Function at 0x1403489d8
Capabilities:
Query environment variable

Disassembly:
push rax
pushf
mov eax, 0x196a6a0d
pushf
not eax
add eax, 0xf74026f3
xor eax, 0xd2d56704
rol eax, 4
popf
pushf
not eax
add eax, 0xc80d161e
xor eax, 0xca9f30eb
rol eax, 0xc0
popf
pushf
not eax
add eax, 0xe0d4dd68
xor eax, 0xc3747481
rol eax, 0x3f
popf
cmp eax, 4
jne 0x140348a28
popf
pop rax
jmp 0x140348ca6
cmp eax, 0
jne 0x140348a37
popf
pop rax
jmp 0x140348aeb
cmp eax, 3
jne 0x140348a46
popf
pop rax
jmp 0x140348c5c
cmp eax, 1
jne 0x140348a55
popf
pop rax
jmp 0x140348b8e
cmp eax, 0xd
jne 0x140348a64
popf
pop rax
jmp 0x140349067
cmp eax, 7
jne 0x140348a73
popf
pop rax
jmp 0x140348e96
cmp eax, 6
jne 0x140348a82
popf
pop rax
jmp 0x140348dfd
cmp eax, 0xb
jne 0x140348a91
popf
pop rax
jmp 0x140348fed
cmp eax, 0xc
jne 0x140348aa0
popf
pop rax
jmp 0x14034902a
cmp eax, 8
jne 0x140348aaf
popf
pop rax
jmp 0x140348ed8
cmp eax, 5
jne 0x140348abe
popf
pop rax
jmp 0x140348d3c
cmp eax, 2
jne 0x140348acd
popf
pop rax
jmp 0x140348bc8
cmp eax, 9
jne 0x140348adc
popf
pop rax
jmp 0x140348f74
cmp eax, 0xa
jne 0x140348aeb
popf
pop rax
jmp 0x140348fc6
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
jmp 0x140348b05
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x140348b48
push rax
pushf
mov eax, 0x1c5179c6
pushf
not eax
add eax, 0x8e818717
xor eax, 0xa58a4c8c
rol eax, 0x12
popf
pushf
not eax
add eax, 0xa79654d6
xor eax, 0xa02275ec
rol eax, 0xf1
popf
jmp 0x140348a19
push rax
pushf
mov eax, 0x68302a46
pushf
not eax
add eax, 0xed45bb57
xor eax, 0xb409c722
rol eax, 0x9b
popf
pushf
not eax
add eax, 0x8b42a4d6
xor eax, 0x931bb736
rol eax, 0x65
popf
pushf
not eax
add eax, 0xdd06f4b6
xor eax, 0x88b85368
rol eax, 0xb9
popf
jmp 0x140348a19
xor eax, eax
jmp 0x140349074
mov rbp, rbx
cmp word [rax], si
je 0x140348c29
push rax
pushf
mov eax, 0x8089379a
pushf
not eax
add eax, 0xb3bad77a
xor eax, 0xea8004e4
rol eax, 0xba
popf
pushf
not eax
add eax, 0xdffb9d51
xor eax, 0xb750cdd8
rol eax, 9
popf
pushf
not eax
add eax, 0xb4634d60
xor eax, 0xf460cbd9
rol eax, 0x85
popf
pushf
not eax
add eax, 0xc9f54f47
xor eax, 0xc0716d0b
rol eax, 0xd8
popf
jmp 0x140348a19
push rax
pushf
mov eax, 0x41607d04
pushf
not eax
add eax, 0xb3a4bb2a
xor eax, 0x91c9b1a2
rol eax, 0x69
popf
pushf
not eax
add eax, 0xf3817f7e
xor eax, 0xd87a6fb6
rol eax, 0x6e
popf
jmp 0x140348a19
or rax, 0xffffffffffffffff
push rax
pushf
mov eax, 0x3d901534
pushf
not eax
add eax, 0xa62970d8
xor eax, 0xa4490d66
rol eax, 0x19
popf
pushf
not eax
add eax, 0xb8cf5a80
xor eax, 0xe3fa658f
rol eax, 2
popf
pushf
not eax
add eax, 0xf7c68aad
xor eax, 0xbc871934
rol eax, 0x82
popf
jmp 0x140348a19
inc rax
cmp word [rbp + rax*2], si
jne 0x140348ce3
push rax
pushf
mov eax, 0x3c23ac42
pushf
not eax
add eax, 0xad48bf53
xor eax, 0xc7db9013
rol eax, 3
popf
pushf
not eax
add eax, 0xb6f19eb8
xor eax, 0xfe5d869a
rol eax, 0xb
popf
jmp 0x140348a19
push rax
pushf
mov eax, 0xd93b1e39
pushf
not eax
add eax, 0x8d09b74e
xor eax, 0xd224e4a7
rol eax, 0x78
popf
pushf
not eax
add eax, 0xb7bde81b
xor eax, 0xa1fb0b04
rol eax, 0x1f
popf
pushf
not eax
add eax, 0xe9023100
xor eax, 0x9787baaf
rol eax, 0x64
popf
pushf
not eax
add eax, 0xedffc58e
xor eax, 0xd29e53c5
rol eax, 0x33
popf
jmp 0x140348a19
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140348da4
push rax
pushf
mov eax, 0x4052a0f5
pushf
not eax
add eax, 0xe2f31826
xor eax, 0xd1dcc1d9
rol eax, 0xf3
popf
pushf
not eax
add eax, 0xc5b97458
xor eax, 0xd7995231
rol eax, 0xb4
popf
pushf
not eax
add eax, 0x8cab5d6a
xor eax, 0xb2dff546
rol eax, 0x5d
popf
pushf
not eax
add eax, 0xac9d4513
xor eax, 0xc146fba5
rol eax, 0xa1
popf
jmp 0x140348a19
push rax
pushf
mov eax, 0x8587243c
pushf
not eax
add eax, 0x822ab1a6
xor eax, 0xeb553d2a
rol eax, 0x2f
popf
pushf
not eax
add eax, 0xe7c94063
xor eax, 0x9314594c
rol eax, 0x10
popf
pushf
not eax
add eax, 0xaecc6bce
xor eax, 0xe2dc0435
rol eax, 0xf3
popf
pushf
not eax
add eax, 0xfec145c8
xor eax, 0xa54829ed
rol eax, 0x9c
popf
jmp 0x140348a19
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14039a6dc
movsxd r14, eax
test eax, eax
jne 0x140348e63
push rax
pushf
mov eax, 0xf471f6b7
pushf
not eax
add eax, 0x8c11a707
xor eax, 0x80c9fd9a
rol eax, 0xa0
popf
pushf
not eax
add eax, 0xd2f613bb
xor eax, 0xbb7fc5e5
rol eax, 0x4b
popf
jmp 0x140348a19
push rax
pushf
mov eax, 0x4df76016
pushf
not eax
add eax, 0x8dc2d13d
xor eax, 0x80a995cd
rol eax, 0x40
popf
pushf
not eax
add eax, 0xb6cfcbab
xor eax, 0xf76de6bf
rol eax, 0x53
popf
jmp 0x140348a19
mov rcx, rbx
jmp 0x140348e9a
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x140348b8e
mov rcx, r14
call fcn.14030676f
mov rdi, rax
test rax, rax
jne 0x140348f1b
push rax
pushf
mov eax, 0x2b09c7d4
pushf
not eax
add eax, 0xf3a80594
xor eax, 0xedda17f3
rol eax, 0xea
popf
pushf
not eax
add eax, 0xe82b97e7
xor eax, 0xd782f751
rol eax, 0x14
popf
jmp 0x140348a19
push rax
pushf
mov eax, 0x3e4a8daa
pushf
not eax
add eax, 0xb3143397
xor eax, 0xa27546e7
rol eax, 0xe9
popf
pushf
not eax
add eax, 0xa50fd047
xor eax, 0xb1e463c7
rol eax, 0x68
popf
pushf
not eax
add eax, 0xa567b4cb
xor eax, 0x93fe2ffd
rol eax, 0x5a
popf
pushf
not eax
add eax, 0xa40d7c2c
xor eax, 0xce7bb244
rol eax, 0x44
popf
jmp 0x140348a19
xor ecx, ecx
call fcn.14038d988
jmp 0x140348e96
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14039a6dc
test eax, eax
jne 0x14034902a
mov rcx, rdi
call fcn.14038d988
jmp 0x140349067
xor ecx, ecx
call fcn.14038d988
mov rsi, rdi
push rax
pushf
mov eax, 0xd9a907f2
pushf
not eax
add eax, 0xf542f845
xor eax, 0xa95b5c12
rol eax, 0x45
popf
pushf
not eax
add eax, 0xdf69bd1b
xor eax, 0x87143530
rol eax, 0xde
popf
jmp 0x140348a19
mov rcx, rbx
jmp 0x14034906b
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret