Function at 0x18014ace1
Capabilities:
Query environment variable

Disassembly:
push rax
pushf
mov eax, 0xa872170a
pushf
not eax
add eax, 0xb78e4ff3
xor eax, 0x9daaf630
rol eax, 0xf2
popf
pushf
not eax
add eax, 0xfb9a0b17
xor eax, 0xbd370444
rol eax, 0xd0
popf
pushf
not eax
add eax, 0x8e9477ad
xor eax, 0xca14faac
rol eax, 0xdb
popf
cmp eax, 4
jne 0x18014ad31
popf
pop rax
jmp 0x18014afaf
cmp eax, 0
jne 0x18014ad40
popf
pop rax
jmp 0x18014adf4
cmp eax, 3
jne 0x18014ad4f
popf
pop rax
jmp 0x18014af78
cmp eax, 1
jne 0x18014ad5e
popf
pop rax
jmp 0x18014ae97
cmp eax, 0xd
jne 0x18014ad6d
popf
pop rax
jmp 0x18014b3d2
cmp eax, 7
jne 0x18014ad7c
popf
pop rax
jmp 0x18014b19f
cmp eax, 6
jne 0x18014ad8b
popf
pop rax
jmp 0x18014b106
cmp eax, 0xb
jne 0x18014ad9a
popf
pop rax
jmp 0x18014b309
cmp eax, 0xc
jne 0x18014ada9
popf
pop rax
jmp 0x18014b36f
cmp eax, 8
jne 0x18014adb8
popf
pop rax
jmp 0x18014b1f4
cmp eax, 5
jne 0x18014adc7
popf
pop rax
jmp 0x18014b058
cmp eax, 2
jne 0x18014add6
popf
pop rax
jmp 0x18014aef7
cmp eax, 9
jne 0x18014ade5
popf
pop rax
jmp 0x18014b27d
cmp eax, 0xa
jne 0x18014adf4
popf
pop rax
jmp 0x18014b2e2
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
jmp 0x18014ae0e
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x18014ae51
push rax
pushf
mov eax, 0xbc1e0951
pushf
not eax
add eax, 0xc1c55a40
xor eax, 0xa81a4c22
rol eax, 0xad
popf
pushf
not eax
add eax, 0x9861fb38
xor eax, 0xf6c86580
rol eax, 0xe7
popf
jmp 0x18014ad22
push rax
pushf
mov eax, 0x8df51d29
pushf
not eax
add eax, 0xdea58b53
xor eax, 0xa6bab080
rol eax, 0xb8
popf
pushf
not eax
add eax, 0xd184693f
xor eax, 0xf9229315
rol eax, 0xe
popf
pushf
not eax
add eax, 0xef694403
xor eax, 0xbc03cc57
rol eax, 0xae
popf
jmp 0x18014ad22
xor eax, eax
jmp 0x18014b3df
mov rbp, rbx
cmp word [rax], si
je 0x18014af32
push rax
pushf
mov eax, 0x6ae98a18
pushf
not eax
add eax, 0xd87df15c
xor eax, 0x95ce042c
rol eax, 0xe6
popf
pushf
not eax
add eax, 0xa4663036
xor eax, 0x8dcd5431
rol eax, 0x3f
popf
jmp 0x18014ad22
push rax
pushf
mov eax, 0xdc2cf02d
pushf
not eax
add eax, 0xffb7e7d4
xor eax, 0xcc57c953
rol eax, 0x27
popf
pushf
not eax
add eax, 0xee29831e
xor eax, 0x9a7b263e
rol eax, 0xcc
popf
pushf
not eax
add eax, 0xc50908b8
xor eax, 0xb2218258
rol eax, 0x10
popf
jmp 0x18014ad22
or rax, 0xffffffffffffffff
push rax
pushf
mov eax, 0x228388a2
pushf
not eax
add eax, 0xf2507f10
xor eax, 0xc442b34f
rol eax, 0x75
popf
pushf
not eax
add eax, 0x90c102bc
xor eax, 0xec7f9073
rol eax, 0x5b
popf
jmp 0x18014ad22
inc rax
cmp word [rbp + rax*2], si
jne 0x18014afff
push rax
pushf
mov eax, 0xc4bd5308
pushf
not eax
add eax, 0xdecc92d2
xor eax, 0xf58bc68e
rol eax, 0x31
popf
pushf
not eax
add eax, 0xfaac350a
xor eax, 0x8434e862
rol eax, 0x91
popf
pushf
not eax
add eax, 0xd12e39b8
xor eax, 0xd4692164
rol eax, 0xe1
popf
jmp 0x18014ad22
push rax
pushf
mov eax, 0xb3c40e89
pushf
not eax
add eax, 0xd867c4e5
xor eax, 0x9b559f6c
rol eax, 0x9c
popf
pushf
not eax
add eax, 0x9353c4e5
xor eax, 0xc3c2ee95
rol eax, 0x2e
popf
pushf
not eax
add eax, 0x9792e217
xor eax, 0xcffafdf1
rol eax, 0xf0
popf
pushf
not eax
add eax, 0xeead88c0
xor eax, 0x9da54d24
rol eax, 0x2f
popf
jmp 0x18014ad22
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x18014b0ad
push rax
pushf
mov eax, 0x2bbc3d02
pushf
not eax
add eax, 0xdea6f76e
xor eax, 0xf56d24d7
rol eax, 0x93
popf
pushf
not eax
add eax, 0xcb5c157d
xor eax, 0xf3ac4b59
rol eax, 0xc5
popf
pushf
not eax
add eax, 0xc7565703
xor eax, 0xeca473de
rol eax, 0x14
popf
jmp 0x18014ad22
push rax
pushf
mov eax, 0xff14b478
pushf
not eax
add eax, 0xda4d89e1
xor eax, 0xd2244014
rol eax, 0xed
popf
pushf
not eax
add eax, 0xec9ee9cc
xor eax, 0xa881a4dc
rol eax, 0x67
popf
pushf
not eax
add eax, 0xbe24475e
xor eax, 0x97e852c4
rol eax, 0x6e
popf
pushf
not eax
add eax, 0x95e8015a
xor eax, 0xf85f9d04
rol eax, 0xc7
popf
jmp 0x18014ad22
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1801675e1
movsxd r14, eax
test eax, eax
jne 0x18014b16c
push rax
pushf
mov eax, 0x36699cdd
pushf
not eax
add eax, 0xc9dde7d6
xor eax, 0xf95d3d53
rol eax, 0x81
popf
pushf
not eax
add eax, 0xc5d1a760
xor eax, 0xf17eb831
rol eax, 0xbd
popf
jmp 0x18014ad22
push rax
pushf
mov eax, 0xbd2ecd81
pushf
not eax
add eax, 0xfa37975d
xor eax, 0xe138534b
rol eax, 0x21
popf
pushf
not eax
add eax, 0x87952038
xor eax, 0xcf33eb06
rol eax, 0x5f
popf
jmp 0x18014ad22
mov rcx, rbx
jmp 0x18014b1a3
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x18014ae97
mov rcx, r14
call fcn.1801169d5
mov rdi, rax
test rax, rax
jne 0x18014b24a
push rax
pushf
mov eax, 0x7011b5a3
pushf
not eax
add eax, 0x94517a0e
xor eax, 0xe4b28088
rol eax, 0xef
popf
pushf
not eax
add eax, 0xff5c2831
xor eax, 0xf719043c
rol eax, 0xe
popf
pushf
not eax
add eax, 0xd7e62c0a
xor eax, 0xe270810d
rol eax, 0x69
popf
jmp 0x18014ad22
push rax
pushf
mov eax, 0xd6bb1e1b
pushf
not eax
add eax, 0x82c571d9
xor eax, 0xbbd3b57e
rol eax, 0xe8
popf
pushf
not eax
add eax, 0xc1459e5b
xor eax, 0xe75edb46
rol eax, 0x61
popf
jmp 0x18014ad22
xor ecx, ecx
call fcn.180160126
jmp 0x18014b19f
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1801675e1
test eax, eax
jne 0x18014b36f
mov rcx, rdi
call fcn.180160126
jmp 0x18014b3d2
xor ecx, ecx
call fcn.180160126
mov rsi, rdi
push rax
pushf
mov eax, 0x7df587f3
pushf
not eax
add eax, 0xca228271
xor eax, 0x9bda6cae
rol eax, 0x62
popf
pushf
not eax
add eax, 0xcd1485aa
xor eax, 0xa457e86b
rol eax, 0xd6
popf
pushf
not eax
add eax, 0xf24c59ae
xor eax, 0xa7996e2f
rol eax, 0x6d
popf
pushf
not eax
add eax, 0xea97c26b
xor eax, 0xd8986a22
rol eax, 0x30
popf
jmp 0x18014ad22
mov rcx, rbx
jmp 0x18014b3d6
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret