Function at 0x140003474
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1340]
mov eax, 0x1440
call fcn.1400160e0
sub rsp, rax
mov rax, qword [0x14001f078]
xor rax, rsp
mov qword [rbp + 0x1330], rax
xor r10d, r10d
mov qword [rsp + 0x28], r9
mov rdi, r8
mov r12, rdx
mov ebx, r10d
mov r13d, r10d
mov cl, r10b
mov r15d, r10d
test r9, r9
je 0x140003816
cmp qword [r9], r10
jne 0x140003816
or rax, 0xffffffffffffffff
inc rax
cmp byte [r8 + rax], r10b
jne 0x1400034da
test rax, rax
je 0x14000381d
mov rsi, rdi
mov qword [rsp + 0x20], rdi
cmp byte [r8], r10b
je 0x14000381d
mov r11d, 0x400
cmp byte [rsi], 0x25
jne 0x140003609
cmp rsi, rdi
je 0x14000351b
cmp byte [rsi - 1], 0x5c
je 0x140003609
lea r14, [rsi + 1]
mov al, byte [r14]
test al, al
je 0x140003603
cmp al, 0x25
jne 0x140003535
cmp byte [r14 - 1], 0x5c
jne 0x14000353a
inc r14
jmp 0x14000351f
mov eax, r14d
sub eax, esi
sub eax, 1
je 0x14000363a
cmp eax, r11d
jae 0x140003631
mov r8d, eax
cmp r8, 0x7ffffffe
ja 0x140003622
lea rax, [rsp + 0x30]
mov r9, rsi
sub r9, rax
lea rcx, [rsp + 0x30]
mov rdx, r11
lea rax, [rdx - 0x400]
add rax, r8
je 0x140003594
mov al, byte [r9 + rcx + 1]
test al, al
je 0x140003594
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x140003574
test rdx, rdx
lea rax, [rcx - 1]
cmovne rax, rcx
mov byte [rax], r10b
mov rax, rdx
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x8007007a
test rdx, rdx
je 0x1400037cd
cmp r8, r11
jae 0x14000384d
mov byte [rsp + r8 + 0x30], r10b
lea rcx, [rsp + 0x30]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
nop dword [rax + rax]
xor r10d, r10d
test eax, eax
je 0x140003619
sub esi, dword [rsp + 0x20]
mov cl, 1
add esi, eax
mov r11d, 0x400
lea rax, [r14 + 1]
add r15d, esi
mov qword [rsp + 0x20], rax
mov rsi, r14
cmp byte [r14], 0x25
jne 0x140003653
inc rsi
inc r15d
cmp byte [rsi], r10b
je 0x140003659
jmp 0x140003503
lea rdx, str.MCF__SubstituteEnv:___item_not_found_as_an_environment_variable._r_n
jmp 0x140003641
mov byte [rsp + 0x30], r10b
mov ebx, 0x80070057
jmp 0x1400037cd
lea rdx, str.MCF__SubstituteEnv:_Too_many_characters_in___variable_1024_Max._r_n
jmp 0x140003641
lea rdx, str.MCF__SubstituteEnv:____found._Illegal_syntax._r_n
mov rcx, r12
call fcn.14000eba4
mov ebx, 0x8007064a
jmp 0x1400037cd
sub r14d, esi
add r15d, r14d
test cl, cl
je 0x1400037c4
lea eax, [r15 + 1]
mov ecx, eax
mov r15d, eax
call fcn.140015308
mov r13, rax
test rax, rax
jne 0x140003681
mov ebx, 0x8007000e
jmp 0x1400037cd
mov r8, r15
xor edx, edx
mov rcx, r13
call sub.msvcrt.dll_memset
xor r10d, r10d
mov r14, r13
cmp byte [rdi], r10b
je 0x1400037c1
mov al, byte [rdi]
cmp al, 0x25
jne 0x1400037f0
lea rsi, [rdi + 1]
jmp 0x1400036b4
cmp al, 0x25
je 0x1400036bf
inc rsi
mov al, byte [rsi]
test al, al
jne 0x1400036ad
jmp 0x1400037a5
mov r8d, esi
sub r8d, edi
dec r8d
cmp r8, 0x7ffffffe
ja 0x140003622
mov r9d, 0x400
lea rax, [rsp + 0x30]
mov edx, r9d
lea rcx, [rsp + 0x30]
sub rdi, rax
lea rax, [rdx - 0x400]
add rax, r8
je 0x14000370a
mov al, byte [rdi + rcx + 1]
test al, al
je 0x14000370a
mov byte [rcx], al
inc rcx
sub rdx, 1
jne 0x1400036eb
test rdx, rdx
lea rax, [rcx - 1]
cmovne rax, rcx
mov byte [rax], r10b
mov rax, rdx
neg rax
sbb ebx, ebx
not ebx
and ebx, 0x8007007a
test rdx, rdx
je 0x1400037cd
cmp r8, r9
jae 0x140003853
mov byte [rsp + r8 + 0x30], r10b
lea rdx, [rbp + 0x330]
mov r8d, 0x1000
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
nop dword [rax + rax]
test eax, eax
je 0x14000380a
cmp eax, 0x1000
jae 0x1400037fe
lea r8, [rbp + 0x330]
mov rdx, r15
mov rcx, r13
call fcn.140007b6c
xor r10d, r10d
mov ebx, eax
test eax, eax
js 0x1400037cd
lea rax, [rbp + 0x330]
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], r10b
jne 0x140003796
add r14, rcx
mov rdi, rsi
cmp byte [rsi], 0x25
je 0x1400037f6
mov r8, rdi
mov rdx, r15
mov rcx, r13
call fcn.140007b6c
xor r10d, r10d
mov ebx, eax
test eax, eax
js 0x1400037cd
mov byte [r14], r10b
mov r9, qword [rsp + 0x28]
test ebx, ebx
jns 0x14000381d
mov rcx, r13
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
nop dword [rax + rax]
mov r8d, ebx
lea rdx, str.MCF__SubstituteEnv_failed:__hr
mov rcx, r12
call fcn.14000eef8
jmp 0x140003820
mov byte [r14], al
inc r14
inc rdi
jmp 0x140003694
lea rdx, str.MCF__SubstituteEnv:_value__of_Environment_variable_too_large_Max_4096_Characters._r_n
jmp 0x140003641
lea rdx, str.MCF__SubstituteEnv:_item_not_found_as_an_environment_variable._r_n
jmp 0x140003641
mov ebx, 0x80070057
jmp 0x1400037c9
mov qword [r9], r13
mov eax, ebx
mov rcx, qword [rbp + 0x1330]
xor rcx, rsp
call fcn.1400156d0
mov rbx, qword [rsp + 0x1480]
add rsp, 0x1440
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400159e8
int3
call fcn.1400159e8
int3