Function at 0x14007afc0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x868
mov rax, qword [0x14016f898]
xor rax, rsp
mov qword [rsp + 0x840], rax
mov edi, dword [rsp + 0x8c8]
mov r15, r9
mov r12, qword [rsp + 0x8c0]
mov r14, rdx
mov dword [rsp + 0x30], edi
mov rsi, rcx
movsxd r13, r8d
test rcx, rcx
je 0x14007b04a
mov edx, 0x27
call sub.VCRUNTIME140.dll_strchr
test rax, rax
jne 0x14007b027
lea edx, [rax + 0x22]
mov rcx, rsi
call sub.VCRUNTIME140.dll_strchr
test rax, rax
je 0x14007b04a
mov dword [rsp + 0x28], edi
lea rcx, str.INVALID_TITLE_WITH_QUOTES
mov r9, r15
mov qword [rsp + 0x20], r12
mov r8d, r13d
mov rdx, r14
call fcn.14007afc0
jmp 0x14007b1fb
test r14, r14
je 0x14007b094
mov edx, 0x27
mov rcx, r14
call sub.VCRUNTIME140.dll_strchr
test rax, rax
jne 0x14007b071
lea edx, [rax + 0x22]
mov rcx, r14
call sub.VCRUNTIME140.dll_strchr
test rax, rax
je 0x14007b094
mov dword [rsp + 0x28], edi
lea rdx, str.INVALID_DEFAULT_PATH_WITH_QUOTES
mov r9, r15
mov qword [rsp + 0x20], r12
mov r8d, r13d
mov rcx, rsi
call fcn.14007afc0
jmp 0x14007b1fb
test r12, r12
je 0x14007b0e1
mov edx, 0x27
mov rcx, r12
call sub.VCRUNTIME140.dll_strchr
test rax, rax
jne 0x14007b0bb
lea edx, [rax + 0x22]
mov rcx, r12
call sub.VCRUNTIME140.dll_strchr
test rax, rax
je 0x14007b0e1
lea rax, str.INVALID_FILTER_DESCRIPTION_WITH_QUOTES
mov dword [rsp + 0x28], edi
mov r9, r15
mov qword [rsp + 0x20], rax
mov r8d, r13d
mov rdx, r14
mov rcx, rsi
call fcn.14007afc0
jmp 0x14007b1fb
mov qword [rsp + 0x860], rbx
mov qword [rsp + 0x858], rbp
test r13d, r13d
jle 0x14007b13f
xor ebx, ebx
nop dword [rax + rax]
mov rdi, qword [r15 + rbx*8]
test rdi, rdi
je 0x14007b133
mov edx, 0x27
mov rcx, rdi
call sub.VCRUNTIME140.dll_strchr
test rax, rax
jne 0x14007b21d
lea edx, [rax + 0x22]
mov rcx, rdi
call sub.VCRUNTIME140.dll_strchr
test rax, rax
jne 0x14007b21d
inc rbx
cmp rbx, r13
jl 0x14007b100
mov edi, dword [rsp + 0x30]
cmp dword [0x140173188], 0
je 0x14007b15c
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
test rax, rax
jne 0x14007b195
call fcn.1400784a0
test eax, eax
jne 0x14007b195
lea rcx, str.SSH_CLIENT
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14007b385
cmp dword [0x14017318c], 0
jne 0x14007b385
lea rcx, str.DISPLAY
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x14007b385
call fcn.1400784a0
test eax, eax
je 0x14007b255
test rsi, rsi
je 0x14007b245
lea rdx, str.tinyfd_query
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x14007b245
mov eax, dword [str.dialog]
mov dword [0x1401800c0], eax
movzx eax, word [0x140111504]
mov word [0x1401800c4], ax
movzx eax, byte [0x140111506]
mov byte [0x1401800c6], al
xor eax, eax
mov rbx, qword [rsp + 0x860]
mov rbp, qword [rsp + 0x858]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.1400f2a70
add rsp, 0x868
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov eax, dword [rsp + 0x30]
lea rcx, str.INVALID_FILTER_PATTERN_WITH_QUOTES
mov dword [rsp + 0x28], eax
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], 0
mov rdx, r14
call fcn.14007afc0
jmp 0x14007b1eb
mov rdx, r14
mov rcx, rsi
call fcn.140079200
jmp 0x14007b3d2
test rsi, rsi
je 0x14007b29d
lea rdx, str.tinyfd_query
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x14007b29d
movzx eax, word [0x140111510]
movsd xmm0, qword [str.basicinput]
mov word [0x1401800c8], ax
movzx eax, byte [0x140111512]
mov byte [0x1401800ca], al
movsd qword [0x1401800c0], xmm0
jmp 0x14007b1e9
movups xmm0, xmmword [str.Open_file_from]
mov edx, 0x400
lea rcx, [0x1401731a0]
movaps xmmword [rsp + 0x40], xmm0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__getcwd]
lea rcx, [rsp + 0x40]
mov r8, rax
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x14007b2c6
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x14007b2e0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.140079e30
mov rbx, rax
test rax, rax
je 0x14007b320
mov rdx, rax
lea rax, [rsp + 0x440]
sub rax, rdx
movzx ecx, byte [rdx]
mov byte [rax + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x14007b312
lea r8, [0x1400fb69c]
mov rcx, rsi
lea rdx, [rsp + 0x40]
call fcn.140079e30
test rax, rax
je 0x14007b351
lea rdx, [rsp + 0x40]
sub rdx, rax
movzx ecx, byte [rax]
mov byte [rdx + rax], cl
lea rax, [rax + 1]
test cl, cl
jne 0x14007b341
jmp 0x14007b356
mov byte [rsp + 0x40], 0
test rbx, rbx
je 0x14007b37e
lea rax, [rsp + 0x440]
sub rbx, rax
lea rcx, [rsp + 0x440]
nop
movzx eax, byte [rcx]
mov byte [rbx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x14007b370
lea rsi, [rsp + 0x40]
jmp 0x14007b3de
test rsi, rsi
je 0x14007b3b8
lea rdx, str.tinyfd_query
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x14007b3b8
movabs rax, 0x73776f646e6977
mov qword [0x1401800c0], rax
mov eax, 1
jmp 0x14007b1eb
mov dword [rsp + 0x28], edi
mov r9, r15
mov r8d, r13d
mov qword [rsp + 0x20], r12
mov rdx, r14
mov rcx, rsi
call fcn.140079660
mov rsi, rax
test rax, rax
je 0x14007b1e9
mov r14, 0xffffffffffffffff
mov rax, r14
nop dword [rax + rax]
inc rax
cmp byte [rsi + rax], 0
jne 0x14007b3f0
test rax, rax
je 0x14007b1e9
test edi, edi
je 0x14007b4e4
mov edx, 0x7c
mov rcx, rsi
call sub.VCRUNTIME140.dll_strchr
test rax, rax
je 0x14007b4e4
mov rdi, rsi
mov rax, r14
inc rax
cmp byte [rsi + rax], 0
jne 0x14007b426
test rax, rax
jne 0x14007b43d
xor esi, esi
mov eax, esi
jmp 0x14007b1eb
mov edx, 0x7c
mov rcx, rsi
mov rbp, rsi
call sub.VCRUNTIME140.dll_strchr
mov r15, rax
test rax, rax
je 0x14007b4a7
nop word [rax + rax]
mov rbx, r15
mov rdx, rbp
sub rbx, rbp
mov rcx, rdi
mov r8, rbx
call sub.VCRUNTIME140.dll_memmove
mov rcx, rdi
mov byte [rbx + rdi], 0
call fcn.140078670
test eax, eax
je 0x14007b48e
mov byte [rbx + rdi], 0x7c
inc rdi
add rdi, rbx
lea rbp, [r15 + 1]
mov edx, 0x7c
mov rcx, rbp
call sub.VCRUNTIME140.dll_strchr
mov r15, rax
test rax, rax
jne 0x14007b460
mov rcx, rbp
call fcn.140078670
test eax, eax
je 0x14007b4d8
inc r14
cmp byte [r14 + rbp], 0
jne 0x14007b4b3
mov r8, r14
mov rdx, rbp
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov rax, rsi
mov byte [r14 + rdi], 0
jmp 0x14007b1eb
mov byte [rdi - 1], 0
mov rax, rsi
jmp 0x14007b1eb
mov rcx, rsi
call fcn.140078670
test eax, eax
je 0x14007b1e9
mov rax, rsi
jmp 0x14007b1eb