Function at 0x140025a70
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1f8
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov rbp, qword [rsp + 0x260]
movzx eax, r9b
or rbx, 0xffffffffffffffff
mov r12d, r8d
mov dword [rsp + 0x34], r8d
mov r15, rdx
mov dword [rsp + 0x30], eax
mov rsi, rbx
mov rdi, rcx
nop dword [rax + rax]
inc rsi
cmp byte [rcx + rsi], 0
jne 0x140025ac0
sub eax, dword [rsp + 0x268]
xor ecx, ecx
mov edx, 0x186
lea r8d, [rcx + 8]
add esi, eax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov r14, rax
mov qword [rsp + 0x38], rax
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov rdx, r14
mov r9d, eax
mov ecx, esi
mov qword [rsp + 0x20], rax
call fcn.14008c360
lea rcx, str.route
mov r14, rax
call fcn.1400ba050
mov r13, rax
mov qword [rsp + 0x40], rax
mov eax, dword [rsp + 0x268]
cmp dword [rsp + 0x20], eax
jne 0x140025ba6
lea rcx, [rsp + 0xa0]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_FindFirstVolumeA]
mov rcx, rbx
mov r8, rax
nop dword [rax + rax]
inc rcx
cmp byte [r14 + rcx], 0
jne 0x140025b50
movzx eax, byte [rsp + 0x20]
movzx r9d, byte [rsp + 0x268]
imul cl
sub r9b, al
mov rax, rbx
sub r9b, byte [rsp + 0x28]
inc rax
cmp byte [rax + rbp], 0
jne 0x140025b75
add r9b, al
mov rax, rbx
inc rax
cmp byte [rdi + rax], 0
jne 0x140025b84
add r9b, al
lea rdx, str.pencil
xor ecx, ecx
add r9b, sil
call fcn.14008b570
call fcn.1400cfd90
xor ecx, ecx
lea rax, str.couch
mov edx, 0x20a
lea r8d, [rcx + 0x14]
mov qword [rsp + 0x48], rax
call qword [sym.imp.KERNEL32.dll_FindResourceA]
mov qword [rsp + 0x50], rax
mov rax, rbx
nop dword [rax + rax]
inc rax
cmp byte [rax + rbp], 0
jne 0x140025bd0
imul eax, r12d
mov ecx, 2
imul eax, esi
sub ecx, eax
mov rax, rbx
sub ecx, dword [rsp + 0x28]
nop
inc rax
cmp byte [rdi + rax], 0
jne 0x140025bf0
add ecx, eax
xor edx, edx
mov r8d, 0x140
mov dword [rsp + 0x58], ecx
lea rcx, [rsp + 0xa0]
call fcn.1400e27d0
lea rdx, [rsp + 0xa0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, rbx
mov qword [rsp + 0x60], rax
nop dword [rax]
inc rcx
cmp byte [rcx + rbp], 0
jne 0x140025c30
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [r15 + rax], 0
jne 0x140025c40
imul ecx, eax
mov rax, rbx
inc rax
cmp byte [rdi + rax], 0
jne 0x140025c50
imul ecx, eax
mov eax, dword [rsp + 0x38]
imul ecx, r12d
imul eax, esi
sub ecx, eax
mov rax, rbx
nop dword [rax]
cmp byte [r14 + rax + 1], 0
lea rax, [rax + 1]
jne 0x140025c70
lea eax, [rax + rax*4]
sub ecx, eax
mov rax, qword [rsp + 0x20]
sub ecx, dword [rsp + 0x28]
add eax, 2
add eax, ecx
mov dword [rsp + 0x68], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r8, [rsp + 0x70]
movups xmm0, xmmword [rsp + 0x48]
movups xmm1, xmmword [rsp + 0x58]
lea rdx, [0x1400ed3f4]
mov rcx, r13
movzx r9d, al
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm1
movsd xmm0, qword [rsp + 0x68]
mov r12d, eax
movsd qword [rsp + 0x90], xmm0
call fcn.1400bc3b0
mov r13d, eax
call fcn.140069440
mov rcx, rbx
movzx edx, al
nop dword [rax + rax]
inc rcx
cmp byte [r15 + rcx], 0
jne 0x140025cf0
mov rax, qword [rsp + 0x40]
imul ecx, dword [rsp + 0x34]
imul eax, eax
sub ecx, eax
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [rax + rbp], 0
jne 0x140025d10
imul eax, dword [rsp + 0x268]
sub ecx, eax
movsx rax, dl
sub ecx, eax
movzx eax, r12b
sub ecx, dword [rsp + 0x50]
add ecx, eax
mov rax, rbx
sub ecx, dword [rsp + 0x28]
sub ecx, dword [rsp + 0x20]
sub ecx, esi
add ecx, dword [rsp + 0x30]
add ecx, r13d
add ecx, dword [rsp + 0x38]
nop dword [rax + rax]
inc rax
cmp byte [r14 + rax], 0
jne 0x140025d50
sub ecx, eax
nop dword [rax]
inc rbx
cmp byte [rdi + rbx], 0
jne 0x140025d60
lea eax, [rcx + 5]
add eax, ebx
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.1400dd340
add rsp, 0x1f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret