Function at 0x14003c8e0
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x2b0
mov rax, qword [0x1400ca008]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rdi, rdx
mov ebp, r8d
mov ebx, ecx
lea rdx, [rsp + 0x180]
mov rcx, rdi
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jne 0x14003cad5
mov ecx, ebx
lea r8, [rsp + 0x70]
sub ecx, 1
je 0x14003ca7f
sub ecx, 1
je 0x14003ca40
sub ecx, 1
je 0x14003c9f0
cmp ecx, 1
mov ecx, 0x103
je 0x14003c9a0
lea rdx, str.UNKNOWN
nop word [rax + rax]
movzx eax, byte [rdx]
inc rdx
mov byte [r8], al
lea r8, [r8 + 1]
test al, al
je 0x14003c979
sub rcx, 1
jne 0x14003c960
jmp 0x14003c982
test rcx, rcx
jne 0x14003cabd
mov byte [r8], 0
nop word [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x14003c990
jmp 0x14003cabd
lea rdx, str.STATS_LEAP_FILE
nop word [rax + rax]
movzx eax, byte [rdx]
inc rdx
mov byte [r8], al
lea r8, [r8 + 1]
test al, al
je 0x14003c9c9
sub rcx, 1
jne 0x14003c9b0
jmp 0x14003c9d2
test rcx, rcx
jne 0x14003cabd
mov byte [r8], 0
nop word [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x14003c9e0
jmp 0x14003cabd
lea rdx, str.STATS_PID_FILE
mov ecx, 0x103
nop dword [rax]
movzx eax, byte [rdx]
inc rdx
mov byte [r8], al
lea r8, [r8 + 1]
test al, al
je 0x14003ca19
sub rcx, 1
jne 0x14003ca00
jmp 0x14003ca22
test rcx, rcx
jne 0x14003cabd
mov byte [r8], 0
nop word [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x14003ca30
jmp 0x14003cabd
lea rdx, str.STATS_STATSDIR
mov ecx, 0x103
nop dword [rax]
movzx eax, byte [rdx]
inc rdx
mov byte [r8], al
lea r8, [r8 + 1]
test al, al
je 0x14003ca69
sub rcx, 1
jne 0x14003ca50
jmp 0x14003ca6e
test rcx, rcx
jne 0x14003cabd
mov byte [r8], 0
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x14003ca72
jmp 0x14003cabd
lea rdx, str.STATS_FREQ_FILE
mov ecx, 0x103
nop dword [rax + rax]
movzx eax, byte [rdx]
inc rdx
mov byte [r8], al
lea r8, [r8 + 1]
test al, al
je 0x14003caa9
sub rcx, 1
jne 0x14003ca90
jmp 0x14003caae
test rcx, rcx
jne 0x14003cabd
mov byte [r8], 0
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
test al, al
jne 0x14003cab2
lea r8, [rsp + 0x70]
mov ecx, 3
lea rdx, str.ExpandEnvironmentStrings__s__failed:__m_n
call fcn.14005c0d0
jmp 0x14003cadd
lea rdi, [rsp + 0x180]
mov qword [rsp + 0x2d0], rsi
mov qword [rsp + 0x2a8], r14
sub ebx, 1
je 0x14003cd74
sub ebx, 1
je 0x14003ccc2
sub ebx, 1
je 0x14003cc57
cmp ebx, 1
jne 0x14003cf83
test rdi, rdi
je 0x14003cf83
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rdi + rbx], 0
jne 0x14003cb20
test rbx, rbx
je 0x14003cf83
mov rcx, qword [0x1400d4650]
add rbx, 1
mov rdx, rbx
mov r14d, 1
cmove rdx, r14
call fcn.140088978
mov rsi, rax
test rax, rax
je 0x14003cfae
mov r8, rbx
mov qword [0x1400d4650], rax
mov rdx, rdi
mov rcx, rax
call fcn.140074d50
mov r8d, r14d
mov dword [0x1400cca70], ebp
mov edx, r14d
mov rcx, rsi
call fcn.140022c10
test eax, eax
je 0x14003cf83
lea rcx, [rsp + 0x50]
call fcn.1400680f0
lea rcx, [rsp + 0x58]
call fcn.140080c84
xor ecx, ecx
call fcn.140022320
movsd xmm0, qword [rax]
mov eax, dword [rax + 8]
movsd qword [rsp + 0x40], xmm0
mov dword [rsp + 0x48], eax
call fcn.140022320
mov rdi, rax
call fcn.140080c84
mov rbx, qword [rsp + 0x50]
add rax, 0x3aa7e80
xor esi, esi
mov ecx, ebx
sub ecx, eax
mov ebp, esi
add rcx, rax
cmp rcx, qword [rdi + 0x18]
seta bpl
cmp rcx, qword [rdi + 0x18]
mov ecx, dword [rsp + 0x40]
setb sil
sub ebp, esi
call fcn.14003df00
mov ecx, dword [rsp + 0x44]
lea rdi, str.expires
mov rsi, rax
test ebp, ebp
lea rax, str.expired
cmovns rdi, rax
call fcn.14003df00
movsx r9d, word [rsp + 0x48]
lea r8, str._d_leap__s__s__s
xor edx, edx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
lea ecx, [rdx + 0xe]
call fcn.140016420
lea r8, [rsp + 0x58]
mov dword [0x1400d0a08], r14d
mov edx, ebx
mov ecx, r14d
call fcn.14003dc70
jmp 0x14003cf83
test ebp, ebp
jne 0x14003cc69
test byte [0x1400d0a0c], 8
je 0x14003cc70
jmp 0x14003cf83
or dword [0x1400d0a0c], 8
lea rdx, [0x1400ae8d4]
mov rcx, rdi
call fcn.14008026c
mov rbx, rax
test rax, rax
jne 0x14003cc9e
mov r8, rdi
lea rdx, str.pid_file__s:__m
lea ecx, [rax + 3]
call fcn.14005c0d0
jmp 0x14003cf83
call sub.KERNEL32.dll_GetCurrentProcessId
mov r8d, eax
lea rdx, [0x1400ae2c8]
mov rcx, rbx
call fcn.140004e80
mov rcx, rbx
call fcn.140081584
jmp 0x14003cf83
test ebp, ebp
jne 0x14003ccd4
test byte [0x1400d0a0c], 4
je 0x14003ccdb
jmp 0x14003cf83
or dword [0x1400d0a0c], 4
or rbx, 0xffffffffffffffff
nop
inc rbx
cmp byte [rdi + rbx], 0
jne 0x14003cce0
cmp rbx, 0xff
jb 0x14003cd0e
mov r8d, 0xfe
lea rdx, str.statsdir_too_long____d__sigh_
mov ecx, 3
call fcn.14005c0d0
jmp 0x14003cf83
test rbx, rbx
je 0x14003cd4f
xor esi, esi
cmp byte [rbx + rdi - 1], 0x5c
setne sil
test esi, esi
je 0x14003cd4f
mov r9, rdi
mov dword [rsp + 0x20], 0x5c
lea r8, str._s_c
mov edx, 0x100
lea rcx, str.c:_var_ntp_
call fcn.14005e600
call fcn.14001e610
jmp 0x14003cf83
mov r9, rdi
lea r8, [0x1400ad0bc]
mov edx, 0x100
lea rcx, str.c:_var_ntp_
call fcn.14005e600
call fcn.14001e610
jmp 0x14003cf83
test ebp, ebp
jne 0x14003cd86
test byte [0x1400d0a0c], 2
je 0x14003cd8d
jmp 0x14003cf83
or dword [0x1400d0a0c], 2
xor esi, esi
mov qword [rsp + 0x2e0], r12
mov qword [rsp + 0x2a0], r15
test rdi, rdi
je 0x14003cf34
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rdi + rbx], sil
jne 0x14003cdb0
test rbx, rbx
je 0x14003cf34
mov rcx, qword [0x1400d5ef0]
lea rbp, [rbx + 1]
test rbp, rbp
mov rdx, rbp
mov r14d, 1
cmove rdx, r14
call fcn.140088978
test rax, rax
je 0x14003cfd2
mov rcx, qword [0x1400d45b8]
lea r12, [rbx + 6]
test r12, r12
mov qword [0x1400d5ef0], rax
mov rdx, r12
cmove rdx, r14
call fcn.140088978
mov r15, rax
test rax, rax
je 0x14003cff6
mov r8, rbp
mov qword [0x1400d45b8], rax
mov rbp, qword [0x1400d5ef0]
mov rdx, rdi
mov rcx, rbp
call fcn.140074d50
mov r8, rbx
mov rdx, rdi
mov rcx, r15
call fcn.140074d50
mov eax, dword [str..TEMP]
mov dword [r15 + rbx], eax
movzx eax, word [0x1400a4a78]
mov word [r15 + rbx + 4], ax
test rbp, rbp
je 0x14003cf5a
lea rdx, [0x1400ae8ac]
mov rcx, rbp
call fcn.14008026c
mov rbx, rax
test rax, rax
jne 0x14003ceb1
call fcn.1400808e8
cmp dword [rax], 2
je 0x14003cf73
call fcn.1400808e8
mov ecx, dword [rax]
call fcn.14006bfa0
mov r8, qword [0x1400d5ef0]
lea rdx, str.cannot_read_frequency_file__s:__s
mov r9, rax
lea ecx, [rbx + 4]
call fcn.14005c0d0
jmp 0x14003cf73
lea r8, [rsp + 0x60]
mov rcx, rbx
lea rdx, [0x1400acf48]
call fcn.14003c690
cmp eax, r14d
je 0x14003ceef
mov r8, qword [0x1400d5ef0]
lea rdx, str.format_error_frequency_file__s
mov ecx, 3
call fcn.14005c0d0
mov rcx, rbx
call fcn.140081584
jmp 0x14003cf73
movsd xmm2, qword [rsp + 0x60]
lea rdx, str.initial_drift_restored_to__f
movsd xmm0, qword [0x1400d7200]
movq r8, xmm2
mov ecx, 6
movsd qword [0x1400d21d0], xmm2
movsd qword [0x1400d4588], xmm0
mov dword [0x1400d71d0], r14d
call fcn.14005c0d0
mov rcx, rbx
call fcn.140081584
jmp 0x14003cf73
mov rcx, qword [0x1400d5ef0]
call fcn.140078220
mov rcx, qword [0x1400d45b8]
call fcn.140078220
mov qword [0x1400d45b8], rsi
mov qword [0x1400d5ef0], rsi
xorps xmm0, xmm0
mov dword [0x1400d71d0], esi
movsd qword [0x1400d21d0], xmm0
movsd qword [0x1400d4588], xmm0
mov r12, qword [rsp + 0x2e0]
mov r15, qword [rsp + 0x2a0]
mov r14, qword [rsp + 0x2a8]
mov rsi, qword [rsp + 0x2d0]
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140073c20
add rsp, 0x2b0
pop rdi
pop rbp
pop rbx
ret
mov r8d, ebx
mov dword [0x1400d1b14], r14d
lea rdx, str.fatal_out_of_memory___lu_bytes_
mov ecx, 3
call fcn.14005c0d0
mov ecx, r14d
call fcn.1400786ac
int3
mov r8d, ebp
mov dword [0x1400d1b14], r14d
lea rdx, str.fatal_out_of_memory___lu_bytes_
mov ecx, 3
call fcn.14005c0d0
mov ecx, r14d
call fcn.1400786ac
int3
mov r8d, r12d
mov dword [0x1400d1b14], r14d
lea rdx, str.fatal_out_of_memory___lu_bytes_
mov ecx, 3
call fcn.14005c0d0
mov ecx, r14d
call fcn.1400786ac
int3