Function at 0x140003640
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x518
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x490], 0xfffffffffffffffe
xorps xmm0, xmm0
movaps xmmword [rbp + 0x470], xmm0
mov qword [rbp + 0x480], 0
nop
mov qword [rbp + 0x488], 7
lea rsi, [rbp - 0x50]
mov r8d, 0x208
mov rcx, rsi
xor edx, edx
call fcn.14006dd10
lea rcx, str.CommonProgramFiles
mov rdx, rsi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
nop
movaps xmm0, xmmword [0x1400701f0]
movaps xmmword [rbp + 0x410], xmm0
movaps xmm0, xmmword [str._r_4824__r]
movaps xmmword [rbp + 0x400], xmm0
movabs rax, 0xd00000022
mov qword [rbp + 0x420], rax
lea rcx, [rbp - 0x50]
call fcn.1400441fc
mov rsi, rax
mov r14, qword [rbp + 0x488]
cmp r14, rax
movabs rbx, 0x7fffffffffffffff
jae 0x1400037e1
cmp rsi, rbx
jae 0x14000418a
mov rax, rsi
or rax, 7
movabs r15, 0x7ffffffffffffffe
mov rcx, 0xfffffffffffffffe
cmp rax, r15
ja 0x140003761
mov rdx, r14
shr rdx, 1
mov r8, r15
sub r8, rdx
cmp r8, r14
jb 0x140003761
add rdx, r14
cmp rax, rdx
mov r15, rdx
cmova r15, rax
mov rax, r15
inc rax
js 0x1400041a3
lea rcx, [rax + rax]
cmp rax, 0x800
jb 0x1400040d4
call fcn.140005860
mov rdi, rax
nop
mov qword [rbp + 0x480], rsi
mov qword [rbp + 0x488], r15
mov r8, rsi
add r8, rsi
lea rdx, [rbp - 0x50]
mov rcx, rax
call fcn.14006d670
mov word [rdi + rsi*2], 0
cmp r14, 8
jb 0x1400037d7
nop
mov rcx, qword [rbp + 0x470]
lea rdx, [r14*2 + 2]
cmp rdx, 0x1000
jb 0x1400037d2
nop
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x1400041a8
add r14, r14
add r14, 0x29
mov rdx, r14
mov rcx, rax
call fcn.14001ef80
nop
mov qword [rbp + 0x470], rdi
jmp 0x140003816
cmp r14, 8
jb 0x1400037f0
mov rdi, qword [rbp + 0x470]
jmp 0x1400037f7
lea rdi, [rbp + 0x470]
mov qword [rbp + 0x480], rsi
mov r8, rsi
add r8, rsi
lea rdx, [rbp - 0x50]
mov rcx, rdi
call fcn.14006d670
mov word [rdi + rsi*2], 0
lea rsi, [rbp + 0x1c0]
lea rdx, [rbp + 0x400]
mov rcx, rsi
mov r8d, 0xa
call fcn.140006940
nop
mov r8, qword [rbp + 0x1d0]
cmp qword [rbp + 0x1d8], 8
jb 0x14000384b
mov rsi, qword [rbp + 0x1c0]
mov rax, qword [rbp + 0x480]
mov rcx, qword [rbp + 0x488]
mov rdx, rcx
sub rdx, rax
cmp rdx, r8
jae 0x14000387e
nop
mov qword [rsp + 0x20], r8
lea rcx, [rbp + 0x470]
mov rdx, r8
mov r9, rsi
call fcn.140005e10
jmp 0x1400038b5
lea rdi, [rax + r8]
mov qword [rbp + 0x480], rdi
cmp rcx, 8
jb 0x140003898
mov r14, qword [rbp + 0x470]
jmp 0x14000389f
lea r14, [rbp + 0x470]
lea rcx, [r14 + rax*2]
add r8, r8
mov rdx, rsi
call fcn.14006d670
mov word [r14 + rdi*2], 0
nop
mov rax, qword [rbp + 0x1d8]
cmp rax, 8
jb 0x140003904
nop
mov rcx, qword [rbp + 0x1c0]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x1400038ff
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000418f
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
lea rdx, [0x14008f210]
lea rsi, [rbp + 0x1c0]
mov rcx, rsi
mov r8d, 9
call fcn.140006940
nop
mov r8, qword [rbp + 0x1d0]
cmp qword [rbp + 0x1d8], 8
jb 0x140003939
mov rsi, qword [rbp + 0x1c0]
mov rax, qword [rbp + 0x480]
mov rcx, qword [rbp + 0x488]
mov rdx, rcx
sub rdx, rax
cmp rdx, r8
jae 0x14000396c
nop
mov qword [rsp + 0x20], r8
lea rcx, [rbp + 0x470]
mov rdx, r8
mov r9, rsi
call fcn.140005e10
jmp 0x1400039a3
lea rdi, [rax + r8]
mov qword [rbp + 0x480], rdi
cmp rcx, 8
jb 0x140003986
mov r14, qword [rbp + 0x470]
jmp 0x14000398d
lea r14, [rbp + 0x470]
lea rcx, [r14 + rax*2]
add r8, r8
mov rdx, rsi
call fcn.14006d670
mov word [r14 + rdi*2], 0
nop
mov rax, qword [rbp + 0x1d8]
cmp rax, 8
jb 0x1400039f2
nop
mov rcx, qword [rbp + 0x1c0]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x1400039ed
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140004194
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
lea rdx, [rbp + 0x1c0]
xor ecx, ecx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movaps xmmword [rbp + 0x460], xmm0
movaps xmmword [rbp + 0x450], xmm0
lea rcx, [rbp + 0x1c0]
call fcn.1400441fc
cmp rax, rbx
jae 0x140004185
mov rsi, rax
cmp rax, 7
ja 0x140003a70
nop
mov qword [rbp + 0x460], rsi
mov qword [rbp + 0x468], 7
lea r8, [rsi + rsi]
lea rcx, [rbp + 0x450]
lea rdx, [rbp + 0x1c0]
call fcn.14006d670
lea rax, [rsi*2 + 0x450]
add rax, rbp
jmp 0x140003af3
nop
mov qword [rbp + 0x468], 7
mov rax, rsi
or rax, 7
movabs rbx, 0x7ffffffffffffffe
mov rcx, 0xfffffffffffffffe
cmp rax, rbx
ja 0x140003ab7
cmp rax, 0xb
mov ebx, 0xa
cmovae rbx, rax
lea rcx, [rbx*2 + 2]
cmp rbx, 0x7ff
jb 0x140003abe
call fcn.140005860
jmp 0x140003ac3
call fcn.14001ef3c
mov rdi, rax
nop
mov qword [rbp + 0x450], rax
mov qword [rbp + 0x460], rsi
mov qword [rbp + 0x468], rbx
lea r8, [rsi + rsi]
lea rdx, [rbp + 0x1c0]
mov rcx, rax
call fcn.14006d670
lea rax, [rdi + rsi*2]
nop
mov word [rax], 0
nop
mov rcx, qword [rbp + 0x460]
cmp qword [rbp + 0x468], 8
jb 0x140003b14
mov rax, qword [rbp + 0x450]
jmp 0x140003b1b
lea rax, [rbp + 0x450]
cmp rcx, 0xc
jb 0x140003c09
lea rdx, [rax + rcx*2]
add rdx, 0xffffffffffffffe8
lea r8, [rax + rcx*2]
add r8, 0xffffffffffffffea
cmp r8, rax
je 0x140003c18
mov r9, rax
mov rsi, r8
sub rsi, r9
sar rsi, 1
xor r11d, r11d
xor r10d, r10d
nop
cmp word [r9 + r11*2], 0x43
je 0x140003b70
add r10, 0xfffffffffffffffe
inc r11
cmp rsi, r11
jne 0x140003b50
jmp 0x140003c03
nop
cmp word [r9 + r11*2 + 2], 0x6f
jne 0x140003bf0
nop
cmp word [r9 + r11*2 + 4], 0x6d
jne 0x140003bf0
nop
cmp word [r9 + r11*2 + 6], 0x6d
jne 0x140003bf0
nop
cmp word [r9 + r11*2 + 8], 0x6f
jne 0x140003bf0
nop
cmp word [r9 + r11*2 + 0xa], 0x6e
jne 0x140003bf0
nop
cmp word [r9 + r11*2 + 0xc], 0x20
jne 0x140003bf0
nop
cmp word [r9 + r11*2 + 0xe], 0x46
jne 0x140003bf0
nop
cmp word [r9 + r11*2 + 0x10], 0x69
jne 0x140003bf0
nop
cmp word [r9 + r11*2 + 0x12], 0x6c
jne 0x140003bf0
nop
cmp word [r9 + r11*2 + 0x14], 0x65
jne 0x140003bf0
nop
cmp word [r9 + r11*2 + 0x16], 0x73
je 0x140004161
nop word cs:[rax + rax]
sub r9, r10
lea r10, [r9 + 2]
cmp r9, rdx
mov r9, r10
jne 0x140003b41
cmp rcx, 0xc
jae 0x140003c18
cmp rcx, 8
jae 0x140003cf8
jmp 0x140003e53
cmp r8, rax
je 0x140003cf8
mov r9, rax
mov rsi, r8
sub rsi, r9
sar rsi, 1
xor r11d, r11d
xor r10d, r10d
nop word cs:[rax + rax]
nop
cmp word [r9 + r11*2], 0x63
je 0x140003c60
add r10, 0xfffffffffffffffe
inc r11
cmp rsi, r11
jne 0x140003c40
jmp 0x140003c09
nop
cmp word [r9 + r11*2 + 2], 0x6f
jne 0x140003ce0
nop
cmp word [r9 + r11*2 + 4], 0x6d
jne 0x140003ce0
nop
cmp word [r9 + r11*2 + 6], 0x6d
jne 0x140003ce0
nop
cmp word [r9 + r11*2 + 8], 0x6f
jne 0x140003ce0
nop
cmp word [r9 + r11*2 + 0xa], 0x6e
jne 0x140003ce0
nop
cmp word [r9 + r11*2 + 0xc], 0x20
jne 0x140003ce0
nop
cmp word [r9 + r11*2 + 0xe], 0x66
jne 0x140003ce0
nop
cmp word [r9 + r11*2 + 0x10], 0x69
jne 0x140003ce0
nop
cmp word [r9 + r11*2 + 0x12], 0x6c
jne 0x140003ce0
nop
cmp word [r9 + r11*2 + 0x14], 0x65
jne 0x140003ce0
nop
cmp word [r9 + r11*2 + 0x16], 0x73
je 0x140004173
nop word cs:[rax + rax]
sub r9, r10
lea r10, [r9 + 2]
cmp r9, rdx
mov r9, r10
jne 0x140003c24
jmp 0x140003c09
lea rdx, [rax + rcx*2]
add rdx, 0xfffffffffffffff0
lea rcx, [rax + rcx*2]
add rcx, 0xfffffffffffffff2
cmp rcx, rax
je 0x140003db3
mov r8, rax
mov r11, rcx
sub r11, r8
sar r11, 1
xor r10d, r10d
xor r9d, r9d
nop word cs:[rax + rax]
nop
cmp word [r8 + r10*2], 0x43
je 0x140003d50
add r9, 0xfffffffffffffffe
inc r10
cmp r11, r10
jne 0x140003d30
jmp 0x140003db3
nop
cmp word [r8 + r10*2 + 2], 0x6f
jne 0x140003da0
nop
cmp word [r8 + r10*2 + 4], 0x6d
jne 0x140003da0
nop
cmp word [r8 + r10*2 + 6], 0x6d
jne 0x140003da0
nop
cmp word [r8 + r10*2 + 8], 0x6f
jne 0x140003da0
nop
cmp word [r8 + r10*2 + 0xa], 0x6e
jne 0x140003da0
nop
cmp word [r8 + r10*2 + 0xc], 0x7e
jne 0x140003da0
nop
cmp word [r8 + r10*2 + 0xe], 0x31
je 0x140004129
nop word [rax + rax]
sub r8, r9
lea r9, [r8 + 2]
cmp r8, rdx
mov r8, r9
jne 0x140003d14
cmp rcx, rax
je 0x140003e53
mov r8, rax
mov r11, rcx
sub r11, r8
sar r11, 1
xor r10d, r10d
xor r9d, r9d
nop
nop
cmp word [r8 + r10*2], 0x63
je 0x140003df0
add r9, 0xfffffffffffffffe
inc r10
cmp r11, r10
jne 0x140003dd0
jmp 0x140003e53
nop
cmp word [r8 + r10*2 + 2], 0x6f
jne 0x140003e40
nop
cmp word [r8 + r10*2 + 4], 0x6d
jne 0x140003e40
nop
cmp word [r8 + r10*2 + 6], 0x6d
jne 0x140003e40
nop
cmp word [r8 + r10*2 + 8], 0x6f
jne 0x140003e40
nop
cmp word [r8 + r10*2 + 0xa], 0x6e
jne 0x140003e40
nop
cmp word [r8 + r10*2 + 0xc], 0x7e
jne 0x140003e40
nop
cmp word [r8 + r10*2 + 0xe], 0x31
je 0x14000413b
nop word [rax + rax]
sub r8, r9
lea r9, [r8 + 2]
cmp r8, rdx
mov r8, r9
jne 0x140003dbf
nop
cmp qword [rbp + 0x488], 8
jb 0x140003e67
mov rdx, qword [rbp + 0x470]
jmp 0x140003e6e
lea rdx, [rbp + 0x470]
mov rcx, rax
call fcn.1400035d0
test eax, eax
je 0x140003ee4
lea rdx, str.Microsoft
lea rdi, [rbp + 0x450]
mov rcx, rdi
xor r8d, r8d
call fcn.140004780
cmp rax, 0xffffffffffffffff
jne 0x140003ebc
lea rdx, str.Microsoft
lea rsi, [rbp + 0x450]
mov rcx, rsi
xor r8d, r8d
call fcn.140004780
cmp rax, 0xffffffffffffffff
je 0x140003fca
nop
cmp qword [rbp + 0x468], 8
jb 0x140003ece
mov rdi, qword [rbp + 0x450]
mov esi, 2
lea rcx, [0x140090450]
mov rdx, rdi
call fcn.1400440c4
jmp 0x140003f10
nop
cmp qword [rbp + 0x488], 8
jb 0x140003ef8
mov rdx, qword [rbp + 0x470]
jmp 0x140003eff
lea rdx, [rbp + 0x470]
mov esi, 1
lea rcx, [0x140090450]
call fcn.1400440c4
nop
mov rax, qword [rbp + 0x468]
cmp rax, 8
jb 0x140003f5f
nop
mov rcx, qword [rbp + 0x450]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140003f5a
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140004199
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
nop
mov rax, qword [rbp + 0x488]
cmp rax, 8
jb 0x140003fae
nop
mov rcx, qword [rbp + 0x470]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140003fa9
nop
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000419e
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.14001ef80
mov dword [rbp + 0x44c], esi
mov eax, dword [rbp + 0x44c]
add rsp, 0x518
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
lea rcx, str.LOCALAPPDATA
lea rdx, [rbp - 0x50]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
nop
movups xmm0, xmmword [0x14007022c]
movups xmmword [rbp + 0x3ec], xmm0
movaps xmm0, xmmword [0x140070220]
movaps xmmword [rbp + 0x3e0], xmm0
movaps xmm0, xmmword [0x140070210]
movaps xmmword [rbp + 0x3d0], xmm0
lea rcx, [rbp + 0x470]
lea rdx, [rbp - 0x50]
call fcn.1400045b0
lea rcx, [rbp + 0x428]
lea rdx, [rbp + 0x3d0]
mov r8d, inet_ntoa
call fcn.140006940
lea rcx, [rbp + 0x470]
lea rdx, [rbp + 0x428]
call fcn.1400030f0
lea rcx, [rbp + 0x428]
call fcn.140002170
lea rdx, [0x14008f210]
lea rcx, [rbp + 0x428]
mov r8d, 9
call fcn.140006940
lea rdi, [rbp + 0x470]
lea rdx, [rbp + 0x428]
mov rcx, rdi
call fcn.1400030f0
lea rcx, [rbp + 0x428]
call fcn.140002170
cmp qword [rbp + 0x488], 8
jb 0x1400040a0
mov rdi, qword [rbp + 0x470]
cmp qword [rbp + 0x468], 8
jb 0x1400040b1
mov rsi, qword [rbp + 0x450]
mov rcx, rsi
mov rdx, rdi
call fcn.1400035d0
test eax, eax
je 0x1400040de
nop
cmp qword [rbp + 0x468], 8
jb 0x1400040f2
mov rdx, qword [rbp + 0x450]
jmp 0x1400040f9
call fcn.14001ef3c
jmp 0x140003766
nop
cmp qword [rbp + 0x488], 8
jb 0x14000410c
mov rdx, qword [rbp + 0x470]
jmp 0x140004113
lea rdx, [rbp + 0x450]
mov esi, 4
lea rcx, [0x140090450]
call fcn.1400440c4
jmp 0x140004124
lea rdx, [rbp + 0x470]
mov esi, 3
lea rcx, [0x140090450]
call fcn.1400440c4
jmp 0x140003f10
sub r8, rax
add r8, 2
cmp r8, r9
je 0x140003db3
jmp 0x14000414b
sub r8, rax
add r8, 2
cmp r8, r9
je 0x140003e53
xor esi, esi
lea rcx, [0x140090450]
mov rdx, rax
call fcn.1400440c4
jmp 0x140003f10
sub r9, rax
add r9, 2
cmp r9, r10
je 0x140003c03
jmp 0x14000414b
sub r9, rax
add r9, 2
cmp r9, r10
je 0x140003c09
jmp 0x14000414b
call fcn.140005840
call fcn.140005840
call fcn.14003f990
call fcn.14003f990
call fcn.14003f990
call fcn.14003f990
call fcn.140005890
call fcn.14003f990
int3