Function at 0x7ff344757b8
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x240
mov rax, qword [0x7ff34484108]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor ebp, ebp
mov rdi, rcx
mov r12d, 0x80004005
cmp dword [rcx + 0x50], ebp
je 0x7ff34475999
mov rax, qword [rcx + 0x30]
cmp rax, rbp
je 0x7ff34475999
add rcx, 0x48
call rax
cmp qword [rdi + 8], rbp
je 0x7ff3447581f
lea rcx, [rdi + 8]
call fcn.7ff344766a4
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
lea rdx, [0x7ff34475394]
xor r9d, r9d
mov ecx, eax
mov r8, rdi
mov ebx, eax
call sub.iertutil.dll_Ordinal_170
cmp ebx, 0x45
mov ecx, 0x17
mov r15d, eax
lea rax, [0x7ff34443120]
lea rsi, [0x7ff34442e40]
cmove rsi, rax
cmp ebx, 0x45
lea eax, [rcx - 0x10]
cmove ecx, eax
cmp ecx, ebp
jle 0x7ff34475983
movsxd r14, ecx
add rsi, 8
mov ecx, 0x48
call fcn.7ff3444f574
mov rbx, rax
cmp rax, rbp
je 0x7ff344758b0
mov qword [rax], rbp
mov qword [rax + 8], rbp
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rbp
mov dword [rax + 0x28], ebp
mov dword [rax + 0x2c], ebp
mov dword [rax + 0x30], ebp
mov dword [rax + 0x34], 5
mov dword [rax + 0x38], ebp
mov qword [rax + 0x40], rbp
jmp 0x7ff344758b3
mov rbx, rbp
cmp rbx, rbp
je 0x7ff34475975
mov dword [rbx + 0x34], 4
mov eax, dword [rsi - 8]
mov dword [rbx + 0x28], eax
mov rcx, qword [rsi]
cmp rcx, rbp
je 0x7ff3447592a
call sub.SHLWAPI.dll_StrDupW
mov qword [rbx + 8], rax
cmp rax, rbp
je 0x7ff3447595d
mov rcx, qword [rsi + 0x10]
lea rdx, [rsp + 0x20]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebp, eax
test eax, eax
je 0x7ff3447595b
cmp eax, 0x104
ja 0x7ff3447595b
lea rcx, [rsp + 0x20]
dec ebp
call sub.SHLWAPI.dll_StrDupW
mov qword [rbx], rax
test rax, rax
je 0x7ff3447595b
mov edx, 0x5c
mov ecx, ebp
cmp dx, word [rax + rbp*2]
jne 0x7ff34475944
xor ebp, ebp
mov word [rax + rcx*2], bp
jmp 0x7ff34475946
mov rcx, qword [rsi + 8]
call sub.SHLWAPI.dll_StrDupW
cmp rax, rbp
mov qword [rbx + 0x10], rax
setne al
cmp al, bpl
je 0x7ff3447595d
jmp 0x7ff34475946
xor ebp, ebp
lea rdx, [rdi + 8]
mov r8, rbx
mov rcx, rdi
call fcn.7ff34475494
cmp eax, ebp
jne 0x7ff34475975
jmp 0x7ff3447595d
xor ebp, ebp
mov rcx, rbx
call fcn.7ff344766f8
mov rcx, rbx
call fcn.7ff344766f8
mov rcx, rbx
call fcn.7ff3444f5a0
add rsi, 0x20
sub r14, 1
jne 0x7ff34475872
cmp dword [rdi + 0x50], ebp
je 0x7ff3447599c
mov rax, qword [rdi + 0x20]
cmp rax, rbp
je 0x7ff3447599c
lea rcx, [rdi + 0x48]
call rax
jmp 0x7ff3447599c
mov r15d, r12d
cmp dword [rdi + 0xa8], ebp
je 0x7ff34475a02
mov rax, qword [rdi + 0x88]
cmp rax, rbp
je 0x7ff34475a02
lea rcx, [rdi + 0xa0]
call rax
lea rcx, [rdi + 0x60]
cmp qword [rcx], rbp
je 0x7ff344759c7
call fcn.7ff344766a4
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
lea rdx, [0x7ff34475394]
xor r9d, r9d
mov ecx, eax
mov r8, rdi
call sub.iertutil.dll_Ordinal_170
mov ebx, eax
cmp dword [rdi + 0xa8], ebp
je 0x7ff34475a05
mov rdx, qword [rdi + 0x78]
cmp rdx, rbp
je 0x7ff34475a05
lea rcx, [rdi + 0xa0]
call rdx
jmp 0x7ff34475a05
mov ebx, r12d
cmp r15d, ebp
jge 0x7ff34475a0e
cmp ebx, ebp
jl 0x7ff34475a11
mov r12d, ebp
mov eax, r12d
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.7ff344779c0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret