Function at 0x14001f738
Capabilities:
Set environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1d8]
sub rsp, 0x2b0
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov r12, rcx
mov qword [rsp + 0x40], rcx
xor edx, edx
mov esi, edx
mov dword [rsp + 0x30], edx
movaps xmm0, xmmword [str.Reloading_environment_variables_from_system_registry]
movaps xmmword [rbp + 0x130], xmm0
movaps xmm1, xmmword [0x14017c610]
movaps xmmword [rbp + 0x140], xmm1
movaps xmm0, xmmword [0x14017c620]
movaps xmmword [rbp + 0x150], xmm0
movaps xmm1, xmmword [0x14017c630]
movaps xmmword [rbp + 0x160], xmm1
movaps xmm0, xmmword [0x14017c640]
movaps xmmword [rbp + 0x170], xmm0
movaps xmm1, xmmword [0x14017c650]
movaps xmmword [rbp + 0x180], xmm1
movsd xmm0, qword [0x14017c660]
movsd qword [rbp + 0x190], xmm0
movzx eax, word [0x14017c668]
mov word [rbp + 0x198], ax
test rcx, rcx
je 0x14001f819
mov rcx, qword [rcx + 0x3e70]
test rcx, rcx
je 0x14001f819
mov byte [rsp + 0x20], 1
xor r9d, r9d
mov r8b, 1
lea rdx, [rbp + 0x130]
call fcn.14011c0a8
lea rcx, [rsp + 0x48]
call fcn.14000c66c
nop
mov r13, qword [rsp + 0x48]
mov rcx, r13
call fcn.1400e87d0
mov r15, qword [r12 + 0x7c50]
mov qword [rsp + 0x38], r15
mov rdi, qword [r15 + 8]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14001f9c4
xor esi, esi
lea r14, [rbx + 0x10]
mov rcx, r14
cmp qword [r14 + 0x18], 8
jb 0x14001f861
mov rcx, qword [r14]
mov rdx, qword [r14 + 0x10]
call fcn.14000c3f8
mov r9, rax
mov r8, r14
lea rdx, [rsp + 0x70]
mov rcx, r13
call fcn.14000c2f4
cmp qword [rax + 8], rsi
jne 0x14001f9af
lea r15, [r14 + 0x28]
mov r8, r15
lea rdx, str.__Erased:__
lea rcx, [rbp + 0x30]
call fcn.14000bda4
nop
lea r8, str.___old_value:__
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.14000bd40
nop
lea r8, [r14 + 0x48]
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.14000bce8
nop
lea r8, [0x140175e48]
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.14000bd40
nop
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x14001f8f3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
call fcn.14000c18c
mov qword [rbp], rsi
mov r14d, 7
mov qword [rbp + 8], r14
mov word [rbp - 0x10], si
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x14001f920
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
call fcn.14000c18c
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], r14
mov word [rbp + 0x10], si
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x14001f947
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
call fcn.14000c18c
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], r14
mov word [rbp + 0x30], si
lea rdx, [rbp + 0x50]
cmp qword [rbp + 0x68], 8
cmovae rdx, qword [rbp + 0x50]
mov rcx, qword [r12 + 0x3e70]
test rcx, rcx
je 0x14001f97e
mov byte [rsp + 0x20], 1
xor r9d, r9d
mov r8b, 1
call fcn.14011c0a8
cmp qword [r15 + 0x18], 8
jb 0x14001f988
mov r15, qword [r15]
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 8
jb 0x14001f9af
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
call fcn.14000c18c
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14001f850
mov esi, dword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
mov rdi, qword [r13 + 8]
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14001fef5
lea r12, [rbx + 0x10]
mov rcx, r12
cmp qword [r12 + 0x18], 8
jb 0x14001f9e7
mov rcx, qword [r12]
mov rdx, qword [r12 + 0x10]
call fcn.14000c3f8
mov r9, rax
mov r8, r12
lea rdx, [rbp - 0x80]
mov rcx, r15
call fcn.14000c2f4
mov r14, qword [rax + 8]
test r14, r14
je 0x14001fa36
mov r15, qword [r15 + 8]
mov rax, r14
cmp r14, r15
je 0x14001fa40
lea r13, [r14 + 0x58]
lea rdx, [r12 + 0x48]
mov rcx, r13
call fcn.14000bc9c
test al, al
jne 0x14001fede
mov rax, r14
jmp 0x14001fa44
mov rax, qword [r15 + 8]
mov r15, rax
mov r14, rax
lea r13, [r14 + 0x58]
cmp rax, r15
jne 0x14001fa7a
xor r13d, r13d
mov qword [rbp - 0x40], r13
lea r14d, [r13 + 7]
mov qword [rbp - 0x38], r14
mov word [rbp - 0x50], r13w
lea r8d, [r13 + 6]
lea rdx, str.Absent
lea rcx, [rbp - 0x50]
call fcn.140025f1c
lea rax, [rbp - 0x50]
or esi, 1
jmp 0x14001fab5
mov r8, r13
lea rdx, [0x140175e48]
lea rcx, [rbp + 0x90]
call fcn.14000bda4
nop
or esi, 2
mov dword [rsp + 0x30], esi
lea r8, [0x140175e48]
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.14000bd40
or esi, 4
xor r13d, r13d
lea r14d, [r13 + 7]
mov dword [rsp + 0x30], esi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], r14
mov word [rax], r13w
test sil, 4
je 0x14001fb12
and esi, 0xfffffffb
mov dword [rsp + 0x30], esi
mov rdx, qword [rbp + 0x88]
cmp rdx, 8
jb 0x14001faff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
call fcn.14000c18c
mov qword [rbp + 0x80], r13
mov qword [rbp + 0x88], r14
mov word [rbp + 0x70], r13w
test sil, 2
je 0x14001fb56
and esi, 0xfffffffd
mov dword [rsp + 0x30], esi
mov rdx, qword [rbp + 0xa8]
cmp rdx, 8
jb 0x14001fb40
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x90]
call fcn.14000c18c
mov qword [rbp + 0xa0], r13
mov qword [rbp + 0xa8], r14
mov word [rbp + 0x90], r13w
test sil, 1
je 0x14001fbb0
and esi, 0xfffffffe
mov dword [rsp + 0x30], esi
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x14001fba3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001fb9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ffa5
call fcn.14012bc14
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], r14
mov word [rbp - 0x50], r13w
lea r14, [r12 + 0x28]
mov r8, r14
lea rdx, str.__Changed:__
lea rcx, [rbp + 0x110]
call fcn.14000bda4
nop
lea r8, str.___new_value:__
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.14000bd40
nop
lea r15, [r12 + 0x48]
mov r8, r15
mov rdx, rax
lea rcx, [rbp + 0xd0]
call fcn.14000bce8
nop
lea r8, str.___old_value:
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.14000bd40
nop
lea r8, [rbp - 0x30]
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.14000bce8
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 8
jb 0x14001fc44
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb0]
call fcn.14000c18c
mov qword [rbp + 0xc0], r13
mov qword [rbp + 0xc8], 7
mov word [rbp + 0xb0], r13w
mov rdx, qword [rbp + 0xe8]
cmp rdx, 8
jb 0x14001fc7f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd0]
call fcn.14000c18c
mov qword [rbp + 0xe0], r13
mov qword [rbp + 0xe8], 7
mov word [rbp + 0xd0], r13w
mov rdx, qword [rbp + 0x108]
cmp rdx, 8
jb 0x14001fcba
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf0]
call fcn.14000c18c
mov qword [rbp + 0x100], r13
mov qword [rbp + 0x108], 7
mov word [rbp + 0xf0], r13w
mov rdx, qword [rbp + 0x128]
cmp rdx, 8
jb 0x14001fcf5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x110]
call fcn.14000c18c
mov qword [rbp + 0x120], r13
mov qword [rbp + 0x128], 7
mov word [rbp + 0x110], r13w
lea rdx, [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae rdx, qword [rbp - 0x70]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x3e70]
test rcx, rcx
je 0x14001fd3e
mov byte [rsp + 0x20], 1
xor r9d, r9d
mov r8b, 1
call fcn.14011c0a8
cmp byte [r12 + 0x20], r13b
je 0x14001fe2c
mov rcx, r15
cmp qword [r15 + 0x18], 8
jb 0x14001fd56
mov rcx, qword [r15]
call fcn.14011ad0c
mov qword [rsp + 0x68], rax
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x58]
call fcn.140114b38
nop
lea rcx, [rsp + 0x58]
call fcn.14011513c
test al, al
jne 0x14001fe22
cmp qword [r14 + 0x18], 8
jb 0x14001fd8c
mov r14, qword [r14]
lea rcx, [rsp + 0x58]
call fcn.140054ee8
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
nop
lea rcx, [rsp + 0x58]
call fcn.140114ca4
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14001fdc9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
call fcn.14000c18c
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r13w
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14001fede
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001fed9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ff9f
jmp 0x14001fed9
lea rcx, [rsp + 0x58]
call fcn.140114ca4
cmp qword [r15 + 0x18], 8
jb 0x14001fe36
mov r15, qword [r15]
cmp qword [r14 + 0x18], 8
jb 0x14001fe40
mov r14, qword [r14]
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x14001fe8d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001fe88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ffab
call fcn.14012bc14
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r13w
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x14001fede
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001fed9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001ffb1
call fcn.14012bc14
mov rbx, qword [rbx]
cmp rbx, rdi
je 0x14001fef0
mov r15, qword [rsp + 0x38]
jmp 0x14001f9d4
mov r12, qword [rsp + 0x40]
lea rbx, [r12 + 0x7c60]
mov rcx, rbx
call fcn.14012a88c
test eax, eax
jne 0x14001ffb7
lea rdx, [rsp + 0x48]
lea rcx, [r12 + 0x7c50]
call fcn.14000e634
nop
mov rcx, rbx
call fcn.14012a8b0
test eax, eax
jne 0x14001ff97
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x14001ff67
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rcx + 8], eax
add eax, edi
jne 0x14001ff67
mov rbx, qword [rsp + 0x50]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, edi
lock xadd dword [rbx + 0xc], eax
add eax, edi
jne 0x14001ff67
mov rcx, qword [rsp + 0x50]
mov rax, qword [rcx]
call qword [rax + reloc.COMCTL32.dll_CreateMappedBitmap]
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.14012bda0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, eax
call fcn.14012aeec
nop
call fcn.140135b30
nop
call fcn.140135b30
int3
call fcn.140135b30
nop
call fcn.140135b30
int3
mov ecx, eax
call fcn.14012aeec
int3