Function at 0x1400cf5f4
Capabilities:
Create thread
Query environment variable

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x3060
call fcn.1400fe810
sub rsp, rax
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x3090], rbx
mov qword [rsp + 0x30a0], rbp
mov qword [rsp + 0x30a8], rsi
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x3050], rax
mov bpl, r8b
mov r12, rdx
mov r14d, 0x800
xor r13d, r13d
cmp r9, r13
jne 0x1400cf6a8
mov dword [rsp + 0x20], r14d
lea r9, [0x140109540]
lea r8, [rsp + 0x50]
lea rdx, str.ExternalViewer
lea rcx, [0x14010f380]
call fcn.14009b8dc
mov r8d, r14d
lea rdx, [rsp + 0x2050]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, r13d
jbe 0x1400cf6c3
mov r8, r14
lea rdx, [rsp + 0x2050]
lea rcx, [rsp + 0x50]
call fcn.140065d00
jmp 0x1400cf6c3
lea rcx, [rsp + 0x50]
sub rcx, r9
movzx eax, word [r9]
mov word [rcx + r9], ax
add r9, 2
cmp ax, r13w
jne 0x1400cf6b0
cmp word [rsp + 0x50], r13w
jne 0x1400cf6d2
xor al, al
jmp 0x1400cf8a5
mov r8, r14
mov rdx, r12
lea rcx, [rsp + 0x1050]
call fcn.140065d00
mov rdx, r14
lea rcx, [rsp + 0x1050]
call fcn.1400a3f28
lea rcx, [rsp + 0x50]
call fcn.14004258c
cmp al, r13b
jne 0x1400cf7f9
mov r15d, 0x22
cmp word [rsp + 0x50], r15w
jne 0x1400cf725
mov edx, r15d
lea rcx, [rsp + 0x52]
call fcn.1400ed378
jmp 0x1400cf72a
lea rax, [rsp + 0x50]
cmp rax, r13
je 0x1400cf7f9
lea rdx, [0x1401174d0]
mov rcx, rax
call fcn.1400edbf4
mov rdi, rax
cmp rax, r13
je 0x1400cf7f9
mov rbx, rax
movzx ecx, word [rax]
call fcn.1400659e8
cmp al, r13b
je 0x1400cf76f
add rbx, 2
movzx ecx, word [rbx]
call fcn.1400659e8
cmp al, r13b
jne 0x1400cf75e
mov r8, r14
mov rdx, rbx
lea rcx, [rsp + 0x2050]
call fcn.140065d00
mov r8, r14
lea rdx, [0x14011014c]
lea rcx, [rsp + 0x2050]
call fcn.140065d80
mov r8, r14
lea rdx, [rsp + 0x1050]
lea rcx, [rsp + 0x2050]
call fcn.140065d80
movzx esi, word [rdi]
mov word [rdi], r13w
cmp word [rsp + 0x50], r15w
je 0x1400cf7e1
lea rcx, [rsp + 0x50]
call fcn.14004258c
cmp al, r13b
jne 0x1400cf7e1
mov word [rdi], si
lea rax, [rbx + 2]
cmp rax, r13
jne 0x1400cf733
jmp 0x1400cf7f9
mov r8, r14
lea rdx, [rsp + 0x2050]
lea rcx, [rsp + 0x1050]
call fcn.140065d00
mov eax, dword [0x1401973c0]
test al, 1
jne 0x1400cf826
or eax, 1
mov dword [0x1401973c0], eax
lea rcx, [0x1401972be]
call fcn.140063478
nop
lea rcx, [0x140107698]
call fcn.1400ee7f4
nop
mov r8b, 1
mov rdx, r12
lea rbx, [0x140193290]
mov rcx, rbx
call fcn.1400cd8d0
cmp bpl, r13b
sete al
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rbx
mov byte [rsp + 0x20], al
lea r9, [rsp + 0x1050]
xor r8d, r8d
lea rdx, [rsp + 0x50]
xor ecx, ecx
call fcn.1400cd064
cmp al, r13b
jne 0x1400cf877
mov rcx, rbx
call fcn.1400ccd54
xor al, al
jmp 0x1400cf8a5
cmp bpl, r13b
je 0x1400cf89b
cmp qword [0x140193290], r13
je 0x1400cf89b
mov r8, rbx
mov edx, 0x10000
lea rcx, [0x1400cecd0]
call fcn.1400efe18
jmp 0x1400cf8a3
mov rcx, rbx
call fcn.1400ccd54
mov al, 1
mov rcx, qword [rsp + 0x3050]
xor rcx, rsp
call fcn.1400e9d80
lea r11, [rsp + 0x3060]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret