Function at 0x1800103c0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x208
mov rax, qword [0x1800623f8]
xor rax, rsp
mov qword [rsp + 0x1f8], rax
mov qword [rsp + 0x148], 0
mov dword [rsp + 0x140], 0
mov dword [rsp + 0x164], 2
mov dword [rsp + 0x174], 0x10
cmp dword [rsp + 0x174], 0
jle 0x18001046b
mov eax, dword [rsp + 0x174]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18001044d
mov dword [rsp + 0x164], 4
mov eax, dword [rsp + 0x174]
dec eax
mov dword [rsp + 0x174], eax
jmp 0x18001040b
mov dword [rsp + 0x164], 4
mov eax, dword [rsp + 0x174]
sub eax, 2
mov dword [rsp + 0x174], eax
jmp 0x18001040b
mov dword [rsp + 0x15c], 3
mov dword [rsp + 0x170], 0x12
cmp dword [rsp + 0x170], 0
jle 0x1800104e2
mov eax, dword [rsp + 0x170]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x1800104c4
mov dword [rsp + 0x15c], 4
mov eax, dword [rsp + 0x170]
sub eax, 2
mov dword [rsp + 0x170], eax
jmp 0x180010481
mov dword [rsp + 0x15c], 0
mov eax, dword [rsp + 0x170]
sub eax, 2
mov dword [rsp + 0x170], eax
jmp 0x180010481
mov dword [rsp + 0x154], 4
mov dword [rsp + 0x160], 3
mov eax, dword [rsp + 0x160]
test eax, eax
jle 0x180010566
mov eax, dword [rsp + 0x160]
cmp eax, 1
jle 0x180010535
mov eax, dword [rsp + 0x154]
and eax, 0x1494
mov dword [rsp + 0x154], eax
mov eax, dword [rsp + 0x160]
sub eax, 2
mov dword [rsp + 0x160], eax
jmp 0x1800104f8
mov eax, dword [rsp + 0x154]
cmp eax, 0x805
jle 0x180010554
mov eax, dword [rsp + 0x154]
and eax, 0x7e
mov dword [rsp + 0x154], eax
mov eax, dword [rsp + 0x160]
dec eax
mov dword [rsp + 0x160], eax
jmp 0x1800104f8
mov dword [rsp + 0x168], 2
mov dword [rsp + 0x16c], 4
mov eax, dword [rsp + 0x16c]
test eax, eax
jle 0x1800105ea
mov eax, dword [rsp + 0x16c]
cmp eax, 1
jle 0x1800105b9
mov eax, dword [rsp + 0x168]
and eax, 0x1176
mov dword [rsp + 0x168], eax
mov eax, dword [rsp + 0x16c]
sub eax, 2
mov dword [rsp + 0x16c], eax
jmp 0x18001057c
mov eax, dword [rsp + 0x168]
cmp eax, 0x806
jle 0x1800105d8
mov eax, dword [rsp + 0x168]
and eax, 0x7f
mov dword [rsp + 0x168], eax
mov eax, dword [rsp + 0x16c]
dec eax
mov dword [rsp + 0x16c], eax
jmp 0x18001057c
mov dword [rsp + 0x158], 7
mov dword [rsp + 0x150], 4
mov eax, dword [rsp + 0x150]
test eax, eax
jle 0x18001066e
mov eax, dword [rsp + 0x150]
cmp eax, 1
jle 0x18001063d
mov eax, dword [rsp + 0x158]
and eax, 0x21f3
mov dword [rsp + 0x158], eax
mov eax, dword [rsp + 0x150]
sub eax, 2
mov dword [rsp + 0x150], eax
jmp 0x180010600
mov eax, dword [rsp + 0x158]
cmp eax, 0x806
jle 0x18001065c
mov eax, dword [rsp + 0x158]
and eax, 0x7f
mov dword [rsp + 0x158], eax
mov eax, dword [rsp + 0x150]
dec eax
mov dword [rsp + 0x150], eax
jmp 0x180010600
mov rax, qword [rsp + 0x210]
add rax, 0x1c
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea r8, [rsp + 0x140]
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x30]
call fcn.18000e1c0
test eax, eax
jne 0x1800109b8
mov dword [rsp + 0x18c], 9
mov dword [rsp + 0x1a0], 4
mov eax, dword [rsp + 0x1a0]
test eax, eax
jle 0x180010734
mov eax, dword [rsp + 0x1a0]
cmp eax, 1
jle 0x180010703
mov eax, dword [rsp + 0x18c]
and eax, 0x197d
mov dword [rsp + 0x18c], eax
mov eax, dword [rsp + 0x1a0]
sub eax, 2
mov dword [rsp + 0x1a0], eax
jmp 0x1800106c6
mov eax, dword [rsp + 0x18c]
cmp eax, 0x806
jle 0x180010722
mov eax, dword [rsp + 0x18c]
and eax, 0x7f
mov dword [rsp + 0x18c], eax
mov eax, dword [rsp + 0x1a0]
dec eax
mov dword [rsp + 0x1a0], eax
jmp 0x1800106c6
mov dword [rsp + 0x188], 6
mov dword [rsp + 0x178], 7
mov eax, dword [rsp + 0x178]
test eax, eax
jle 0x1800107ba
mov eax, dword [rsp + 0x178]
cmp eax, 1
jle 0x180010787
mov eax, dword [rsp + 0x188]
and eax, 0x169a
mov dword [rsp + 0x188], eax
mov eax, dword [rsp + 0x178]
sub eax, 2
mov dword [rsp + 0x178], eax
jmp 0x18001074a
mov eax, dword [rsp + 0x188]
cmp eax, 0x809
jle 0x1800107a8
mov eax, dword [rsp + 0x188]
and eax, 0x82
mov dword [rsp + 0x188], eax
mov eax, dword [rsp + 0x178]
dec eax
mov dword [rsp + 0x178], eax
jmp 0x18001074a
mov dword [rsp + 0x194], 2
mov dword [rsp + 0x19c], 4
mov eax, dword [rsp + 0x19c]
test eax, eax
jle 0x18001083e
mov eax, dword [rsp + 0x19c]
cmp eax, 1
jle 0x18001080d
mov eax, dword [rsp + 0x194]
and eax, 0x1176
mov dword [rsp + 0x194], eax
mov eax, dword [rsp + 0x19c]
sub eax, 2
mov dword [rsp + 0x19c], eax
jmp 0x1800107d0
mov eax, dword [rsp + 0x194]
cmp eax, 0x806
jle 0x18001082c
mov eax, dword [rsp + 0x194]
and eax, 0x7f
mov dword [rsp + 0x194], eax
mov eax, dword [rsp + 0x19c]
dec eax
mov dword [rsp + 0x19c], eax
jmp 0x1800107d0
mov dword [rsp + 0x198], 3
mov dword [rsp + 0x1a4], 9
mov eax, dword [rsp + 0x1a4]
test eax, eax
jle 0x1800108c4
mov eax, dword [rsp + 0x1a4]
cmp eax, 1
jle 0x180010891
mov eax, dword [rsp + 0x198]
and eax, 0x15f8
mov dword [rsp + 0x198], eax
mov eax, dword [rsp + 0x1a4]
sub eax, 2
mov dword [rsp + 0x1a4], eax
jmp 0x180010854
mov eax, dword [rsp + 0x198]
cmp eax, 0x80b
jle 0x1800108b2
mov eax, dword [rsp + 0x198]
and eax, 0x84
mov dword [rsp + 0x198], eax
mov eax, dword [rsp + 0x1a4]
dec eax
mov dword [rsp + 0x1a4], eax
jmp 0x180010854
mov dword [rsp + 0x180], 4
mov dword [rsp + 0x17c], 0x15
cmp dword [rsp + 0x17c], 0
jle 0x18001093b
mov eax, dword [rsp + 0x17c]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x18001091d
mov dword [rsp + 0x180], 0
mov eax, dword [rsp + 0x17c]
sub eax, 2
mov dword [rsp + 0x17c], eax
jmp 0x1800108da
mov dword [rsp + 0x180], 0
mov eax, dword [rsp + 0x17c]
sub eax, 2
mov dword [rsp + 0x17c], eax
jmp 0x1800108da
mov dword [rsp + 0x190], 1
mov dword [rsp + 0x184], 0x10
cmp dword [rsp + 0x184], 0
jle 0x1800109b1
mov eax, dword [rsp + 0x184]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180010993
mov dword [rsp + 0x190], 4
mov eax, dword [rsp + 0x184]
dec eax
mov dword [rsp + 0x184], eax
jmp 0x180010951
mov dword [rsp + 0x190], 0
mov eax, dword [rsp + 0x184]
sub eax, 2
mov dword [rsp + 0x184], eax
jmp 0x180010951
xor eax, eax
jmp 0x180010f26
mov rax, qword [rsp + 0x210]
cmp dword [rax + 4], 0
je 0x180010c8d
mov edx, dword [rsp + 0x140]
mov rcx, qword [rsp + 0x148]
call fcn.18000cea0
test eax, eax
jne 0x180010c8d
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x148]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov dword [rsp + 0x1a8], 3
mov dword [rsp + 0x1ac], 0xa
mov eax, dword [rsp + 0x1ac]
test eax, eax
jle 0x180010a82
mov eax, dword [rsp + 0x1ac]
cmp eax, 1
jle 0x180010a4f
mov eax, dword [rsp + 0x1a8]
and eax, 0x107d
mov dword [rsp + 0x1a8], eax
mov eax, dword [rsp + 0x1ac]
sub eax, 2
mov dword [rsp + 0x1ac], eax
jmp 0x180010a12
mov eax, dword [rsp + 0x1a8]
cmp eax, 0x80c
jle 0x180010a70
mov eax, dword [rsp + 0x1a8]
and eax, 0x85
mov dword [rsp + 0x1a8], eax
mov eax, dword [rsp + 0x1ac]
dec eax
mov dword [rsp + 0x1ac], eax
jmp 0x180010a12
mov dword [rsp + 0x1bc], 8
mov dword [rsp + 0x1c8], 3
mov eax, dword [rsp + 0x1c8]
test eax, eax
jle 0x180010b06
mov eax, dword [rsp + 0x1c8]
cmp eax, 1
jle 0x180010ad5
mov eax, dword [rsp + 0x1bc]
and eax, 0x1fed
mov dword [rsp + 0x1bc], eax
mov eax, dword [rsp + 0x1c8]
sub eax, 2
mov dword [rsp + 0x1c8], eax
jmp 0x180010a98
mov eax, dword [rsp + 0x1bc]
cmp eax, 0x805
jle 0x180010af4
mov eax, dword [rsp + 0x1bc]
and eax, 0x7e
mov dword [rsp + 0x1bc], eax
mov eax, dword [rsp + 0x1c8]
dec eax
mov dword [rsp + 0x1c8], eax
jmp 0x180010a98
mov dword [rsp + 0x1cc], 4
mov dword [rsp + 0x1b0], 0x13
cmp dword [rsp + 0x1b0], 0
jle 0x180010b7c
mov eax, dword [rsp + 0x1b0]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180010b5e
mov dword [rsp + 0x1cc], 0
mov eax, dword [rsp + 0x1b0]
dec eax
mov dword [rsp + 0x1b0], eax
jmp 0x180010b1c
mov dword [rsp + 0x1cc], 0
mov eax, dword [rsp + 0x1b0]
sub eax, 2
mov dword [rsp + 0x1b0], eax
jmp 0x180010b1c
mov dword [rsp + 0x1b4], 4
mov dword [rsp + 0x1c4], 3
mov eax, dword [rsp + 0x1c4]
test eax, eax
jle 0x180010c00
mov eax, dword [rsp + 0x1c4]
cmp eax, 1
jle 0x180010bcf
mov eax, dword [rsp + 0x1b4]
and eax, 0xdd8
mov dword [rsp + 0x1b4], eax
mov eax, dword [rsp + 0x1c4]
sub eax, 2
mov dword [rsp + 0x1c4], eax
jmp 0x180010b92
mov eax, dword [rsp + 0x1b4]
cmp eax, 0x805
jle 0x180010bee
mov eax, dword [rsp + 0x1b4]
and eax, 0x7e
mov dword [rsp + 0x1b4], eax
mov eax, dword [rsp + 0x1c4]
dec eax
mov dword [rsp + 0x1c4], eax
jmp 0x180010b92
mov dword [rsp + 0x1b8], 7
mov dword [rsp + 0x1c0], 9
mov eax, dword [rsp + 0x1c0]
test eax, eax
jle 0x180010c86
mov eax, dword [rsp + 0x1c0]
cmp eax, 1
jle 0x180010c53
mov eax, dword [rsp + 0x1b8]
and eax, 0x19b6
mov dword [rsp + 0x1b8], eax
mov eax, dword [rsp + 0x1c0]
sub eax, 2
mov dword [rsp + 0x1c0], eax
jmp 0x180010c16
mov eax, dword [rsp + 0x1b8]
cmp eax, 0x80b
jle 0x180010c74
mov eax, dword [rsp + 0x1b8]
and eax, 0x84
mov dword [rsp + 0x1b8], eax
mov eax, dword [rsp + 0x1c0]
dec eax
mov dword [rsp + 0x1c0], eax
jmp 0x180010c16
xor eax, eax
jmp 0x180010f26
mov rax, qword [rsp + 0x210]
mov rcx, qword [rsp + 0x148]
mov qword [rax + 0x10], rcx
mov rax, qword [rsp + 0x210]
mov ecx, dword [rsp + 0x140]
mov dword [rax + 0x18], ecx
mov dword [rsp + 0x1e4], 6
mov dword [rsp + 0x1d4], 7
mov eax, dword [rsp + 0x1d4]
test eax, eax
jle 0x180010d39
mov eax, dword [rsp + 0x1d4]
cmp eax, 1
jle 0x180010d06
mov eax, dword [rsp + 0x1e4]
and eax, 0x169a
mov dword [rsp + 0x1e4], eax
mov eax, dword [rsp + 0x1d4]
sub eax, 2
mov dword [rsp + 0x1d4], eax
jmp 0x180010cc9
mov eax, dword [rsp + 0x1e4]
cmp eax, 0x809
jle 0x180010d27
mov eax, dword [rsp + 0x1e4]
and eax, 0x82
mov dword [rsp + 0x1e4], eax
mov eax, dword [rsp + 0x1d4]
dec eax
mov dword [rsp + 0x1d4], eax
jmp 0x180010cc9
mov dword [rsp + 0x1dc], 4
mov dword [rsp + 0x1ec], 0x11
cmp dword [rsp + 0x1ec], 0
jle 0x180010daf
mov eax, dword [rsp + 0x1ec]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180010d91
mov dword [rsp + 0x1dc], 4
mov eax, dword [rsp + 0x1ec]
dec eax
mov dword [rsp + 0x1ec], eax
jmp 0x180010d4f
mov dword [rsp + 0x1dc], 4
mov eax, dword [rsp + 0x1ec]
sub eax, 2
mov dword [rsp + 0x1ec], eax
jmp 0x180010d4f
mov dword [rsp + 0x1d8], 7
mov dword [rsp + 0x1d0], 0x10
cmp dword [rsp + 0x1d0], 0
jle 0x180010e25
mov eax, dword [rsp + 0x1d0]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180010e08
mov dword [rsp + 0x1d8], 0
mov eax, dword [rsp + 0x1d0]
sub eax, 2
mov dword [rsp + 0x1d0], eax
jmp 0x180010dc5
mov dword [rsp + 0x1d8], 0
mov eax, dword [rsp + 0x1d0]
dec eax
mov dword [rsp + 0x1d0], eax
jmp 0x180010dc5
mov dword [rsp + 0x1e8], 3
mov dword [rsp + 0x1f4], 9
mov eax, dword [rsp + 0x1f4]
test eax, eax
jle 0x180010eab
mov eax, dword [rsp + 0x1f4]
cmp eax, 1
jle 0x180010e78
mov eax, dword [rsp + 0x1e8]
and eax, 0x15f8
mov dword [rsp + 0x1e8], eax
mov eax, dword [rsp + 0x1f4]
sub eax, 2
mov dword [rsp + 0x1f4], eax
jmp 0x180010e3b
mov eax, dword [rsp + 0x1e8]
cmp eax, 0x80b
jle 0x180010e99
mov eax, dword [rsp + 0x1e8]
and eax, 0x84
mov dword [rsp + 0x1e8], eax
mov eax, dword [rsp + 0x1f4]
dec eax
mov dword [rsp + 0x1f4], eax
jmp 0x180010e3b
mov dword [rsp + 0x1f0], 4
mov dword [rsp + 0x1e0], 0x13
cmp dword [rsp + 0x1e0], 0
jle 0x180010f21
mov eax, dword [rsp + 0x1e0]
cdq
and eax, 1
xor eax, edx
sub eax, edx
cdqe
add rax, 4
cmp rax, 4
jbe 0x180010f03
mov dword [rsp + 0x1f0], 0
mov eax, dword [rsp + 0x1e0]
dec eax
mov dword [rsp + 0x1e0], eax
jmp 0x180010ec1
mov dword [rsp + 0x1f0], 0
mov eax, dword [rsp + 0x1e0]
sub eax, 2
mov dword [rsp + 0x1e0], eax
jmp 0x180010ec1
mov eax, 1
mov rcx, qword [rsp + 0x1f8]
xor rcx, rsp
call fcn.180049ea0
add rsp, 0x208
ret