Function at 0x14009b160
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rax, qword [0x14013aa80]
xor rax, rsp
mov qword [rsp + 0x68], rax
cmp byte [0x14013bc34], 1
jne 0x14009b18e
mov edi, dword [0x14013bc38]
jmp 0x14009b439
mov byte [0x14013bc34], 1
lea rcx, str.COLORTERM
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rbx, rax
test rax, rax
lea rsi, [0x140122c0a]
cmove rbx, rsi
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm0
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x14009b454
mov rdi, rax
cmp rax, 0xf
ja 0x14009b201
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
lea rcx, [rsp + 0x40]
mov rdx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, rsp
add rdi, 0x40
jmp 0x14009b262
mov rax, rdi
or rax, 0xf
cmp rax, 0x17
mov r15d, socket
cmovae r15, rax
cmp r15, 0xfff
jb 0x14009b236
lea rcx, [r15 + 0x28]
call fcn.1400d1e28
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14009b242
lea rcx, [r15 + 1]
call fcn.1400d1e28
mov r14, rax
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], r15
mov rcx, r14
mov rdx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, r14
mov byte [rdi], 0
lea rdx, str.24bit
lea rcx, [rsp + 0x40]
xor r8d, r8d
call fcn.14009b460
mov edi, 3
cmp rax, 0xffffffffffffffff
jne 0x14009b3f6
lea rdx, str.truecolor
lea rcx, [rsp + 0x40]
xor r8d, r8d
call fcn.14009b460
cmp rax, 0xffffffffffffffff
jne 0x14009b3f6
lea rcx, [0x14011f3bb]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
cmovne rsi, rax
xorps xmm0, xmm0
movaps xmmword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0x30], xmm0
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x14009b454
mov rdi, rax
cmp rax, 0xf
ja 0x14009b308
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
lea rcx, [rsp + 0x20]
mov rdx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, rsp
add rdi, 0x20
jmp 0x14009b369
mov rax, rdi
or rax, 0xf
cmp rax, 0x17
mov r14d, socket
cmovae r14, rax
cmp r14, 0xfff
jb 0x14009b33d
lea rcx, [r14 + 0x28]
call fcn.1400d1e28
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14009b349
lea rcx, [r14 + 1]
call fcn.1400d1e28
mov rbx, rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], r14
mov rcx, rbx
mov rdx, rsi
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, rbx
mov byte [rdi], 0
lea rdx, [0x14011ffe9]
lea rcx, [rsp + 0x40]
xor r8d, r8d
call fcn.14009b460
mov edi, 2
cmp rax, 0xffffffffffffffff
jne 0x14009b3b9
lea rdx, [0x14011ffe9]
lea rcx, [rsp + 0x20]
xor r8d, r8d
call fcn.14009b460
cmp rax, 0xffffffffffffffff
jne 0x14009b3b9
mov rax, qword [rsp + 0x30]
xor ecx, ecx
or rax, qword [rsp + 0x50]
sete cl
lea edi, [rcx + rcx]
inc edi
mov rax, qword [rsp + 0x38]
cmp rax, 0x10
jb 0x14009b3f6
mov rcx, qword [rsp + 0x20]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14009b3f1
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14009b459
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.1400d1e6c
mov rax, qword [rsp + 0x58]
cmp rax, 0x10
jb 0x14009b433
mov rcx, qword [rsp + 0x40]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14009b42e
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14009b459
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.1400d1e6c
mov dword [0x14013bc38], edi
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1400d2000
mov eax, edi
add rsp, 0x70
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
call fcn.140001300
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3