Function at 0x1400012e0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2a0
movaps xmmword [rsp + 0x290], xmm6
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [0x140007098]
test rcx, rcx
je 0x140001640
lea rdx, str.FDICreate
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rbx
mov qword [0x140007080], rax
mov rcx, qword [0x140007098]
lea rdx, str.FDIDestroy
call rbx
mov qword [0x140007090], rax
mov rcx, qword [0x140007098]
lea rdx, str.FDICopy
call rbx
mov rcx, rax
mov qword [0x140007088], rax
xor eax, eax
cmp qword [0x140007080], 0
je 0x140001613
cmp qword [0x140007090], 0
je 0x140001613
test rcx, rcx
je 0x140001613
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cdqe
lea r14, [rdi + rax*2]
test eax, eax
jle 0x1400013a1
cmp word [r14], 0x5c
je 0x1400013a1
add r14, 0xfffffffffffffffe
cmp r14, rdi
ja 0x140001391
cmp r14, rdi
je 0x1400015ed
add r14, 2
xorps xmm6, xmm6
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor ebx, ebx
mov ecx, 0xfde9
xor edx, edx
mov r8, r14
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x140001430
mov ebp, eax
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor ebx, ebx
mov rcx, rax
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140001430
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, r14
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rbx, r15
sub r14, rdi
shr r14, 1
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, rdi
mov r9d, r14d
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x1400015f1
mov r12d, eax
xor eax, eax
cmp r14d, 0xffffffff
setne al
add r12d, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1400015f1
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rdi
mov r9d, r14d
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp r14d, 0xffffffff
je 0x1400014ca
movsxd rax, r12d
mov byte [r15 + rax - 1], 0
test rbx, rbx
je 0x1400015d3
lea rcx, [rsp + 0x50]
mov dword [rcx + 8], 0
mov qword [rcx], 0
mov rax, qword [0x140007080]
mov qword [rsp + 0x40], rcx
lea rcx, [0x140001760]
mov qword [rsp + 0x30], rcx
lea rcx, [0x140001770]
mov qword [rsp + 0x28], rcx
lea rcx, [0x140001790]
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x38], 0xffffffff
lea rcx, [0x140001970]
lea rdx, [0x140001940]
lea r8, [0x140001810]
lea r9, [0x1400017d0]
call qword [0x1400058d8]
test rax, rax
je 0x1400015d3
mov r14, rax
lea rdi, [rsp + 0x68]
mov qword [rdi - 8], rsi
mov rcx, rdi
call fcn.140001d40
mov byte [rdi + 0x218], 0
mov rax, qword [0x140007088]
lea rsi, [rsp + 0x60]
mov qword [rsp + 0x30], rsi
lea rcx, [0x1400019a0]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], 0
mov rcx, r14
mov rdx, rbx
mov r8, r15
xor r9d, r9d
call qword [0x1400058d8]
mov rax, qword [0x140007090]
mov rcx, r14
call qword [0x1400058d8]
mov sil, byte [rsi + 0x220]
mov rcx, rdi
test sil, sil
je 0x14000162d
call fcn.140001f10
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rdi
call fcn.140001d60
jmp 0x1400015d5
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
jmp 0x1400015f8
xor eax, eax
jmp 0x140001613
xor esi, esi
mov eax, 0
test rbx, rbx
je 0x140001613
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
movaps xmm6, xmmword [rsp + 0x290]
add rsp, 0x2a0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.140001e40
test al, al
je 0x1400015c9
mov rcx, rdi
call fcn.140001e50
jmp 0x1400015c9
lea rbx, [rsp + 0x60]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call fcn.140003d60
lea rcx, str._WINDIR__system32cabinet.dll
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x104
jb 0x14000167d
mov rcx, qword [0x140007098]
jmp 0x14000169a
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
mov qword [0x140007098], rax
test rcx, rcx
jne 0x14000130f
lea rdx, [rsp + 0x60]
mov word [rdx], 0
lea rcx, str._SYSTEMROOT__system32cabinet.dll
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x104
jb 0x1400016d2
mov rcx, qword [0x140007098]
jmp 0x1400016ef
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
mov qword [0x140007098], rax
test rcx, rcx
jne 0x14000130f
lea rdx, [rsp + 0x60]
mov word [rdx], 0
lea rcx, str.C:Windows_system32cabinet.dll
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x104
jb 0x140001727
mov rcx, qword [0x140007098]
jmp 0x140001744
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
mov qword [0x140007098], rax
test rcx, rcx
jne 0x14000130f
mov rcx, qword [0x140007088]
jmp 0x140001357