Function at 0x1400057ef
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x478
mov r15, rcx
lea rsi, [rsp + 0x78]
mov rcx, rsi
call fcn.140005c36
mov rdi, qword [rsi]
test rdi, rdi
je 0x140005aa2
mov qword [rsp + 0x50], r15
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x70], rax
mov esi, 0x200
mov eax, 2
mov qword [rsp + 0x28], rax
xor r14d, r14d
mov rbx, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor r15d, r15d
cmp rsi, 0x201
jae 0x140005867
lea r12, [rsp + 0x78]
mov ebp, 0x200
mov r13, rsi
jmp 0x140005919
sub rsi, r15
mov rax, r14
sub rax, r15
cmp rax, rsi
jae 0x1400058fb
add r15, rsi
jb 0x140005c32
lea rax, [r14 + r14]
mov rsi, rax
cmp rax, r15
ja 0x140005891
mov rsi, r15
cmp rsi, 5
jae 0x14000589c
mov esi, 4
xor edx, edx
mov rcx, rsi
shr rcx, 0x3e
sete cl
test r14, r14
je 0x1400058c3
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x40], rax
mov eax, 2
jmp 0x1400058c5
xor eax, eax
lea r8, [rsi + rsi]
mov dl, cl
add rdx, rdx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x58]
lea r9, [rsp + 0x30]
call fcn.140002cd5
cmp qword [rsp + 0x58], 0
jne 0x140005c2c
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov r14, rsi
mov eax, 0xffffffff
mov r15, r14
cmp r14, rax
jb 0x14000590e
mov r15d, 0xffffffff
mov r12, qword [rsp + 0x28]
mov rbp, r15
mov r13, r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rdi
mov rdx, r12
mov r8d, r13d
call rbx
mov esi, eax
test eax, eax
jne 0x140005940
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140005ada
mov esi, esi
cmp r13, rsi
jne 0x140005971
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x140005c32
add r13, r13
mov eax, 0xffffffff
cmp r13, rax
jb 0x140005969
mov r13d, 0xffffffff
mov rsi, r13
jmp 0x14000584c
jb 0x14000584c
cmp rbp, rsi
jb 0x140005c32
mov rcx, rsi
xor edx, edx
call fcn.140002b3e
lea rbx, [rsp + 0x30]
mov qword [rbx], rax
mov qword [rbx + 8], rdx
and qword [rbx + 0x10], 0
mov byte [rbx + 0x18], 1
lea rax, [r12 + rsi*2]
lea r13, [rsp + 0x58]
mov qword [r13], r12
mov qword [r13 + 8], rax
and word [r13 + 0x10], 0
lea rbp, [rsp + 0x20]
mov r15, qword [rsp + 0x50]
mov rcx, r13
call fcn.140002a96
test ax, ax
je 0x1400059e3
movzx ecx, ax
cmp ecx, 2
je 0x140005ab4
shr eax, 0x10
mov byte [rsp + 0x48], 0
jmp 0x1400059e7
shr rax, 0x20
and dword [rsp + 0x20], 0
cmp eax, 0x80
jae 0x140005a01
mov byte [rsp + 0x20], al
mov eax, 1
jmp 0x140005a8a
mov ecx, eax
cmp eax, 0x800
jae 0x140005a23
shr ecx, 6
or cl, 0xc0
mov byte [rsp + 0x20], cl
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x21], al
mov eax, 2
jmp 0x140005a8a
cmp eax, 0x10000
jae 0x140005a52
shr ecx, 0xc
or cl, 0xe0
mov byte [rsp + 0x20], cl
mov ecx, eax
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [rsp + 0x21], cl
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x22], al
mov eax, 3
jmp 0x140005a8a
shr ecx, 0x12
and cl, 7
or cl, 0xf0
mov byte [rsp + 0x20], cl
mov ecx, eax
shr ecx, 0xc
and cl, 0x3f
or cl, 0x80
mov byte [rsp + 0x21], cl
mov ecx, eax
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [rsp + 0x22], cl
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x23], al
mov eax, 4
lea r8, [rsp + rax]
add r8, 0x20
mov rcx, rbx
mov rdx, rbp
call fcn.140002d91
jmp 0x1400059c0
mov rcx, qword [rsp + 0x80]
call fcn.14000502b
jmp 0x140005b3a
mov r12, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov bpl, byte [rsp + 0x48]
mov eax, dword [rsp + 0x49]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x5b], eax
jmp 0x140005aea
mov bpl, 2
call fcn.140005ea6
mov r12, rax
mov r15, qword [rsp + 0x50]
test r14, r14
je 0x140005b04
add r14, r14
mov edx, 2
mov rcx, qword [rsp + 0x28]
mov r8, r14
call fcn.1400030e0
cmp bpl, 2
jne 0x140005b17
mov rcx, r12
call fcn.14000502b
mov bpl, 2
jmp 0x140005b27
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x5b]
mov dword [rsp + 0x23], ecx
mov dword [rsp + 0x20], eax
mov rcx, rdi
mov rdx, qword [rsp + 0x70]
call fcn.1400049b5
cmp bpl, 2
jne 0x140005b53
mov byte [r15 + 0x18], 2
add rsp, 0x478
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov al, 2
test bpl, bpl
je 0x140005b86
mov qword [r15], r12
mov qword [r15 + 8], rbx
mov qword [r15 + 0x10], rsi
cmp al, 2
jne 0x140005b70
mov byte [r15 + 0x18], 3
jmp 0x140005b3f
mov byte [r15 + 0x18], al
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x33]
mov dword [r15 + 0x19], eax
mov dword [r15 + 0x1c], ecx
jmp 0x140005b3f
lea rcx, [r12 + rsi]
mov rdx, r12
cmp rdx, rcx
je 0x140005b5a
mov r8, rdx
inc rdx
mov r9b, byte [r8]
test r9b, r9b
jns 0x140005b8d
cmp r9b, 0xe0
jae 0x140005bb3
add r8, 2
cmp rdx, rcx
cmovne rdx, r8
jmp 0x140005b8d
cmp r9b, 0xed
jne 0x140005bda
cmp rdx, rcx
mov rdx, rcx
je 0x140005b8d
lea r9, [r8 + 2]
mov rdx, rcx
cmp r9, rcx
je 0x140005b8d
lea rdx, [r8 + 3]
cmp byte [r8 + 1], 0x9f
jbe 0x140005b8d
jmp 0x140005c05
add r8, 2
cmp rdx, rcx
cmove r8, rdx
xor edx, edx
cmp r8, rcx
setne dl
add rdx, r8
cmp r9b, 0xf0
jb 0x140005b8d
xor r8d, r8d
cmp rdx, rcx
setne r8b
add rdx, r8
jmp 0x140005b8d
mov eax, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x23]
mov dword [rsp + 0x7b], ecx
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0x78]
mov ecx, dword [rsp + 0x7b]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x33], ecx
xor eax, eax
jmp 0x140005b5a
cmp qword [rsp + 0x60], 0
ud2