Function at 0x1400014a0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x2a0
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x140007008]
xor rax, rsp
mov qword [rsp + 0x298], rax
mov rax, qword [0x140007090]
test rax, rax
je 0x1400016b9
lea rdx, str.FDICreate
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call rbx
mov qword [0x140007078], rax
mov rcx, qword [0x140007090]
lea rdx, str.FDIDestroy
call rbx
mov qword [0x140007088], rax
mov rcx, qword [0x140007090]
lea rdx, str.FDICopy
call rbx
mov qword [0x140007080], rax
xor ebx, ebx
cmp qword [0x140007078], 0
je 0x140001778
cmp qword [0x140007088], 0
je 0x140001778
test rax, rax
je 0x140001778
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cdqe
lea rbx, [rdi + rax*2]
test eax, eax
jle 0x14000156b
cmp word [rbx], 0x5c
je 0x14000156b
add rbx, 0xfffffffffffffffe
cmp rbx, rdi
ja 0x14000155c
cmp rbx, rdi
je 0x140001743
add rbx, 2
mov rcx, rbx
mov edx, 0xffffffff
call fcn.14000179d
mov r14, rax
mov qword [rsp + 0x68], rax
sub rbx, rdi
shr rbx, 1
mov rcx, rdi
mov edx, ebx
call fcn.14000179d
mov qword [rsp + 0x60], rax
xor ebx, ebx
test r14, r14
je 0x140001764
mov rdi, rax
test rax, rax
je 0x140001764
lea rcx, [rsp + 0x50]
mov dword [rcx + 8], 0
mov qword [rcx], 0
mov rax, qword [0x140007078]
mov qword [rsp + 0x40], rcx
lea rcx, [0x140001850]
mov qword [rsp + 0x30], rcx
lea rcx, [0x140001860]
mov qword [rsp + 0x28], rcx
lea rcx, [0x140001880]
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x38], 0xffffffff
lea rcx, [0x140001aa0]
lea rdx, [0x140001a70]
lea r8, [0x140001940]
lea r9, [0x1400018e0]
call qword [0x140009008]
test rax, rax
je 0x140001747
mov rbx, rax
lea r15, [rsp + 0x78]
mov qword [r15 - 8], rsi
mov rcx, r15
call fcn.140001ecc
mov byte [r15 + 0x218], 0
mov rax, qword [0x140007080]
lea rsi, [rsp + 0x70]
mov qword [rsp + 0x30], rsi
lea rcx, [0x140001ad0]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], 0
mov rcx, rbx
mov rdx, r14
mov r8, rdi
xor r9d, r9d
call qword [0x140009008]
mov rax, qword [0x140007088]
mov rcx, rbx
call qword [0x140009008]
cmp byte [rsi + 0x220], 0
setne bl
mov rcx, r15
je 0x14000174b
call fcn.1400020b2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
jmp 0x14000175c
xor r14d, r14d
lea rbx, [rsp + 0x70]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call fcn.140001030
lea r15, str._WINDIR__system32cabinet.dll
mov r12, qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov r13, qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov word [rsp + 0x70], 0
mov rcx, qword [r14 + r15]
mov rdx, rbx
mov r8d, 0x104
call r12
dec eax
cmp eax, 0x103
ja 0x14000171d
mov rcx, rbx
xor edx, edx
mov r8d, 8
call r13
mov qword [0x140007090], rax
jmp 0x140001724
mov rax, qword [0x140007090]
test rax, rax
jne 0x1400014da
add r14, 8
cmp r14, 0x18
jne 0x1400016e6
mov rax, qword [0x140007080]
jmp 0x140001522
xor ebx, ebx
jmp 0x140001778
xor ebx, ebx
jmp 0x140001764
call fcn.140001fae
test al, al
je 0x14000175c
mov rcx, r15
call fcn.140001fba
mov rcx, r15
call fcn.140001ee8
lea rcx, [rsp + 0x60]
call fcn.140001bc6
lea rcx, [rsp + 0x68]
call fcn.140001bc6
mov rcx, qword [rsp + 0x298]
xor rcx, rsp
call fcn.1400049e0
mov eax, ebx
add rsp, 0x2a0
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret