Function at 0x14000a600
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x140059010]
xor rax, rsp
mov qword [rbp + 0x80], rax
mov r15, rcx
xor ebx, ebx
mov r12d, ebx
mov dword [rsp + 0x38], ebx
mov qword [rsp + 0x30], rbx
lea rax, [rsp + 0x30]
mov qword [rbp - 0x30], rax
mov byte [rbp - 0x28], 1
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdi, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000a8df
cmp word [rax], 0
je 0x14000a8dd
lea r13, [0x140000000]
mov r9d, 0x3b
nop dword [rax]
nop dword [rax + rax]
mov rsi, 0xffffffffffffffff
nop word [rax + rax]
inc rsi
cmp word [rdi + rsi*2], 0
jne 0x14000a6a0
test rsi, rsi
je 0x14000a8c6
mov rcx, rsi
mov rax, rdi
mov rdx, rbx
cmp word [rdi], 0x3d
je 0x14000a6d5
cmp rcx, 1
je 0x14000a6d8
dec rcx
add rax, 2
cmp word [rax], 0x3d
jne 0x14000a6c2
mov rdx, rax
test rdx, rdx
je 0x14000a8c6
sub rdx, rdi
sar rdx, 1
cmp rdx, 0xffffffffffffffff
je 0x14000a8c6
mov r8, rdx
cmp rsi, rdx
cmovb r8, rsi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], r8
inc rdx
cmp rsi, rdx
jb 0x14000a9d1
mov rax, rsi
sub rax, rdx
mov rcx, 0xffffffffffffffff
cmp rax, rcx
cmovb rcx, rax
lea rax, [rdi + rdx*2]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
cmp r8, 4
jne 0x14000a920
mov rdx, rbx
movzx ecx, word [rdi + rdx*2]
cmp ecx, 0x7f
ja 0x14000a752
movsx ecx, byte [rcx + r13 + 0x37f80]
movzx eax, word [r13 + rdx*2 + 0x33a88]
cmp eax, 0x7f
ja 0x14000a769
movsx eax, byte [rax + r13 + 0x37f80]
cmp cx, ax
jne 0x14000a982
inc rdx
cmp rdx, r8
jb 0x14000a740
movaps xmm0, xmmword [rsp + 0x50]
movups xmmword [rbp - 0x10], xmm0
mov word [rbp], r9w
lea r8, [rbp - 0x10]
lea rdx, [rbp - 0x60]
call fcn.140007870
or r12d, 4
mov rbx, qword [rbp - 0x60]
mov r14, qword [rbp - 0x58]
cmp rbx, r14
je 0x14000a881
nop word [rax + rax]
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x38], rax
movaps xmm1, xmmword [rbp + 0x30]
movups xmmword [rsp + 0x38], xmm1
lea rax, [rsp + 0x48]
mov qword [rbp - 0x40], rax
xor eax, eax
mov qword [rbp - 0x38], rax
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x80], xmm1
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 8]
call fcn.14000b2c0
or r12d, 3
mov rdx, qword [r15 + 8]
cmp rdx, qword [r15 + 0x10]
je 0x14000a824
movups xmm0, xmmword [rbp + 8]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x18]
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
xor eax, eax
mov word [rbp + 8], ax
add qword [r15 + 8], 0x20
jmp 0x14000a834
lea r8, [rbp + 8]
mov rcx, r15
call fcn.140008060
mov rdx, qword [rbp + 0x20]
cmp rdx, 8
jb 0x14000a870
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a86b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a9d7
call fcn.140014f34
add rbx, 0x10
cmp rbx, r14
jne 0x14000a7b0
mov rbx, qword [rbp - 0x60]
test rbx, rbx
je 0x14000a8be
mov rdx, qword [rbp - 0x50]
sub rdx, rbx
and rdx, 0xfffffffffffffff0
mov rax, rbx
cmp rdx, 0x1000
jb 0x14000a8b6
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a9cb
mov rcx, rbx
call fcn.140014f34
xor ebx, ebx
mov r9d, 0x3b
lea rdi, [rdi + rsi*2]
add rdi, 2
cmp word [rdi], 0
jne 0x14000a690
mov rdi, qword [rsp + 0x30]
mov bl, 1
test rdi, rdi
je 0x14000a8ed
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
movzx eax, bl
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140014ed0
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
cmp r8, 7
jne 0x14000a982
mov rdx, rbx
nop dword [rax]
movzx ecx, word [rdi + rdx*2]
cmp ecx, 0x7f
ja 0x14000a942
movsx ecx, byte [rcx + r13 + 0x37f80]
movzx eax, word [r13 + rdx*2 + 0x384c8]
cmp eax, 0x7f
ja 0x14000a959
movsx eax, byte [rax + r13 + 0x37f80]
cmp cx, ax
jne 0x14000a982
inc rdx
cmp rdx, r8
jb 0x14000a930
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rbp - 0x80], xmm0
lea rdx, [r15 + 0x18]
lea rcx, [rbp - 0x80]
call fcn.14000a1a0
jmp 0x14000a8c0
lea rax, [r15 + 0x30]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x70]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x38]
call fcn.140008e90
jmp 0x14000a8c0
call fcn.14001bb3c
int3
call fcn.140006970
nop
call fcn.14001bb3c
int3