Function at 0x140053a90
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x230
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14057b2a8]
xor rax, rsp
mov qword [rbp + 0x1e0], rax
movabs r13, 0x84ce2a40ccc4353c
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0xb84476c2c91a01d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0xf13960c0a19dffad
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0x75f618257cd2cb3f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0xe588ddbe089197b4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs r12, 0x635bee37f6479c6d
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs r15, 0xe1ba4b36a5b66560
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
movabs rsi, 0x48d8310347e3c149
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
movabs rax, 0x847605acceee91c2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
movabs rax, 0x183777908a7bb4b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
movabs rax, 0xe5fca5ca26e5e2c4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0xa0], ymm1
vmovdqa xmm0, xmmword [rbp + 0xc0]
vpxor xmm0, xmm0, xmmword [rbp + 0x180]
vmovdqa xmmword [rbp + 0xc0], xmm0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x60], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x70], xmm1
lea rax, [rbp + 0xa0]
mov rbx, 0xffffffffffffffff
mov r8, rbx
vzeroupper
inc r8
cmp byte [rax + r8], 0
jne 0x140053c41
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x60]
call fcn.140048220
nop
movabs r14, 0xe1fb1f77e1e63521
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movdqa xmm0, xmmword [rbp + 0x40]
pxor xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x40], xmm0
lea rcx, [rbp + 0x40]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
lea r8, [rbp + 0x60]
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.140049a60
nop
mov rcx, rax
call fcn.1400516d0
movzx edi, al
mov rdx, qword [rbp + 0x138]
cmp rdx, 0x10
jb 0x140053d12
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140053d0d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140053d0d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b7258
movdqa xmm0, xmmword [0x140132010]
movdqu xmmword [rbp + 0x130], xmm0
mov byte [rbp + 0x120], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x140053d67
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140053d62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140053d62
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b7258
movdqa xmm0, xmmword [0x140132010]
movdqu xmmword [rbp + 0x70], xmm0
mov byte [rbp + 0x60], 0
test dil, dil
je 0x14005412b
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0xb84476c2c91a01d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0xf13960c0a19dffad
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rax, 0x75f618257cd2cb3f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0xe588ddbe089197b4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
movabs rax, 0x847605acceee91c2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
movabs rax, 0x183777908a7bb4b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
movabs rax, 0xe5fca5ca26e5e2c4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x1a0]
vmovdqa ymmword [rbp + 0xe0], ymm1
vmovdqa xmm0, xmmword [rbp + 0x100]
vpxor xmm0, xmm0, xmmword [rbp + 0x1c0]
vmovdqa xmmword [rbp + 0x100], xmm0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x80], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x90], xmm1
lea rax, [rbp + 0xe0]
vzeroupper
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140053ed0
mov r8, rbx
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x80]
call fcn.140048220
nop
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movdqa xmm0, xmmword [rbp + 0x50]
pxor xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x50], xmm0
lea rcx, [rbp + 0x50]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
lea r8, [rbp + 0x80]
mov rdx, rax
lea rcx, [rbp + 0x140]
call fcn.140049a60
nop
mov rdx, rax
lea rcx, [rbp + 8]
call fcn.140052640
nop
mov rdx, qword [rbp + 0x158]
cmp rdx, 0x10
jb 0x140053fa1
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140053f9c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140053f9c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b7258
movdqa xmm0, xmmword [0x140132010]
movdqu xmmword [rbp + 0x150], xmm0
mov byte [rbp + 0x140], 0
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x140053ffc
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140053ff7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140053ff7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b7258
mov rbx, qword [rbp + 8]
mov rdi, rbx
mov rsi, qword [rbp + 0x10]
cmp rbx, rsi
je 0x1400540db
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14005401d
mov rcx, qword [rdi]
cmp qword [rdi + 0x10], 0xf
jne 0x14005403a
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.usermode_exited
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140054043
add rdi, 0x20
cmp rdi, rsi
jmp 0x14005400a
test rbx, rbx
je 0x1400540d7
xor edi, edi
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14005408a
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140054085
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14005411f
mov rcx, r8
call fcn.1400b7258
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], dil
add rbx, 0x20
cmp rbx, rsi
jne 0x140054050
mov rdx, qword [rbp + 0x18]
mov rcx, qword [rbp + 8]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400540d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005411f
call fcn.1400b7258
mov al, 1
jmp 0x14005412d
test rbx, rbx
je 0x14005412b
lea r8, [rbp + 8]
mov rdx, rsi
mov rcx, rbx
call fcn.140049c70
mov rdx, qword [rbp + 0x18]
mov rcx, qword [rbp + 8]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140054126
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140054126
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b7258
xor al, al
mov rcx, qword [rbp + 0x1e0]
xor rcx, rsp
call fcn.1400b72f0
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret