Function at 0x140053dd0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x140159060]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov qword [rsp + 0x78], rdx
mov rbx, rcx
movabs rsi, 0x4c70efae6863a8a3
mov qword [rbp + 0x110], rsi
movabs r15, 0x4269f1bd1d4dc80
mov qword [rbp + 0x118], r15
movabs rax, 0x3e2081cb182cdced
mov qword [rsp + 0x60], rax
movabs rax, 0x4269f68a2b1bfef
mov qword [rsp + 0x68], rax
movdqa xmm0, xmmword [rbp + 0x110]
pxor xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rbp + 0x120], rsi
mov qword [rbp + 0x128], r15
movabs rax, 0x2014c1c20407dccd
mov qword [rbp + 0x110], rax
movabs rax, 0x4269f1bd1d4dcec
mov qword [rbp + 0x118], rax
movdqa xmm0, xmmword [rbp + 0x120]
pxor xmm0, xmmword [rbp + 0x110]
movdqa xmmword [rbp + 0x110], xmm0
lea rcx, [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r14d, r14d
mov edi, r14d
mov qword [rbp + 0x120], r14
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x68], rbx
mov dword [rbp + 0xe0], gethostname
mov qword [rbp + 0xf0], r14
mov dword [rbp + 0xf8], r14d
mov qword [rbp + 0xe8], r14
mov qword [rbp + 0x100], r14
movups xmm0, xmmword [rbp + 0xe0]
movups xmmword [rbp + 0xb0], xmm0
movups xmm1, xmmword [rbp + 0xf0]
movups xmmword [rbp + 0xc0], xmm1
movups xmm0, xmmword [rbp + 0x100]
movups xmmword [rbp + 0xd0], xmm0
lea r9, [rbp + 0x68]
lea r8, [rbp + 0xb0]
mov edx, 0x1fffff
lea rcx, [rbp + 0x60]
call rax
test eax, eax
js 0x1400548d0
mov qword [rbp + 0x110], rsi
mov qword [rbp + 0x118], r15
movabs rax, 0x3e3482cb1c10d1f0
mov qword [rsp + 0x60], rax
movabs rax, 0x4269f1bd1b1aae9
mov qword [rsp + 0x68], rax
movdqa xmm0, xmmword [rbp + 0x110]
pxor xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov qword [rbp + 0x90], r14
mov qword [rbp + 0xa0], r14
mov qword [rbp + 0xa8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x90], r14b
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140053fb4
mov rdx, rax
lea rcx, [rbp + 0x90]
call fcn.14000d860
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x78], xmm0
mov qword [rbp + 0x88], rax
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], r15
movabs r12, 0x17d470e42231bb6d
mov qword [rbp + 0xf0], r12
movabs rbx, 0x25c843f90ee5de4a
mov qword [rbp + 0xf8], rbx
movabs r13, 0x3f0780ca060affff
mov qword [rsp + 0x40], r13
movabs rax, 0x374bfa6fa2ad8fdc
mov qword [rsp + 0x48], rax
movabs rax, 0x64bb18875442e75f
mov qword [rsp + 0x50], rax
movabs rax, 0x25c8439c7680f03e
mov qword [rsp + 0x58], rax
movdqa xmm0, xmmword [rbp + 0xe0]
pxor xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [rbp + 0xf0]
pxor xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
mov qword [rbp - 0x80], r14
movdqa xmm0, xmmword [0x140141bf0]
movdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x80], 0
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140054093
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x80]
call fcn.14000d860
nop
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], r15
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], rbx
mov qword [rsp + 0x40], r13
movabs rax, 0x374bfa6fa2ad8fdc
mov qword [rsp + 0x48], rax
movabs rax, 0x64bb188a4d52e75f
mov qword [rsp + 0x50], rax
movabs rax, 0x25c8439c7680f03e
mov qword [rsp + 0x58], rax
movdqa xmm0, xmmword [rbp + 0xe0]
pxor xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [rbp + 0xf0]
pxor xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
mov qword [rbp - 0x60], r14
movdqa xmm0, xmmword [0x140141bf0]
movdqu xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140054143
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.14000d860
nop
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], r15
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], rbx
mov qword [rsp + 0x40], r13
movabs rax, 0x374bfa6fa2ad8fdc
mov qword [rsp + 0x48], rax
movabs rax, 0x39a70385515de75f
mov qword [rsp + 0x50], rax
movabs rax, 0x25c843f90e80a62f
mov qword [rsp + 0x58], rax
movdqa xmm0, xmmword [rbp + 0xe0]
pxor xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [rbp + 0xf0]
pxor xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
mov qword [rbp - 0x40], r14
movdqa xmm0, xmmword [0x140141bf0]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400541f3
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x40]
call fcn.14000d860
nop
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], r15
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], rbx
mov qword [rsp + 0x40], r13
movabs rax, 0x6154f077a1acb9dc
mov qword [rsp + 0x48], rax
movabs rax, 0x17d470815a54951f
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
movdqa xmm0, xmmword [rbp + 0xe0]
pxor xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [rbp + 0xf0]
pxor xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
mov qword [rbp - 0x20], r14
movdqa xmm0, xmmword [0x140141bf0]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400542a0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.14000d860
nop
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], r15
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], rbx
mov qword [rsp + 0x40], r13
movabs rax, 0x374bfa6fa2ad8fdc
mov qword [rsp + 0x48], rax
movabs rax, 0x39a703965152e75f
mov qword [rsp + 0x50], rax
movabs rax, 0x25c843f90e80a62f
mov qword [rsp + 0x58], rax
movdqa xmm0, xmmword [rbp + 0xe0]
pxor xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [rbp + 0xf0]
pxor xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
mov qword [rbp], r14
movdqa xmm0, xmmword [0x140141bf0]
movdqu xmmword [rbp + 0x10], xmm0
mov byte [rbp], 0
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140054350
lea rdx, [rsp + 0x40]
lea rcx, [rbp]
call fcn.14000d860
nop
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], r15
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], rbx
mov qword [rsp + 0x40], r13
movabs rax, 0x374bfa6fa2ad8fdc
mov qword [rsp + 0x48], rax
movabs rax, 0x7eba198a4b46e75f
mov qword [rsp + 0x50], rax
movabs rax, 0x25c8439c7680f03e
mov qword [rsp + 0x58], rax
movdqa xmm0, xmmword [rbp + 0xe0]
pxor xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [rbp + 0xf0]
pxor xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
mov qword [rbp + 0x20], r14
movdqa xmm0, xmmword [0x140141bf0]
movdqu xmmword [rbp + 0x30], xmm0
mov byte [rbp + 0x20], 0
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140054400
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x20]
call fcn.14000d860
nop
mov qword [rbp + 0xe0], rsi
mov qword [rbp + 0xe8], r15
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], rbx
mov qword [rsp + 0x40], r13
movabs rax, 0x374bfa6fa2ad8fdc
mov qword [rsp + 0x48], rax
movabs rax, 0x70bb1c8a4b46e75f
mov qword [rsp + 0x50], rax
movabs rax, 0x25c826816bcbb025
mov qword [rsp + 0x58], rax
movdqa xmm0, xmmword [rbp + 0xe0]
pxor xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [rbp + 0xf0]
pxor xmm1, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm1
mov qword [rbp + 0x40], r14
movdqa xmm0, xmmword [0x140141bf0]
movdqu xmmword [rbp + 0x50], xmm0
mov byte [rbp + 0x40], 0
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400544b0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x40]
call fcn.14000d860
nop
lea rax, [rbp - 0x80]
mov qword [rsp + 0x60], rax
lea rax, [rbp + 0x60]
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x78]
call fcn.140056210
nop
lea r9, [fcn.14000c4d0]
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea r8d, [rdx - 0x19]
lea rcx, [rbp - 0x80]
call fcn.14010cea4
mov r9d, 0x104
lea r8, [rbp + 0x130]
xor edx, edx
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
mov rsi, qword [rbp + 0x78]
mov rax, qword [rbp + 0x80]
mov qword [rsp + 0x70], rax
mov rbx, qword [rbp + 0x90]
cmp rsi, rax
je 0x1400547e6
movabs rdx, 0x7fffffffffffffff
mov rcx, rdx
mov rax, qword [rbp + 0xa0]
sub rcx, rax
mov qword [rsp + 0x60], rcx
mov r8d, reloc.WLDAP32.dll_Ordinal_22
mov r15, qword [rsi + 0x10]
cmp rcx, r15
jb 0x1400548fd
lea r12, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0x10
cmovae r12, rbx
mov r13, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x14005458b
mov r13, qword [rsi]
mov qword [rsp + 0x40], r14
lea r14, [rax + r15]
mov edi, reloc.WS2_32.dll_ntohs
lea rbx, [rsp + 0x40]
cmp r14, rdi
jbe 0x14005462b
mov rdi, r14
or rdi, 0xf
cmp rdi, rdx
jbe 0x1400545b8
mov rdi, rdx
jmp 0x1400545c0
cmp rdi, 0x16
cmovb rdi, r8
mov rcx, rdi
add rcx, 1
mov rdx, 0xffffffffffffffff
cmovb rcx, rdx
cmp rcx, 0x1000
jb 0x14005460e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140054903
mov rcx, rax
call fcn.14010c940
test rax, rax
je 0x140054720
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
mov rax, qword [rbp + 0xa0]
jmp 0x140054626
test rcx, rcx
je 0x140054624
call fcn.14010c940
mov rbx, rax
mov rax, qword [rbp + 0xa0]
jmp 0x140054626
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], rdi
mov r8, rax
mov rdx, r12
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbp + 0xa0]
add rcx, rbx
mov r8, r15
mov rdx, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r14], 0
lea rdx, [rsp + 0x40]
mov r9, qword [rsp + 0x58]
lea rax, [rbp + 0x130]
cmp r9, 0x10
jb 0x1400546c7
mov r8, qword [rsp + 0x40]
mov rdx, r8
sub rdx, rax
nop
movzx ecx, byte [rax]
cmp cl, byte [rax + rdx]
jne 0x140054693
inc rax
test cl, cl
jne 0x140054680
xor ebx, ebx
jmp 0x140054698
sbb ebx, ebx
or ebx, 1
lea rdx, [r9 + 1]
mov rax, r8
cmp rdx, 0x1000
jb 0x1400546bd
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140054720
mov rcx, r8
call fcn.14010c6a0
jmp 0x1400546e8
sub rdx, rax
nop word [rax + rax]
movzx ecx, byte [rax]
cmp cl, byte [rax + rdx]
jne 0x1400546e3
inc rax
test cl, cl
jne 0x1400546d0
xor ebx, ebx
jmp 0x1400546e8
sbb ebx, ebx
or ebx, 1
test ebx, ebx
je 0x140054727
add rsi, 0x20
mov rbx, qword [rbp + 0x90]
xor r14d, r14d
cmp rsi, qword [rsp + 0x70]
je 0x1400547df
mov rax, qword [rbp + 0xa0]
mov rcx, qword [rsp + 0x60]
movabs rdx, 0x7fffffffffffffff
jmp 0x140054558
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x78]
test rcx, rcx
je 0x140054796
mov rdx, qword [rbp + 0x80]
call fcn.1400564e0
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x78]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005477e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140054874
call fcn.14010c6a0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x78], xmm0
mov qword [rbp + 0x88], 0
mov rax, qword [rbp + 0xa8]
cmp rax, 0x10
jb 0x1400547d8
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400547d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400548c1
call fcn.14010c6a0
xor eax, eax
jmp 0x1400548d3
mov rdi, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], r14d
lea r9, [rbp + 0x110]
mov r8, rax
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
cmovns rdi, qword [rbp + 0x110]
mov rcx, qword [rbp + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, qword [rbp + 0x78]
test rcx, rcx
je 0x14005488f
mov rdx, qword [rbp + 0x80]
call fcn.1400564e0
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x78]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005487b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005487b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010c6a0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x78], xmm0
mov qword [rbp + 0x88], r14
mov rax, qword [rbp + 0xa8]
cmp rax, 0x10
jb 0x1400548d0
lea rdx, [rax + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400548c8
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400548c8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14010c6a0
mov rax, rdi
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.14010c680
mov rbx, qword [rsp + 0x3a0]
add rsp, 0x350
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400013d0
nop
call fcn.140001330
int3