Function at 0x1400b4660
Capabilities:
Query environment variable
Read file on windows

Disassembly:
push r12
push r14
push r15
mov eax, 0x2760
call fcn.1400fe810
sub rsp, rax
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x2788], rbx
mov qword [rsp + 0x2790], rsi
mov qword [rsp + 0x2798], rdi
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x2750], rax
mov r14b, cl
xor ebx, ebx
cmp dl, bl
je 0x1400b46d6
cmp word [0x14016bb2e], bx
je 0x1400b46ce
cmp qword [0x140186650], rbx
je 0x1400b46ce
mov word [0x14016bb2e], bx
lea r12d, [rbx + 3]
jmp 0x1400b4738
mov r12d, 3
jmp 0x1400b4738
mov cl, 1
call fcn.1400b1614
mov r12d, 3
mov dword [0x14016ec78], r12d
mov qword [0x140157278], rbx
mov cl, byte [0x1401561c5]
cmp cl, bl
jne 0x1400b4837
xor r8d, r8d
lea rdx, [0x140174f50]
lea rcx, [0x140162be0]
call fcn.140092ce8
cmp byte [0x140163c5a], bl
je 0x1400b4738
mov eax, dword [0x14016ec74]
lea ecx, [r12 + 1]
cmp dword [0x140174f78], 1
cmova eax, ecx
mov dword [0x14016ec74], eax
mov cl, byte [0x1401561c5]
cmp cl, bl
jne 0x1400b4829
cmp word [0x140173f4a], bx
jne 0x1400b4829
mov r14b, bl
mov esi, 0x800
mov r8, rsi
lea rdx, [0x140173f4a]
mov ecx, dword [0x140170ee8]
call fcn.1400ad91c
mov dword [rsp + 0x20], esi
lea r15, [0x140109540]
mov r9, r15
lea r8, [rsp + 0x1350]
lea rdx, str.DefFolder
lea rcx, [0x14010eed8]
call fcn.14009b8dc
cmp word [rsp + 0x1350], bx
jne 0x1400b47c2
cmp byte [0x140163c5a], bl
je 0x1400b4800
lea rcx, [rsp + 0x1350]
call fcn.14008c39c
cmp word [rsp + 0x1350], bx
je 0x1400b4800
mov rdx, rsi
lea rcx, [rsp + 0x1350]
call fcn.1400504dc
mov r8, rsi
lea rdx, [0x140173f4a]
lea rcx, [rsp + 0x1350]
call fcn.140065d80
mov r8, rsi
lea rdx, [rsp + 0x1350]
lea rcx, [0x140173f4a]
call fcn.140065d00
cmp word [0x140169b28], bx
setne r8b
mov r9d, dword [0x140170ee8]
mov rdx, rsi
lea rcx, [0x140173f4a]
call fcn.1400adb64
mov cl, byte [0x1401561c5]
jmp 0x1400b4843
mov esi, 0x800
lea r15, [0x140109540]
jmp 0x1400b4843
mov esi, 0x800
lea r15, [0x140109540]
mov eax, dword [0x14016ec74]
mov edx, 5
cmp eax, ebx
cmove eax, edx
mov dword [0x14016ec74], eax
cmp cl, bl
je 0x1400b49c7
mov edi, dword [0x140164e74]
cmp edi, ebx
je 0x1400b48af
cmp edi, 1
je 0x1400b48af
cmp dword [0x14016ec44], r12d
je 0x1400b4dae
lea ecx, [rdx + 0x60]
call fcn.14005fad8
mov rdi, rax
mov ecx, 0x1fd
call fcn.14005fad8
mov rdx, rax
mov r9d, 0x30
mov r8, rdi
mov rcx, qword [0x140158350]
call fcn.1400b6df8
jmp 0x1400b4dae
mov r8, rsi
lea rdx, [0x140173f4a]
lea rcx, [0x140164e70]
call fcn.14007858c
mov r8, rsi
lea rdx, [0x14016cb40]
lea rcx, [0x140164e70]
call fcn.14007856c
