Function at 0x402dbf
Capabilities:
Query environment variable

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov qword [rbp - 0x18], 0
mov rcx, qword [rbp + 0x10]
call sub.msvcrt.dll_strlen
mov qword [rbp - 0x38], rax
mov edx, 0x2f
mov rcx, qword [rbp + 0x10]
call sub.msvcrt.dll_strchr
test rax, rax
jne 0x402e0c
mov edx, 0x5c
mov rcx, qword [rbp + 0x10]
call sub.msvcrt.dll_strchr
test rax, rax
je 0x402e13
mov eax, 1
jmp 0x402e18
mov eax, 0
mov dword [rbp - 0x3c], eax
cmp dword [rbp - 0x3c], 0
je 0x402e28
mov dword [rbp + 0x18], 0
cmp dword [rbp + 0x18], 0
je 0x402e3e
lea rcx, str.PATH
call sub.msvcrt.dll_getenv
mov qword [rbp - 0x18], rax
cmp qword [rbp - 0x18], 0
jne 0x402e50
lea rax, [0x0040e37c]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], 0
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x28], rax
jmp 0x402ec5
mov rax, qword [rbp - 0x28]
mov qword [rbp - 0x30], rax
jmp 0x402e71
add qword [rbp - 0x30], 1
mov rax, qword [rbp - 0x30]
movzx eax, byte [rax]
cmp al, 0x3b
je 0x402e87
mov rax, qword [rbp - 0x30]
movzx eax, byte [rax]
test al, al
jne 0x402e6c
mov rdx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x28]
sub rdx, rax
mov rax, rdx
cmp qword [rbp - 0x10], rax
jae 0x402ead
mov rdx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x28]
sub rdx, rax
mov rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x30]
movzx eax, byte [rax]
cmp al, 0x3b
jne 0x402ebd
add qword [rbp - 0x30], 1
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
movzx eax, byte [rax]
test al, al
jne 0x402e62
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x38]
add rax, rdx
add rax, 6
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov rcx, rax
call fcn.00404136
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
mov qword [rbp - 0x30], rax
jmp 0x402f0a
add qword [rbp - 0x30], 1
mov rax, qword [rbp - 0x30]
movzx eax, byte [rax]
cmp al, 0x3b
je 0x402f20
mov rax, qword [rbp - 0x30]
movzx eax, byte [rax]
test al, al
jne 0x402f05
mov rax, qword [rbp - 0x48]
mov qword [rbp - 8], rax
mov rdx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x28]
sub rdx, rax
mov rax, rdx
mov rcx, rax
mov rdx, qword [rbp - 0x28]
mov rax, qword [rbp - 8]
mov r8, rcx
mov rcx, rax
call sub.msvcrt.dll_memcpy
mov rdx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x28]
sub rdx, rax
mov rax, rdx
add qword [rbp - 8], rax
mov rdx, qword [rbp - 0x30]
mov rax, qword [rbp - 0x28]
cmp rdx, rax
je 0x402f7a
mov rax, qword [rbp - 8]
lea rdx, [rax + 1]
mov qword [rbp - 8], rdx
mov byte [rax], 0x5c
mov rax, qword [rbp - 8]
mov rdx, qword [rbp + 0x10]
mov rcx, rax
call sub.msvcrt.dll_strcpy
mov rax, qword [rbp - 0x30]
movzx eax, byte [rax]
cmp al, 0x3b
jne 0x402f9a
add qword [rbp - 0x30], 1
mov rax, qword [rbp - 0x48]
mov qword [rbp - 8], rax
jmp 0x402fbb
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
cmp al, 0x2f
jne 0x402fb6
mov rax, qword [rbp - 8]
mov byte [rax], 0x5c
add qword [rbp - 8], 1
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
test al, al
jne 0x402fa4
lea rax, str..com
mov qword [rbp - 0x20], rax
jmp 0x403037
mov rax, qword [rbp - 8]
mov byte [rax], 0
mov rax, qword [rbp - 0x20]
mov rdx, qword [rax]
mov rax, qword [rbp - 0x48]
mov rcx, rax
call sub.msvcrt.dll_strcat
mov rax, qword [rbp - 0x48]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
mov r9d, 0
mov r8d, 3
mov edx, 0x80000000
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateFileA]
call rax
mov qword [rbp - 0x50], rax
cmp qword [rbp - 0x50], 0xffffffffffffffff
jne 0x40306d
add qword [rbp - 0x20], 8
mov rax, qword [rbp - 0x20]
mov rax, qword [rax]
test rax, rax
jne 0x402fd3
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x28]
movzx eax, byte [rax]
test al, al
jne 0x402efb
mov rax, qword [rbp - 0x48]
mov rcx, rax
call sub.msvcrt.dll_free
mov eax, 0
jmp 0x403082
nop
mov rax, qword [rbp - 0x50]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 0x48]
add rsp, 0x90
pop rbp
ret