Function at 0x47acaf
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov qword [rbp - 0x18], 0
mov rcx, qword [rbp + 0x10]
call sub.msvcrt.dll_strlen
mov qword [rbp - 0x38], rax
mov edx, 0x2f
mov rcx, qword [rbp + 0x10]
call sub.msvcrt.dll_strchr
test rax, rax
jne 0x47acfc
mov edx, 0x5c
mov rcx, qword [rbp + 0x10]
call sub.msvcrt.dll_strchr
test rax, rax
je 0x47ad03
mov eax, 1
jmp 0x47ad08
mov eax, 0
mov dword [rbp - 0x3c], eax
cmp dword [rbp - 0x3c], 0
je 0x47ad18
mov dword [rbp + 0x18], 0
cmp dword [rbp + 0x18], 0
je 0x47ad2e
lea rcx, str.PATH
call sub.msvcrt.dll_getenv
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
jne 0x47ad40
lea rax, [0x004fef7c]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], 0
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x28], rax
jmp 0x47adb5
mov rax, qword [rbp - 0x28]
mov qword [rbp - 0x30], rax
jmp 0x47ad61
add qword [rbp - 0x30], 1
mov rax, qword [rbp - 0x30]
movzx eax, byte [rax]
cmp al, 0x3b
je 0x47ad77
mov rax, qword [rbp - 0x30]
movzx eax, byte [rax]
test al, al
jne 0x47ad5c
mov rdx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x28]
sub rdx, rax
mov rax, rdx
cmp qword [rbp - 0x10], rax
jae 0x47ad9d
mov rdx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x28]
sub rdx, rax
mov rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x30]
movzx eax, byte [rax]
cmp al, 0x3b
jne 0x47adad
add qword [rbp - 0x30], 1
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
movzx eax, byte [rax]
test al, al
jne 0x47ad52
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x38]
add rax, rdx
add rax, 6
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.0047c0a6
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov qword [rbp - 0x30], rax
jmp 0x47adfa
add qword [rbp - 0x30], 1
mov rax, qword [rbp - 0x30]
movzx eax, byte [rax]
cmp al, 0x3b
je 0x47ae10
mov rax, qword [rbp - 0x30]
movzx eax, byte [rax]
test al, al
jne 0x47adf5
mov rax, qword [rbp - 0x48]
mov qword [rbp - 8], rax
mov rdx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x28]
sub rdx, rax
mov rax, rdx
mov rcx, rax
mov rdx, qword [rbp - 0x28]
mov rax, qword [rbp - 8]
mov r8, rcx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rdx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x28]
sub rdx, rax
mov rax, rdx
add qword [rbp - 8], rax
mov rdx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x28]
cmp rdx, rax
je 0x47ae6a
mov rax, qword [rbp - 8]
lea rdx, [rax + 1]
mov qword [rbp - 8], rdx
mov byte [rax], 0x5c
mov rax, qword [rbp - 8]
mov rdx, qword [rbp + 0x10]
mov rcx, rax
call sub.msvcrt.dll_strcpy
mov rax, qword [rbp - 0x30]
movzx eax, byte [rax]
cmp al, 0x3b
jne 0x47ae8a
add qword [rbp - 0x30], 1
mov rax, qword [rbp - 0x48]
mov qword [rbp - 8], rax
jmp 0x47aeab
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
cmp al, 0x2f
jne 0x47aea6
mov rax, qword [rbp - 8]
mov byte [rax], 0x5c
add qword [rbp - 8], 1
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
test al, al
jne 0x47ae94
lea rax, str..com
mov qword [rbp - 0x20], rax
jmp 0x47af27
mov rax, qword [rbp - 8]
mov byte [rax], 0
mov rax, qword [rbp - 0x20]
mov rdx, qword [rax]
mov rax, qword [rbp - 0x48]
mov rcx, rax
call sub.msvcrt.dll_strcat
mov rax, qword [rbp - 0x48]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 3
mov edx, 0x80000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp - 0x50], rax
cmp qword [rbp - 0x50], 0xffffffffffffffff
jne 0x47af5d
add qword [rbp - 0x20], 8
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
test rax, rax
jne 0x47aec3
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
movzx eax, byte [rax]
test al, al
jne 0x47adeb
mov rax, qword [rbp - 0x48]
mov rcx, rax
call fcn.00494cb8
mov eax, 0
jmp 0x47af72
nop
mov rax, qword [rbp - 0x50]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x48]
add rsp, 0x90
pop rbp
ret