cmp word [0x14016cb40], bx
je 0x1400b48f3
mov rdx, rsi
lea rcx, [0x14016cb40]
call fcn.1400504dc
mov byte [0x14016ece0], bl
lea rdx, [rsp + 0x40]
lea rcx, [0x140164e70]
call fcn.1400785a8
mov edx, dword [rsp + 0x188]
mov dword [0x140170ee8], edx
mov qword [rsp + 0x1250], rbx
mov qword [rsp + 0x1258], rbx
mov qword [rsp + 0x1260], rbx
xor r8d, r8d
lea rdx, [rsp + 0x240]
lea rcx, [0x140173f4a]
call fcn.140043f04
cmp al, bl
je 0x1400b4955
cmp qword [rsp + 0x1240], 0x14
je 0x1400b4976
cmp dword [rsp + 0x188], ebx
jne 0x1400b4970
cmp byte [rsp + 0xc0], bl
je 0x1400b4970
mov byte [0x14016ecc7], 1
jmp 0x1400b4976
mov byte [0x14016ecc7], bl
cmp edi, ebx
jne 0x1400b4983
cmp dword [rsp + 0x210], ebx
je 0x1400b4991
movzx eax, byte [rsp + 0x182]
mov dword [0x14016ec64], eax
cmp qword [rsp + 0x178], rbx
je 0x1400b49c0
mov rcx, rbx
lea rdx, [0x140000000]
movzx eax, word [rcx + rdx + 0x10be18]
mov word [rcx + rdx + 0x169b28], ax
add rcx, 2
cmp ax, bx
jne 0x1400b49a5
jmp 0x1400b49c7
mov word [0x140169b28], bx
mov rcx, qword [0x140158350]
call qword [sym.imp.USER32.dll_IsWindowVisible]
neg eax
sbb rcx, rcx
and rcx, qword [0x140158350]
xor r8d, r8d
mov dl, r14b
call fcn.1400b4348
cmp al, bl
je 0x1400b4d90
mov al, byte [0x14018666f]
neg al
sbb ecx, ecx
and ecx, dword [0x140186670]
mov dword [0x14016ec58], ecx
mov eax, dword [0x14018665c]
cmp eax, 1
je 0x1400b4a19
cmp eax, 2
jne 0x1400b4a80
mov eax, dword [0x140186668]
mov dword [rsp + 0x28], eax
mov eax, dword [0x140186664]
mov dword [rsp + 0x20], eax
mov r9d, dword [0x140186660]
lea r8, str._dd_dh_dm
mov edx, 0x50
lea rcx, [rsp + 0x1290]
call fcn.1400e0c0c
cmp dword [0x14018665c], 1
jne 0x1400b4a6c
lea rdx, [rsp + 0x1290]
lea rcx, [0x14016ede8]
call fcn.14006781c
jmp 0x1400b4a80
lea rdx, [rsp + 0x1290]
lea rcx, [0x14016edf0]
call fcn.14006781c
mov rcx, qword [0x140186650]
cmp rcx, rbx
je 0x1400b4a93
call fcn.1400ab3b8
jmp 0x1400b4ab6
cmp byte [0x1401561c5], bl
je 0x1400b4ab6
cmp qword [rsp + 0x178], rbx
je 0x1400b4ab6
cmp word [0x140169b28], 0x2a
jne 0x1400b4ab6
mov word [0x140169b28], bx
cmp dword [0x140174f78], ebx
jne 0x1400b4af2
mov ecx, 0x65
call fcn.14005fad8
mov rdi, rax
mov ecx, 0x14b
call fcn.14005fad8
mov rdx, rax
mov r9d, 0x30
mov r8, rdi
mov rcx, qword [0x140158350]
call fcn.1400b6df8
jmp 0x1400b4d90
cmp word [0x14016bb2e], bx
je 0x1400b4b76
cmp dword [0x14016cb30], ebx
jne 0x1400b4b76
lea rdx, [0x140110150]
lea rcx, [0x14016bb2e]
call fcn.1400423bc
mov rdi, rax
cmp rax, rbx
je 0x1400b4b76
mov r9, rax
mov edx, 1
mov r8d, 0x400
lea rcx, [rsp + 0x2350]
call fcn.1400ef54c
mov dword [rsp + 0x30], 0x30c
cmp rax, rbx
jbe 0x1400b4b6d
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x2350]
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
mov ecx, dword [0x14016cb30]
cmp eax, ebx
cmovne ecx, r12d
mov dword [0x14016cb30], ecx
mov rcx, rdi
call fcn.1400eee40
nop
lea rcx, [rsp + 0x1290]
call fcn.140066320
nop
lea rcx, [0x140174f50]
call fcn.140066108
mov r12d, 0x25
lea rcx, [0x140174f50]
call fcn.140066438
mov rdi, rax
cmp rax, rbx
je 0x1400b4c49
mov r9, rsi
lea r8, [rsp + 0x1350]
mov rdx, rax
lea rcx, [0x140162be0]
call fcn.14008eba0
mov edx, r12d
mov rcx, rdi
call fcn.1400ed378
cmp rax, rbx
je 0x1400b4c2f
mov edx, r12d
lea rcx, [rax + 2]
call fcn.1400ed378
cmp rax, rbx
je 0x1400b4c2f
lea rcx, [rsp + 0x1350]
call fcn.14004258c
cmp al, bl
jne 0x1400b4c2f
mov r8d, esi
lea rdx, [rsp + 0x240]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x7ff
ja 0x1400b4c2f
mov r8, rsi
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x1350]
call fcn.140065d00
lea rdx, [rsp + 0x1350]
lea rcx, [rsp + 0x1290]
call fcn.140066178
jmp 0x1400b4b96
lea rdx, [rsp + 0x1290]
lea rcx, [0x140174f50]
call fcn.1400816ec
nop
mov rcx, qword [rsp + 0x1290]
cmp rcx, rbx
je 0x1400b4c71
call fcn.1400ea2a8
nop
jmp 0x1400b4c81
cmp byte [0x140172efd], bl
jne 0x1400b4ca6
mov r9, rsi
lea r8, [0x140173f4a]
lea rdx, [0x140173f4a]
lea rcx, [0x140162be0]
call fcn.14008eba0
mov al, byte [0x14016dc40]
mov byte [0x140158390], al
lea rcx, [0x140158360]
call fcn.1400a3b78
cmp byte [0x140172f19], bl
je 0x1400b4ccd
call fcn.1400b3bc0
jmp 0x1400b4cdf
mov dl, byte [0x140172efb]
lea rcx, [0x140164e70]
call fcn.14007a3e4
cmp qword [0x140186650], rbx
je 0x1400b4cf4
lea rcx, [0x14016bb2e]
call fcn.140042190
cmp dword [0x1401571f0], 1
je 0x1400b4d90
cmp byte [0x1401561c5], bl
je 0x1400b4d17
lea rcx, [0x140162be0]
call fcn.1400950ec
jmp 0x1400b4d90
cmp byte [0x14016ecc6], bl
je 0x1400b4d2b
lea rcx, [0x140162bb0]
call fcn.1400a8ff0
mov r8, rsi
lea rdx, [rsp + 0x1350]
lea rcx, [0x140162be0]
call fcn.14008eb6c
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x1350]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [0x140173f4a]
lea rcx, [rsp + 0x1350]
call fcn.140068d60
cmp eax, ebx
jne 0x1400b4d81
lea rcx, [0x140173f4a]
call fcn.140050ce8
mov r15, rax
mov rdx, r15
lea rcx, [0x140162be0]
call fcn.140093bdc
mov rcx, qword [0x140186650]
call fcn.1400e9b08
mov byte [0x140158390], bl
lea rcx, [0x140158360]
call fcn.1400a3b78
mov rcx, qword [rsp + 0x2750]
xor rcx, rsp
call fcn.1400e9d80
lea r11, [rsp + 0x2760]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret