Function at 0x1800bef10
Capabilities:
Query environment variable

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov qword [rbp - 0x71], 0xfffffffffffffffe
mov qword [rsp + 0x110], rbx
mov rax, qword [0x1802a8008]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rcx, str.APPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov qword [rbp + 0xf], 0xf
xor ebx, ebx
mov qword [rbp + 7], rbx
mov byte [rbp - 9], bl
cmp byte [rax], bl
jne 0x1800bef63
mov r8d, ebx
jmp 0x1800bef70
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], bl
jne 0x1800bef67
mov rdx, rax
lea rcx, [rbp - 9]
call fcn.18003d620
nop
lea r8, str..exFilLocat_
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x29]
call fcn.1800a97a0
nop
mov qword [rbp - 0x51], 0xf
mov qword [rbp - 0x59], rbx
mov byte [rbp - 0x69], 0
mov r8d, 0xe
lea rdx, str.exFilLocat.ytd
lea rcx, [rbp - 0x69]
call fcn.18003d620
nop
lea r8, [rbp - 0x69]
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x49]
call fcn.1800ce630
nop
lea rcx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae rcx, qword [rbp - 0x49]
lea rdx, [rbp + 0x17]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jne 0x1800bf015
lea r9, [rbp - 0x69]
cmp qword [rbp - 0x51], 0x10
cmovae r9, qword [rbp - 0x69]
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae rdx, qword [rbp - 0x49]
mov byte [rsp + 0x20], al
mov r8b, 1
lea rcx, [rbp - 0x79]
call qword [0x18034e908]
nop
mov rax, qword [rbp - 0x31]
cmp rax, 0x10
jb 0x1800bf06f
inc rax
mov rcx, qword [rbp - 0x49]
cmp rax, 0x1000
jb 0x1800bf06a
test cl, 0x1f
je 0x1800bf03a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800bf04a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800bf05a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x1800bf067
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.1801e6174
mov qword [rbp - 0x31], 0xf
mov qword [rbp - 0x39], rbx
mov byte [rbp - 0x49], 0
mov rax, qword [rbp - 0x51]
cmp rax, 0x10
jb 0x1800bf0d9
inc rax
mov rcx, qword [rbp - 0x69]
cmp rax, 0x1000
jb 0x1800bf0d4
test cl, 0x1f
je 0x1800bf0a4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800bf0b4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800bf0c4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x1800bf0d1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.1801e6174
mov qword [rbp - 0x51], 0xf
mov qword [rbp - 0x59], rbx
mov byte [rbp - 0x69], 0
mov rax, qword [rbp - 0x11]
cmp rax, 0x10
jb 0x1800bf143
inc rax
mov rcx, qword [rbp - 0x29]
cmp rax, 0x1000
jb 0x1800bf13e
test cl, 0x1f
je 0x1800bf10e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800bf11e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800bf12e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x1800bf13b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.1801e6174
mov qword [rbp - 0x11], 0xf
mov qword [rbp - 0x19], rbx
mov byte [rbp - 0x29], 0
mov rax, qword [rbp + 0xf]
cmp rax, 0x10
jb 0x1800bf1ad
inc rax
mov rcx, qword [rbp - 9]
cmp rax, 0x1000
jb 0x1800bf1a8
test cl, 0x1f
je 0x1800bf178
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800bf188
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800bf198
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x1800bf1a5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.1801e6174
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1801e6190
mov rbx, qword [rsp + 0x110]
add rsp, 0x100
pop rbp
ret