Function at 0x14005ac70
Capabilities:
Query environment variable

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x420]
sub rsp, 0x520
mov rax, qword [0x1401b7030]
xor rax, rsp
mov qword [rbp + 0x410], rax
mov rbx, r9
mov r12, rdx
mov r15, rcx
mov rdi, qword [rbp + 0x480]
mov edx, 0x104
add rcx, 0xb98
call fcn.14012524c
mov r8, rbx
mov edx, 0x38
lea rcx, [r15 + 0xc9c]
call fcn.14012524c
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [r15 + rax + 0xb98], 0
jne 0x14005ace0
test rax, rax
je 0x14005ad13
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [r15 + rax + 0xc9c], 0
jne 0x14005ad00
test rax, rax
jne 0x14005ad6b
lea r8, [r15 + 0xb98]
mov edx, 0x104
lea rcx, [r15 + 0xb98]
call fcn.14012524c
lea r8, [r15 + 0xc9c]
mov edx, 0x38
lea rcx, [r15 + 0xc9c]
call fcn.14012524c
mov qword [rsp + 0x20], r15
lea r9, [0x14005b2b0]
xor r8d, r8d
mov edx, 0xd8
mov rcx, qword [0x1401bc5b8]
mov rcx, qword [rcx + 0xb98]
call qword [sym.imp.USER32.dll_DialogBoxParamA]
lea r8, [r15 + 0xb98]
mov edx, 0x104
lea rcx, [rbp - 0x70]
call fcn.14012524c
lea r8, [0x14019c38c]
mov edx, 0x104
lea rcx, [rbp - 0x70]
call fcn.1401252ac
lea r8, [r15 + 0xc9c]
mov edx, 0x104
lea rcx, [rbp - 0x70]
call fcn.1401252ac
lea rcx, [rsp + 0x40]
call fcn.14012d7b4
lea rcx, [rsp + 0x40]
call fcn.140132260
mov r9, rax
lea r8, str._Y_m_d__H_M_S
mov edx, 0x50
lea rcx, [rbp + 0xa0]
call fcn.140131f48
lea r8, [0x14019dc98]
mov edx, 0x104
lea rcx, [rbp - 0x70]
call fcn.1401252ac
lea r8, [rbp + 0xa0]
mov edx, 0x104
lea rcx, [rbp - 0x70]
call fcn.1401252ac
mov r8, rdi
mov edx, 0x104
lea rcx, [rbp - 0x70]
call fcn.1401252ac
mov r8d, 0x104
lea rdx, [rbp + 0xf0]
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [rsp + 0x50], 1
xor ebx, ebx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rbx
xor r8d, r8d
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x48]
call qword [sym.imp.gdiplus.dll_GdiplusStartup]
lea rax, vtable.Gdiplus::Bitmap.0
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x38], rbx
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, r12
call qword [sym.imp.gdiplus.dll_GdipCreateBitmapFromHBITMAP]
mov dword [rsp + 0x78], eax
mov rsi, qword [rsp + 0x38]
mov qword [rsp + 0x70], rsi
mov ecx, ebx
lea rdx, str..jpeg
nop word [rax + rax]
movzx eax, byte [rdi + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x14005af58
cmp rcx, 6
jne 0x14005ae90
mov dword [rsp + 0x34], ebx
mov dword [rsp + 0x30], ebx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x34]
call qword [sym.imp.gdiplus.dll_GdipGetImageEncodersSize]
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x14005b01e
mov ecx, eax
call fcn.1401313c0
mov rdi, rax
test rax, rax
je 0x14005b01e
mov r8, rax
mov edx, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
call qword [sym.imp.gdiplus.dll_GdipGetImageEncoders]
mov r9d, dword [rsp + 0x34]
test r9d, r9d
je 0x14005b016
lea r10, str.image_jpeg
mov r8d, ebx
imul rax, r8, 0x68
mov rdx, qword [rax + rdi + 0x40]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [r10 + rax*2 + 2]
jne 0x14005af42
add rax, 2
cmp rax, 0xb
je 0x14005af4f
movzx ecx, word [rdx + rax*2]
cmp cx, word [r10 + rax*2]
je 0x14005af20
inc ebx
cmp ebx, r9d
jae 0x14005b016
jmp 0x14005af04
imul rax, r8, 0x68
jmp 0x14005b00e
mov rcx, rbx
lea rdx, str..png
movzx eax, byte [rdi + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x14005b091
cmp rcx, 5
jne 0x14005af62
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x30]
call qword [sym.imp.gdiplus.dll_GdipGetImageEncodersSize]
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x14005b01e
mov ecx, eax
call fcn.1401313c0
mov rdi, rax
test rax, rax
je 0x14005b01e
mov r8, rax
mov edx, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.gdiplus.dll_GdipGetImageEncoders]
mov r8d, ebx
mov r10d, dword [rsp + 0x30]
test r10d, r10d
je 0x14005b016
lea r11, str.image_png
mov r9d, r8d
imul rax, r9, 0x68
mov rdx, qword [rax + rdi + 0x40]
mov rcx, rbx
movzx eax, word [rdx + rcx*2]
cmp ax, word [r11 + rcx*2]
jne 0x14005b084
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r11 + rcx*2 + 2]
jne 0x14005b084
add rcx, 2
cmp rcx, 0xa
jne 0x14005afe0
imul rax, r9, 0x68
movups xmm0, xmmword [rax + rdi]
movups xmmword [rbp - 0x80], xmm0
mov rcx, rdi
call fcn.140125238
mov r8d, 0x104
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x200]
call fcn.140130d54
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x200]
mov rcx, rsi
call qword [sym.imp.gdiplus.dll_GdipSaveImageToFile]
nop
mov rcx, rsi
call qword [sym.imp.gdiplus.dll_GdipDisposeImage]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.gdiplus.dll_GdiplusShutdown]
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.14011c340
add rsp, 0x520
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
inc r8d
cmp r8d, r10d
jae 0x14005b016
jmp 0x14005afd1
mov rcx, rbx
lea rdx, str..gif
nop dword [rax + rax]
movzx eax, byte [rdi + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x14005b166
cmp rcx, 5
jne 0x14005b0a0
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x30]
call qword [sym.imp.gdiplus.dll_GdipGetImageEncodersSize]
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x14005b01e
mov ecx, eax
call fcn.1401313c0
mov rdi, rax
test rax, rax
je 0x14005b01e
mov r8, rax
mov edx, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.gdiplus.dll_GdipGetImageEncoders]
mov r8d, ebx
mov r10d, dword [rsp + 0x30]
test r10d, r10d
je 0x14005b016
lea r11, str.image_gif
nop word [rax + rax]
mov r9d, r8d
imul rax, r9, 0x68
mov rdx, qword [rax + rdi + 0x40]
mov rcx, rbx
nop
movzx eax, word [rdx + rcx*2]
cmp ax, word [r11 + rcx*2]
jne 0x14005b158
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r11 + rcx*2 + 2]
jne 0x14005b158
add rcx, 2
cmp rcx, 0xa
je 0x14005b00a
jmp 0x14005b130
inc r8d
cmp r8d, r10d
jae 0x14005b016
jmp 0x14005b120
mov rcx, rbx
lea rdx, str..bmp
movzx eax, byte [rdi + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x14005b01e
cmp rcx, 5
jne 0x14005b170
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], ebx
lea rdx, [rsp + 0x34]
lea rcx, [rsp + 0x30]
call qword [sym.imp.gdiplus.dll_GdipGetImageEncodersSize]
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x14005b01e
mov ecx, eax
call fcn.1401313c0
mov rdi, rax
test rax, rax
je 0x14005b01e
mov r8, rax
mov edx, dword [rsp + 0x34]
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.gdiplus.dll_GdipGetImageEncoders]
mov r8d, ebx
mov r10d, dword [rsp + 0x30]
test r10d, r10d
je 0x14005b016
lea r11, str.image_bmp
nop word [rax + rax]
mov r9d, r8d
imul rax, r9, 0x68
mov rdx, qword [rax + rdi + 0x40]
mov rcx, rbx
nop
movzx eax, word [rdx + rcx*2]
cmp ax, word [r11 + rcx*2]
jne 0x14005b228
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r11 + rcx*2 + 2]
jne 0x14005b228
add rcx, 2
cmp rcx, 0xa
je 0x14005b00a
jmp 0x14005b200
inc r8d
cmp r8d, r10d
jae 0x14005b016
jmp 0x14005b1f0