Function at 0x1401281d9
Capabilities:
Set environment variable

Disassembly:
jmp 0x1404ddf5c
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
xor bp, r11w
or rbp, r11
mov qword [rsp + 0x18], rsi
btc bp, r13w
movsxd rbp, r14d
adc rbp, rcx
push rdi
and rbp, rdx
push r12
push r13
adc bpl, 0x60
sar ebp, 4
bswap bp
push r14
push r15
sbb r15, 0x62c13c78
bts r15w, r14w
movsxd rbp, edi
sub rsp, 0x30
bsf bp, dx
sub esi, esi
shld r15w, r14w, 0xd6
mov ebp, r8d
mov ebp, edx
sets r15b
sbb r15d, 0x4de77538
and r15b, 0xda
mov r15, rcx
test rcx, rcx
jmp 0x1404ddfd1
jne 0x1404ddff2
call fcn.1404ba199
mov dword [rax], 0x16
cmc
stc
or rax, 0xffffffffffffffff
jmp 0x1404ddfed
jmp 0x1404de564
mov edx, 0x3d
movsxd rdi, ecx
mov dil, 0x8d
mov di, r15w
mov rdi, r15
jmp 0x1404de009
call fcn.1401fe1ab
mov r13, rax
test rax, rax
jmp 0x1404de019
je 0x1404de50e
cmp rax, r15
je 0x1404de50e
mov r14, qword [0x1400ba2e8]
cmp r14, qword [0x1400ba2f0]
mov r12b, 0xa7
mov r12w, r12w
movsxd r12, r13d
movzx r12d, word [rax + 2]
jmp 0x1404de04a
jne 0x1404de071
mov rcx, r14
jmp 0x1404de058
call fcn.1404de5d2
mov r14, rax
mov qword [0x1400ba2e8], rax
xor bl, bl
sar bx, 0x14
btr ebx, 0xd6
mov ebx, 1
cmp bl, dil
clc
cmc
test r14, r14
jmp 0x1404de083
jne 0x1404de1bb
mov rax, qword [0x1400ba2e0]
cmc
test rdi, 0x7365765c
test ebp, ebp
jmp 0x1404de09f
je 0x1404de0fc
test rax, rax
jmp 0x1404de0ad
je 0x1404de0fc
call fcn.1404ba3b6
test rax, rax
jmp 0x1404de0c0
je 0x1404de50e
mov r14, qword [0x1400ba2e8]
clc
cmp r14, qword [0x1400ba2f0]
jmp 0x1404de0da
jne 0x1404de1ad
mov rcx, r14
call fcn.1404de5d2
mov r14, rax
jmp 0x1404de0f0
mov qword [0x1400ba2e8], rax
jmp 0x1404de1ad
test r12w, r12w
jmp 0x1404de105
je 0x1404de520
test rax, rax
jne 0x1404de174
lea edx, [rax + 8]
mov cl, r15b
cmovge cx, r10w
mov rcx, rbx
call fcn.1404d22c7
sub ecx, ecx
jmp 0x1404de12e
mov qword [0x1400ba2e0], rax
jmp 0x1404de13a
call fcn.1404ce159
cmp qword [0x1400ba2e0], rsi
jmp 0x1404de14b
jne 0x1404de15f
or rbp, 0xffffffffffffffff
jmp 0x1404de15a
jmp 0x1404de532
mov r14, qword [0x1400ba2e8]
test r14, r14
jmp 0x1404de16e
jne 0x1404de1bb
mov edx, 8
jmp 0x1404de181
mov rcx, rbx
jmp 0x1404de189
call fcn.1404d22c7
sub ecx, ecx
jmp 0x1404de195
mov qword [0x1400ba2e8], rax
jmp 0x1404de1a1
call fcn.1404ce159
mov r14, qword [0x1400ba2e8]
test r14, r14
jmp 0x1404de1b5
je 0x1404de151
mov rax, qword [r14]
btr bx, 9
sub r13, r15
btr ebx, 0x82
rol ebx, 0x71
rol bx, cl
sar r13, 1
xchg bh, bh
mov rbx, r14
test bpl, dil
test rax, rax
jmp 0x1404de1e3
je 0x1404de26f
mov r8, r13
mov rdx, rax
movzx rcx, r14w
mov rcx, r15
jmp 0x1404de1fb
call fcn.1404ea267
test eax, eax
jmp 0x1404de207
jne 0x1404de243
mov rax, qword [rbx]
and cl, 2
test r12b, 0x3e
sbb ch, 0xc3
mov ecx, 0x3d
clc
test r12b, r8b
cmp word [rax + r13*2], cx
jmp 0x1404de22d
je 0x1404de259
cmp word [rax + r13*2], si
jmp 0x1404de23d
je 0x1404de259
add rbx, 8
lahf
nop
cbw
mov rax, qword [rbx]
jmp 0x1404de254
jmp 0x1404de1db
sub rbx, r14
jmp 0x1404de261
sar rbx, 3
jmp 0x1404de26a
jmp 0x1404de27e
sub rbx, r14
test r14b, cl
sar rbx, 3
cmc
neg rbx
cmc
test rbx, rbx
jmp 0x1404de286
js 0x1404de350
cmp qword [r14], rsi
jmp 0x1404de294
je 0x1404de350
mov rcx, qword [r14 + rbx*8]
jmp 0x1404de2a3
call fcn.1404ce159
test r12w, r12w
jmp 0x1404de2b1
je 0x1404de2dc
mov qword [r14 + rbx*8], r15
jmp 0x1404de2c0
jmp 0x1404de400
mov rax, qword [r14 + rbx*8 + 8]
jmp 0x1404de2cf
mov qword [r14 + rbx*8], rax
jmp 0x1404de2d8
inc rbx
cmc
cmp qword [r14 + rbx*8], rsi
jmp 0x1404de2e5
jne 0x1404de2c5
mov r8d, 8
movzx rcx, cx
jmp 0x1404de2fa
mov rdx, rbx
movsx cx, r9b
movsx rcx, r15w
jmp 0x1404de30b
mov rcx, r14
jmp 0x1404de313
call fcn.1404dd960
xor ecx, ecx
jmp 0x1404de324
mov rbx, rax
jmp 0x1404de32c
call fcn.1404ce159
test rbx, rbx
jmp 0x1404de339
je 0x1404de403
mov qword [0x1400ba2e8], rbx
jmp 0x1404de34b
jmp 0x1404de403
test r12w, r12w
jmp 0x1404de359
je 0x1404de534
neg rbx
sal edx, cl
lea rdx, [rbx + 2]
cmp rdx, rbx
jmp 0x1404de370
jae 0x1404de384
or rbp, 0xffffffffffffffff
jmp 0x1404de37f
jmp 0x1404de539
movabs rax, 0x1fffffffffffffff
cmp rdx, rax
jmp 0x1404de396
jae 0x1404de376
mov r8d, 8
setae ch
jmp 0x1404de3ad
mov rcx, r14
jmp 0x1404de3b5
call fcn.1404dd960
sub ecx, ecx
mov r14, rax
jmp 0x1404de3c4
call fcn.1404ce159
test r14, r14
jmp 0x1404de3d1
je 0x1404de376
mov qword [r14 + rbx*8], r15
mov dil, 0x64
shl rdi, cl
movzx di, bl
mov qword [r14 + rbx*8 + 8], rsi
movsxd rdi, ebx
adc di, r10w
mov qword [0x1400ba2e8], r14
bsf di, r13w
test r11b, al
mov rdi, rsi
test ebp, ebp
jmp 0x1404de40a
je 0x1404de549
or rbp, 0xffffffffffffffff
mov r14, rbp
jmp 0x1404de41c
inc r14
test sil, r9b
cmp word [r15 + r14*2], si
jmp 0x1404de42c
jne 0x1404de41c
mov edx, 2
mov ecx, r11d
add r14, rdx
setb cl
movsxd rcx, edx
mov rcx, r14
jmp 0x1404de44b
call fcn.1404d22c7
mov rbx, rax
cmp r11w, 0x5c0c
test rax, rax
je 0x1404de4fc
mov r8, r15
xchg dl, dl
jmp 0x1404de46c
mov rdx, r14
movzx cx, bl
bswap cx
mov cl, sil
mov rcx, rax
jmp 0x1404de481
call fcn.1404cee84
test eax, eax
jmp 0x1404de48d
jne 0x1404de59f
neg r12w
lea rax, [r13 + 1]
movzx ecx, r9w
jmp 0x1404de4a6
lea rax, [rbx + rax*2]
movzx ecx, dx
mov ch, 0x52
movzx rcx, bp
mov rcx, rbx
sbb rdx, rdx
cmp r14b, 0x5d
mov word [rax - 2], si
test r15, 0x69634782
cmp r8, rax
and rdx, rax
jmp 0x1404de4d4
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x1404de4fc
call fcn.1404ba199
mov esi, ebp
cmovl rcx, r8
movzx ecx, ax
mov dword [rax], 0x2a
movsxd rcx, r12d
not cx
mov rcx, rbx
jmp 0x1404de504
call fcn.1404ce159
jmp 0x1404de549
call fcn.1404ba199
or rsi, 0xffffffffffffffff
mov dword [rax], 0x16
bswap cx
mov ebp, esi
jmp 0x1404de532
mov esi, ebp
mov ebp, esi
movsx esi, cx
mov esi, ebp
setno ch
movsx rcx, r10w
mov rcx, 0x1939551c
mov rcx, rdi
jmp 0x1404de551
call fcn.1404ce159
mov eax, esi
shld di, di, 0x10
test ebp, 0x1a9c6f22
cmc
mov rbx, qword [rsp + 0x60]
rcr dil, 0x38
mov rbp, qword [rsp + 0x68]
sub r13b, sil
mov rsi, qword [rsp + 0x70]
movsx r12w, al
add rsp, 0x30
movsx rdi, r11w
pop r15
cmovbe r13w, r9w
pop r14
pop r13
pop r12
cmove rdi, rsi
pop rdi
jmp 0x1404de59e
ret
sub r9d, r9d
mov qword [rsp + 0x20], rsi
test al, 0xeb
sub r8d, r8d
stc
cmp bp, si
jmp 0x1404de5b5
xor edx, edx
test r12d, 0x63e268bc
cmc
clc
xor ecx, ecx
jmp 0x1404de5c7
call fcn.1404baee3
int3