Function at 0x14006df30
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x208
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
mov rbx, r8
mov r13d, ecx
mov r15, rdx
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8d, 0x140
mov r14, r9
mov qword [rsp + 0x88], rbx
call fcn.1400e27d0
lea rdx, [rsp + 0xb0]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
or rbp, 0xffffffffffffffff
mov qword [rsp + 0xa0], rax
mov rcx, rbp
nop
inc rcx
cmp byte [r14 + rcx], 0
jne 0x14006dfa0
imul ecx, ebx
mov edi, r13d
mov edx, 0x104
sub edi, ecx
lea rcx, [rsp + 0xb0]
mov dword [rsp + 0x64], edi
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov qword [rsp + 0x98], rax
cmp r13d, 0x20
jbe 0x14006dfe3
call qword [sym.imp.KERNEL32.dll_GetTickCount]
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov rcx, rbp
inc rcx
cmp byte [r14 + rcx], 0
jne 0x14006dfe6
lea r12d, [rbx + r13]
sub r12b, cl
mov rcx, rbp
sub r12b, 2
movsx r8, r12b
inc rcx
cmp byte [r15 + rcx], 0
jne 0x14006e002
lea eax, [rbx*8]
movzx edx, bl
sub edx, eax
mov rax, rbp
sub edx, r8d
add edx, r13d
add edx, edi
sub edx, ecx
inc rax
cmp byte [r14 + rax], 0
jne 0x14006e025
add eax, 5
add eax, edx
mov dword [rsp + 0x60], eax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8d, 0x140
mov rsi, rax
call fcn.1400e27d0
lea rdx, [rsp + 0xb0]
lea rcx, str.ocelot
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea rcx, str.rack
mov rbx, rax
mov qword [rsp + 0x80], rax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
movzx ecx, al
mov dword [rsp + 0x6c], eax
shl cl, 3
sub bl, cl
add bl, 5
call qword [sym.imp.USER32.dll_GetActiveWindow]
mov qword [rsp + 0x90], rax
call qword [sym.imp.USER32.dll_GetActiveWindow]
xor r8d, r8d
mov edx, 0x280
xor ecx, ecx
mov qword [rsp + 0x78], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
xor ecx, ecx
mov edx, 0x2cc
lea r8d, [rcx + 0x18]
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [rsp + 0x60]
xor r8d, r8d
mov qword [rsp + 0x58], r8
mov qword [rsp + 0x50], r8
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], r13
movzx edx, sil
mov rdi, rax
movzx eax, bl
mov dword [rsp + 0x70], edx
lea r8, str.c7ret
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], 0x20
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], ecx
lea rdx, str.anywhere
movsx r9d, r12b
mov ecx, eax
mov dword [rsp + 0x68], eax
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov rsi, qword [rsp + 0xa0]
mov ebx, 3
sub bl, sil
add bl, bl
add bl, dil
mov rdi, qword [rsp + 0x90]
add bl, byte [rsp + 0x78]
add bl, dil
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rdx, rbp
mov r8d, eax
inc rdx
cmp byte [r14 + rdx], 0
jne 0x14006e162
mov rcx, qword [rsp + 0x80]
mov eax, 0x5e
imul ecx, dword [rsp + 0x6c]
sub eax, ecx
movsx rcx, bl
sub eax, dword [rsp + 0x64]
add edx, eax
lea eax, [rsi + rsi]
sub ecx, eax
lea eax, [rcx + rcx*4]
lea eax, [rax + rdx*2]
inc rbp
cmp byte [r15 + rbp], 0
jne 0x14006e195
imul ebp, dword [rsp + 0x88]
movsx rcx, r12b
sub eax, ebp
sub eax, ecx
sub eax, dword [rsp + 0x78]
sub eax, edi
sub eax, r8d
sub eax, dword [rsp + 0x68]
sub eax, dword [rsp + 0x70]
sub eax, dword [rsp + 0x98]
add eax, r13d
add eax, dword [rsp + 0x60]
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x208
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret