Function at 0x14000ea20
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x460
mov rax, qword [0x14004f018]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rsi, rdx
mov qword [rsp + 0x28], rdx
mov rcx, rdx
call fcn.140004c80
mov rdx, rcx
call fcn.14000ece0
movzx edi, al
mov byte [rsp + 0x20], al
jmp 0x14000ea7a
test dil, dil
jne 0x14000eca3
mov rcx, rsi
call fcn.140004c80
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x207
lea rdx, [rsp + 0x40]
lea rcx, str.APPDATA
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rsp + 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
mov r12, rax
mov rcx, rsi
call fcn.140002de0
mov r14, rax
mov r13, qword [rax + 0x18]
cmp r12, r13
ja 0x14000eb12
mov rbx, rax
cmp r13, 8
jb 0x14000eae2
mov rbx, qword [rax]
mov qword [rax + 0x10], r12
mov r8, r12
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140002fe4
xor r15d, r15d
mov word [rsp + 0x22], r15w
lea rcx, [rbx + r12*2]
lea rdx, [rsp + 0x22]
call fcn.140002fdc
jmp 0x14000ec8d
call fcn.140002f24
cmp r12, rax
ja 0x14000ecd4
call fcn.140002f24
mov rbx, rax
mov rcx, r12
or rcx, 7
mov qword [rsp + 0x38], rcx
cmp rcx, rax
ja 0x14000eb71
mov rcx, rsi
call fcn.140002de0
mov rdx, qword [rax + 0x18]
mov rcx, rdx
shr rcx, 1
mov rax, rbx
sub rax, rcx
cmp rdx, rax
ja 0x14000eb71
lea rax, [rcx + rdx]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.140002e7c
mov rbx, qword [rax]
lea rax, [rbx + 1]
lea rdx, [rax + rax]
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
jbe 0x14000eb94
mov rax, 0xffffffffffffffff
mov rdx, rax
jmp 0x14000eba4
cmp rdx, 0x1000
jb 0x14000ebd4
mov rax, 0xffffffffffffffff
lea rcx, [rdx + 0x27]
cmp rcx, rdx
cmovbe rcx, rax
call fcn.140025ae4
mov rcx, rax
test rax, rax
je 0x14000ebcd
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
xor r15d, r15d
jmp 0x14000ebec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rdx, rdx
je 0x14000ebe6
mov rcx, rdx
call fcn.140025ae4
xor r15d, r15d
jmp 0x14000ebec
xor r15d, r15d
mov eax, r15d
mov qword [rsp + 0x28], rax
mov qword [r14 + 0x10], r12
mov qword [r14 + 0x18], rbx
mov rbx, qword [rsp + 0x28]
mov r8, r12
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140002e8c
mov word [rsp + 0x22], r15w
lea rcx, [rbx + r12*2]
lea rdx, [rsp + 0x22]
call fcn.140002fdc
cmp r13, 8
jb 0x14000ec6a
lea rdx, [r13*2 + 2]
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x14000ec54
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000ec63
mov rcx, r8
call fcn.140025dd4
mov rax, qword [rsp + 0x28]
mov qword [r14], rax
jmp 0x14000ec8d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea rcx, [rsp + 0x28]
call fcn.140002de0
mov r8, rax
mov rcx, r14
call fcn.140002de0
mov rdx, rax
call fcn.1400029a0
mov rdx, qword [r8]
mov qword [rax], rdx
mov rcx, rsi
call fcn.140002a60
movzx edi, dil
mov ecx, 1
test al, al
cmove edi, ecx
movzx eax, dil
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140025ac0
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.140003280
nop
int3