Function at 0x1800be950
Capabilities:
Query environment variable

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov qword [rbp - 0x71], 0xfffffffffffffffe
mov qword [rsp + 0x110], rbx
mov rax, qword [0x1802a8008]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rcx, str.APPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov qword [rbp + 0xf], 0xf
xor ebx, ebx
mov qword [rbp + 7], rbx
mov byte [rbp - 9], bl
cmp byte [rax], bl
jne 0x1800be9a3
mov r8d, ebx
jmp 0x1800be9b0
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], bl
jne 0x1800be9a7
mov rdx, rax
lea rcx, [rbp - 9]
call fcn.18003d620
nop
lea r8, str..exFilLocat_
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x29]
call fcn.1800a9640
nop
mov qword [rbp - 0x51], 0xf
mov qword [rbp - 0x59], rbx
mov byte [rbp - 0x69], 0
mov r8d, 0xb
lea rdx, str.headerr.ytd
lea rcx, [rbp - 0x69]
call fcn.18003d620
nop
lea r8, [rbp - 0x69]
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x49]
call fcn.1800ce550
nop
lea rcx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae rcx, qword [rbp - 0x49]
lea rdx, [rbp + 0x17]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jne 0x1800bea55
lea r9, [rbp - 0x69]
cmp qword [rbp - 0x51], 0x10
cmovae r9, qword [rbp - 0x69]
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae rdx, qword [rbp - 0x49]
mov byte [rsp + 0x20], al
mov r8b, 1
lea rcx, [rbp - 0x79]
call qword [0x18034e910]
nop
mov rax, qword [rbp - 0x31]
cmp rax, 0x10
jb 0x1800beaaf
inc rax
mov rcx, qword [rbp - 0x49]
cmp rax, 0x1000
jb 0x1800beaaa
test cl, 0x1f
je 0x1800bea7a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800bea8a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800bea9a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x1800beaa7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.1801e6034
mov qword [rbp - 0x31], 0xf
mov qword [rbp - 0x39], rbx
mov byte [rbp - 0x49], 0
mov rax, qword [rbp - 0x51]
cmp rax, 0x10
jb 0x1800beb19
inc rax
mov rcx, qword [rbp - 0x69]
cmp rax, 0x1000
jb 0x1800beb14
test cl, 0x1f
je 0x1800beae4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800beaf4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800beb04
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x1800beb11
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.1801e6034
mov qword [rbp - 0x51], 0xf
mov qword [rbp - 0x59], rbx
mov byte [rbp - 0x69], 0
mov rax, qword [rbp - 0x11]
cmp rax, 0x10
jb 0x1800beb83
inc rax
mov rcx, qword [rbp - 0x29]
cmp rax, 0x1000
jb 0x1800beb7e
test cl, 0x1f
je 0x1800beb4e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800beb5e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800beb6e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x1800beb7b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.1801e6034
mov qword [rbp - 0x11], 0xf
mov qword [rbp - 0x19], rbx
mov byte [rbp - 0x29], 0
mov rax, qword [rbp + 0xf]
cmp rax, 0x10
jb 0x1800bebed
inc rax
mov rcx, qword [rbp - 9]
cmp rax, 0x1000
jb 0x1800bebe8
test cl, 0x1f
je 0x1800bebb8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800bebc8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800bebd8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x1800bebe5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.1801e6034
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1801e6050
mov rbx, qword [rsp + 0x110]
add rsp, 0x100
pop rbp
ret