Function at 0x1000b235c
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x460
mov rax, qword [0x1000de138]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rsi, rcx
mov rdi, r8
mov ebp, edx
mov ebx, 0x206
lea rcx, [rsp + 0x242]
xor r13d, r13d
xor edx, edx
mov r8, rbx
mov r12, r9
mov word [rsp + 0x240], r13w
call sub.msvcrt.dll_memset
lea rcx, [rsp + 0x32]
mov r8, rbx
xor edx, edx
mov word [rsp + 0x30], r13w
call sub.msvcrt.dll_memset
mov ebx, 0x80070057
cmp rsi, r13
jne 0x1000b23f4
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b26fb
test byte [rcx + 0x1c], 1
je 0x1000b26fb
lea edx, [r13 + 0x11]
jmp 0x1000b241f
cmp rdi, r13
jne 0x1000b2434
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b26fb
test byte [rcx + 0x1c], 1
je 0x1000b26fb
mov edx, 0x12
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fe8]
call fcn.100020584
jmp 0x1000b26fb
mov r14d, 0x104
cmp dword [rdi], r13d
jne 0x1000b2504
lea r8, [0x10001ab70]
lea rcx, [rsp + 0x240]
mov r9, rsi
mov rdx, r14
call fcn.100058674
cmp eax, r13d
mov ebx, eax
jge 0x1000b248f
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b26fb
test byte [rcx + 0x1c], 1
je 0x1000b26fb
mov edx, 0x13
jmp 0x1000b26bf
mov eax, ebp
lea r8, [0x10001ac10]
lea rdx, [rsp + 0x240]
neg eax
mov r9, rdi
sbb rcx, rcx
neg rcx
add rcx, 0xffffffff80000001
call fcn.1000aa3f4
cmp eax, r13d
jne 0x1000b24c1
cmp dword [rdi], r13d
jne 0x1000b2504
mov ebx, 0x90070a02
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b26fb
test byte [rcx + 0x1c], 4
je 0x1000b26fb
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fe8]
mov edx, 0x14
mov r9, rsi
call fcn.100020614
jmp 0x1000b26fb
cmp r12, r13
je 0x1000b26d4
mov r8d, r14d
lea rdx, [rsp + 0x30]
cmp ebp, r13d
je 0x1000b2559
lea rcx, [0x10001a8c0]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, r13d
je 0x1000b2531
cmp eax, r14d
jbe 0x1000b2578
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, r13d
cmovle ebx, eax
cmp ebx, r13d
jl 0x1000b26fb
mov ebx, 0x80004005
jmp 0x1000b26fb
lea rcx, [0x10001ac20]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, r13d
je 0x1000b26d9
cmp eax, r14d
ja 0x1000b26d9
lea rdx, [0x10001ac40]
lea rcx, [rsp + 0x30]
call fcn.1000b2118
cmp eax, r13d
mov ebx, eax
jge 0x1000b25bb
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b26fb
test byte [rcx + 0x1c], 1
je 0x1000b26fb
mov edx, 0x15
jmp 0x1000b26bf
lea rcx, [rsp + 0x30]
mov rdx, rsi
call fcn.1000b2118
cmp eax, r13d
mov ebx, eax
jge 0x1000b25fa
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b26fb
test byte [rcx + 0x1c], 1
je 0x1000b26fb
mov edx, 0x16
jmp 0x1000b26bf
lea rdx, [0x10001ac58]
lea rcx, [rsp + 0x30]
call fcn.1000b2118
cmp eax, r13d
mov ebx, eax
jge 0x1000b263d
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b26fb
test byte [rcx + 0x1c], 1
je 0x1000b26fb
mov edx, 0x17
jmp 0x1000b26bf
lea rdx, [0x10001ac60]
lea rcx, [rsp + 0x30]
call fcn.1000b2118
cmp eax, r13d
mov ebx, eax
jge 0x1000b267d
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b26fb
test byte [rcx + 0x1c], 1
je 0x1000b26fb
mov edx, 0x18
jmp 0x1000b26bf
mov eax, dword [rdi]
lea r9, [rsp + 0x30]
lea r8, [0x10001ac78]
mov rdx, r14
mov rcx, r12
mov dword [rsp + 0x20], eax
call fcn.100058674
cmp eax, r13d
mov ebx, eax
jge 0x1000b26d4
mov rcx, qword [0x1000dedd8]
lea rax, [0x1000dedd8]
cmp rcx, rax
je 0x1000b26fb
test byte [rcx + 0x1c], 1
je 0x1000b26fb
mov edx, 0x19
mov rcx, qword [rcx + 0x10]
lea r8, [0x100002fe8]
mov r9d, ebx
call fcn.100020d8c
jmp 0x1000b26fb
mov ebx, r13d
jmp 0x1000b26fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0x80004005
movzx ecx, ax
or ecx, 0x80070000
cmp eax, r13d
cmovle ecx, eax
cmp ecx, r13d
cmovge ecx, ebx
mov ebx, ecx
mov eax, ebx
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.1000cd7d0
add rsp, 0x460
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret