Function at 0x1400036cc
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
xor r12d, r12d
mov r14d, r8d
mov dword [rbp + 0x40], r12d
mov eax, r12d
mov qword [rbp + 0x48], rax
mov rsi, rdx
mov qword [rbp - 0x10], r12
mov r15, rcx
lea edi, [r12 + 0x40]
mov r9d, r12d
test r8b, 1
je 0x140003814
mov edx, edi
mov dword [rbp + 0x40], edi
lea rcx, [rbp + 0x48]
call fcn.1400048c8
mov ebx, eax
test eax, eax
js 0x140003908
mov r8d, dword [rbp + 0x40]
mov rcx, rsi
mov rdx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x140003776
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x108
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, 0x80004005
test ebx, ebx
cmovns ebx, eax
mov r8d, ebx
lea rcx, str.c:_agent_work138_s_srclibsdutilpathutil.cpp
call fcn.140005770
jmp 0x140003908
mov r9d, dword [rbp + 0x40]
cmp r9d, eax
jae 0x1400037d2
mov edx, eax
lea rcx, [rbp + 0x48]
mov dword [rbp + 0x40], eax
call fcn.1400048c8
mov ebx, eax
test eax, eax
js 0x140003908
mov r8d, dword [rbp + 0x40]
mov rcx, rsi
mov rdx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x1400037b9
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x113
jmp 0x14000374a
mov r9d, dword [rbp + 0x40]
cmp r9d, eax
jae 0x1400037d2
mov r8d, 0x8007007a
mov edx, pe_nt_image_headers64
mov ebx, r8d
jmp 0x140003765
cmp eax, 0x104
jbe 0x140003810
lea rcx, [rbp + 0x48]
call fcn.140003ab8
cmp eax, 0x80070057
mov ebx, eax
cmove ebx, r12d
test ebx, ebx
js 0x140003908
mov rcx, qword [rbp + 0x48]
lea rdx, [rbp + 0x40]
call fcn.140005054
mov ebx, eax
test eax, eax
js 0x140003908
mov r9d, dword [rbp + 0x40]
mov rax, qword [rbp + 0x48]
test r14b, 2
je 0x1400038e9
test rax, rax
mov qword [rbp - 8], r12
mov r14, rsi
lea rcx, [rbp - 0x10]
cmovne r14, rax
cmp r9d, edi
cmova edi, r9d
mov edx, edi
call fcn.1400048c8
mov ebx, eax
test eax, eax
js 0x140003908
mov r8, qword [rbp - 0x10]
lea r9, [rbp - 8]
mov edx, edi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x14000386f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x139
jmp 0x14000374a
cmp edi, eax
jae 0x1400038cd
cmp eax, 0x104
lea edi, [rax + 7]
lea rcx, [rbp - 0x10]
cmovb edi, eax
mov edx, edi
call fcn.1400048c8
mov ebx, eax
test eax, eax
js 0x140003908
mov r8, qword [rbp - 0x10]
lea r9, [rbp - 8]
mov edx, edi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
jne 0x1400038b6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0x144
jmp 0x14000374a
cmp edi, eax
jae 0x1400038cd
mov r8d, 0x8007007a
mov edx, 0x149
mov ebx, r8d
jmp 0x140003765
cmp eax, 0x104
jbe 0x1400038e3
lea rcx, [rbp - 0x10]
call fcn.140003ab8
mov ebx, eax
test eax, eax
js 0x140003908
mov rax, qword [rbp - 0x10]
jmp 0x1400038f1
mov qword [rbp - 0x10], rax
mov qword [rbp + 0x48], r12
test rax, rax
mov rcx, r15
cmovne rsi, rax
xor r8d, r8d
mov rdx, rsi
call fcn.140004a84
mov ebx, eax
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140003916
call fcn.14000504c
mov rcx, qword [rbp + 0x48]
test rcx, rcx
je 0x140003924
call fcn.14000504c
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret