Function at 0x1401d8c10
Capabilities:
Query environment variable

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
push rdi
push r12
push r13
push r15
sub rsp, 0x30
mov r12d, r8d
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x1401d8c35
mov r13, qword [rcx + 0x18]
jmp 0x1401d8c38
xor r13d, r13d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ecx, dword [rbx + 4]
mov r15, rax
sub ecx, dword [rbx]
mov qword [rsp + 0x60], rax
cmp ecx, 1
jge 0x1401d8c65
mov edx, 1
mov rcx, rbx
call fcn.1400326e0
test eax, eax
je 0x1401d8feb
mov qword [rsp + 0x68], rbp
mov rbp, 0xffffffffffffffff
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r14
lea r14, [0x1403b051f]
test rdi, rdi
je 0x1401d8e08
mov rax, qword [rdi + 0x38]
test r13, r13
je 0x1401d8e08
lea r12, [rax + 8]
lea rax, [0x14046a270]
mov rdi, qword [r12]
test rdi, rdi
je 0x1401d8df1
cmp rdi, rax
je 0x1401d8df1
xor edx, edx
mov rcx, rdi
call fcn.140321ad0
lea rcx, [rdi - 0x11]
xor r8d, r8d
lea rdx, [0x1404651c0]
mov r15, rax
call fcn.1402c2ec0
test rax, rax
mov rcx, r14
cmovne rcx, rax
xor edx, edx
call fcn.140321ad0
dec r13
mov r14, rax
test r15, r15
je 0x1401d8dcd
test rax, rax
je 0x1401d8dbc
mov rdi, rbp
inc rdi
cmp word [r15 + rdi*2], 0
jne 0x1401d8d05
mov rsi, rbp
inc rsi
cmp word [rax + rsi*2], 0
jne 0x1401d8d13
mov eax, dword [rbx + 4]
lea edx, [rsi + 2]
mov ecx, dword [rbx]
add edx, edi
sub eax, ecx
cmp eax, edx
jge 0x1401d8d3f
mov rcx, rbx
call fcn.1400326e0
test eax, eax
je 0x1401d8de3
mov ecx, dword [rbx]
xor r9d, r9d
mov r8d, r9d
test rdi, rdi
je 0x1401d8d6e
nop word [rax + rax]
movzx eax, word [r15 + r8*2]
inc r8
movsxd rdx, dword [rbx]
mov rcx, qword [rbx + 0x10]
mov word [rcx + rdx*2], ax
mov ecx, dword [rbx]
inc ecx
mov dword [rbx], ecx
cmp r8, rdi
jb 0x1401d8d50
mov rax, qword [rbx + 0x10]
mov r8, r9
movsxd rcx, ecx
mov word [rax + rcx*2], 0x3d
mov eax, dword [rbx]
inc eax
mov dword [rbx], eax
test rsi, rsi
je 0x1401d8dae
nop dword [rax]
mov rcx, qword [rbx + 0x10]
movsxd rdx, eax
movzx eax, word [r14 + r8*2]
inc r8
mov word [rcx + rdx*2], ax
mov eax, dword [rbx]
inc eax
mov dword [rbx], eax
cmp r8, rsi
jb 0x1401d8d90
movsxd rcx, eax
mov rax, qword [rbx + 0x10]
mov word [rax + rcx*2], r9w
inc dword [rbx]
cmp dword [0x14045b3f8], 0
jne 0x1401d8dcd
mov rcx, r15
call fcn.140005660
test r14, r14
je 0x1401d8de3
cmp dword [0x14045b3f8], 0
jne 0x1401d8de3
mov rcx, r14
call fcn.140005660
lea rax, [0x14046a270]
lea r14, [0x1403b051f]
add r12, 0x10
test r13, r13
jne 0x1401d8ca3
mov r15, qword [rsp + 0x60]
mov r12d, dword [rsp + 0x70]
test r15, r15
je 0x1401d8e89
mov eax, dword [rbx + 4]
mov rsi, r15
sub eax, dword [rbx]
cmp eax, 1
jge 0x1401d8e30
mov edx, 1
mov rcx, rbx
call fcn.1400326e0
test eax, eax
je 0x1401d8fdc
nop
cmp word [rsi], 0
jne 0x1401d8e3d
cmp word [rsi + 2], 0
je 0x1401d8e6f
mov eax, dword [rbx + 4]
sub eax, dword [rbx]
cmp eax, 1
jge 0x1401d8e59
mov edx, 1
mov rcx, rbx
call fcn.1400326e0
cmp eax, 1
jne 0x1401d8e69
movsxd rdx, dword [rbx]
movzx eax, word [rsi]
mov rcx, qword [rbx + 0x10]
mov word [rcx + rdx*2], ax
inc dword [rbx]
add rsi, 2
jmp 0x1401d8e30
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
movsxd rcx, dword [rbx]
xor r15d, r15d
mov rax, qword [rbx + 0x10]
mov word [rax + rcx*2], r15w
inc dword [rbx]
xor r8d, r8d
lea rdx, [0x1404651c0]
lea rcx, [0x14043d1a8]
call fcn.1402c2ec0
test rax, rax
mov rsi, r14
mov rdi, rbp
cmovne rsi, rax
nop dword [rax]
inc rdi
cmp byte [rsi + rdi], 0
jne 0x1401d8eb0
xor r8d, r8d
lea rdx, [0x1404651c0]
lea rcx, [0x14043cce8]
call fcn.1402c2ec0
test rax, rax
cmovne r14, rax
inc rbp
cmp byte [r14 + rbp], 0
jne 0x1401d8ed6
mov eax, dword [rbx + 4]
lea edx, [rbp + 0x1e]
sub eax, dword [rbx]
add edx, edi
cmp eax, edx
jge 0x1401d8eff
mov rcx, rbx
call fcn.1400326e0
cmp eax, 1
jne 0x1401d8fdc
mov r8, r15
lea r9, [0x140000000]
nop dword [rax]
movsx edx, byte [r8 + r9 + 0x3c9290]
inc r8
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 0x10]
mov word [rax + rcx*2], dx
mov eax, dword [rbx]
inc eax
mov dword [rbx], eax
cmp r8, 0xf
jb 0x1401d8f10
mov r8, r15
test rdi, rdi
je 0x1401d8f5e
nop dword [rax + rax]
movzx edx, byte [r8 + rsi]
inc r8
movsxd rcx, eax
mov rax, qword [rbx + 0x10]
mov word [rax + rcx*2], dx
mov eax, dword [rbx]
inc eax
mov dword [rbx], eax
cmp r8, rdi
jb 0x1401d8f40
movsxd rcx, eax
mov rax, qword [rbx + 0x10]
mov word [rax + rcx*2], r15w
mov eax, dword [rbx]
inc eax
mov dword [rbx], eax
test r12d, r12d
je 0x1401d8fdc
mov r8, r15
nop dword [rax + rax]
movsx edx, byte [r8 + r9 + 0x3c92a0]
inc r8
movsxd rcx, eax
mov rax, qword [rbx + 0x10]
mov word [rax + rcx*2], dx
mov eax, dword [rbx]
inc eax
mov dword [rbx], eax
cmp r8, 0xd
jb 0x1401d8f80
mov r8, r15
test rbp, rbp
je 0x1401d8fce
nop dword [rax + rax]
movzx edx, byte [r8 + r14]
inc r8
movsxd rcx, eax
mov rax, qword [rbx + 0x10]
mov word [rax + rcx*2], dx
mov eax, dword [rbx]
inc eax
mov dword [rbx], eax
cmp r8, rbp
jb 0x1401d8fb0
movsxd rcx, eax
mov rax, qword [rbx + 0x10]
mov word [rax + rcx*2], r15w
inc dword [rbx]
mov rsi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x68]
mov r14, qword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r13
pop r12
pop rdi
pop rbx
ret