xor edx, edx
xor ecx, ecx
mov r8d, 0x1d32
call fcn.180038d90
mov rcx, qword [0x18008b378]
lea rax, str._systemdrive_
mov edx, 3
mov qword [rsp + 0x20], rax
mov r9d, 0x1d2f
mov r8d, 0xc00006ab
call fcn.18000c740
call fcn.180038654
jmp 0x18002f793
lea rdx, [rbp]
mov rcx, r14
call fcn.180030194
mov edi, eax
test eax, eax
jne 0x18002f9ae
cmp dword [rbp], r15d
je 0x18002f9a6
mov r9, r14
xor edx, edx
xor ecx, ecx
mov r8d, 0x1d1d
call fcn.180038d90
mov rcx, r14
call fcn.180030608
mov rdx, r14
mov rcx, rbx
call fcn.180030428
lea r8, [rbp]
mov dword [rbp], r15d
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.1800302f0
mov edi, eax
xor edx, edx
lea rax, str.D:_A_OICI_GA___BA__A_OICI_GA___SY__A_OICI_SDGXGWGR___AU__A_OICI_GXGR___BU_
mov r9d, edi
xor ecx, ecx
mov qword [rsp + 0x20], rax
mov r8d, 0x1d22
call fcn.180038d90
test edi, edi
jne 0x18002f9ae
xor edx, edx
lea rcx, [rbp + 0x20]
mov r8d, 0x208
call sub.msvcrt.dll_memset
lea r9d, [rdi + 5]
mov r8, r14
mov edi, 0x104
lea rcx, [rbp + 0x20]
mov edx, edi
call qword [sym.imp.msvcrt.dll_wcsncpy_s]
nop dword [rax + rax]
lea r8, [0x18007a640]
mov edx, edi
lea rcx, [rbp + 0x20]
call qword [sym.imp.msvcrt.dll_wcscat_s]
nop dword [rax + rax]
mov rax, qword [rbp + 8]
lea rcx, [rbp + 0x20]
mov r8d, dword [rbp]
xor r9d, r9d
mov qword [rsp + 0x30], r15
mov edx, r12d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
call qword [sym.imp.api_ms_win_security_provider_l1_1_0.dll_SetNamedSecurityInfoW]
nop dword [rax + rax]
xor edx, edx
xor ecx, ecx
mov edi, eax
test eax, eax
je 0x18002f993
lea rax, [rbp + 0x20]
mov r9d, edi
mov r8d, 0x1d23
mov qword [rsp + 0x20], rax
call fcn.180038d90
jmp 0x18002f9a2
lea r9, [rbp + 0x20]
mov r8d, 0x1d2b
call fcn.180038d90
test edi, edi
jne 0x18002f9ae
mov r8d, 0x400006ad
jmp 0x18002f9b4
mov r8d, 0x400006ac
mov rcx, qword [0x18008b378]
xor r9d, r9d
mov edx, r12d
mov qword [rsp + 0x20], r14
call fcn.18000c740
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x18002f9e0
call qword [sym.imp.api_ms_win_core_heap_l2_1_0.dll_LocalFree]
nop dword [rax + rax]
call fcn.180038654
test rsi, rsi
je 0x18002fa03
lea rcx, [rsi - 8]
cmp dword [rcx], 0x70616548
jne 0x18002fa03
mov rax, qword [0x18008b2f0]
call qword [0x180071c20]
test rbx, rbx
je 0x18002fa21
lea rcx, [rbx - 8]
cmp dword [rcx], 0x70616548
jne 0x18002fa21
mov rax, qword [0x18008b2f0]
call qword [0x180071c20]
mov eax, edi
mov rcx, qword [rbp + 0x4b0]
xor rcx, rbp
call fcn.180002a90
mov rbx, qword [rbp + 0x4f8]
mov rsi, qword [rbp + 0x500]
lea rsp, [rbp + 0x4c0]
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret