Function at 0x140008298
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x370]
sub rsp, 0x470
mov rax, qword [0x140021bb8]
xor rax, rsp
mov qword [rbp + 0x360], rax
mov r14, rcx
lea rdx, [rbp + 0x160]
lea rcx, str.Init
mov r8d, 0xf5
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetEnvironmentVariableW]
xor r15d, r15d
test eax, eax
je 0x1400088ae
mov r8d, 0x100
lea rdx, str.TOOLS.INI
lea rcx, [rbp + 0x160]
call fcn.14000b5e4
test eax, eax
je 0x1400088ae
lea rdx, [0x140011fa8]
lea rcx, [rbp + 0x160]
call qword [sym.imp.msvcrt.dll__wfopen]
mov rsi, rax
test rax, rax
je 0x1400088ae
lea rdx, [0x140014b58]
mov rcx, rax
call fcn.140008204
test eax, eax
jne 0x140008366
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_rewind]
lea rdx, str.dbgeng
mov rcx, rsi
call fcn.140008204
test eax, eax
je 0x1400088a5
mov r13d, 1
lea rax, [rsp + 0x50]
mov r8, rsi
mov edx, 0x104
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x50]
call qword [sym.imp.msvcrt.dll_fgetws]
test rax, rax
je 0x1400088a5
mov rax, r15
cmp word [rsp + 0x50], r15w
je 0x1400083ba
lea rcx, [rsp + 0x50]
cmp word [rcx], 0x1a
jbe 0x1400083ba
add rax, r13
lea rcx, [rsp + 0x50]
lea rcx, [rcx + rax*2]
cmp word [rcx], r15w
jne 0x1400083a2
add rax, rax
cmp rax, 0x208
jae 0x1400088f2
lea rdx, [rbp + 0x158]
mov word [rsp + rax + 0x50], r15w
lea rcx, [rsp + 0x38]
call fcn.14000810c
mov rbx, qword [rsp + 0x38]
mov edi, eax
cmp word [rbx], 0x3a
ja 0x14000840b
movzx ecx, word [rbx]
movabs rax, 0x400000100000200
bt rax, rcx
jae 0x14000840b
add rbx, 2
mov qword [rsp + 0x38], rbx
jmp 0x1400083e7
lea eax, [rdi - 8]
mov edx, 9
cmp eax, edx
ja 0x140008450
cmp word [rbx], r15w
je 0x14000889c
cmp dword [0x140026794], r15d
jne 0x14000889c
mov rcx, qword [0x140026660]
lea edx, [rdi - 8]
mov r8, rbx
mov rax, qword [rcx]
mov rax, qword [rax + 0x418]
call qword [0x140011380]
jmp 0x14000889c
cmp edi, 0x13
jl 0x140008695
cmp edi, 0x14
jle 0x14000866a
cmp edi, 0x15
je 0x140008614
cmp edi, 0x16
je 0x1400085e0
cmp edi, 0x18
je 0x1400085c7
cmp edi, 0x19
je 0x14000859e
cmp edi, 0x1d
jne 0x140008695
cmp word [rbx], r15w
je 0x14000836c
mov rcx, rbx
add rbx, 2
movzx eax, word [rbx]
test ax, ax
je 0x14000836c
mov edi, 0x20
cmp ax, di
je 0x1400084c7
cmp ax, dx
je 0x1400084c7
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x1400084b1
cmp word [rbx], r15w
je 0x14000836c
cmp rbx, rcx
je 0x14000836c
mov word [rbx], r15w
add rbx, 2
cmp word [rbx], di
je 0x1400084de
cmp word [rbx], dx
je 0x1400084de
cmp word [rbx], r15w
je 0x14000836c
lea rdi, [rbx + 2]
mov rdx, rdi
cmp word [rdi], r15w
je 0x14000850d
add rdx, 2
cmp word [rdx], r15w
jne 0x140008503
lea rax, [rbx + 6]
cmp rdx, rax
jne 0x14000836c
call fcn.14000c240
test rax, rax
je 0x14000836c
cmp word [rbx], 0x72
mov ecx, r15d
jne 0x140008538
mov ecx, 4
jmp 0x14000854f
cmp word [rbx], 0x52
jne 0x140008545
mov ecx, 0xc
jmp 0x14000854f
cmp word [rbx], 0x2d
jne 0x14000836c
cmp word [rdi], 0x67
jne 0x14000855a
or ecx, 2
jmp 0x14000856f
cmp word [rdi], 0x47
jne 0x140008565
or ecx, 0xa
jmp 0x14000856f
cmp word [rdi], 0x2d
jne 0x14000836c
cmp word [rdi + 2], 0x62
jne 0x14000857b
or ecx, r13d
jmp 0x140008592
cmp word [rdi + 2], 0x42
jne 0x140008587
or ecx, 9
jmp 0x140008592
cmp word [rdi + 2], 0x2d
jne 0x14000836c
mov dword [rax + 0x10], ecx
mov qword [rax + 0x20], r13
jmp 0x14000836c
cmp dword [0x140026794], r15d
jne 0x14000836c
mov r8d, 0x20
lea rcx, str..srcpath
mov r9, rbx
xor edx, edx
call fcn.14000890c
jmp 0x14000836c
cmp dword [0x140026794], r15d
jne 0x14000836c
xor r8d, r8d
lea rcx, [0x140014b34]
jmp 0x1400085b8
cmp dword [0x140026794], r15d
jne 0x14000836c
mov rcx, qword [0x140026660]
lea r9, [rsp + 0x40]
xor r8d, r8d
mov rdx, rbx
mov rax, qword [rcx]
mov rax, qword [rax + 0x458]
call qword [0x140011380]
jmp 0x14000836c
or rdx, 0xffffffffffffffff
inc rdx
cmp word [rbx + rdx*2], r15w
jne 0x140008618
add rdx, r13
mov ecx, 2
call qword [sym.imp.msvcrt.dll_calloc]
mov qword [str.ntsd.ini], rax
test rax, rax
je 0x1400088d9
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rbx + rcx*2], r15w
jne 0x140008644
add ecx, r13d
je 0x14000836c
mov r8d, ecx
mov rdx, rbx
mov rcx, rax
call fcn.14000b57c
jmp 0x14000836c
cmp dword [0x140026794], r15d
jne 0x14000889c
movzx edx, word [rbx - 4]
lea rcx, [0x140014ad8]
mov r8d, 0x20
mov r9, rbx
call fcn.14000890c
jmp 0x14000889c
lea rdx, [rbp + 0x158]
mov dword [rsp + 0x30], r15d
lea rcx, [rsp + 0x38]
call fcn.14000810c
cmp eax, 7
mov ebx, r15d
setne bl
cmp edi, 0x12
jg 0x1400087fc
je 0x1400087d0
mov ecx, edi
sub ecx, r13d
je 0x1400087c0
sub ecx, r13d
je 0x1400087ad
sub ecx, r13d
je 0x14000878d
sub ecx, r13d
je 0x140008723
cmp ecx, r13d
jne 0x14000889c
cmp dword [0x140026794], r15d
jne 0x14000836c
mov rcx, qword [0x140026680]
mov edx, 4
mov rax, qword [rcx]
test ebx, ebx
je 0x14000871d
mov rax, qword [rax + 0x20]
call qword [0x140011380]
jmp 0x14000836c
mov rax, qword [rax + 0x28]
jmp 0x140008712
cmp dword [0x140026794], r15d
jne 0x14000875e
mov rcx, qword [0x140026638]
lea rdx, [rsp + 0x30]
mov rax, qword [rcx]
mov rax, qword [rax + 0x118]
call qword [0x140011380]
mov edx, dword [rsp + 0x30]
test ebx, ebx
je 0x140008759
or edx, 8
mov dword [rsp + 0x30], edx
jmp 0x140008762
and edx, 0xfffffff7
jmp 0x140008753
mov edx, dword [rsp + 0x30]
mov rcx, qword [0x140026638]
mov rax, qword [rcx]
mov rax, qword [rax + 0x120]
call qword [0x140011380]
mov rcx, qword [0x140026660]
mov edx, dword [rsp + 0x30]
mov rax, qword [rcx]
mov rax, qword [rax + 0x58]
jmp 0x140008712
cmp dword [0x140026794], r15d
jne 0x14000836c
mov edx, 0x20
jmp 0x1400087e2
mov rax, qword [rax + 0x1b0]
jmp 0x140008712
mov eax, r15d
test ebx, ebx
setne al
mov dword [0x140028410], eax
jmp 0x14000836c
test ebx, ebx
je 0x14000836c
mov dword [r14], r13d
jmp 0x14000836c
cmp dword [0x140026794], r15d
jne 0x14000836c
mov edx, 0x80
mov rcx, qword [0x140026660]
mov rax, qword [rcx]
test ebx, ebx
jne 0x1400087a1
mov rax, qword [rax + 0x1b8]
jmp 0x140008712
mov ecx, edi
sub ecx, 0x17
je 0x14000886e
sub ecx, 3
je 0x140008844
sub ecx, r13d
je 0x140008824
cmp ecx, r13d
jne 0x14000889c
test ebx, ebx
setne byte [0x140022607]
jmp 0x14000836c
cmp dword [0x140026794], r15d
jne 0x14000836c
mov edx, 4
jmp 0x140008854
mov rax, qword [rax + 0x1c8]
jmp 0x140008712
cmp dword [0x140026794], r15d
jne 0x14000836c
mov edx, r13d
mov rcx, qword [0x140026680]
mov rax, qword [rcx]
test ebx, ebx
jne 0x140008838
mov rax, qword [rax + 0x1d0]
jmp 0x140008712
cmp dword [0x140026794], r15d
jne 0x14000836c
mov rcx, qword [0x140026680]
mov edx, 0x10
mov rax, qword [rcx]
test ebx, ebx
jne 0x14000870e
mov rax, qword [rax + 0x28]
call qword [0x140011380]
cmp edi, 0x1f
jne 0x14000836c
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_fclose]
mov rcx, qword [rbp + 0x360]
xor rcx, rsp
call fcn.14000e6b0
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
lea r8, [0x140014b58]
mov ecx, 0x8007000e
lea rdx, str._s:_Input_file_memory_allocation_failed_n
call fcn.140002f30
int3
call fcn.14000e968
int3