Function at 0x1406b4793
Capabilities:
Query environment variable

Disassembly:
push rax
pushf
mov eax, 0xfbc044a6
pushf
not eax
add eax, 0xe5de8b47
xor eax, 0xc97f90a7
rol eax, 0x2b
popf
pushf
not eax
add eax, 0xc7a6b2da
xor eax, 0xf2aa124d
rol eax, 0x9f
popf
pushf
not eax
add eax, 0xc540b662
xor eax, 0xd569d6b9
rol eax, 0xea
popf
pushf
not eax
add eax, 0xd137d092
xor eax, 0xe3dc88bc
rol eax, 0x92
popf
cmp eax, 4
jne 0x1406b47f6
popf
pop rax
jmp 0x1406b4aad
cmp eax, 0
jne 0x1406b4805
popf
pop rax
jmp 0x1406b48b9
cmp eax, 3
jne 0x1406b4814
popf
pop rax
jmp 0x1406b4a63
cmp eax, 1
jne 0x1406b4823
popf
pop rax
jmp 0x1406b495c
cmp eax, 0xd
jne 0x1406b4832
popf
pop rax
jmp 0x1406b4eaa
cmp eax, 7
jne 0x1406b4841
popf
pop rax
jmp 0x1406b4ca0
cmp eax, 6
jne 0x1406b4850
popf
pop rax
jmp 0x1406b4bf1
cmp eax, 0xb
jne 0x1406b485f
popf
pop rax
jmp 0x1406b4e1a
cmp eax, 0xc
jne 0x1406b486e
popf
pop rax
jmp 0x1406b4e5a
cmp eax, 8
jne 0x1406b487d
popf
pop rax
jmp 0x1406b4d08
cmp eax, 5
jne 0x1406b488c
popf
pop rax
jmp 0x1406b4b43
cmp eax, 2
jne 0x1406b489b
popf
pop rax
jmp 0x1406b49bc
cmp eax, 9
jne 0x1406b48aa
popf
pop rax
jmp 0x1406b4da1
cmp eax, 0xa
jne 0x1406b48b9
popf
pop rax
jmp 0x1406b4df3
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
jmp 0x1406b48d3
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1406b4916
push rax
pushf
mov eax, 0x658d5d4d
pushf
not eax
add eax, 0xf5839da9
xor eax, 0x9e778095
rol eax, 0xfc
popf
pushf
not eax
add eax, 0x938c7df8
xor eax, 0xb27461fb
rol eax, 0xbc
popf
jmp 0x1406b47e7
push rax
pushf
mov eax, 0xcf6bf580
pushf
not eax
add eax, 0x86dfbb17
xor eax, 0xf2c48a73
rol eax, 0xe4
popf
pushf
not eax
add eax, 0xc0eefc31
xor eax, 0xd95af150
rol eax, 0xcd
popf
pushf
not eax
add eax, 0xeecd80fd
xor eax, 0x8d3beb78
rol eax, 0x98
popf
jmp 0x1406b47e7
xor eax, eax
jmp 0x1406b4eb7
mov rbp, rbx
cmp word [rax], si
je 0x1406b4a0a
push rax
pushf
mov eax, 0x3e3cb101
pushf
not eax
add eax, 0xa71ed53e
xor eax, 0xc68b5477
rol eax, 0xd1
popf
pushf
not eax
add eax, 0xf2f8ab82
xor eax, 0xc4ee2f4c
rol eax, 0xaa
popf
pushf
not eax
add eax, 0xbdb91428
xor eax, 0x802984cd
rol eax, 0xd
popf
jmp 0x1406b47e7
push rax
pushf
mov eax, 0xccbed20f
pushf
not eax
add eax, 0xef380b56
xor eax, 0xd856d243
rol eax, 0xf7
popf
pushf
not eax
add eax, 0x92f494b9
xor eax, 0x80558c33
rol eax, 0x56
popf
pushf
not eax
add eax, 0xfdcdb418
xor eax, 0xc4768962
rol eax, 0xa3
popf
pushf
not eax
add eax, 0xdb26f35d
xor eax, 0xac2ce154
rol eax, 0xbb
popf
jmp 0x1406b47e7
or rax, 0xffffffffffffffff
push rax
pushf
mov eax, 0x26f157b7
pushf
not eax
add eax, 0xa4ef970e
xor eax, 0x8cfed7a9
rol eax, 0x19
popf
pushf
not eax
add eax, 0xe2f4a210
xor eax, 0xf115adbb
rol eax, 0x24
popf
pushf
not eax
add eax, 0xbf2a41ec
xor eax, 0x9cb9699a
rol eax, 0x69
popf
jmp 0x1406b47e7
inc rax
cmp word [rbp + rax*2], si
jne 0x1406b4afd
push rax
pushf
mov eax, 0xbeccb228
pushf
not eax
add eax, 0x9abc548f
xor eax, 0x8c1992b1
rol eax, 0x7d
popf
pushf
not eax
add eax, 0xfcf48614
xor eax, 0xe6e11ba9
rol eax, 0xee
popf
pushf
not eax
add eax, 0xdfa5d9e7
xor eax, 0xb6919c71
rol eax, 0x9c
popf
jmp 0x1406b47e7
push rax
pushf
mov eax, 0x9309ffcb
pushf
not eax
add eax, 0xf4c8cd65
xor eax, 0xebc4b9c1
rol eax, 0xf3
popf
pushf
not eax
add eax, 0xac1e80c1
xor eax, 0xeefb135f
rol eax, 0xc2
popf
pushf
not eax
add eax, 0x903dacc3
xor eax, 0xf1b8aff7
rol eax, 0x39
popf
jmp 0x1406b47e7
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1406b4bab
push rax
pushf
mov eax, 0x724c8ae2
pushf
not eax
add eax, 0x856b2e6b
xor eax, 0x902887c8
rol eax, 0xb
popf
pushf
not eax
add eax, 0x83536f38
xor eax, 0x9b31e6dd
rol eax, 0x98
popf
pushf
not eax
add eax, 0xb2fcac16
xor eax, 0xe040b920
rol eax, 0x67
popf
pushf
not eax
add eax, 0xcf09aeb9
xor eax, 0xcd805ab1
rol eax, 6
popf
jmp 0x1406b47e7
push rax
pushf
mov eax, 0xa9b309c
pushf
not eax
add eax, 0x8e5c8cf7
xor eax, 0x963a0d4f
rol eax, 4
popf
pushf
not eax
add eax, 0x9a801395
xor eax, 0xaef00c95
rol eax, 0x47
popf
pushf
not eax
add eax, 0xc55986d2
xor eax, 0xa7d27b87
rol eax, 0xf3
popf
jmp 0x1406b47e7
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1406d5b59
movsxd r14, eax
mov rcx, r14
test eax, eax
jne 0x1406b4c6d
push rax
pushf
mov eax, 0xdeb02be7
pushf
not eax
add eax, 0xb84e65e8
xor eax, 0xe4882c37
rol eax, 0x8d
popf
pushf
not eax
add eax, 0xc5f5a485
xor eax, 0xba587cdd
rol eax, 0xd0
popf
pushf
not eax
add eax, 0x8a6b3c44
xor eax, 0xca2b822d
rol eax, 0x7b
popf
jmp 0x1406b47e7
push rax
pushf
mov eax, 0x9e95b7ad
pushf
not eax
add eax, 0xfd541678
xor eax, 0xce7e9cfb
rol eax, 0x25
popf
pushf
not eax
add eax, 0xe4f50142
xor eax, 0xccdcba0f
rol eax, 0x5b
popf
jmp 0x1406b47e7
mov rcx, rbx
jmp 0x1406b4ca4
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1406b495c
call fcn.14068d7b5
mov rdi, rax
test rax, rax
jne 0x1406b4d48
push rax
pushf
mov eax, 0xe5514920
pushf
not eax
add eax, 0xd925b703
xor eax, 0xa6a27d93
rol eax, 0xd1
popf
pushf
not eax
add eax, 0xa97e2f59
xor eax, 0x889b84fc
rol eax, 0xfc
popf
jmp 0x1406b47e7
push rax
pushf
mov eax, 0x818581ae
pushf
not eax
add eax, 0x9f9ef90c
xor eax, 0xf4a33187
rol eax, 0xa0
popf
pushf
not eax
add eax, 0xa85a8567
xor eax, 0xc5bc28d3
rol eax, 0xe2
popf
pushf
not eax
add eax, 0x9da90348
xor eax, 0xe1f88121
rol eax, 0xcc
popf
pushf
not eax
add eax, 0xbcfbe071
xor eax, 0xba6d3ea4
rol eax, 0xd7
popf
jmp 0x1406b47e7
xor ecx, ecx
call fcn.1406d037b
jmp 0x1406b4ca0
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1406d5b59
test eax, eax
jne 0x1406b4e5a
mov rcx, rdi
call fcn.1406d037b
jmp 0x1406b4eaa
xor ecx, ecx
call fcn.1406d037b
mov rsi, rdi
push rax
pushf
mov eax, 0x578401bb
pushf
not eax
add eax, 0xd43e9e1b
xor eax, 0xb004a5cb
rol eax, 0xb0
popf
pushf
not eax
add eax, 0xcd13083e
xor eax, 0xd6f6c25c
rol eax, 0x93
popf
pushf
not eax
add eax, 0xb35eb2f8
xor eax, 0xaa4486b3
rol eax, 0x82
popf
jmp 0x1406b47e7
mov rcx, rbx
jmp 0x1406b4eae
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret