Function at 0x18009d670
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov r14, rcx
mov qword [rbp - 0x49], rcx
mov dword [rsp + 0x28], 0
movabs rax, 0x99d06f33440c9ae2
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp - 0x79], rax
movabs r15, 0x5c35933f10c6ae20
mov qword [rsp + 0x20], r15
mov rax, qword [rsp + 0x20]
mov qword [rbp - 0x71], rax
movabs r12, 0x99b11b52207cea83
mov qword [rsp + 0x20], r12
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x17], rax
mov qword [rsp + 0x20], r15
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x1f], rax
movdqa xmm0, xmmword [rbp - 0x79]
pxor xmm0, xmmword [rbp + 0x17]
movdqa xmmword [rbp - 0x79], xmm0
lea rcx, [rbp - 0x79]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rsi, rax
mov rbx, 0xffffffffffffffff
mov rdi, rbx
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x18009d720
call fcn.1800ab98c
mov qword [rbp - 0x69], rsi
mov qword [rbp - 0x61], rdi
lea r8, [rbp - 0x69]
mov edx, eax
mov rcx, r14
call fcn.18001a560
mov dword [rsp + 0x28], 7
movabs rax, 0xffc37e394e1d9ad0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rax, 0x5c35933f74aacb49
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x20], r12
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x27], rax
mov qword [rsp + 0x20], r15
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x2f], rax
movdqa xmm0, xmmword [rsp + 0x30]
pxor xmm0, xmmword [rbp + 0x27]
movdqa xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x30]
inc rbx
cmp byte [rax + rbx], 0
jne 0x18009d7b0
call fcn.1800ab98c
lea rcx, [rsp + 0x30]
mov qword [rbp - 0x59], rcx
mov qword [rbp - 0x51], rbx
lea r8, [rbp - 0x59]
mov edx, eax
lea rcx, [rbp - 0x41]
call fcn.18001a560
mov dword [rsp + 0x28], 0x1f
lea rdx, [rbp - 0x41]
mov rcx, r14
call fcn.18001a7e0
nop
lea rcx, [rbp - 0x41]
call fcn.18002e290
mov rdx, r14
lea rcx, [rbp - 0x11]
call fcn.18001aa50
mov rbx, rax
mov qword [rsp + 0x20], rax
mov rcx, rax
call fcn.18001b500
test al, al
jne 0x18009d838
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x18009d825
mov rcx, qword [rbx]
call fcn.1800abce4
shr rax, 0x20
test eax, eax
jne 0x18009d8d9
jmp 0x18009d8a0
mov rdx, rbx
lea rcx, [rbp - 0x21]
call fcn.18001b740
movsd xmm0, qword [rax]
movsd qword [rsp + 0x30], xmm0
mov edx, dword [rax + 8]
mov ecx, dword [rsp + 0x30]
test edx, edx
je 0x18009d867
lea eax, [rcx - 1]
test eax, 0xfffffff7
jne 0x18009d8eb
cmp ecx, 3
je 0x18009d8a0
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x18009d879
mov rcx, qword [rbx]
call fcn.1800ac130
shr rax, 0x20
test eax, eax
jne 0x18009d8fb
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x18009d893
mov rcx, qword [rbx]
call fcn.1800abce4
shr rax, 0x20
test eax, eax
jne 0x18009d8c7
mov rcx, rbx
call fcn.18002e290
mov rax, r14
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov r8, rbx
mov edx, eax
lea rcx, str.create_directory
call fcn.18001b000
int3
mov r8, rbx
mov edx, eax
lea rcx, str.create_directory
call fcn.18001b000
int3
mov r8, rbx
lea rcx, str.status
call fcn.18001b000
int3
mov r8, rbx
mov edx, eax
lea rcx, str.remove
call fcn.18001b000
int3