Function at 0x140054990
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x14015a060]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov qword [rsp + 0x78], rdx
mov rbx, rcx
movabs rsi, 0xb6051b5eb332d3c7
mov qword [rbp + 0x110], rsi
movabs r15, 0xa5a1a7cfa3ff837c
mov qword [rbp + 0x118], r15
movabs rax, 0xc455753bc37da789
mov qword [rsp + 0x60], rax
movabs rax, 0xa5a1a7bcd09ae013
mov qword [rsp + 0x68], rax
movdqa xmm0, xmmword [rbp + 0x110]
pxor xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rbp + 0x120], rsi
mov qword [rbp + 0x128], r15
movabs rax, 0xda613532df56a7a9
mov qword [rbp + 0x110], rax
movabs rax, 0xa5a1a7cfa3ff8310
mov qword [rbp + 0x118], rax
movdqa xmm0, xmmword [rbp + 0x120]
pxor xmm0, xmmword [rbp + 0x110]
movdqa xmmword [rbp + 0x110], xmm0
lea rcx, [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r14d, r14d
mov edi, r14d
mov qword [rbp + 0x120], r14
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x68], rbx
mov dword [rbp + 0xe0], gethostname
mov qword [rbp + 0xf0], r14
mov dword [rbp + 0xf8], r14d
mov qword [rbp + 0xe8], r14
mov qword [rbp + 0x100], r14
movups xmm0, xmmword [rbp + 0xe0]
movups xmmword [rbp + 0xb0], xmm0
movups xmm1, xmmword [rbp + 0xf0]
movups xmmword [rbp + 0xc0], xmm1
movups xmm0, xmmword [rbp + 0x100]
movups xmmword [rbp + 0xd0], xmm0
lea r9, [rbp + 0x68]
lea r8, [rbp + 0xb0]
mov edx, 0x1fffff
lea rcx, [rbp + 0x60]
call rax
test eax, eax
js 0x140055490
mov qword [rbp + 0x110], rsi
mov qword [rbp + 0x118], r15
movabs rax, 0xc441763bc741aa94
mov qword [rsp + 0x60], rax
movabs rax, 0xa5a1a7cfa39af515
mov qword [rsp + 0x68], rax
movdqa xmm0, xmmword [rbp + 0x110]
pxor xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov qword [rbp + 0x90], r14
mov qword [rbp + 0xa0], r14
mov qword [rbp + 0xa8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x90], r14b
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140054b74
mov rdx, rax
lea rcx, [rbp + 0x90]
call fcn.14000e310
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x78], xmm0
mov qword [rbp + 0x88], rax
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], r15
movabs r12, 0x1de382b45d832dc9
mov qword [rbp + 0xf0], r12
movabs rbx, 0xf3830325a37ef3fe
mov qword [rbp + 0xf8], rbx
movabs r13, 0xc572743add5b849b
mov qword [rsp + 0x40], r13
movabs rax, 0x96ccc2bbd086d020
mov qword [rsp + 0x48], rax
movabs rax, 0x6e8cead72bf071fb
mov qword [rsp + 0x50], rax
movabs rax, 0xf3830340db1bdd8a
mov qword [rsp + 0x58], rax
movdqa xmm0, xmmword [rbp + 0xe0]
pxor xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [rbp + 0xf0]
pxor xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
mov qword [rbp - 0x80], r14
movdqa xmm0, xmmword [0x140142c00]
movdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x80], 0
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140054c53
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x80]
call fcn.14000e310
nop
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], r15
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], rbx
mov qword [rsp + 0x40], r13
movabs rax, 0x96ccc2bbd086d020
mov qword [rsp + 0x48], rax
movabs rax, 0x6e8ceada32e071fb
mov qword [rsp + 0x50], rax
movabs rax, 0xf3830340db1bdd8a
mov qword [rsp + 0x58], rax
movdqa xmm0, xmmword [rbp + 0xe0]
pxor xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [rbp + 0xf0]
pxor xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
mov qword [rbp - 0x60], r14
movdqa xmm0, xmmword [0x140142c00]
movdqu xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140054d03
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.14000e310
nop
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], r15
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], rbx
mov qword [rsp + 0x40], r13
movabs rax, 0x96ccc2bbd086d020
mov qword [rsp + 0x48], rax
movabs rax, 0x3390f1d52eef71fb
mov qword [rsp + 0x50], rax
movabs rax, 0xf3830325a31b8b9b
mov qword [rsp + 0x58], rax
movdqa xmm0, xmmword [rbp + 0xe0]
pxor xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [rbp + 0xf0]
pxor xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
mov qword [rbp - 0x40], r14
movdqa xmm0, xmmword [0x140142c00]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140054db3
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x40]
call fcn.14000e310
nop
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], r15
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], rbx
mov qword [rsp + 0x40], r13
movabs rax, 0xc0d3c8a3d387e620
mov qword [rsp + 0x48], rax
movabs rax, 0x1de382d125e603bb
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
movdqa xmm0, xmmword [rbp + 0xe0]
pxor xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [rbp + 0xf0]
pxor xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
mov qword [rbp - 0x20], r14
movdqa xmm0, xmmword [0x140142c00]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140054e60
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.14000e310
nop
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], r15
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], rbx
mov qword [rsp + 0x40], r13
movabs rax, 0x96ccc2bbd086d020
mov qword [rsp + 0x48], rax
movabs rax, 0x3390f1c62ee071fb
mov qword [rsp + 0x50], rax
movabs rax, 0xf3830325a31b8b9b
mov qword [rsp + 0x58], rax
movdqa xmm0, xmmword [rbp + 0xe0]
pxor xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [rbp + 0xf0]
pxor xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
mov qword [rbp], r14
movdqa xmm0, xmmword [0x140142c00]
movdqu xmmword [rbp + 0x10], xmm0
mov byte [rbp], 0
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140054f10
lea rdx, [rsp + 0x40]
lea rcx, [rbp]
call fcn.14000e310
nop
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], r15
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], rbx
mov qword [rsp + 0x40], r13
movabs rax, 0x96ccc2bbd086d020
mov qword [rsp + 0x48], rax
movabs rax, 0x748debda34f471fb
mov qword [rsp + 0x50], rax
movabs rax, 0xf3830340db1bdd8a
mov qword [rsp + 0x58], rax
movdqa xmm0, xmmword [rbp + 0xe0]
pxor xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [rbp + 0xf0]
pxor xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
mov qword [rbp + 0x20], r14
movdqa xmm0, xmmword [0x140142c00]
movdqu xmmword [rbp + 0x30], xmm0
mov byte [rbp + 0x20], 0
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140054fc0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x20]
call fcn.14000e310
nop
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], r15
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], rbx
mov qword [rsp + 0x40], r13
movabs rax, 0x96ccc2bbd086d020
mov qword [rsp + 0x48], rax
movabs rax, 0x7a8ceeda34f471fb
mov qword [rsp + 0x50], rax
movabs rax, 0xf383665dc6509d91
mov qword [rsp + 0x58], rax
movdqa xmm0, xmmword [rbp + 0xe0]
pxor xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [rbp + 0xf0]
pxor xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
mov qword [rbp + 0x40], r14
movdqa xmm0, xmmword [0x140142c00]
movdqu xmmword [rbp + 0x50], xmm0
mov byte [rbp + 0x40], 0
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140055070
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x40]
call fcn.14000e310
nop
lea rax, [rbp - 0x80]
mov qword [rsp + 0x60], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x78]
call fcn.14000c3f0
nop
lea r9, [fcn.14000cf80]
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea r8d, [rdx - 0x19]
lea rcx, [rbp - 0x80]
call fcn.14010d22c
mov r9d, 0x104
lea r8, [rbp + 0x130]
xor edx, edx
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
mov rsi, qword [rbp + 0x78]
mov rax, qword [rbp + 0x80]
mov qword [rsp + 0x70], rax
mov rbx, qword [rbp + 0x90]
cmp rsi, rax
je 0x1400553a6
movabs rdx, 0x7fffffffffffffff
mov rcx, rdx
mov rax, qword [rbp + 0xa0]
sub rcx, rax
mov qword [rsp + 0x60], rcx
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov r15, qword [rsi + 0x10]
cmp rcx, r15
jb 0x1400554bd
lea r12, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0x10
cmovae r12, rbx
mov r13, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x14005514b
mov r13, qword [rsi]
mov qword [rsp + 0x40], r14
lea r14, [rax + r15]
mov edi, reloc.WS2_32.dll_ntohs
lea rbx, [rsp + 0x40]
cmp r14, rdi
jbe 0x1400551eb
mov rdi, r14
or rdi, 0xf
cmp rdi, rdx
jbe 0x140055178
mov rdi, rdx
jmp 0x140055180
cmp rdi, 0x16
cmovb rdi, r8
mov rcx, rdi
add rcx, 1
mov rdx, 0xffffffffffffffff
cmovb rcx, rdx
cmp rcx, 0x1000
jb 0x1400551ce
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400554c3
mov rcx, rax
call fcn.14010d1f0
test rax, rax
je 0x1400552e0
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
mov rax, qword [rbp + 0xa0]
jmp 0x1400551e6
test rcx, rcx
je 0x1400551e4
call fcn.14010d1f0
mov rbx, rax
mov rax, qword [rbp + 0xa0]
jmp 0x1400551e6
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], rdi
mov r8, rax
mov rdx, r12
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbp + 0xa0]
add rcx, rbx
mov r8, r15
mov rdx, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r14], 0
lea rdx, [rsp + 0x40]
mov r9, qword [rsp + 0x58]
lea rax, [rbp + 0x130]
cmp r9, 0x10
jb 0x140055287
mov r8, qword [rsp + 0x40]
mov rdx, r8
sub rdx, rax
nop
movzx ecx, byte [rax]
cmp cl, byte [rax + rdx]
jne 0x140055253
inc rax
test cl, cl
jne 0x140055240
xor ebx, ebx
jmp 0x140055258
sbb ebx, ebx
or ebx, 1
lea rdx, [r9 + 1]
mov rax, r8
cmp rdx, 0x1000
jb 0x14005527d
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400552e0
mov rcx, r8
call fcn.14010cf50
jmp 0x1400552a8
sub rdx, rax
nop word [rax + rax]
movzx ecx, byte [rax]
cmp cl, byte [rax + rdx]
jne 0x1400552a3
inc rax
test cl, cl
jne 0x140055290
xor ebx, ebx
jmp 0x1400552a8
sbb ebx, ebx
or ebx, 1
test ebx, ebx
je 0x1400552e7
add rsi, 0x20
mov rbx, qword [rbp + 0x90]
xor r14d, r14d
cmp rsi, qword [rsp + 0x70]
je 0x14005539f
mov rax, qword [rbp + 0xa0]
mov rcx, qword [rsp + 0x60]
movabs rdx, 0x7fffffffffffffff
jmp 0x140055118
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x78]
test rcx, rcx
je 0x140055356
mov rdx, qword [rbp + 0x80]
call fcn.140010850
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x78]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005533e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140055434
call fcn.14010cf50
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x78], xmm0
mov qword [rbp + 0x88], 0
mov rax, qword [rbp + 0xa8]
cmp rax, 0x10
jb 0x140055398
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055393
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140055481
call fcn.14010cf50
xor eax, eax
jmp 0x140055493
mov rdi, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
lea r9, [rbp + 0x110]
mov r8, rax
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
cmovns rdi, qword [rbp + 0x110]
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x78]
test rcx, rcx
je 0x14005544f
mov rdx, qword [rbp + 0x80]
call fcn.140010850
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x78]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005543b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005543b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010cf50
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x78], xmm0
mov qword [rbp + 0x88], r14
mov rax, qword [rbp + 0xa8]
cmp rax, 0x10
jb 0x140055490
lea rdx, [rax + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140055488
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140055488
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14010cf50
mov rax, rdi
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.14010cf30
mov rbx, qword [rsp + 0x3a0]
add rsp, 0x350
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400013d0
nop
call fcn.140001330
int3