Function at 0x1400017c0
Capabilities:
Query environment variable

Disassembly:
push rbp
push rsi
push rdi
mov eax, 0x20060
call fcn.140037820
sub rsp, rax
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x20090], rbx
mov rax, qword [0x14004e300]
xor rax, rsp
mov qword [rsp + 0x20050], rax
mov rdi, rdx
mov rsi, rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov eax, dword [0x1400564f0]
lea ebx, [rbp + 1]
test bl, al
jne 0x140001857
or eax, ebx
mov dword [0x1400564f0], eax
call fcn.140014600
mov rcx, rax
mov eax, ebp
cmp rcx, rbp
setne al
cmp eax, ebp
jne 0x140001834
mov ecx, 0x80004005
call fcn.140007c44
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1400564e8], rax
lea rcx, [0x140039f18]
call fcn.1400222c8
mov eax, dword [0x1400564f0]
test al, 2
jne 0x1400018a0
or eax, 2
mov dword [0x1400564f0], eax
call fcn.140014600
mov rcx, rax
mov eax, ebp
cmp rcx, rbp
setne al
cmp eax, ebp
jne 0x140001883
mov ecx, 0x80004005
call fcn.140007c44
int3
mov rax, qword [rcx]
call qword [rax + 0x18]
add rax, 0x18
mov qword [0x1400564e0], rax
lea rcx, [0x140039eec]
call fcn.1400222c8
cmp dword [0x14004f980], ebp
je 0x14000198f
call fcn.140001690
cmp eax, ebp
je 0x14000198f
mov dword [0x14004f980], ebp
lea rdx, str._programfiles_
lea rcx, [rsp + 0x38]
call fcn.1400017c0
nop
mov rdx, rax
lea rcx, [0x1400564e8]
call fcn.140007b74
nop
mov rdx, qword [rsp + 0x38]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, ebp
jg 0x140001901
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rdx, str._commonprogramfiles_
lea rcx, [rsp + 0x40]
call fcn.1400017c0
nop
mov rdx, rax
lea rcx, [0x1400564e0]
call fcn.140007b74
nop
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, ebp
jg 0x140001943
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
lea rcx, [0x1400564e8]
call fcn.140005198
lea r8, [0x140041464]
lea rdx, str.__x86_
lea rcx, [0x1400564e8]
call fcn.140004e8c
lea rcx, [0x1400564e0]
call fcn.140005198
lea r8, [0x140041464]
lea rdx, str.__x86_
lea rcx, [0x1400564e0]
call fcn.140004e8c
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.1400077ac
nop
mov eax, dword [0x1400564dc]
test bl, al
jne 0x1400019bc
or eax, ebx
mov dword [0x1400564dc], eax
call fcn.140001690
mov dword [0x1400564d8], eax
jmp 0x1400019c2
mov eax, dword [0x1400564d8]
cmp eax, ebp
je 0x1400019f8
mov rax, qword [0x140056488]
cmp rax, rbp
je 0x1400019f8
cmp qword [0x140056490], rbp
je 0x1400019f8
mov qword [rsp + 0x28], rbp
lea rcx, [rsp + 0x28]
call rax
mov rcx, qword [rsp + 0x28]
call qword [0x140056490]
mov edx, dword [rsp + 0x28]
jmp 0x1400019fa
mov edx, ebx
cmp edx, ebp
je 0x140001a44
lea rcx, [rsp + 0x20]
call fcn.140005198
mov r8, qword [0x1400564e8]
cmp dword [r8 - 0x10], ebp
je 0x140001a26
lea rdx, str._programfiles_
lea rcx, [rsp + 0x20]
call fcn.140004e8c
mov r8, qword [0x1400564e0]
cmp dword [r8 - 0x10], ebp
je 0x140001a44
lea rdx, str._commonprogramfiles_
lea rcx, [rsp + 0x20]
call fcn.140004e8c
mov word [rsp + 0x50], bp
mov r8d, 0x8000
lea rdx, [rsp + 0x50]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, 0x25
mov edx, edi
lea rcx, [rsp + 0x50]
call fcn.1400223dc
cmp rax, rbp
je 0x140001bad
mov edx, edi
lea rcx, [rax + 2]
call fcn.1400223dc
cmp rax, rbp
je 0x140001bad
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x50]
repne scasw ax, word [rdi]
not rcx
sub rcx, rbx
mov r8d, ecx
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.140007a14
mov edx, dword [0x1400564dc]
test bl, dl
jne 0x140001ad2
or edx, ebx
mov dword [0x1400564dc], edx
call fcn.140001690
mov dword [0x1400564d8], eax
jmp 0x140001ad8
mov eax, dword [0x1400564d8]
cmp eax, ebp
je 0x140001b0c
mov rax, qword [0x140056488]
cmp rax, rbp
je 0x140001b0c
cmp qword [0x140056490], rbp
je 0x140001b0c
mov qword [rsp + 0x30], rbp
lea rcx, [rsp + 0x30]
call rax
mov rcx, qword [rsp + 0x30]
call qword [0x140056490]
mov ebx, dword [rsp + 0x30]
cmp ebx, ebp
je 0x140001b56
lea rcx, [rsp + 0x20]
call fcn.140005198
mov r8, qword [0x1400564e8]
cmp dword [r8 - 0x10], ebp
je 0x140001b38
lea rdx, str._programfiles_
lea rcx, [rsp + 0x20]
call fcn.140004e8c
mov r8, qword [0x1400564e0]
cmp dword [r8 - 0x10], ebp
je 0x140001b56
lea rdx, str._commonprogramfiles_
lea rcx, [rsp + 0x20]
call fcn.140004e8c
mov word [rsp + 0x10050], bp
mov r8d, 0x8000
lea rdx, [rsp + 0x10050]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rsp + 0x10050]
mov rcx, rsi
call fcn.1400077ac
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
cmp ecx, ebp
jg 0x140001ba8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rsi
jmp 0x140001bde
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.1400077ac
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
cmp eax, ebp
jg 0x140001bdb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rsi
mov rcx, qword [rsp + 0x20050]
xor rcx, rsp
call fcn.140021c70
mov rbx, qword [rsp + 0x20090]
add rsp, 0x20060
pop rdi
pop rsi
pop rbp
ret