Function at 0x1400356fc
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x38]
sub rsp, 0x130
mov rax, qword [0x14005ab08]
xor rax, rsp
mov qword [rbp + 0x28], rax
mov rdi, rcx
xor esi, esi
mov qword [rbp - 0x58], rsi
movdqa xmm0, xmmword [0x14004ce30]
movdqu xmmword [rbp - 0x48], xmm0
mov word [rbp - 0x58], si
lea rdx, [0x14004c408]
lea rcx, [rbp - 0x58]
call fcn.14000742c
nop
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x28], rsi
lea ebx, [rsi + 7]
mov qword [rbp - 0x20], rbx
mov word [rbp - 0x38], si
lea rdx, str.MicrosoftCryptoPCPKSPWindowsAIK
lea rcx, [rbp - 0x38]
call fcn.14000742c
nop
mov qword [rbp - 0x78], rsi
movdqa xmm0, xmmword [0x14004ce30]
movdqu xmmword [rbp - 0x68], xmm0
mov word [rbp - 0x78], si
lea rdx, str.SystemDrive
lea rcx, [rbp - 0x78]
call fcn.14000742c
nop
mov qword [rbp - 0x18], rsi
movdqa xmm0, xmmword [0x14004ce30]
movdqu xmmword [rbp - 8], xmm0
mov word [rbp - 0x18], si
lea rdx, str.ProgramData
lea rcx, [rbp - 0x18]
call fcn.14000742c
nop
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rbx
mov word [rsp + 0x48], si
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
cmovae rcx, qword [rbp - 0x58]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x14003584a
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.1400329e0
lea rdx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rdx, qword [rsp + 0x48]
lea rcx, [rbp - 0x58]
cmp qword [rbp - 0x40], 8
cmovae rcx, qword [rbp - 0x58]
mov r8d, ebx
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
mov rdx, qword [rsp + 0x58]
dec rdx
lea rcx, [rsp + 0x48]
call fcn.1400329e0
jmp 0x14003595d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0xcb
jne 0x140035ac1
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rcx, qword [rbp - 0x78]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
je 0x140035add
mov qword [rsp + 0x68], rsi
movdqa xmm0, xmmword [0x14004ce30]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], si
mov edx, ebx
lea rcx, [rsp + 0x68]
call fcn.1400329e0
lea rdx, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae rdx, qword [rsp + 0x68]
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 8
cmovae rcx, qword [rbp - 0x78]
mov r8d, ebx
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
nop dword [rax + rax]
mov edx, dword [rbp - 8]
add edx, dword [rsp + 0x78]
lea rcx, [rsp + 0x48]
call fcn.1400329e0
lea r9, [rbp - 0x18]
cmp qword [rbp], 8
cmovae r9, qword [rbp - 0x18]
lea r8, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae r8, qword [rsp + 0x68]
lea rcx, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae rcx, qword [rsp + 0x48]
mov dword [rsp + 0x20], 1
mov rdx, qword [rsp + 0x58]
call qword [sym.imp.api_ms_win_core_path_l1_1_0.dll_PathCchCombineEx]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x38]
test eax, eax
js 0x140035b02
mov rdx, qword [rsp + 0x58]
dec rdx
lea rcx, [rsp + 0x48]
call fcn.1400329e0
nop
lea rcx, [rsp + 0x68]
call fcn.140006e10
movabs rax, 0x7ffffffffffffffe
mov rcx, qword [rsp + 0x58]
sub rax, rcx
mov rdx, qword [rbp - 0x28]
cmp rax, rdx
jb 0x140035b17
lea r9, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r9, qword [rsp + 0x48]
lea rax, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae rax, qword [rbp - 0x38]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea rcx, [rbp + 8]
call fcn.14001d358
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x104
jae 0x140035b1d
mov rax, rdx
shr rax, 0x20
test eax, eax
je 0x1400359fe
mov rcx, rax
add rcx, rcx
je 0x1400359fe
mov rax, rcx
shr rax, 0x20
test eax, eax
jne 0x140035abb
mov eax, edx
add rax, rax
shl rcx, 0x20
add rcx, rax
cmp rcx, rax
jb 0x140035abb
jmp 0x140035a03
mov ecx, edx
add rcx, rcx
mov eax, 0xffffffff
cmp rcx, rax
ja 0x140035abb
lea r8, [rbp + 8]
cmp qword [rbp + 0x20], 8
cmovae r8, qword [rbp + 8]
mov dword [rsp + 0x20], esi
mov r9d, ecx
lea rdx, str.PCP_ALTERNATE_KEY_STORAGE_LOCATION
mov rcx, rdi
call qword [sym.imp.ncrypt.dll_NCryptSetProperty]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x38]
test eax, eax
js 0x140035aa6
lea rcx, [rbp + 8]
call fcn.140006e10
nop
lea rcx, [rsp + 0x48]
call fcn.140006e10
nop
lea rcx, [rbp - 0x18]
call fcn.140006e10
nop
lea rcx, [rbp - 0x78]
call fcn.140006e10
nop
lea rcx, [rbp - 0x38]
call fcn.140006e10
nop
lea rcx, [rbp - 0x58]
call fcn.140006e10
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.140040640
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov r9d, eax
lea r8, str.onecore_amcoreoctagoncommon_tpmattestation_attesttpm.cpp
mov edx, 0x70
call fcn.140016324
int3
call fcn.14002e600
nop
mov rcx, qword [rbp + 0x38]
mov r9d, 0x139f
lea r8, str.onecore_amcoreoctagoncommon_tpmattestation_attesttpm.cpp
mov edx, 0x45
call fcn.140023740
int3
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r9d, eax
mov rcx, qword [rbp + 0x38]
lea r8, str.onecore_amcoreoctagoncommon_tpmattestation_attesttpm.cpp
mov edx, 0x4d
call fcn.140023740
nop
mov r9d, eax
lea r8, str.onecore_amcoreoctagoncommon_tpmattestation_attesttpm.cpp
mov edx, 0x5f
call fcn.140016324
nop
call fcn.140005e7c
nop
mov rcx, qword [rbp + 0x38]
mov r9d, 0x32
lea r8, str.onecore_amcoreoctagoncommon_tpmattestation_attesttpm.cpp
lea edx, [r9 + 0x36]
call fcn.140023740
int3