Function at 0x14006ca30
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xe8
mov qword [rsp + 0x88], 0xfffffffffffffffe
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r14d, r9d
mov dword [rsp + 0x24], r9d
mov r13, r8
mov qword [rsp + 0x48], r8
mov rsi, rdx
mov r15, rcx
mov qword [rsp + 0x50], rcx
mov rbp, qword [rsp + 0x158]
mov qword [rsp + 0x78], rbp
test r9d, r9d
sets cl
mov byte [rsp + 0x28], cl
movzx eax, byte [r15 + 0xf]
and al, 0x11
mov byte [rsp + 0x20], al
test cl, cl
jne 0x14006cab3
movzx r12d, byte [rsp + 0x150]
test r12b, r12b
jns 0x14006cac1
jmp 0x14006cabb
mov r12b, byte [rsp + 0x150]
xor al, al
mov byte [rsp + 0x20], al
and r12b, 1
mov byte [rsp + 0x150], r12b
xor al, al
mov dword [rsp + 0x58], eax
mov byte [rsp + 0x38], al
test rbp, rbp
je 0x14006cae4
movzx eax, byte [rbp]
mov byte [rsp + 0x38], al
mov eax, 0x50
mov dword [rsp + 0x5c], eax
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.140063580
nop
cmp r14d, 0x400
jge 0x14006cb19
mov r14d, 0x400
mov dword [rsp + 0x24], r14d
mov edx, r14d
mov rcx, r13
call fcn.1400635c0
mov r9, qword [r13]
mov qword [rsp + 0x30], r9
movsxd rax, r14d
lea r8, [r9 + rax*2 - 2]
mov qword [rsp + 0x40], r8
lea r10, [r8 - 0x7e4]
mov rdi, r9
xor ebp, ebp
lea r11d, [rbp + 0x25]
mov rbx, qword [rsp + 0x68]
jmp 0x14006cbcc
mov r14d, dword [rsp + 0x24]
mov r15, qword [rsp + 0x50]
mov r13, qword [rsp + 0x48]
mov r12b, byte [rsp + 0x150]
xor ebp, ebp
jmp 0x14006cbcc
mov r13, qword [rsp + 0x48]
jmp 0x14006cbcc
mov r13, qword [rsp + 0x48]
jmp 0x14006cbcc
mov r13, qword [rsp + 0x48]
jmp 0x14006cbcc
mov r13, qword [rsp + 0x48]
mov r12b, byte [rsp + 0x150]
jmp 0x14006cbcc
mov r13, qword [rsp + 0x48]
mov r12b, byte [rsp + 0x150]
jmp 0x14006cbcc
mov r12b, byte [rsp + 0x150]
xor ebp, ebp
jmp 0x14006cbcc
mov r12b, byte [rsp + 0x150]
xor ebp, ebp
jmp 0x14006cbcc
mov r12b, byte [rsp + 0x150]
xor ebp, ebp
jmp 0x14006cbcc
xor ebp, ebp
jmp 0x14006cbcc
xor ebp, ebp
jmp 0x14006cbcc
xor ebp, ebp
cmp rdi, r8
jae 0x14006d656
cmp word [rsi], 0
je 0x14006d656
mov rax, rdi
sub rax, r10
sar rax, 1
test eax, eax
js 0x14006cc33
sub rdi, r9
sar rdi, 1
add r14d, 0x400
mov dword [rsp + 0x24], r14d
mov edx, r14d
mov rcx, r13
call fcn.1400635c0
mov r9, qword [r13]
mov qword [rsp + 0x30], r9
movsxd rax, r14d
lea r8, [r9 + rax*2 - 2]
mov qword [rsp + 0x40], r8
lea r10, [r8 - 0x7e4]
movsxd rax, edi
lea rdi, [r9 + rax*2]
mov r11d, 0x25
cmp word [rsi], 0x25
je 0x14006cc67
mov ecx, 0x3dd
nop
movzx eax, word [rsi]
test ax, ax
je 0x14006cbcc
cmp r11w, ax
je 0x14006cbcc
mov word [rdi], ax
add rdi, 2
add rsi, 2
sub ecx, 1
jns 0x14006cc40
jmp 0x14006cbcc
mov rbp, rsi
mov qword [rsp + 0x80], rsi
test r12b, r12b
je 0x14006cfe4
lea rdx, [rsi + 2]
movzx ecx, word [rdx]
cmp cx, 0x25
jne 0x14006cc9b
mov word [rdi], r11w
add rdi, 2
add rsi, 4
xor ebp, ebp
jmp 0x14006cbcc
cmp cx, 0x23
jne 0x14006cce8
add rsi, 4
mov rcx, qword [r15 + 0x50]
test rcx, rcx
mov ebp, 0
je 0x14006cbcc
movsxd rax, dword [r15 + 0x4c]
mov rcx, qword [rcx + rax*8 + 0x10]
movzx eax, word [rcx]
test ax, ax
je 0x14006cbcc
nop dword [rax]
mov word [rdi], ax
add rdi, 2
add rcx, 2
mov ax, word [rcx]
test ax, ax
jne 0x14006ccd0
jmp 0x14006cbcc
cmp cx, 0x2a
jne 0x14006cdba
add rsi, 4
mov rcx, qword [r15 + 0x50]
test rcx, rcx
mov ebp, 0
je 0x14006cbcc
movsxd rax, dword [r15 + 0x4c]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, eax
add eax, 2
movsxd rcx, eax
add rcx, rcx
mov r8, qword [rsp + 0x40]
sub rcx, r8
add rcx, rdi
sar rcx, 1
test ecx, ecx
js 0x14006cd76
sub rdi, qword [rsp + 0x30]
sar rdi, 1
lea r14d, [r14 + rbp + 0x10]
mov dword [rsp + 0x24], r14d
mov edx, r14d
mov rcx, r13
call fcn.1400635c0
mov r9, qword [r13]
mov qword [rsp + 0x30], r9
movsxd rax, r14d
lea r8, [r9 + rax*2 - 2]
mov qword [rsp + 0x40], r8
lea r10, [r8 - 0x7e4]
movsxd rax, edi
lea rdi, [r9 + rax*2]
jmp 0x14006cd82
mov r9, qword [rsp + 0x30]
lea r10, [r8 - 0x7e4]
movsxd rcx, dword [r15 + 0x4c]
mov rax, qword [r15 + 0x50]
mov rdx, qword [rax + rcx*8]
sub ebp, 1
mov r11d, 0x25
js 0x14006cbca
nop dword [rax]
movzx eax, word [rdx]
mov word [rdi], ax
add rdi, 2
add rdx, 2
sub ebp, 1
jns 0x14006cda0
xor ebp, ebp
jmp 0x14006cbcc
cmp cx, 0x40
jne 0x14006ce8b
add rsi, 4
mov rcx, qword [r15 + 0x50]
test rcx, rcx
mov ebp, 0
je 0x14006cbcc
movsxd rax, dword [r15 + 0x4c]
mov rcx, qword [rcx + rax*8 + 8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, eax
add eax, 2
movsxd rcx, eax
add rcx, rcx
mov r8, qword [rsp + 0x40]
sub rcx, r8
add rcx, rdi
sar rcx, 1
test ecx, ecx
js 0x14006ce49
sub rdi, qword [rsp + 0x30]
sar rdi, 1
lea r14d, [r14 + rbp + 0x10]
mov dword [rsp + 0x24], r14d
mov edx, r14d
mov rcx, r13
call fcn.1400635c0
mov r9, qword [r13]
mov qword [rsp + 0x30], r9
movsxd rax, r14d
lea r8, [r9 + rax*2 - 2]
mov qword [rsp + 0x40], r8
lea r10, [r8 - 0x7e4]
movsxd rax, edi
lea rdi, [r9 + rax*2]
jmp 0x14006ce55
mov r9, qword [rsp + 0x30]
lea r10, [r8 - 0x7e4]
movsxd rcx, dword [r15 + 0x4c]
mov rax, qword [r15 + 0x50]
mov rdx, qword [rax + rcx*8 + 8]
sub ebp, 1
mov r11d, 0x25
js 0x14006cbc6
movzx eax, word [rdx]
mov word [rdi], ax
add rdi, 2
add rdx, 2
sub ebp, 1
jns 0x14006ce71
xor ebp, ebp
jmp 0x14006cbcc
lea eax, [rcx - 0x30]
cmp ax, 9
jbe 0x14006ceb0
cmp cx, 0x7e
jb 0x14006cfe4
movzx eax, word [rsi + 4]
sub ax, 0x30
cmp ax, 9
ja 0x14006cfe4
xor ebp, ebp
mov r13d, ebp
cmp cx, 0x7e
jb 0x14006cec1
mov r13d, r11d
mov rsi, rdx
add rsi, 2
mov r12, rbp
nop dword [rax + rax]
movzx edx, word [rsi]
lea eax, [rdx - 0x30]
cmp ax, 9
ja 0x14006ceee
lea rcx, [r12 + r12*4]
movzx eax, dx
lea r12, [rax + rcx*2 - 0x30]
add rsi, 2
jmp 0x14006ced0
movsxd rax, dword [r15 + 0x4c]
cmp r12, rax
jae 0x14006cb8f
mov rax, qword [r15 + 0x50]
test rax, rax
je 0x14006cb80
mov r12, qword [rax + r12*8]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rbp, eax
test r13d, r13d
