Function at 0x180058ec0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x18009da48]
xor rax, rsp
mov qword [rbp + 0x80], rax
lea r14d, [r8 + 0x4a1]
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
cmp r8d, r14d
jae case.0x180058f57.135
mov r15, qword [rsp + 0x38]
lea r13, [0x180000000]
xor r12d, r12d
nop dword [rax + rax]
cmp ebx, 0x1bb
ja 0x18005902c
je 0x180059002
lea eax, [rbx - 0x85]
cmp eax, 0xe7
ja case.0x180058f57.140
movzx eax, byte [rax + r13 + 0x591b0]
mov ecx, dword [r13 + rax*4 + 0x59190]
add rcx, r13
jmp rcx
mov r8d, 3
mov dword [rsp + 0x40], 0x74656e69
lea rdx, [0x180095444]
mov byte [rsp + 0x44], r12b
lea rcx, [rsp + 0x44]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp case.0x180058f57.140
mov eax, dword [rdi + 8]
cmp eax, dword [rsi + 8]
jbe 0x180058f98
mov dword [rsp + 0x30], 1
jmp case.0x180058f57.140
sbb eax, eax
mov dword [rsp + 0x30], eax
jmp case.0x180058f57.140
test rdi, rdi
je case.0x180058f57.140
or byte [rdi], 2
jmp case.0x180058f57.140
mov r8d, 1
mov byte [rsp + 0x47], r12b
lea rdx, [0x1800954ca]
lea rcx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov byte [rsp + 0x48], 0x72
jmp case.0x180058f57.140
imul eax, dword [rsi], 0x38
lea rdx, [rsp + 0x38]
mov r8d, 0x5f
mov rcx, rdi
mov dword [rsp + 0x38], eax
call fcn.180022530
test eax, eax
jne 0x180059166
jmp case.0x180058f57.140
movsd xmm0, qword [0x1800954e2]
movzx eax, word [0x1800954ea]
movsd qword [rsp + 0x60], xmm0
mov word [rsp + 0x68], ax
mov byte [rsp + 0x49], r12b
mov word [rsp + 0x6a], r12w
jmp case.0x180058f57.140
cmp ebx, 0x2f7
ja 0x1800590e1
je 0x1800590b9
mov eax, ebx
sub eax, 0x20a
je 0x180059092
sub eax, 0x4f
je 0x180059075
cmp eax, 0x4f
jne case.0x180058f57.140
movzx eax, word [0x18009547f]
mov word [rsp + 0x53], ax
movzx eax, byte [0x180095481]
mov byte [rsp + 0x55], al
mov dword [rsp + 0x56], 0x20706378
jmp case.0x180058f57.140
mov r8d, 3
lea rdx, str.v_cMPX_NGT_F64_e64_si
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
jmp case.0x180058f57.140
movsd xmm0, qword [0x1800954b8]
movzx eax, word [0x1800954c0]
movsd qword [rsp + 0x6a], xmm0
mov word [rsp + 0x72], ax
mov word [rsp + 0x74], r12w
mov byte [rsp + 0x50], r12b
jmp case.0x180058f57.140
lea rax, [rsp + 0x40]
mov byte [rsp + 0x5a], r12b
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x60]
xor edx, edx
mov ecx, SHSetFolderPathA
call fcn.180043060
mov r15, rax
jmp case.0x180058f57.140
mov eax, ebx
sub eax, 0x346
je 0x180059114
sub eax, 0x4f
je 0x1800590f6
cmp eax, 0x4f
je case.0x180058f57.135
jmp case.0x180058f57.140
xor r9d, r9d
mov qword [rsp + 0x20], r12
mov r8, rsi
mov edx, 0xab
mov rcx, rdi
call fcn.180053e00
mov byte [rsp + 0x30], al
jmp case.0x180058f57.140
mov rcx, rdi
call r15
mov dword [rsi], eax
cmp eax, 0xffffffff
jne 0x18005915d
mov r8d, 0x100
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
add ebx, 0x4f
cmp ebx, r14d
jb 0x180058f20
jmp case.0x180058f57.135
xor r9d, r9d
mov qword [rsp + 0x20], rsi
mov r8, rdi
mov rdx, rdi
lea ecx, [r9 + 0x1e]
call fcn.18005f3f0
jmp 0x180059166
mov byte [rsp + 0x30], 1
mov eax, dword [rsp + 0x30]
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.180083f10
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x190
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret