Function at 0x140002ba0
Capabilities:
Query environment variable
Set environment variable
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
mov eax, 0x20480
call fcn.140016e60
sub rsp, rax
mov rax, qword [0x140022008]
xor rax, rsp
mov qword [rsp + 0x20470], rax
mov rbx, rcx
mov r8d, 0x104
xor ecx, ecx
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x140002bea
call fcn.140002770
movzx ecx, word [rsi]
lea rdx, [rsi + 2]
mov rdi, rsi
test ecx, ecx
je 0x140002c1b
nop dword [rax + rax]
cmp ecx, 0x5c
mov rax, rdx
movzx ecx, word [rdx]
cmovne rax, rdi
add rdx, 2
mov rdi, rax
test ecx, ecx
jne 0x140002c00
movzx ecx, word [rax]
lea rax, [rsp + 0x50]
test cx, cx
je 0x140002c40
lea r8, [rsp + 0x50]
mov rdx, rdi
sub rdx, r8
mov word [rax], cx
add rax, 2
movzx ecx, word [rdx + rax]
test cx, cx
jne 0x140002c30
lea rdx, [rsp + 0x50]
mov rcx, rax
sub rcx, rdx
and rcx, 0xfffffffffffffffe
cmp rcx, 8
jl 0x140002cb1
cmp word [rax - 8], 0x2e
jne 0x140002cb1
movzx edx, word [rax - 6]
mov r8d, 0xffdf
lea ecx, [rdx - 0x45]
test r8w, cx
jne 0x140002c8b
movzx ecx, word [rax - 4]
sub cx, 0x58
test r8w, cx
jne 0x140002c8b
movzx ecx, word [rax - 2]
sub cx, 0x45
test r8w, cx
je 0x140002cbd
sub dx, 0x43
test r8w, dx
jne 0x140002cb1
movzx ecx, word [rax - 4]
sub cx, 0x4f
test r8w, cx
jne 0x140002cb1
movzx ecx, word [rax - 2]
sub cx, 0x4d
test r8w, cx
je 0x140002cbd
mov ecx, 0x2e
mov word [rax], cx
add rax, 8
mov dword [rax - 6], 0x690062
lea r9, [rsp + 0x50]
mov ecx, 0x6e
mov r8, rdi
mov word [rax - 2], cx
mov rdx, rsi
lea rcx, [rsp + 0x50]
sub rax, rcx
mov rcx, rbx
sar rax, 1
mov qword [rsp + 0x20], rax
call fcn.1400151f0
xor r14d, r14d
lea rdx, [rsp + 0x260]
mov r8d, 0x7fff
mov word [rdi], r14w
lea rcx, [0x140019838]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebp, eax
lea ecx, [rax - 1]
cmp ecx, 0x7ffd
jbe 0x140002da3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x140002da3
mov qword [rsp + 0x40], r14
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov r8d, eax
mov dword [rsp + 0x28], r14d
lea rax, [rsp + 0x40]
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rdx, qword [rsp + 0x40]
lea r9d, [r14 + 0x10]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rbx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
sub rdi, rsi
lea rcx, [rsp + 0x260]
sar rdi, 1
mov rdx, rsi
lea rbx, [rdi - 1]
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncmp]
test eax, eax
jne 0x140002dd4
cmp word [rsp + rdi*2 + 0x25e], 0x3b
je 0x140002ead
lea r8, [rbx + 1]
mov rdx, rsi
lea rcx, [rsp + 0x10260]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy]
lea rcx, [rsp + 0x10260]
lea rcx, [rcx + rbx*2]
test ebp, ebp
je 0x140002e1b
mov eax, 0x3b
lea r8d, [rbp + 1]
mov word [rcx], ax
lea rdx, [rsp + 0x260]
add rcx, 2
add r8, r8
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140002e1f
mov word [rcx], r14w
lea rdx, [rsp + 0x10260]
lea rcx, [0x140019838]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
test eax, eax
jne 0x140002ead
mov qword [rsp + 0x40], r14
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov r8d, eax
mov dword [rsp + 0x28], r14d
lea rax, [rsp + 0x40]
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_FormatMessageW]
mov rdx, qword [rsp + 0x40]
mov r9d, 0x10
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rbx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x20470]
xor rcx, rsp
call fcn.1400153b0
lea r11, [rsp + 0x20480]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret