Function at 0x1400791d0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rdi
sub rsp, 0xf8
mov r8b, 1
xor edx, edx
mov rdi, rcx
call fcn.14004cea0
mov rbx, rax
test rax, rax
jne 0x1400791fd
add rsp, 0xf8
pop rdi
pop rbx
ret
cmp byte [rax + 0x23], 0
jne 0x140079207
mov rbx, qword [rax + 0x10]
movzx r9d, byte [rdi + 1]
mov qword [rsp + 0xd0], r15
cmp r9b, 1
jbe 0x14007924c
mov rax, qword [rdi + 8]
mov rdx, qword [rax + 0x38]
test rdx, rdx
je 0x14007924c
mov rdx, qword [rdx]
mov r8b, reloc.OLEAUT32.dll_SafeArrayGetElement
mov rcx, rbx
call fcn.140001090
mov r15, qword [rsp + 0xd0]
mov eax, 1
add rsp, 0xf8
pop rdi
pop rbx
ret
mov qword [rsp + 0x128], rbp
xor ebp, ebp
mov qword [rsp + 0xe8], r12
mov qword [rsp + 0xe0], r13
cmp r9b, 2
jb 0x140079373
mov r12, qword [rdi + 8]
mov rax, qword [r12 + 0x30]
test rax, rax
je 0x140079373
cmp qword [rax], rbp
je 0x140079373
mov rdi, qword [r12 + 0x30]
add r12, 0x20
mov r13, qword [rdi + 8]
movzx ecx, byte [r13 + 0x23]
test cl, cl
jne 0x1400792ab
mov rax, qword [r13 + 0x10]
movzx edx, byte [rax + 0x23]
jmp 0x1400792ae
movzx edx, cl
cmp dl, 3
jne 0x1400792e6
movzx eax, byte [rbx + 0x23]
cmp al, 2
jne 0x1400792c9
mov r15d, 1
mov eax, r15d
jmp 0x140079d1c
test al, al
jne 0x1400792d1
mov rbx, qword [rbx + 0x10]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.1400e67c0
mov r15d, eax
jmp 0x140079d1c
test cl, cl
jne 0x1400792f5
mov rax, qword [r13 + 0x10]
movzx r8d, byte [rax + 0x21]
jmp 0x1400792fa
movzx r8d, byte [r13 + 0x21]
test r8b, 1
je 0x140079310
mov rdx, r13
mov rcx, rbx
call fcn.1400e6b50
jmp 0x140079d1c
cmp qword [rdi + 0x18], rbp
jne 0x140079369
movzx eax, word [r12 + 2]
cmp word [rdi + 0x12], ax
jne 0x140079369
cmp dl, 1
jne 0x14007935a
mov rax, qword [0x14013b0f8]
cmp byte [rax + 0x134], bpl
je 0x14007934a
test cl, cl
jne 0x140079341
mov rax, qword [r13 + 0x10]
jmp 0x140079344
mov rax, r13
test byte [rax + 0x21], 8
je 0x14007935a
mov rdx, r13
mov rcx, rbx
call fcn.1400e5f70
jmp 0x140079d1c
mov rdi, qword [rsp + 0x110]
mov qword [rsp + 0x38], r13
jmp 0x14007937e
mov rdi, qword [rsp + 0x110]
jmp 0x140079376
mov r12, rbp
mov qword [rsp + 0x38], rbp
mov r13, rbp
xor r8b, r8b
mov qword [rsp + 0xf0], rsi
mov qword [rsp + 0xd8], r14
xor r14b, r14b
mov r15d, 1
mov byte [rsp + 0x118], r8b
test r12, r12
je 0x140079460
movzx eax, byte [rbx + 0x23]
test al, al
jne 0x1400793bb
mov rax, qword [rbx + 0x10]
movzx eax, byte [rax + 0x23]
cmp al, 2
je 0x140079460
mov rcx, qword [r12 + 0x10]
mov rdx, qword [rcx]
test rdx, rdx
je 0x140079460
mov rax, qword [rcx + 8]
test r14b, r14b
je 0x140079427
cmp byte [rax + 0x23], bpl
jne 0x1400793e7
mov rax, qword [rax + 0x10]
cmp rax, rbx
jne 0x14007944d
xor r14b, r14b
test r8b, r8b
je 0x140079460
test r14b, r14b
jne 0x140079460
xor r9d, r9d
or r8, 0xffffffffffffffff
xor edx, edx
mov rcx, rdi
call fcn.1400af9f0
cmp eax, r15d
jne 0x1400799d1
mov edx, r15d
mov rcx, rdi
call fcn.14004cbc0
lea rsi, [rax + 1]
jmp 0x140079612
cmp byte [rax + 0x23], bpl
jne 0x140079431
mov rax, qword [rax + 0x10]
cmp rax, rbx
jne 0x14007944d
movzx r8d, r15b
mov byte [rsp + 0x118], r15b
cmp rdx, qword [r12 + 8]
jne 0x1400793f9
movzx r14d, r15b
mov rdx, qword [rcx + 0x18]
add rcx, 0x18
test rdx, rdx
jne 0x1400793d4
jmp 0x1400793ef
cmp r9b, 2
jb 0x140079a97
test r13, r13
je 0x140079534
movzx ecx, byte [r13 + 0x23]
test ecx, ecx
je 0x140079520
dec ecx
je 0x1400794bb
dec ecx
je 0x14007949f
dec ecx
je 0x140079503
mov rdx, qword [r13 + 0x28]
xor ecx, ecx
call qword [r13 + reloc.OLEAUT32.dll_SafeArrayGetElement]
lea rsi, [rax + 1]
jmp 0x140079612
xor ecx, ecx
call fcn.140006960
mov ecx, 0xffffffff
cmp rax, rcx
cmove rax, rbp
lea rsi, [rax + 1]
jmp 0x140079612
mov rcx, r13
call fcn.140001130
cmp dword [0x14013b0c4], ebp
jne 0x14007950f
cmp qword [r13 + 0x10], rbp
jne 0x14007950f
mov rcx, qword [r13 + 0x28]
lea rdx, [rsp + 0x120]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1400794fc
dec eax
mov qword [0x1401440e0], rbp
lea rsi, [rax + 1]
jmp 0x140079612
mov qword [0x1401440e0], r13
mov rax, rbp
lea rsi, [rax + 1]
jmp 0x140079612
mov rax, qword [r13 + 0x10]
shr rax, 1
lea rsi, [rax + 1]
jmp 0x140079612
mov rcx, qword [r13 + 0x10]
xor edx, edx
call fcn.1400e7270
lea rsi, [rax + 1]
jmp 0x140079612
mov rax, qword [rdi + 8]
movzx ecx, word [rax + 0x22]
inc ecx
movsxd rsi, ecx
test r12, r12
je 0x140079612
mov r12, qword [r12 + 0x10]
cmp qword [r12], rbp
je 0x140079612
mov r15d, 0xffffffff
nop
mov rdi, qword [r12 + 8]
movzx eax, word [r12 + 0x12]
movzx ecx, byte [rdi + 0x23]
sub rsi, rax
test ecx, ecx
je 0x1400795f0
dec ecx
je 0x14007959d
dec ecx
je 0x14007958d
dec ecx
je 0x1400795de
mov rdx, qword [rdi + 0x28]
xor ecx, ecx
call qword [rdi + reloc.OLEAUT32.dll_SafeArrayGetElement]
jmp 0x1400795fb
xor ecx, ecx
call fcn.140006960
cmp rax, r15
cmove rax, rbp
jmp 0x1400795fb
mov rcx, rdi
call fcn.140001130
cmp dword [0x14013b0c4], ebp
jne 0x1400795e3
cmp qword [rdi + 0x10], rbp
jne 0x1400795e3
mov rcx, qword [rdi + 0x28]
lea rdx, [rsp + 0x120]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1400795d7
mov qword [0x1401440e0], rbp
dec eax
jmp 0x1400795fb
mov qword [0x1401440e0], rdi
mov rax, rbp
jmp 0x1400795fb
mov rax, qword [rdi + 0x10]
shr rax, 1
jmp 0x1400795fb
mov rcx, qword [rdi + 0x10]
xor edx, edx
call fcn.1400e7270
add r12, 0x18
add rsi, rax
cmp qword [r12], rbp
jne 0x140079560
mov r15d, 1
cmp rsi, 2
jb 0x140079a97
test r14b, r14b
je 0x140079674
cmp byte [rbx + 0x23], bpl
jne 0x14007962d
mov rax, qword [rbx + 0x10]
jmp 0x140079630
mov rax, rbx
cmp byte [rax + 0x23], 2
jne 0x14007963e
mov eax, dword [0x140143df8]
jmp 0x140079642
mov rax, qword [rax + 0x18]
mov r12, qword [rsp + 0x110]
shr rax, 1
cmp rsi, rax
jbe 0x1400799e1
lea r9, [rsp + 0x30]
mov r8, rsi
xor edx, edx
mov rcx, r12
call fcn.1400af9f0
cmp eax, 1
je 0x14007967c
xor eax, eax
jmp 0x140079d0c
mov r12, qword [rsp + 0x110]
cmp byte [rsp + 0x118], bpl
je 0x1400799e1
movzx edx, byte [rbx + 0x23]
mov r13, qword [0x14013f5a8]
test dl, dl
jne 0x1400796b6
mov rcx, qword [rbx + 0x10]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov rdx, r13
mov byte [rsp + 0x20], 1
call fcn.1400e6e20
jmp 0x1400799c9
mov r8b, 1
lea r12, [0x1401035ac]
test r13, r13
jne 0x1400796d0
xor r8b, r8b
mov r14, rbp
mov r13, r12
jmp 0x1400796f2
cmp qword [rbx + 8], r13
jne 0x1400796df
mov r14, qword [rbx + 0x10]
shr r14, 1
jmp 0x1400796f2
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
lea r14, [rcx - 1]
lea rax, [r14 + 1]
lea rsi, [rax + rax]
cmp dl, 2
jne 0x14007970f
mov rdx, r14
mov rcx, r13
call fcn.140006bc0
jmp 0x1400799c9
mov r9, qword [0x14013b0d0]
cmp rsi, r9
jbe 0x14007972d
cmp rsi, qword [rbx + 0x18]
jbe 0x14007972d
lea rdx, [0x140124720]
jmp 0x1400799ba
cmp rax, 2
jae 0x14007974d
test r8b, r8b
mov rcx, rbx
setne bpl
xor r8d, r8d
lea edx, [rbp + 2]
call fcn.1400e74d0
jmp 0x14007990f
movzx eax, byte [rbx + 0x21]
test al, 2
je 0x14007976a
mov rcx, qword [rbx]
and al, 0x3d
mov byte [rbx + 0x21], al
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov r9, qword [0x14013b0d0]
mov r8, qword [rbx + 0x18]
and byte [rbx + 0x21], 0x82
cmp rsi, r8
jbe 0x1400798e9
movzx r10d, byte [rbx + 0x20]
movzx eax, r10b
cmp r10b, 1
jbe 0x1400797a3
cmp al, 2
je 0x1400797e0
mov rdi, qword [rsp + 0x118]
mov rax, qword [rsp + 0x118]
jmp 0x1400798dd
mov edi, 0x80
cmp rsi, rdi
ja 0x1400797e0
cmp rsi, 8
ja 0x1400797ba
mov edi, 8
jmp 0x1400797c6
mov eax, reloc.WSOCK32.dll_recv
cmp rsi, rax
cmovbe rdi, rax
mov rcx, rdi
call fcn.1400dd290
test rax, rax
je 0x1400799d1
mov byte [rbx + 0x20], 1
jmp 0x1400798dd
cmp rsi, 0x20
jae 0x1400797f0
mov edi, SafeArrayAllocDescriptor
jmp 0x14007989a
mov edi, 0x208
cmp rsi, rdi
jb 0x14007989a
cmp rsi, 0x50000
jae 0x140079856
pxor xmm0, xmm0
cvtsi2sd xmm0, rsi
test rsi, rsi
jns 0x14007981d
addsd xmm0, qword [0x1401279a8]
mulsd xmm0, qword [0x1401279e0]
movsd xmm1, qword [0x1401279d8]
xor ecx, ecx
comisd xmm0, xmm1
jbe 0x14007984c
subsd xmm0, xmm1
comisd xmm0, xmm1
jae 0x14007984c
movabs rax, 0x8000000000000000
mov rcx, rax
cvttsd2si rdi, xmm0
add rdi, rcx
jmp 0x14007989a
cmp rsi, 0x320000
jae 0x140079868
lea rdi, [rsi + 0x8000]
jmp 0x14007989a
cmp rsi, 0xc80000
jae 0x140079893
movabs rax, 0x47ae147ae147ae15
mov rdi, rsi
mul rsi
sub rdi, rdx
shr rdi, 1
add rdi, rdx
shr rdi, 6
add rdi, rsi
jmp 0x14007989a
lea rdi, [rsi + 0x20000]
cmp rdi, r9
cmova rdi, r9
cmp r10b, 2
jne 0x1400798bb
test r8, r8
je 0x1400798bb
mov rcx, qword [rbx + 8]
mov sil, 1
call qword [sym.imp.MSVCR100.dll_free]
jmp 0x1400798be
xor sil, sil
test rdi, rdi
js 0x140079992
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll_malloc]
test rax, rax
je 0x140079992
mov byte [rbx + 0x20], 2
and byte [rbx + 0x21], 0x7f
mov qword [rbx + 8], rax
mov qword [rbx + 0x18], rdi
mov rcx, qword [rbx + 8]
cmp rcx, r13
je 0x1400798ff
lea r8, [r14 + r14]
mov rdx, r13
call qword [sym.imp.MSVCR100.dll_memmove]
mov rax, qword [rbx + 8]
lea rcx, [r14 + r14]
mov word [rcx + rax], bp
mov qword [rbx + 0x10], rcx
mov rax, qword [0x14013b0f8]
cmp byte [rax + 0x134], 0
je 0x140079d09
xor r8d, r8d
mov edx, r15d
mov rcx, rbx
call fcn.140001830
mov rdi, rax
cmp word [rax], 0
je 0x140079d09
mov rcx, rbx
call fcn.14002cff0
mov rcx, rdi
mov rdx, rax
call fcn.14002f820
mov rcx, rdi
mov rdx, rax
call fcn.14002f8a0
mov rcx, rbx
mov rdx, rax
call fcn.14002fd90
cmp byte [rbx + 0x23], 0
jne 0x140079971
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x23], 2
jne 0x1400799d8
cmp qword [0x140143de8], 0
je 0x1400799d8
lea rcx, [0x140143dd0]
call fcn.140006d40
jmp 0x140079d09
test sil, sil
je 0x1400799a8
lea rax, [0x140141fa8]
mov qword [rbx + 0x18], rbp
mov qword [rbx + 8], rax
jmp 0x1400799af
mov rax, qword [rbx + 8]
mov word [rax], bp
mov qword [rbx + 0x10], rbp
lea rdx, str.Out_of_memory.
lea rcx, [0x140143150]
mov r8, r12
call fcn.14005f7b0
test eax, eax
jne 0x14007990f
xor eax, eax
jmp 0x140079d0c
and byte [rbx + 0x21], 0x86
jmp 0x140079d09
test r14b, r14b
jne 0x140079a01
lea r8, [rsi - 1]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
mov byte [rsp + 0x20], 1
call fcn.1400e6e20
cmp eax, 1
jne 0x1400799d1
xor r8d, r8d
mov edx, r15d
mov rcx, rbx
call fcn.140001830
mov r9, r13
mov r8d, r15d
mov rdx, rax
mov rcx, r12
mov rdi, rax
call fcn.1400b03c0
mov rdx, rax
test rax, rax
je 0x1400799d1
mov rax, qword [0x14013b0f8]
sub rdx, rdi
sar rdx, 1
dec rdx
cmp byte [rax + 0x134], bpl
je 0x140079a5a
mov rcx, rdi
call fcn.14002f820
mov rcx, rdi
mov rdx, rax
call fcn.14002f8a0
mov rdx, rax
mov rcx, rbx
call fcn.14002fd90
cmp byte [rbx + 0x23], bpl
jne 0x140079a6c
mov rbx, qword [rbx + 0x10]
cmp byte [rbx + 0x23], 2
jne 0x1400799d8
cmp qword [0x140143de8], rbp
je 0x1400799d8
lea rcx, [0x140143dd0]
call fcn.140006d40
mov r15d, eax
jmp 0x140079d09
movzx eax, byte [rbx + 0x23]
test al, al
jne 0x140079ac3
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1401035ac]
xor r9d, r9d
or r8, 0xffffffffffffffff
mov byte [rsp + 0x20], 1
call fcn.1400e6e20
mov r15d, eax
jmp 0x140079d09
lea r12, [0x1401035ac]
cmp qword [rbx + 8], r12
jne 0x140079ad9
mov r13, qword [rbx + 0x10]
shr r13, 1
jmp 0x140079adc
mov r13, rbp
lea rcx, [r13 + 1]
lea rsi, [rcx + rcx]
cmp al, 2
jne 0x140079afb
mov rdx, r13
mov rcx, r12
call fcn.140006bc0
mov r15d, eax
jmp 0x140079d09
mov r8, qword [0x14013b0d0]
cmp rsi, r8
jbe 0x140079b2b
cmp rsi, qword [rbx + 0x18]
jbe 0x140079b2b
lea rdx, [0x140124720]
lea rcx, [0x140143150]
mov r8, r12
call fcn.14005f7b0
mov r15d, eax
jmp 0x140079d09
cmp rcx, 2
jae 0x140079b45
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 3]
call fcn.1400e74d0
jmp 0x140079d09
movzx eax, byte [rbx + 0x21]
test al, 2
je 0x140079b62
mov rcx, qword [rbx]
and al, 0x3d
mov byte [rbx + 0x21], al
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov r8, qword [0x14013b0d0]
mov r9, qword [rbx + 0x18]
and byte [rbx + 0x21], 0x82
cmp rsi, r9
jbe 0x140079ce1
movzx r10d, byte [rbx + 0x20]
movzx eax, r10b
cmp r10b, 1
jbe 0x140079b9b
cmp al, 2
je 0x140079bdc
mov rdi, qword [rsp + 0x118]
mov rax, qword [rsp + 0x118]
jmp 0x140079cd5
mov edi, 0x80
cmp rsi, rdi
ja 0x140079bdc
cmp rsi, 8
ja 0x140079bb2
mov edi, 8
jmp 0x140079bbe
mov eax, reloc.WSOCK32.dll_recv
cmp rsi, rax
cmovbe rdi, rax
mov rcx, rdi
call fcn.1400dd290
test rax, rax
jne 0x140079bd3
mov r15d, ebp
jmp 0x140079d09
mov byte [rbx + 0x20], 1
jmp 0x140079cd5
cmp rsi, 0x20
jae 0x140079bec
mov edi, SafeArrayAllocDescriptor
jmp 0x140079c96
mov edi, 0x208
cmp rsi, rdi
jb 0x140079c96
cmp rsi, 0x50000
jae 0x140079c52
pxor xmm0, xmm0
cvtsi2sd xmm0, rsi
test rsi, rsi
jns 0x140079c19
addsd xmm0, qword [0x1401279a8]
mulsd xmm0, qword [0x1401279e0]
movsd xmm1, qword [0x1401279d8]
xor ecx, ecx
comisd xmm0, xmm1
jbe 0x140079c48
subsd xmm0, xmm1
comisd xmm0, xmm1
jae 0x140079c48
movabs rax, 0x8000000000000000
mov rcx, rax
cvttsd2si rdi, xmm0
add rdi, rcx
jmp 0x140079c96
cmp rsi, 0x320000
jae 0x140079c64
lea rdi, [rsi + 0x8000]
jmp 0x140079c96
cmp rsi, 0xc80000
jae 0x140079c8f
movabs rax, 0x47ae147ae147ae15
mov rdi, rsi
mul rsi
sub rdi, rdx
shr rdi, 1
add rdi, rdx
shr rdi, 6
add rdi, rsi
jmp 0x140079c96
lea rdi, [rsi + 0x20000]
cmp rdi, r8
cmova rdi, r8
cmp r10b, 2
jne 0x140079cb7
test r9, r9
je 0x140079cb7
mov rcx, qword [rbx + 8]
mov sil, 1
call qword [sym.imp.MSVCR100.dll_free]
jmp 0x140079cba
xor sil, sil
test rdi, rdi
js 0x140079d46
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll_malloc]
test rax, rax
je 0x140079d46
mov byte [rbx + 0x20], 2
and byte [rbx + 0x21], 0x7f
mov qword [rbx + 8], rax
mov qword [rbx + 0x18], rdi
mov rcx, qword [rbx + 8]
cmp rcx, r12
je 0x140079cf8
lea r8, [r13 + r13]
mov rdx, r12
call qword [sym.imp.MSVCR100.dll_memmove]
mov rax, qword [rbx + 8]
lea rcx, [r13 + r13]
mov word [rcx + rax], bp
mov qword [rbx + 0x10], rcx
mov eax, r15d
mov r14, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xf0]
mov r12, qword [rsp + 0xe8]
mov r13, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0x128]
mov r15, qword [rsp + 0xd0]
add rsp, 0xf8
pop rdi
pop rbx
ret
test sil, sil
je 0x140079d5c
lea rax, [0x140141fa8]
mov qword [rbx + 0x18], rbp
mov qword [rbx + 8], rax
jmp 0x140079d63
mov rax, qword [rbx + 8]
mov word [rax], bp
lea rdx, str.Out_of_memory.
lea rcx, [0x140143150]
mov r8, r12
mov qword [rbx + 0x10], rbp
call fcn.14005f7b0
mov r15d, eax
jmp 0x140079d09