Function at 0x1400088b4
Capabilities:
Query environment variable

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x650
mov qword [rsp + 0xd0], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rax, qword [0x14002b138]
xor rax, rsp
mov qword [rsp + 0x640], rax
mov r12, r8
mov rbp, rdx
mov r15, rcx
xor edi, edi
mov dword [rsp + 0x40], edi
lea r8, [rsp + 0x40]
lea rdx, [0x140002598]
lea rcx, [r11 - 0x5b0]
call fcn.1400214f4
nop
mov dword [rsp + 0x44], edi
lea r8, [rsp + 0x44]
lea rdx, [0x140002500]
lea rcx, [rsp + 0xe8]
call fcn.1400214f4
mov rsi, rdi
mov r8d, 0x104
lea rdx, [rsp + 0x430]
lea rcx, [0x140002520]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov bl, 4
lea r13, [0x140002070]
lea r14, [0x14002b160]
cmp eax, edi
je 0x1400089c5
cmp eax, 0x104
ja 0x1400089c5
mov word [rsp + 0x636], di
lea rcx, [rsp + 0x430]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
cmp rax, rdi
jne 0x1400089f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r9d, ax
or r9d, 0x80070000
cmp eax, edi
cmovle r9d, eax
mov dword [rsp + 0x44], r9d
mov rcx, qword [0x14002b160]
cmp rcx, r14
je 0x1400089f5
test byte [rcx + 0x1c], bl
je 0x1400089f5
lea edx, [rdi + 0xb]
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140006078
jmp 0x1400089f5
mov dword [rsp + 0x44], 0x80004005
mov rcx, qword [0x14002b160]
cmp rcx, r14
je 0x1400089f5
test byte [rcx + 0x1c], bl
je 0x1400089f5
mov edx, 0xa
mov r9d, 0x80004005
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140006078
lea rcx, [rsp + 0xe8]
call fcn.140021548
cmp rsi, rdi
je 0x140008e25
lea rdx, [0x1400025c0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r14, rax
cmp rax, rdi
jne 0x140008a75
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r9d, ax
or r9d, 0x80070000
cmp eax, edi
cmovle r9d, eax
mov dword [rsp + 0x40], r9d
mov rcx, qword [0x14002b160]
lea rax, [0x14002b160]
cmp rcx, rax
je 0x140008e1c
test byte [rcx + 0x1c], bl
je 0x140008e1c
mov edx, 0xc
mov r8, r13
mov rcx, qword [rcx + 0x10]
call fcn.140006078
jmp 0x140008e1c
mov byte [rsp + 0x100], dil
mov r13d, edi
call fcn.140008710
mov ecx, 0xfde9
cmp al, dil
je 0x140008a99
mov r13d, ecx
mov ebx, 0x80
jmp 0x140008a9e
mov ebx, 0x400
or rdx, 0xffffffffffffffff
cmp r12, rdi
je 0x140008b57
xor eax, eax
mov rcx, rdx
mov rdi, r12
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x140008b55
xor edi, edi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x104
lea rax, [rsp + 0x100]
mov qword [rsp + 0x20], rax
mov r9d, edx
mov r8, r12
mov edx, 0x600
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [rsp + 0x203], dil
cmp eax, edi
jne 0x140008b57
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r8d, ax
or r8d, 0x80070000
cmp eax, edi
cmovle r8d, eax
mov dword [rsp + 0x40], r8d
mov rcx, qword [0x14002b160]
lea rax, [0x14002b160]
cmp rcx, rax
je 0x140008b5c
test byte [rcx + 0x1c], 4
je 0x140008b5c
lea edx, [rdi + 0xd]
mov r9d, r8d
lea r8, [0x140002070]
mov rcx, qword [rcx + 0x10]
call fcn.140006078
mov r8d, dword [rsp + 0x40]
jmp 0x140008b5c
xor edi, edi
mov r8d, dword [rsp + 0x40]
cmp r8d, edi
jl 0x140008e1c
cmp rbp, rdi
je 0x140008c33
xor eax, eax
or rdx, 0xffffffffffffffff
mov rcx, rdx
mov rdi, rbp
repne scasw ax, word [rdi]
not rcx
cmp rcx, 1
je 0x140008c28
xor edi, edi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x104
lea rax, [rsp + 0x210]
mov qword [rsp + 0x20], rax
mov r9d, edx
mov r8, rbp
mov edx, ebx
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [rsp + 0x313], dil
cmp eax, edi
jne 0x140008c1a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx r8d, ax
or r8d, 0x80070000
cmp eax, edi
cmovle r8d, eax
mov dword [rsp + 0x40], r8d
mov rcx, qword [0x14002b160]
lea rbx, [0x14002b160]
cmp rcx, rbx
je 0x140008c3a
test byte [rcx + 0x1c], 4
je 0x140008c3a
lea edx, [rdi + 0xe]
mov r9d, r8d
lea r8, [0x140002070]
mov rcx, qword [rcx + 0x10]
call fcn.140006078
mov r8d, dword [rsp + 0x40]
jmp 0x140008c3a
mov r8d, dword [rsp + 0x40]
lea rbx, [0x14002b160]
jmp 0x140008c3a
xor edi, edi
lea rbx, [0x14002b160]
jmp 0x140008c3a
lea rbx, [0x14002b160]
cmp r8d, edi
jl 0x140008e1c
mov rcx, r12
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
cmp rax, rdi
je 0x140008ce2
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x104
lea rcx, [rsp + 0x320]
mov qword [rsp + 0x20], rcx
or r9d, 0xffffffff
mov r8, rax
mov edx, 0x600
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [rsp + 0x423], dil
cmp eax, edi
jne 0x140008cdc
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
cmp eax, edi
cmovle ecx, eax
mov dword [rsp + 0x40], ecx
mov rax, qword [0x14002b160]
cmp rax, rbx
je 0x140008d26
test byte [rax + 0x1c], 4
je 0x140008d26
mov edx, 0xf
mov r9d, ecx
lea r8, [0x140002070]
mov rcx, qword [rax + 0x10]
call fcn.140006078
mov ecx, dword [rsp + 0x40]
jmp 0x140008d26
mov ecx, dword [rsp + 0x40]
jmp 0x140008d26
mov rcx, qword [0x14002b160]
cmp rcx, rbx
je 0x140008d0e
test byte [rcx + 0x1c], 4
je 0x140008d0e
mov edx, 0x10
mov r9d, dword [rsp + 0x40]
lea r8, [0x140002070]
mov rcx, qword [rcx + 0x10]
call fcn.140006078
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, ax
or ecx, 0x80070000
cmp eax, edi
cmovle ecx, eax
mov dword [rsp + 0x40], ecx
cmp ecx, edi
jl 0x140008e1c
xor edx, edx
lea r8d, [rdx + 0x58]
lea rcx, [rsp + 0x78]
call sub.msvcrt.dll_memset
xor edx, edx
lea r8d, [rdx + 0x24]
lea rcx, [rsp + 0x4c]
call sub.msvcrt.dll_memset
mov dword [rsp + 0x48], edi
mov dword [rsp + 0x4c], edi
or dword [rsp + 0x50], 0xffffffff
lea rax, [rsp + 0x100]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x320]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rdi
mov eax, edi
mov ecx, 0xfde9
cmp r13d, ecx
cmove eax, ecx
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x210]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0x98], rdi
mov dword [rsp + 0xa0], edi
mov qword [rsp + 0xa8], rdi
mov dword [rsp + 0xb0], edi
mov qword [rsp + 0xb8], rdi
mov dword [rsp + 0xc0], 1
lea rax, [rsp + 0x48]
mov qword [rsp + 0xc8], rax
mov dword [rsp + 0x20], edi
mov r9d, 9
lea r8, [rsp + 0x70]
mov rdx, r15
xor ecx, ecx
call r14
cmp eax, edi
je 0x140008e18
cmp eax, 1
je 0x140008e18
mov dword [rsp + 0x40], 0x80004005
jmp 0x140008e1c
mov dword [rsp + 0x40], edi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov edi, dword [rsp + 0x40]
lea rcx, [rsp + 0xd8]
call fcn.140021548
mov eax, edi
mov rcx, qword [rsp + 0x640]
xor rcx, rsp
call fcn.1400247e0
mov rbx, qword [rsp + 0x6a8]
add rsp, 0x650
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret