Function at 0x1400ca4f0
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x228
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov rbp, qword [rsp + 0x290]
mov r15, qword [rsp + 0x298]
mov rbx, qword [rsp + 0x2a0]
mov r12, rcx
mov qword [rsp + 0xc8], rcx
mov r14, rdx
mov qword [rsp + 0x98], rdx
lea rcx, [rsp + 0xd0]
mov edx, 0x104
mov qword [rsp + 0xa8], rbp
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x90], rbx
movzx esi, r9b
mov qword [rsp + 0x70], r8
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
lea rcx, [rsp + 0xd0]
xor edx, edx
mov r8d, 0x140
mov qword [rsp + 0xb0], rax
call fcn.1400e27d0
lea rdx, [rsp + 0xd0]
lea rcx, str.duplexer
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov qword [rsp + 0x78], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x68], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rdx, qword [rbx]
mov r8, qword [r14 + 0x20]
or rbx, 0xffffffffffffffff
mov rcx, rbx
nop
inc rcx
cmp byte [r8 + rcx], 0
jne 0x1400ca5d0
mov r8, qword [rsp + 0x70]
movzx eax, r8b
imul cl
mov rcx, rbx
movzx edi, al
sub dil, byte [rbp + 0x30]
sub dil, sil
add dil, r15b
inc rcx
cmp byte [rdx + rcx], 0
jne 0x1400ca5f5
sub dil, cl
mov rcx, qword [r12 + 8]
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x1400ca610
mov ecx, dword [r12 + 0x10]
add dil, al
mov rax, rbx
inc rax
cmp byte [rdx + rax], 0
jne 0x1400ca624
mov r9, qword [rsp + 0x68]
movzx r13d, sil
mov ebp, ecx
sub ebp, r15d
mov dword [rsp + 0x88], r13d
sub ebp, eax
mov rax, qword [rsp + 0xa8]
mov esi, dword [rax + 0x10]
imul esi, r13d
imul esi, r8d
shl esi, 3
sub esi, dword [r14 + 0x28]
add esi, ecx
add esi, r9d
cmp dil, sil
jb 0x1400ca6b8
call qword [sym.imp.USER32.dll_GetForegroundWindow]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor r8d, r8d
lea edx, [r8 + 0x5a]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceA]
lea rcx, [rsp + 0xd0]
xor edx, edx
mov r8d, 0x140
call fcn.1400e27d0
lea rdx, [rsp + 0xd0]
lea rcx, str.c2ret
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r8, qword [rsp + 0x70]
mov r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x90]
mov rcx, rbx
mov rax, qword [rax]
inc rcx
cmp byte [rax + rcx], 0
jne 0x1400ca6c6
mov rdx, qword [r12 + 8]
mov rax, rbx
inc rax
cmp byte [rdx + rax], 0
jne 0x1400ca6d7
mov edx, dword [r14 + 8]
add ecx, eax
imul edx, r8d
xor r8d, r8d
sub edx, r13d
sub edx, dword [rsp + 0x78]
sub edx, r9d
sub edx, dword [rsp + 0xb0]
inc edx
add edx, ecx
xor ecx, ecx
mov dword [rsp + 0x60], edx
mov edx, 0x344
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r14, rax
mov qword [rsp + 0xc0], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rsp + 0x8c], eax
cmp eax, ebp
ja 0x1400ca748
lea rcx, str.payment
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, r14
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rax, qword [rsp + 0x98]
movzx r15d, dil
mov rcx, qword [rax + 0x18]
mov rax, rbx
mov dword [rsp + 0xa0], r15d
inc rax
cmp byte [rcx + rax], 0
jne 0x1400ca763
mov rcx, qword [rsp + 0x90]
imul eax, r13d
mov rdx, rbx
mov rcx, qword [rcx]
sub eax, r15d
sub eax, dword [rsp + 0x80]
sub eax, dword [rsp + 0x68]
nop dword [rax]
inc rdx
cmp byte [rcx + rdx], 0
jne 0x1400ca790
add eax, dword [rsp + 0x78]
mov r8, qword [r12]
mov rcx, rbx
inc rcx
cmp byte [r8 + rcx], 0
jne 0x1400ca7a4
add eax, edx
lea r14d, [rbp + 0xc]
lea r8, str.duplexer
add ecx, eax
movzx eax, dil
lea rdx, str.payment
add r14d, ecx
xor ecx, ecx
mov r9d, esi
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x38], r15d
mov dword [rsp + 0x30], eax
mov ecx, r13d
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rcx, qword [r12]
mov qword [rsp + 0xb8], rax
mov rdi, rbx
inc rdi
cmp byte [rcx + rdi], 0
jne 0x1400ca811
mov rcx, qword [rsp + 0x98]
movzx eax, byte [rsp + 0x80]
lea r8, str.duplexer
lea rdx, str.duplexer
mov r9d, esi
imul byte [rcx]
movzx ecx, al
movzx eax, byte [rsp + 0x70]
imul cl
xor ecx, ecx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x48], rcx
sub al, r14b
mov ecx, r13d
add dil, al
movsxd rax, esi
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x38], ebp
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], eax
add dil, bpl
mov dword [rsp + 0x20], r15d
add dil, sil
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea rcx, [rsp + 0xd0]
mov edx, 0x104
mov r14, rax
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov r13, rax
cmp dil, sil
jge 0x1400ca8c0
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, qword [rsp + 0xc8]
mov rcx, qword [rcx]
nop dword [rax + rax]
inc rbx
cmp byte [rcx + rbx], 0
jne 0x1400ca8d0
imul eax, esi, 7
sub r14d, eax
lea eax, [r13 + 2]
lea ecx, [r14 + r14*2]
add ecx, ecx
imul eax, dword [rsp + 0x68]
sub ecx, eax
movsx eax, dil
imul eax, dword [rsp + 0xb8]
sub ecx, eax
mov rax, qword [rsp + 0x98]
mov eax, dword [rax + 0x10]
imul eax, dword [rsp + 0x70]
add ecx, eax
mov rax, qword [rsp + 0xc0]
imul eax, dword [rsp + 0x60]
sub ecx, eax
mov eax, dword [rsp + 0xa0]
imul eax, ebp
sub ecx, eax
mov rax, qword [rsp + 0xa8]
sub ecx, dword [rax + 0x20]
imul eax, dword [rsp + 0x8c], 0x19
sub ecx, eax
mov rax, qword [rsp + 0x78]
lea eax, [rax*8]
sub ecx, eax
mov rax, qword [rsp + 0x90]
add ecx, dword [rax + 0xc]
mov eax, dword [rsp + 0x88]
sub ecx, dword [rsp + 0x80]
sub ecx, dword [rsp + 0xb0]
add eax, ecx
add ebx, eax
lea eax, [r15 + 1]
add ebx, r12d
add eax, ebx
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x228
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret