Function at 0x1400c45ec
Capabilities:
Query environment variable
Read file on windows

Disassembly:
push r13
push r14
push r15
mov eax, 0x2770
call fcn.140100e60
sub rsp, rax
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x2798], rbx
mov qword [rsp + 0x27a0], rdi
mov qword [rsp + 0x27a8], r12
mov rax, qword [0x140191630]
xor rax, rsp
mov qword [rsp + 0x2760], rax
mov r12b, cl
xor edi, edi
test dl, dl
je 0x1400c4656
cmp word [0x1401ab1ce], di
je 0x1400c46bb
cmp qword [0x1401f6948], rdi
je 0x1400c46bb
mov word [0x1401ab1ce], di
jmp 0x1400c46bb
mov cl, 1
call fcn.1400cae38
mov dword [0x1401ae31c], 3
mov qword [0x14019b788], rdi
mov cl, byte [0x14019a720]
test cl, cl
jne 0x1400c47b5
xor r8d, r8d
lea rdx, [0x1401b6738]
lea rcx, [0x1401c5f50]
call fcn.140044c78
cmp byte [0x1401c6fce], dil
je 0x1400c46bb
mov eax, dword [0x1401ae318]
mov r14d, 4
cmp qword [0x1401b6768], 1
cmova eax, r14d
mov dword [0x1401ae318], eax
jmp 0x1400c46c1
mov r14d, 4
mov cl, byte [0x14019a720]
test cl, cl
jne 0x1400c47bb
cmp word [0x1401b5732], di
jne 0x1400c47bb
mov r12b, dil
mov ebx, 0x800
mov r8d, ebx
lea rdx, [0x1401b5732]
mov ecx, dword [0x1401b06c8]
call fcn.1400ca8a8
mov dword [rsp + 0x20], ebx
lea r13, [0x1401413c8]
mov r9, r13
lea r8, [rsp + 0x1360]
lea rdx, str.DefFolder
lea rcx, [0x140142090]
call fcn.1400a8668
cmp word [rsp + 0x1360], di
jne 0x1400c474e
cmp byte [0x1401c6fce], dil
je 0x1400c478c
mov edx, ebx
lea rcx, [rsp + 0x1360]
call fcn.14003ec88
cmp word [rsp + 0x1360], di
je 0x1400c478c
mov rdx, rbx
lea rcx, [rsp + 0x1360]
call fcn.14007f660
mov r8, rbx
lea rdx, [0x1401b5732]
lea rcx, [rsp + 0x1360]
call fcn.140096d58
mov r8, rbx
lea rdx, [rsp + 0x1360]
lea rcx, [0x1401b5732]
call fcn.140096d80
cmp word [0x1401a91c8], di
setne r8b
mov r9d, dword [0x1401b06c8]
mov rdx, rbx
lea rcx, [0x1401b5732]
call fcn.1400ce654
mov cl, byte [0x14019a720]
jmp 0x1400c47c7
mov r14d, 4
lea r13, [0x1401413c8]
mov ebx, 0x800
mov eax, dword [0x1401ae318]
mov edx, 2
test eax, eax
cmove eax, edx
mov dword [0x1401ae318], eax
test cl, cl
je 0x1400c4941
mov r15d, dword [0x1401c30e4]
cmp r15d, 1
jbe 0x1400c4831
cmp dword [0x1401ae2e4], 3
je 0x1400c4d61
lea ecx, [rdx + 0x63]
call fcn.140090bf0
mov rbx, rax
mov ecx, 0x1fd
call fcn.140090bf0
mov rdx, rax
mov r9d, 0x30
mov r8, rbx
mov rcx, qword [0x14019a6f0]
call fcn.1400d1204
jmp 0x1400c4d61
mov r8, rbx
lea rdx, [0x1401b5732]
lea rcx, [0x1401c30e0]
call fcn.14000655c
mov r8, rbx
lea rdx, [0x1401ac1e0]
lea rcx, [0x1401c30e0]
call fcn.140006af8
cmp word [0x1401ac1e0], di
je 0x1400c4875
mov rdx, rbx
lea rcx, [0x1401ac1e0]
call fcn.14007f660
mov byte [0x1401ae389], dil
lea rdx, [rsp + 0x110]
lea rcx, [0x1401c30e0]
call fcn.140006b18
mov eax, dword [rsp + 0x258]
mov dword [0x1401b06c8], eax
mov qword [rsp + 0x1320], rdi
mov qword [rsp + 0x1328], rdi
mov qword [rsp + 0x1330], rdi
xor r8d, r8d
lea rdx, [rsp + 0x310]
lea rcx, [0x1401b5732]
call fcn.14007189c
test al, al
je 0x1400c48db
cmp qword [rsp + 0x1310], 0x18
je 0x1400c48fc
cmp dword [rsp + 0x258], edi
jne 0x1400c48f5
cmp byte [rsp + 0x190], dil
mov byte [0x1401ae370], 1
jne 0x1400c48fc
mov byte [0x1401ae370], dil
test r15d, r15d
jne 0x1400c490a
cmp dword [rsp + 0x2e0], edi
je 0x1400c4918
movzx eax, byte [rsp + 0x252]
mov dword [0x1401ae308], eax
cmp qword [rsp + 0x248], rdi
je 0x1400c493a
mov r8, rbx
lea rdx, [0x140141bd8]
lea rcx, [0x1401a91c8]
call fcn.140096d80
jmp 0x1400c4941
mov word [0x1401a91c8], di
mov rcx, qword [0x14019a6f0]
call qword [sym.imp.USER32.dll_IsWindowVisible]
neg eax
sbb rcx, rcx
and rcx, qword [0x14019a6f0]
xor r8d, r8d
mov dl, r12b
call fcn.1400c7b40
test al, al
je 0x1400c4d42
mov al, byte [0x1401f6967]
neg al
sbb ecx, ecx
and ecx, dword [0x1401f6968]
mov dword [0x1401ae2f8], ecx
mov rcx, qword [0x1401f6948]
test rcx, rcx
je 0x1400c4996
call fcn.1400cef7c
jmp 0x1400c49ba
cmp byte [0x14019a720], dil
je 0x1400c49ba
cmp qword [rsp + 0x248], rdi
je 0x1400c49ba
cmp word [0x1401a91c8], 0x2a
jne 0x1400c49ba
mov word [0x1401a91c8], di
cmp qword [0x1401b6768], rdi
jne 0x1400c49f7
mov ecx, 0x65
call fcn.140090bf0
mov rbx, rax
mov ecx, 0x14b
call fcn.140090bf0
mov rdx, rax
mov r9d, 0x30
mov r8, rbx
mov rcx, qword [0x14019a6f0]
call fcn.1400d1204
jmp 0x1400c4d42
cmp word [0x1401ab1ce], di
je 0x1400c4ad6
cmp dword [0x1401ac1d0], edi
jne 0x1400c4ad6
lea rdx, [0x140146338]
lea rcx, [0x1401ab1ce]
call fcn.1400712cc
mov r12, rax
test rax, rax
je 0x1400c4ad6
mov r9, rax
mov edx, 1
mov r8d, 0x400
lea rcx, [rsp + 0x2360]
call fcn.14012ada8
mov r15, rax
mov rcx, r12
call fcn.1401278d8
mov eax, 0x3ff
cmp r15, rax
cmovb rax, r15
cmp rax, 0x400
jae 0x1400c4ad0
mov byte [rsp + rax + 0x2360], dil
mov dword [rsp + 0x40], 0x30c
test r15, r15
je 0x1400c4aa4
lea r8, [rsp + 0x40]
mov edx, r15d
lea rcx, [rsp + 0x2360]
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x1400c4aa4
mov dword [0x1401ac1d0], 3
jmp 0x1400c4ad6
lea rcx, [rsp + 0x2360]
call fcn.1400965a0
cmp eax, 2
jne 0x1400c4abf
mov dword [0x1401ac1d0], r14d
jmp 0x1400c4ad6
cmp eax, 1
jne 0x1400c4ad6
mov dword [0x1401ac1d0], 2
jmp 0x1400c4ad6
call fcn.140100c34
nop
lea rcx, [rsp + 0x50]
call fcn.140096db4
nop
lea rcx, [0x1401b6738]
call fcn.140096ff4
mov r15d, 0x25
lea rcx, [0x1401b6738]
call fcn.140096e64
mov r14, rax
test rax, rax
je 0x1400c4c0d
mov r9, rbx
lea r8, [rsp + 0x1360]
mov rdx, rax
lea rcx, [0x1401c5f50]
call fcn.1400453b4
cmp word [r14], 0x40
jne 0x1400c4b92
lea rcx, [rsp + 0x1360]
call fcn.140070398
test al, al
jne 0x1400c4b92
lea rdx, [r14 + 2]
mov r9, rbx
lea r8, [rsp + 0x1360]
lea rcx, [0x1401c5f50]
call fcn.1400453b4
mov byte [rsp + 0x38], 1
mov byte [rsp + 0x30], 1
mov byte [rsp + 0x28], 1
mov eax, dword [0x1401ac1d4]
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x1360]
call fcn.140071380
test al, al
je 0x1400c4b92
jmp 0x1400c4af3
mov edx, r15d
mov rcx, r14
call fcn.140120300
test rax, rax
je 0x1400c4bf9
mov edx, r15d
lea rcx, [rax + 2]
call fcn.140120300
test rax, rax
je 0x1400c4bf9
lea rcx, [rsp + 0x1360]
call fcn.140070398
test al, al
jne 0x1400c4bf9
mov r8d, ebx
lea rdx, [rsp + 0x310]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x7ff
ja 0x1400c4bf9
mov r8, rbx
lea rdx, [rsp + 0x310]
lea rcx, [rsp + 0x1360]
call fcn.140096d80
lea rdx, [rsp + 0x1360]
lea rcx, [rsp + 0x50]
call fcn.140096df0
jmp 0x1400c4b8d
lea rdx, [rsp + 0x50]
lea rcx, [0x1401b6738]
call fcn.1400c4588
nop
lea rcx, [rsp + 0x50]
call fcn.140004e58
nop
jmp 0x1400c4c3a
mov r9, rbx
lea r8, [0x1401b5732]
lea rdx, [0x1401b5732]
lea rcx, [0x1401c5f50]
call fcn.1400453b4
mov al, byte [0x1401ad2e0]
mov byte [0x1401c5b40], al
lea rcx, [0x1401c5b10]
call fcn.1400b1224
cmp byte [0x1401b4700], dil
je 0x1400c4c7f
call fcn.1400c562c
jmp 0x1400c4c91
mov dl, byte [0x1401b36db]
lea rcx, [0x1401c30e0]
call fcn.1400051dc
cmp qword [0x1401f6948], rdi
je 0x1400c4ca6
lea rcx, [0x1401ab1ce]
call fcn.1400700b0
cmp dword [0x14019a724], 1
je 0x1400c4d42
cmp byte [0x14019a720], dil
je 0x1400c4cca
lea rcx, [0x1401c5f50]
call fcn.140048d5c
jmp 0x1400c4d42
cmp byte [0x1401ae36e], dil
je 0x1400c4cdf
lea rcx, [0x14019b7c8]
call fcn.1400b72bc
mov r8, rbx
lea rdx, [rsp + 0x1360]
lea rcx, [0x1401c5f50]
call fcn.140044bf0
lea rax, [rsp + 0x1360]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], di
jne 0x1400c4d02
lea rdx, [0x1401b5732]
lea rcx, [rsp + 0x1360]
call fcn.140099f78
test eax, eax
jne 0x1400c4d33
lea rcx, [0x1401b5732]
call fcn.140081020
mov r13, rax
mov rdx, r13
lea rcx, [0x1401c5f50]
call fcn.140048180
mov rcx, qword [0x1401f6948]
call fcn.140100b1c
mov byte [0x1401c5b40], dil
lea rcx, [0x1401c5b10]
call fcn.1400b1224
mov rcx, qword [rsp + 0x2760]
xor rcx, rsp
call fcn.140100ed0
lea r11, [rsp + 0x2770]
mov rbx, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret