Function at 0x1800bee30
Capabilities:
Query environment variable

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov qword [rbp - 0x71], 0xfffffffffffffffe
mov qword [rsp + 0x110], rbx
mov rax, qword [0x1802a8008]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rcx, str.APPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov qword [rbp + 0xf], 0xf
xor ebx, ebx
mov qword [rbp + 7], rbx
mov byte [rbp - 9], bl
cmp byte [rax], bl
jne 0x1800bee83
mov r8d, ebx
jmp 0x1800bee90
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], bl
jne 0x1800bee87
mov rdx, rax
lea rcx, [rbp - 9]
call fcn.18003d620
nop
lea r8, str..exFilLocat_
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x29]
call fcn.1800a9640
nop
mov qword [rbp - 0x51], 0xf
mov qword [rbp - 0x59], rbx
mov byte [rbp - 0x69], 0
mov r8d, 0xe
lea rdx, str.exFilLocat.ytd
lea rcx, [rbp - 0x69]
call fcn.18003d620
nop
lea r8, [rbp - 0x69]
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x49]
call fcn.1800ce550
nop
lea rcx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae rcx, qword [rbp - 0x49]
lea rdx, [rbp + 0x17]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jne 0x1800bef35
lea r9, [rbp - 0x69]
cmp qword [rbp - 0x51], 0x10
cmovae r9, qword [rbp - 0x69]
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae rdx, qword [rbp - 0x49]
mov byte [rsp + 0x20], al
mov r8b, 1
lea rcx, [rbp - 0x79]
call qword [0x18034e910]
nop
mov rax, qword [rbp - 0x31]
cmp rax, 0x10
jb 0x1800bef8f
inc rax
mov rcx, qword [rbp - 0x49]
cmp rax, 0x1000
jb 0x1800bef8a
test cl, 0x1f
je 0x1800bef5a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800bef6a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800bef7a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x1800bef87
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.1801e6034
mov qword [rbp - 0x31], 0xf
mov qword [rbp - 0x39], rbx
mov byte [rbp - 0x49], 0
mov rax, qword [rbp - 0x51]
cmp rax, 0x10
jb 0x1800beff9
inc rax
mov rcx, qword [rbp - 0x69]
cmp rax, 0x1000
jb 0x1800beff4
test cl, 0x1f
je 0x1800befc4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800befd4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800befe4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x1800beff1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.1801e6034
mov qword [rbp - 0x51], 0xf
mov qword [rbp - 0x59], rbx
mov byte [rbp - 0x69], 0
mov rax, qword [rbp - 0x11]
cmp rax, 0x10
jb 0x1800bf063
inc rax
mov rcx, qword [rbp - 0x29]
cmp rax, 0x1000
jb 0x1800bf05e
test cl, 0x1f
je 0x1800bf02e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800bf03e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800bf04e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x1800bf05b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.1801e6034
mov qword [rbp - 0x11], 0xf
mov qword [rbp - 0x19], rbx
mov byte [rbp - 0x29], 0
mov rax, qword [rbp + 0xf]
cmp rax, 0x10
jb 0x1800bf0cd
inc rax
mov rcx, qword [rbp - 9]
cmp rax, 0x1000
jb 0x1800bf0c8
test cl, 0x1f
je 0x1800bf098
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800bf0a8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800bf0b8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x1800bf0c5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.1801e6034
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1801e6050
mov rbx, qword [rsp + 0x110]
add rsp, 0x100
pop rbp
ret