je 0x14006cf36
cmp word [r12], 0x22
jne 0x14006cf36
cmp word [r12 + rbp*2 - 2], 0x22
jne 0x14006cf30
dec ebp
dec ebp
add r12, 2
lea eax, [rbp + 2]
movsxd rcx, eax
add rcx, rcx
mov r8, qword [rsp + 0x40]
sub rcx, r8
add rcx, rdi
sar rcx, 1
test ecx, ecx
js 0x14006cf99
sub rdi, qword [rsp + 0x30]
sar rdi, 1
lea r14d, [r14 + rbp + 0x10]
mov dword [rsp + 0x24], r14d
mov edx, r14d
mov r13, qword [rsp + 0x48]
mov rcx, r13
call fcn.1400635c0
mov r9, qword [r13]
mov qword [rsp + 0x30], r9
movsxd rax, r14d
lea r8, [r9 + rax*2 - 2]
mov qword [rsp + 0x40], r8
lea r10, [r8 - 0x7e4]
movsxd rax, edi
lea rdi, [r9 + rax*2]
jmp 0x14006cfaa
mov r9, qword [rsp + 0x30]
mov r13, qword [rsp + 0x48]
lea r10, [r8 - 0x7e4]
sub ebp, 1
mov r11d, 0x25
js 0x14006cbb6
nop dword [rax]
movzx eax, word [r12]
mov word [rdi], ax
add rdi, 2
add r12, 2
sub ebp, 1
jns 0x14006cfc0
mov r12b, byte [rsp + 0x150]
xor ebp, ebp
jmp 0x14006cbcc
mov r8d, 8
lea rdx, str._RANDOM_
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_StrCmpNIW]
test eax, eax
jne 0x14006d0fa
add rsi, 0x10
xor ebp, ebp
mov word [rsp + 0x90], bp
call fcn.14005d820
movabs rdx, 0x7fffffffffffffff
and rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140062c80
mov word [rsp + 0xce], bp
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, eax
cmp eax, 1
mov eax, 0
cmovl ebp, eax
lea eax, [rbp + 2]
movsxd rcx, eax
add rcx, rcx
mov r8, qword [rsp + 0x40]
sub rcx, r8
add rcx, rdi
sar rcx, 1
test ecx, ecx
js 0x14006d0b0
sub rdi, qword [rsp + 0x30]
sar rdi, 1
lea r14d, [r14 + rbp + 0x10]
mov dword [rsp + 0x24], r14d
mov edx, r14d
mov rcx, r13
call fcn.1400635c0
mov r9, qword [r13]
mov qword [rsp + 0x30], r9
movsxd rax, r14d
lea r8, [r9 + rax*2 - 2]
mov qword [rsp + 0x40], r8
lea r10, [r8 - 0x7e4]
movsxd rax, edi
lea rdi, [r9 + rax*2]
jmp 0x14006d0bc
mov r9, qword [rsp + 0x30]
lea r10, [r8 - 0x7e4]
lea rcx, [rsp + 0x90]
sub ebp, 1
mov r11d, 0x25
js 0x14006cbc2
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdi], ax
add rdi, 2
add rcx, 2
sub ebp, 1
jns 0x14006d0e0
xor ebp, ebp
jmp 0x14006cbcc
add rsi, 2
mov r14, rsi
movzx eax, word [rsi]
test ax, ax
je 0x14006d128
nop dword [rax]
cmp ax, 0x25
je 0x14006d128
cmp ax, 0x3d
je 0x14006d128
add rsi, 2
mov ax, word [rsi]
test ax, ax
jne 0x14006d110
mov r15, rsi
mov r13, rsi
sub r13, rbp
sar r13, 1
xor bpl, bpl
movsx ecx, byte [rsp + 0x20]
mov r12d, ecx
mov dword [rsp + 0x60], ecx
cmp word [rsi], 0x25
jne 0x14006d530
movzx edx, byte [rsp + 0x28]
test dl, dl
jne 0x14006d19a
movzx eax, word [r14]
cmp ax, 0x26
je 0x14006d16e
test cl, cl
je 0x14006d19a
mov ecx, 0x5e
cmp cx, ax
je 0x14006d19a
add rsi, 2
mov rax, r14
mov qword [rsp + 0x70], rax
cmp word [r14], 0x26
jne 0x14006d26c
add r14, 2
mov ecx, 1
mov r12d, ecx
mov dword [rsp + 0x60], ecx
jmp 0x14006d26c
add rsi, 2
mov eax, 0x5e
cmp ax, word [r14]
jne 0x14006d1b4
add r14, 2
add rsi, 2
mov bpl, 8
mov rax, r14
mov qword [rsp + 0x70], rax
xor ecx, ecx
mov word [rbx], cx
cmp byte [rsp + 0x38], cl
jne 0x14006d258
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov word [r15], ax
mov r8d, dword [rsp + 0x5c]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r12d, eax
test eax, eax
jle 0x14006d227
cmp word [rbx], 0
jne 0x14006d227
lea ebx, [rax + 0x64]
mov dword [rsp + 0x5c], ebx
mov edx, ebx
lea rcx, [rsp + 0x68]
call fcn.1400635c0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov r8d, ebx
mov rbx, qword [rsp + 0x68]
mov rdx, rbx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov r12d, eax
mov eax, 0x25
mov word [r15], ax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test r12d, r12d
jg 0x14006d2cd
cmp eax, 0xcb
jne 0x14006d2cd
mov rax, qword [rsp + 0x70]
mov r12d, dword [rsp + 0x60]
mov dl, byte [rsp + 0x28]
test bpl, bpl
jne 0x14006d4d4
mov bpl, 1
test dl, dl
jne 0x14006d4d4
xor ecx, ecx
mov word [r15], cx
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call fcn.1400307c0
mov r11d, 0x25
mov word [r15], r11w
test rax, rax
jne 0x14006d407
test r12d, r12d
mov r8, qword [rsp + 0x40]
mov r9, qword [rsp + 0x30]
lea r10, [r8 - 0x7e4]
jne 0x14006cb50
test bpl, bpl
jne 0x14006d3d4
mov bpl, 1
mov rax, qword [rsp + 0x70]
mov dl, byte [rsp + 0x28]
jmp 0x14006d1bc
mov rbp, qword [rsp + 0x78]
test rbp, rbp
je 0x14006d2ff
mov r15, qword [rsp + 0x50]
cmp byte [r15 + 0xba], 0
jne 0x14006d304
mov edx, 0x25
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrChrW]
test rax, rax
je 0x14006d304
mov byte [rbp], 1
jmp 0x14006d304
mov r15, qword [rsp + 0x50]
mov eax, dword [rsp + 0x58]
movzx eax, al
test r12d, r12d
mov ecx, 1
cmovg eax, ecx
mov dword [rsp + 0x58], eax
mov rbp, rbx
lea eax, [r12 + 2]
movsxd rcx, eax
add rcx, rcx
mov r8, qword [rsp + 0x40]
sub rcx, r8
add rcx, rdi
sar rcx, 1
test ecx, ecx
js 0x14006d387
sub rdi, qword [rsp + 0x30]
sar rdi, 1
mov r14d, dword [rsp + 0x24]
lea r14d, [r14 + r12 + 0x10]
mov dword [rsp + 0x24], r14d
mov edx, r14d
mov r13, qword [rsp + 0x48]
mov rcx, r13
call fcn.1400635c0
mov r9, qword [r13]
mov qword [rsp + 0x30], r9
movsxd rax, r14d
lea r8, [r9 + rax*2 - 2]
mov qword [rsp + 0x40], r8
lea r10, [r8 - 0x7e4]
movsxd rax, edi
lea rdi, [r9 + rax*2]
jmp 0x14006d39d
mov r14d, dword [rsp + 0x24]
mov r9, qword [rsp + 0x30]
mov r13, qword [rsp + 0x48]
lea r10, [r8 - 0x7e4]
sub r12d, 1
mov r11d, 0x25
js 0x14006cbaa
nop dword [rax]
movzx eax, word [rbp]
mov word [rdi], ax
add rdi, 2
add rbp, 2
sub r12d, 1
jns 0x14006d3b0
mov r12b, byte [rsp + 0x150]
xor ebp, ebp
jmp 0x14006cbcc
mov al, byte [rsp + 0x20]
cmp al, 1
mov r14d, dword [rsp + 0x24]
mov r15, qword [rsp + 0x50]
lea r10, [r8 - 0x7e4]
mov r12b, byte [rsp + 0x150]
mov ebp, 0
je 0x14006cb72
sub rsi, 2
jmp 0x14006d536
mov rbp, qword [rax]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r12d, eax
add eax, 2
movsxd rcx, eax
add rcx, rcx
mov r8, qword [rsp + 0x40]
sub rcx, r8
add rcx, rdi
sar rcx, 1
test ecx, ecx
js 0x14006d47e
sub rdi, qword [rsp + 0x30]
sar rdi, 1
mov r14d, dword [rsp + 0x24]
lea r14d, [r14 + r12 + 0x10]
mov dword [rsp + 0x24], r14d
mov edx, r14d
mov r13, qword [rsp + 0x48]
mov rcx, r13
call fcn.1400635c0
mov r9, qword [r13]
mov qword [rsp + 0x30], r9
movsxd rax, r14d
lea r8, [r9 + rax*2 - 2]
mov qword [rsp + 0x40], r8
lea r10, [r8 - 0x7e4]
movsxd rax, edi
lea rdi, [r9 + rax*2]
jmp 0x14006d494
mov r14d, dword [rsp + 0x24]
mov r9, qword [rsp + 0x30]
mov r13, qword [rsp + 0x48]
lea r10, [r8 - 0x7e4]
sub r12d, 1
mov r15, qword [rsp + 0x50]
mov r11d, 0x25
js 0x14006cb9e
nop dword [rax]
movzx eax, word [rbp]
mov word [rdi], ax
add rdi, 2
add rbp, 2
sub r12d, 1
jns 0x14006d4b0
mov r12b, byte [rsp + 0x150]
xor ebp, ebp
jmp 0x14006cbcc
mov al, byte [rsp + 0x20]
cmp al, 1
jne 0x14006d512
xor al, al
mov r14d, dword [rsp + 0x24]
mov r15, qword [rsp + 0x50]
mov r8, qword [rsp + 0x40]
mov r9, qword [rsp + 0x30]
lea r10, [r8 - 0x7e4]
mov r12b, byte [rsp + 0x150]
mov ebp, 0
lea r11d, [rbp + 0x25]
je 0x14006cb79
jmp 0x14006d514
xor al, al
sub rsi, 2
test al, al
je 0x14006d528
sub rsi, 2
mov r11d, 0x25
jmp 0x14006d536
mov r11d, 0x25
jmp 0x14006d536
mov r11d, 0x25
lea eax, [r13 + 3]
movsxd rcx, eax
add rcx, rcx
mov r8, qword [rsp + 0x40]
sub rcx, r8
add rcx, rdi
sar rcx, 1
test ecx, ecx
js 0x14006d5a5
sub rdi, qword [rsp + 0x30]
sar rdi, 1
mov r14d, dword [rsp + 0x24]
lea r14d, [r14 + r13 + 0x11]
mov dword [rsp + 0x24], r14d
mov edx, r14d
mov rbp, qword [rsp + 0x48]
mov rcx, rbp
call fcn.1400635c0
mov r9, qword [rbp]
mov qword [rsp + 0x30], r9
movsxd rax, r14d
lea r8, [r9 + rax*2 - 2]
mov qword [rsp + 0x40], r8
lea r10, [r8 - 0x7e4]
movsxd rax, edi
lea rdi, [r9 + rax*2]
mov r11d, 0x25
jmp 0x14006d5b6
mov r14d, dword [rsp + 0x24]
mov r9, qword [rsp + 0x30]
lea r10, [r8 - 0x7e4]
cmp r11w, word [rsi]
jne 0x14006d601
lea rcx, [rsi + 2]
movzx eax, word [rcx]
cmp r11w, ax
je 0x14006d5fb
mov edx, 0x2a
cmp dx, ax
je 0x14006d5fb
mov edx, 0x40
cmp dx, ax
je 0x14006d5fb
mov edx, 0x23
cmp dx, ax
je 0x14006d5fb
mov edx, 0x7e
cmp dx, ax
je 0x14006d5fb
sub ax, 0x30
cmp ax, 9
ja 0x14006d601
mov rsi, rcx
inc r13d
sub r13d, 1
mov r15, qword [rsp + 0x50]
mov r12b, byte [rsp + 0x150]
mov ebp, 0
js 0x14006cb6b
mov rcx, qword [rsp + 0x80]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdi], ax
add rdi, 2
add rcx, 2
sub r13d, 1
jns 0x14006d630
mov r13, qword [rsp + 0x48]
mov r12b, byte [rsp + 0x150]
jmp 0x14006cbcc
mov word [rdi], bp
mov eax, dword [rsp + 0x58]
test al, al
jne 0x14006d678
mov rbp, qword [rsp + 0x78]
test rbp, rbp
je 0x14006d678
cmp byte [r15 + 0xba], al
jne 0x14006d678
mov byte [rbp], 1
sub rdi, r9
sar rdi, 1
lea edx, [rdi + 2]
mov rcx, r13
call fcn.1400635c0
nop
lea rcx, [rsp + 0x68]
call fcn.14005b520
mov eax, edi
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.14010bcc0
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret