Function at 0x14000ab00
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x90
mov rax, qword [0x140257908]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r15, rcx
call fcn.140015c70
mov edx, 0x9a6f
mov rcx, r15
call fcn.140014930
mov rbx, rax
mov edx, 0x403
mov rcx, r15
call fcn.140014930
mov rdi, rax
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1f], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf], xmm1
lea rdx, [rbp + 0x1f]
mov rcx, qword [r15 + 0x40]
call qword [sym.imp.USER32.dll_GetWindowRect]
lea rdx, [rbp + 0xf]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [rbp + 0x1b]
sub edx, dword [rbp + 0x13]
add edx, 0xa
mov eax, dword [rbp + 0x27]
sub eax, dword [rbp + 0x1f]
lea rcx, [r15 + 0x258]
mov dword [rsp + 0x30], 4
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call fcn.140014d84
mov ecx, dword [rbp + 0x27]
sub ecx, dword [rbp + 0x17]
sub ecx, dword [rbp + 0x1f]
mov r8d, dword [rbp + 0xf]
add r8d, 0xffffffec
add r8d, ecx
mov dword [rsp + 0x30], 5
xor esi, esi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor edx, edx
lea r9d, [rsi + 0xa]
mov rcx, rbx
call fcn.140014d84
mov r9d, dword [rbp + 0x1b]
sub r9d, dword [rbp + 0x13]
add r9d, 0xb
mov dword [rsp + 0x30], 5
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], esi
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140014d84
call fcn.1400049c0
nop
xor edx, edx
xor ecx, ecx
lea r8d, [rsi + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
mov qword [rbp - 0x11], rax
test rax, rax
jne 0x14000ac52
xor edx, edx
xor ecx, ecx
lea r8d, [rsi + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
mov qword [rbp - 0x11], rax
test rax, rax
je 0x14000ac90
jmp 0x14000ac71
mov r8d, 0xf01ff
lea rdx, str.HomeGuard_AM_VI
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
jne 0x14000afbb
mov r8d, 0xf01ff
lea rdx, str.HG51_AMC
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
jne 0x14000afbb
test rbx, rbx
jne 0x14000acaf
xor edx, edx
xor ecx, ecx
lea r8d, [rbx + 2]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rbx, rax
mov qword [rbp - 0x11], rax
test rax, rax
je 0x14000acce
mov r8d, 0xf01ff
lea rdx, str.HomeGuard_AMC
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
test rax, rax
jne 0x14000afbb
xor edx, edx
mov rcx, qword [r15 + 0x40]
call qword [sym.imp.USER32.dll_GetSystemMenu]
mov rcx, rax
call fcn.14001cc9c
mov rdi, rax
mov r14, 0xffffffffffffffff
test rax, rax
je 0x14000ad6e
call fcn.1400191fc
mov rcx, rax
test rax, rax
je 0x14000b030
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x19], rax
lea edx, [r14 + 0x66]
lea rcx, [rbp - 0x19]
call fcn.140005390
mov rbx, qword [rbp - 0x19]
cmp dword [rbx - 0x10], 0
je 0x14000ad50
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_AppendMenuW]
mov r9, rbx
xor edx, edx
lea r8d, [r14 + 0x11]
mov rcx, qword [rdi + 8]
call qword [sym.imp.USER32.dll_AppendMenuW]
nop
lea rdx, [rbx - 0x18]
mov eax, r14d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000ad6a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rbp - 0x11]
mov r9, qword [r15 + 0x368]
mov edx, 0x80
lea r8d, [rdx - 0x7f]
mov rcx, qword [r15 + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9, qword [r15 + 0x368]
xor r8d, r8d
mov edx, 0x80
mov rcx, qword [r15 + 0x40]
call qword [sym.imp.USER32.dll_SendMessageW]
mov r12, rsi
mov qword [rbp - 1], rsi
mov ecx, 0x2000
call fcn.14000b7d4
mov r13, rax
mov qword [rbp - 9], rax
test rax, rax
je 0x14000add8
xor edx, edx
mov r8d, 0x2000
mov rcx, rax
call fcn.14019bdf0
mov r12d, 0x1000
mov qword [rbp - 1], r12
lea r8d, [r12 - 0x104]
mov rdx, r13
lea rcx, str._ProgramW6432_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
inc r14
cmp word [r13 + r14*2], 0
jne 0x14000adf0
mov rdi, rsi
cmp r14, r12
cmovb rdi, r14
mov qword [rbp + 7], rdi
lea rax, [rdi + 2]
cmp rax, r12
ja 0x14000ae25
mov eax, 0x5c
mov word [r13 + rdi*2], ax
inc rdi
mov qword [rbp + 7], rdi
test r12, r12
je 0x14000ae69
lea rax, [rdi + 0xe]
cmp rax, r12
jbe 0x14000ae3b
sub r12, rdi
dec r12
jmp 0x14000ae41
mov r12d, 0xd
lea r8, [r12 + r12]
lea rcx, [rdi*2]
add rcx, r13
lea rdx, str.HomeGuard_Pro
call fcn.14019b740
add rdi, r12
mov qword [rbp + 7], rdi
mov word [r13 + rdi*2], si
lea rcx, [r15 + 0x1360]
mov rdx, r13
call fcn.140014de8
cmp qword [r15 + 0x240], 0
jne 0x14000aec1
mov byte [r15 + 0x250], 0
lea rcx, [r15 + 0x238]
mov rdx, qword [r15 + 0x138]
call fcn.14001a0c0
mov ecx, 0xffffff
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
mov qword [r15 + 0x230], rax
mov dword [r15 + 0x248], esi
mov dword [r15 + 0x24c], 2
xor r9d, r9d
mov edi, 1
mov r8d, edi
mov edx, 0xf1
mov rcx, qword [r15 + 0x1570]
call qword [sym.imp.USER32.dll_SendMessageW]
xor r9d, r9d
mov r8d, edi
mov edx, 0xf1
mov rcx, qword [r15 + 0x1658]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, qword [0x140265fe0]
cmp qword [0x140265fd8], rax
je 0x14000af8f
xor r8d, r8d
lea rdx, [0x140004d10]
mov rcx, qword [r15 + 0x40]
call qword [sym.imp.USER32.dll_EnumChildWindows]
mov r8, qword [0x140265fd8]
mov r10, qword [0x140265fe0]
cmp r8, r10
je 0x14000af8f
mov rcx, r10
sub rcx, r8
movabs r11, 0x6666666666666667
mov rax, r11
imul rcx
mov r9, rdx
sar r9, 4
mov rcx, r9
shr rcx, 0x3f
add r9, rcx
je 0x14000af8f
sub r10, r8
mov rax, r11
imul r10
sar rdx, 4
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, rsi
jbe 0x14000b02a
cmp dword [r8], 0xe422
je 0x14000af9e
inc rsi
add r8, 0x28
cmp rsi, r9
jb 0x14000af71
test r13, r13
je 0x14000afed
mov rcx, r13
call fcn.14000b7cc
jmp 0x14000afed
lea rdx, [r8 + 8]
cmp qword [rdx + 0x18], 8
jb 0x14000afac
mov rdx, qword [rdx]
test rdx, rdx
je 0x14000af8f
mov rcx, r15
call fcn.140014de8
jmp 0x14000af8f
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [rbp - 0x19], 0x152
lea rcx, [rbp - 0x19]
call fcn.140004bf0
xor r8d, r8d
lea edx, [r8 + 0x40]
mov rcx, rax
call fcn.14001b37c
xor ecx, ecx
call qword [sym.imp.USER32.dll_PostQuitMessage]
mov edi, esi
test rbx, rbx
je 0x14000affb
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, edi
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.1401943d0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140004360
nop
mov ecx, 0x80004005
call fcn.140004e60
int3