Function at 0x140001330
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2a0
movaps xmmword [rsp + 0x290], xmm6
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [0x1400070b0]
test rcx, rcx
je 0x140001671
lea rdx, str.FDICreate
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rbx
mov qword [0x140007098], rax
mov rcx, qword [0x1400070b0]
lea rdx, str.FDIDestroy
call rbx
mov qword [0x1400070a8], rax
mov rcx, qword [0x1400070b0]
lea rdx, str.FDICopy
call rbx
mov rcx, rax
mov qword [0x1400070a0], rax
xor eax, eax
cmp qword [0x140007098], 0
je 0x140001657
cmp qword [0x1400070a8], 0
je 0x140001657
test rcx, rcx
je 0x140001657
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cdqe
lea r14, [rdi + rax*2]
test eax, eax
jle 0x1400013f1
cmp word [r14], 0x5c
je 0x1400013f1
add r14, 0xfffffffffffffffe
cmp r14, rdi
ja 0x1400013e1
cmp r14, rdi
je 0x140001617
add r14, 2
xorps xmm6, xmm6
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor ebx, ebx
mov ecx, 0xfde9
xor edx, edx
mov r8, r14
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x140001480
mov ebp, eax
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor ebx, ebx
mov rcx, rax
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140001480
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, r14
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rbx, r15
sub r14, rdi
shr r14, 1
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, rdi
mov r9d, r14d
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x140001635
mov r12d, eax
xor eax, eax
cmp r14d, 0xffffffff
setne al
add r12d, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140001635
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rdi
mov r9d, r14d
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp r14d, 0xffffffff
je 0x14000151a
movsxd rax, r12d
mov byte [rax + r15 - 1], 0
test rbx, rbx
je 0x14000161b
lea rcx, [rsp + 0x50]
mov dword [rcx + 8], 0
mov qword [rcx], 0
mov rax, qword [0x140007098]
mov qword [rsp + 0x40], rcx
lea rcx, [0x1400017b0]
mov qword [rsp + 0x30], rcx
lea rcx, [0x1400017c0]
mov qword [rsp + 0x28], rcx
lea rcx, [0x1400017e0]
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x38], 0xffffffff
lea rcx, [0x1400019c0]
lea rdx, [0x140001990]
lea r8, [0x140001860]
lea r9, [0x140001820]
call qword [0x140009008]
test rax, rax
je 0x14000161b
mov r14, rax
lea rdi, [rsp + 0x68]
mov qword [rdi - 8], rsi
mov rcx, rdi
call fcn.140001cb0
mov byte [rdi + 0x218], 0
mov rax, qword [0x1400070a0]
lea rsi, [rsp + 0x60]
mov qword [rsp + 0x30], rsi
lea rcx, [0x1400019f0]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], 0
mov rcx, r14
mov rdx, rbx
mov r8, r15
xor r9d, r9d
call qword [0x140009008]
mov rax, qword [0x1400070a8]
mov rcx, r14
call qword [0x140009008]
cmp byte [rsi + 0x220], 0
setne sil
je 0x140001703
mov rcx, rdi
call fcn.140001cd0
jmp 0x14000161d
xor eax, eax
jmp 0x140001657
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
jmp 0x14000163c
xor esi, esi
mov eax, 0
test rbx, rbx
je 0x140001657
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
movaps xmm6, xmmword [rsp + 0x290]
add rsp, 0x2a0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea rbx, [rsp + 0x60]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call fcn.140001030
lea rcx, str._WINDIR__system32cabinet.dll
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x104
jb 0x1400016ae
mov rcx, qword [0x1400070b0]
jmp 0x1400016cb
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
mov qword [0x1400070b0], rax
test rcx, rcx
jne 0x14000135f
lea rdx, [rsp + 0x60]
mov word [rdx], 0
lea rcx, str._SYSTEMROOT__system32cabinet.dll
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x104
jb 0x140001720
mov rcx, qword [0x1400070b0]
jmp 0x14000173d
mov rcx, rdi
call fcn.140001db0
test al, al
je 0x14000160d
mov rcx, rdi
call fcn.140001dc0
jmp 0x14000160d
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
mov qword [0x1400070b0], rax
test rcx, rcx
jne 0x14000135f
lea rdx, [rsp + 0x60]
mov word [rdx], 0
lea rcx, str.C:Windows_system32cabinet.dll
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x104
jb 0x140001775
mov rcx, qword [0x1400070b0]
jmp 0x140001792
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
mov qword [0x1400070b0], rax
test rcx, rcx
jne 0x14000135f
mov rcx, qword [0x1400070a0]
jmp 0x1400013a7