Function at 0x140029d30
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x478
mov r14, rcx
movabs r15, 0x8000000000000000
lea rcx, [rsp + 0x78]
call fcn.1400313f0
mov rax, qword [rsp + 0x78]
cmp rax, r15
jne 0x140029dd4
mov rdi, qword [rsp + 0x80]
mov eax, edi
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x140029dcc
test rax, rax
je 0x140029dcc
mov rbx, qword [rdi - 1]
mov rsi, qword [rdi + 7]
mov rax, qword [rsi]
test rax, rax
je 0x140029d95
mov rcx, rbx
call rax
dec rdi
cmp qword [rsi + 8], 0
je 0x140029dbb
cmp qword [rsi + 0x10], 0x11
jb 0x140029daa
mov rbx, qword [rbx - 8]
mov rcx, qword [0x1428c80c8]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x1428c80c8]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov qword [r14], r15
jmp 0x14002a030
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r14
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x38], 0
mov r8d, 0x200
mov r14d, 2
xor ebx, ebx
mov esi, 0xffffffff
xor r15d, r15d
cmp r8, 0x201
jae 0x140029e50
jmp 0x140029e3f
jae 0x140029ef4
cmp r8, 0x201
jae 0x140029e50
mov edi, 0x200
lea r12, [rsp + 0x78]
mov r13, r8
jmp 0x140029e79
sub r8, r15
mov rax, rbx
sub rax, r15
cmp r8, rax
ja 0x140029ed8
cmp rbx, rsi
mov r15d, 0xffffffff
cmovb r15, rbx
mov qword [rsp + 0x38], r15
mov rdi, r15
mov r12, r14
mov r13, r15
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, qword [rsp + 0x50]
mov rdx, r12
mov r8d, r13d
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov ebp, eax
test eax, eax
jne 0x140029ea3
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x140029fb6
mov r8d, ebp
cmp r13, r8
jne 0x140029e30
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x14002a045
add r13, r13
cmp r13, rsi
cmovae r13, rsi
mov r8, r13
cmp r8, 0x201
jb 0x140029e3f
jmp 0x140029e50
lea rcx, [rsp + 0x28]
mov rdx, r15
call fcn.14004aa10
mov rbx, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
jmp 0x140029e5e
cmp rdi, r8
jb 0x14002a045
lea rcx, [rsp + 0x58]
mov rdx, r12
call fcn.14002fdc0
cmp qword [rsp + 0x28], 0
mov rsi, qword [rsp + 0x48]
movabs rdi, 0x8000000000000000
je 0x140029f34
mov r8, qword [rsp + 0x30]
mov rcx, qword [0x1428c80c8]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov r14, qword [rsp + 0x40]
cmp qword [rsp + 0x58], rdi
jne 0x14002a007
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x60]
mov eax, esi
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x14002a018
test rax, rax
je 0x14002a018
mov rbx, qword [rsi - 1]
mov rdi, qword [rsi + 7]
mov rax, qword [rdi]
test rax, rax
je 0x140029f7d
mov rcx, rbx
call rax
dec rsi
cmp qword [rdi + 8], 0
je 0x140029fa3
cmp qword [rdi + 0x10], 0x11
jb 0x140029f92
mov rbx, qword [rbx - 8]
mov rcx, qword [0x1428c80c8]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x1428c80c8]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
jmp 0x14002a018
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x60], rax
movabs rdi, 0x8000000000000000
mov qword [rsp + 0x58], rdi
cmp qword [rsp + 0x28], 0
je 0x140029ff2
mov r8, qword [rsp + 0x30]
mov rcx, qword [0x1428c80c8]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsp + 0x40]
cmp qword [rsp + 0x58], rdi
je 0x140029f44
movups xmm0, xmmword [rsp + 0x58]
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test r14, r14
je 0x14002a030
mov rcx, qword [0x1428c80c8]
xor edx, edx
mov r8, qword [rsp + 0x50]
call sub.KERNEL32.dll_HeapFree
nop
add rsp, 0x478
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2