Function at 0x14008ca17
Capabilities:
Query environment variable

Disassembly:
push rax
pushf
mov eax, 0xe84b6b79
pushf
not eax
add eax, 0x38e94d9b
xor eax, 0x17504212
rol eax, 0x1f
popf
pushf
not eax
add eax, 0x31959099
xor eax, 0x2be61966
rol eax, 0xba
popf
pushf
not eax
add eax, 0xea23ad0
xor eax, 0x44af7e11
rol eax, 0x9c
popf
pushf
not eax
add eax, 0x9f51242
xor eax, 0x5b2aabaa
rol eax, 0x22
popf
cmp eax, 2
jne 0x14008ca7a
popf
pop rax
jmp 0x14008cd20
cmp eax, 0
jne 0x14008ca89
popf
pop rax
jmp 0x14008caa7
cmp eax, 3
jne 0x14008ca98
popf
pop rax
jmp 0x14008cd7d
cmp eax, 1
jne 0x14008caa7
popf
pop rax
jmp 0x14008cc38
mov eax, 0x576b7230
pushf
not eax
add eax, 0x712e6faa
xor eax, 0x29d919b0
rol eax, 0x42
popf
pushf
not eax
add eax, 0x2c1590fb
xor eax, 0x5b9b0fb5
rol eax, 0x6d
popf
pushf
not eax
add eax, 0x322a8c1
xor eax, 0x2404cb75
rol eax, 0x69
popf
pushf
not eax
add eax, 0x1c9f6be2
xor eax, 0x740bd3e4
rol eax, 0x2c
popf
call fcn.14009bcb8
sub rsp, rax
mov rax, qword [0x14003e040]
xor rax, rsp
mov qword [rsp + 0x4020], rax
xor r8d, r8d
xor edx, edx
call fcn.1400900bf
mov r8d, 0x94552ec8
pushf
not r8d
add r8d, 0x6ad78f8
xor r8d, 0x2f3e9199
rol r8d, 0xe6
popf
pushf
not r8d
add r8d, 0x6e89fd7f
xor r8d, 0x4ae0e6c9
rol r8d, 0x6a
popf
pushf
not r8d
add r8d, 0x336f9332
xor r8d, 0x63dad9b9
rol r8d, 0xd8
popf
lea rdx, [rsp + 0x20]
mov rcx, rax
jmp 0x14008cb76
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x14008cb7d
dec eax
cmp eax, 0xffe
ja 0x14008cbdf
push rax
pushf
mov eax, 0x9527692a
pushf
not eax
add eax, 0x625dae51
xor eax, 0x335fda0f
rol eax, 0x9b
popf
pushf
not eax
add eax, 0x624fa1ff
xor eax, 0x7fb13f33
rol eax, 0x80
popf
pushf
not eax
add eax, 0x2e07743f
xor eax, 0x12656a73
rol eax, 0xf9
popf
pushf
not eax
add eax, 0xea59bfd
xor eax, 0x17809d3c
rol eax, 0x69
popf
jmp 0x14008ca6b
push rax
pushf
mov eax, 0x891ca20e
pushf
not eax
add eax, 0x3474815c
xor eax, 0x31fd919a
rol eax, 0x43
popf
pushf
not eax
add eax, 0x689871f0
xor eax, 0x27b802ac
rol eax, 0x91
popf
pushf
not eax
add eax, 0x67e0c9e1
xor eax, 0x41d02824
rol eax, 0x82
popf
pushf
not eax
add eax, 0x288f96cb
xor eax, 0x52c9d7c6
rol eax, 0xb3
popf
jmp 0x14008ca6b
mov r8d, 0xd45a1d13
pushf
not r8d
add r8d, 0x32bc344b
xor r8d, 0x7c757659
rol r8d, 0x64
popf
pushf
not r8d
add r8d, 0x8c58aea
xor r8d, 0x2d18b9ab
rol r8d, 0x3c
popf
pushf
not r8d
add r8d, 0x4b26ddcc
xor r8d, 0x7e8060f1
rol r8d, 0xfc
popf
lea rdx, [rsp + 0x2020]
lea rcx, [rsp + 0x20]
jmp 0x14008cc97
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x14008cc9e
dec eax
cmp eax, 0xffe
ja 0x14008ccda
push rax
pushf
mov eax, 0x5a1cdd67
pushf
not eax
add eax, 0x22fac15c
xor eax, 0x53883088
rol eax, 0xc2
popf
pushf
not eax
add eax, 0x7cc92df8
xor eax, 0xb71e005
rol eax, 7
popf
jmp 0x14008ca6b
push rax
pushf
mov eax, 0x288b2401
pushf
not eax
add eax, 0x6312b22a
xor eax, 0x148e97db
rol eax, 0xf4
popf
pushf
not eax
add eax, 0x5416f1b5
xor eax, 0x559063a0
rol eax, 0xda
popf
pushf
not eax
add eax, 0x201a3209
xor eax, 0x2094603e
rol eax, 0x24
popf
jmp 0x14008ca6b
xor r8d, r8d
lea rcx, [rsp + 0x2020]
xor edx, edx
call fcn.1400907c8
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.140098f5b
add rsp, 0x4038
ret
xor eax, eax
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.140098f5b
add rsp, 0x4038
ret