Function at 0x1401cbe60
Capabilities:
Query environment variable

Disassembly:
push rbp
push r12
push r13
push r14
push r15
mov eax, 0x50
call fcn.1400be950
sub rsp, rax
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rdi
mov rax, qword [0x140396c80]
xor rax, rbp
mov qword [rbp + 8], rax
xor ebx, ebx
lea r14, str.RANDFILE
mov r12, rdx
mov r15, rcx
xor r8d, r8d
xor edx, edx
mov rcx, r14
mov esi, ebx
lea r13d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
jne 0x1401cbf17
lea r14, str.HOME
xor r8d, r8d
mov rcx, r14
xor edx, edx
mov r13d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
jne 0x1401cbf17
lea r14, str.USERPROFILE
xor r8d, r8d
mov rcx, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
jne 0x1401cbf17
lea r14, str.SYSTEMROOT
xor r8d, r8d
mov rcx, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
je 0x1401cbff2
mov eax, edi
movabs rdx, 0xffffffffffffff0
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1401cbf32
mov rcx, rdx
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400be950
sub rsp, rcx
mov r8d, edi
mov rcx, r14
lea rax, [rsp + 0x40]
mov rdx, rax
mov qword [rbp], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, edi
jae 0x1401cbfe8
mov rdi, qword [rbp]
mov r9d, 0xffffffff
mov qword [rsp + 0x38], rbx
mov r8, rdi
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdx, eax
test eax, eax
je 0x1401cbfe8
lea rax, [rdx + 0xf]
cmp rax, rdx
ja 0x1401cbfa8
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1400be950
sub rsp, rax
mov r9d, 0xffffffff
mov r8, rdi
mov ecx, 0xfde9
mov qword [rsp + 0x38], rbx
lea rsi, [rsp + 0x40]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], edx
xor edx, edx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rsi, rbx
test r13d, r13d
jne 0x1401cbffb
test rsi, rsi
jne 0x1401cc004
lea rsi, [0x140302af8]
jmp 0x1401cc00c
test rsi, rsi
je 0x1401cc0ad
cmp byte [rsi], bl
je 0x1401cc0ad
mov rcx, rsi
mov eax, ebx
cmp eax, 0x80000000
jae 0x1401cc021
inc rcx
inc eax
cmp byte [rcx], bl
jne 0x1401cc011
mov edx, eax
btr edx, 0x1f
test r13d, r13d
je 0x1401cc04c
lea rax, [rdx + 1]
cmp rax, r12
jae 0x1401cc04c
mov r8, r12
mov rdx, rsi
mov rcx, r15
call fcn.1401d5720
cmp rax, r12
jb 0x1401cc0a7
xor eax, eax
jmp 0x1401cc0bb
lea rcx, str..rnd
mov eax, ebx
cmp eax, 0x80000000
jae 0x1401cc065
inc rcx
inc eax
cmp byte [rcx], bl
jne 0x1401cc055
btr eax, 0x1f
add rax, 2
add rax, rdx
cmp rax, r12
jae 0x1401cc0a7
mov r8, r12
mov rdx, rsi
mov rcx, r15
call fcn.1401d5720
mov r8, r12
lea rdx, [0x140295f54]
mov rcx, r15
call fcn.1401d56a0
mov r8, r12
lea rdx, str..rnd
mov rcx, r15
call fcn.1401d56a0
movzx eax, byte [r15]
jmp 0x1401cc0b2
mov byte [r15], bl
xor al, al
test al, al
cmovne rbx, r15
mov rax, rbx
mov rcx, qword [rbp + 8]
xor rcx, rbp
call fcn.1400be7c0
mov rbx, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x50]
lea rsp, [rbp + 0x10]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret