Function at 0x14006dcf4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov dword [rax + 0x20], r9d
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x170
mov r15b, byte [rcx + 0xd]
mov sil, byte [rsp + 0x1d0]
xor ebx, ebx
cmp r9d, ebx
mov rbp, r8
mov rdi, rdx
setl al
and r15b, 0x11
mov r13, rcx
mov byte [rsp + 0x40], r15b
mov byte [rsp + 0x50], al
cmp al, bl
jne 0x14006dd4c
test sil, sil
jns 0x14006dd53
mov r15b, bl
mov byte [rsp + 0x40], bl
mov r12, qword [rsp + 0x1d8]
and sil, 1
mov r14b, bl
mov byte [rsp + 0x1d0], sil
mov dword [rsp + 0x44], r14d
mov byte [rsp + 0x51], bl
cmp r12, rbx
je 0x14006dd80
mov al, byte [r12]
mov byte [rsp + 0x51], al
mov eax, 0x50
lea rcx, [rsp + 0x58]
mov rdx, rax
mov qword [rsp + 0x78], rax
call fcn.14005a1c4
lea rax, [rsp + 0x88]
lea r9, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x68]
lea r8, [rsp + 0x1c8]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x80]
lea rcx, [rsp + 0x90]
mov rdx, rbp
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x88], rbx
call fcn.140062b30
mov rbx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x48]
mov ebp, 1
xor r8d, r8d
cmp rdx, qword [rsp + 0x80]
jae 0x14006e649
cmp word [rdi], r8w
je 0x14006e649
lea rcx, [rsp + 0x90]
call fcn.140062c74
mov r9d, 0x25
xor r8d, r8d
cmp word [rdi], r9w
je 0x14006de6c
mov rdx, qword [rsp + 0x48]
mov ecx, 0x3dd
movzx eax, word [rdi]
cmp ax, r8w
je 0x14006de04
cmp r9w, ax
je 0x14006de04
mov word [rdx], ax
mov rdx, qword [rsp + 0x48]
add rdi, 2
add rdx, 2
sub ecx, ebp
mov qword [rsp + 0x48], rdx
jns 0x14006de42
jmp 0x14006de04
mov r14, rdi
mov qword [rsp + 0x60], rdi
cmp sil, r8b
je 0x14006e0f3
cmp word [rdi + 2], r9w
jne 0x14006dea1
mov rax, qword [rsp + 0x48]
mov word [rax], r9w
mov rdx, qword [rsp + 0x48]
add rdx, 2
add rdi, 4
mov qword [rsp + 0x48], rdx
jmp 0x14006def6
mov eax, 0x23
cmp word [rdi + 2], ax
jne 0x14006df00
mov rcx, qword [r13 + 0x68]
add rdi, 4
cmp rcx, r8
je 0x14006e590
movsxd rax, dword [r13 + 0x60]
mov rcx, qword [rcx + rax*8 + 0x10]
movzx eax, word [rcx]
cmp ax, r8w
je 0x14006e590
mov rdx, qword [rsp + 0x48]
mov word [rdx], ax
mov rdx, qword [rsp + 0x48]
add rcx, 2
add rdx, 2
mov qword [rsp + 0x48], rdx
mov ax, word [rcx]
cmp ax, r8w
jne 0x14006ded8
mov r14d, dword [rsp + 0x44]
jmp 0x14006de04
mov eax, 0x2a
cmp word [rdi + 2], ax
jne 0x14006df76
mov rcx, qword [r13 + 0x68]
add rdi, 4
cmp rcx, r8
je 0x14006e590
movsxd rax, dword [r13 + 0x60]
mov rcx, qword [rcx + rax*8]
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
lea rcx, [rsp + 0x90]
lea edx, [rax + 2]
mov esi, eax
call fcn.140062bc8
sub esi, ebp
movsxd r11, dword [r13 + 0x60]
mov rcx, qword [r13 + 0x68]
mov rax, qword [rcx + r11*8]
js 0x14006e585
mov rdx, qword [rsp + 0x48]
movzx ecx, word [rax]
add rax, 2
mov word [rdx], cx
mov rdx, qword [rsp + 0x48]
add rdx, 2
sub esi, ebp
mov qword [rsp + 0x48], rdx
jns 0x14006df55
jmp 0x14006e637
mov eax, pe_nt_image_headers64
cmp word [rdi + 2], ax
jne 0x14006dfee
mov rcx, qword [r13 + 0x68]
add rdi, 4
cmp rcx, r8
je 0x14006e590
movsxd rax, dword [r13 + 0x60]
mov rcx, qword [rcx + rax*8 + 8]
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
lea rcx, [rsp + 0x90]
lea edx, [rax + 2]
mov esi, eax
call fcn.140062bc8
sub esi, ebp
movsxd r11, dword [r13 + 0x60]
mov rcx, qword [r13 + 0x68]
mov rax, qword [rcx + r11*8 + 8]
js 0x14006e585
mov rdx, qword [rsp + 0x48]
movzx ecx, word [rax]
add rax, 2
mov word [rdx], cx
mov rdx, qword [rsp + 0x48]
add rdx, 2
sub esi, ebp
mov qword [rsp + 0x48], rdx
jns 0x14006dfcd
jmp 0x14006e637
movzx eax, word [rdi + 2]
sub ax, 0x30
cmp ax, 9
jbe 0x14006e01d
mov eax, 0x7e
cmp word [rdi + 2], ax
jb 0x14006e0f3
movzx eax, word [rdi + 4]
sub ax, 0x30
cmp ax, 9
ja 0x14006e0f3
mov eax, 0x7e
mov r12d, r8d
cmp word [rdi + 2], ax
jb 0x14006e032
mov r12d, r9d
add rdi, 2
mov rbp, r8
add rdi, 2
movzx eax, word [rdi]
sub ax, 0x30
cmp ax, 9
ja 0x14006e055
movzx eax, word [rdi]
lea rcx, [rbp + rbp*4]
lea rbp, [rax + rcx*2 - 0x30]
jmp 0x14006e035
movsxd rax, dword [r13 + 0x60]
cmp rbp, rax
jae 0x14006e5c8
mov rax, qword [r13 + 0x68]
cmp rax, r8
je 0x14006e5c8
mov rbp, qword [rax + rbp*8]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
xor ecx, ecx
movsxd rsi, eax
cmp r12d, ecx
je 0x14006e0a2
cmp word [rbp], 0x22
jne 0x14006e0a2
cmp word [rbp + rsi*2 - 2], 0x22
mov ecx, 1
jne 0x14006e09c
sub esi, ecx
sub esi, ecx
add rbp, 2
lea edx, [rsi + 2]
lea rcx, [rsp + 0x90]
call fcn.140062bc8
mov ecx, 1
sub esi, ecx
js 0x14006e5e9
mov rdx, qword [rsp + 0x48]
movzx eax, word [rbp]
add rbp, 2
mov word [rdx], ax
mov rdx, qword [rsp + 0x48]
add rdx, 2
sub esi, ecx
mov qword [rsp + 0x48], rdx
jns 0x14006e0c4
mov r12, qword [rsp + 0x1d8]
mov r14d, dword [rsp + 0x44]
jmp 0x14006e433
add rdi, 2
mov eax, 0x26
mov rbp, rdi
mov rsi, rdi
cmp ax, word [rdi]
jne 0x14006e110
add rsi, 2
cmp ax, word [rsi]
je 0x14006e107
lea rdx, [0x140102fc8]
mov r8d, 7
mov rcx, rsi
call qword [sym.imp.SHLWAPI.DLL_StrCmpNIW]
xor ecx, ecx
cmp eax, ecx
jne 0x14006e143
call fcn.140054c4c
movabs rcx, 0x7fffffffffffffff
and rax, rcx
xor r8d, r8d
jmp 0x14006e16c
lea rdx, [0x140102fb8]
mov r8d, 7
mov rcx, rsi
call qword [sym.imp.SHLWAPI.DLL_StrCmpNIW]
xor r8d, r8d
cmp eax, r8d
jne 0x14006e1f7
lea rax, [r13 + 0x75bd036]
lea rcx, [rsp + 0xc0]
mov rdx, rax
lea rdi, [rsi + 0xe]
mov word [rsp + 0xc0], r8w
call fcn.1400c90e0
lea rcx, [rsp + 0xc0]
xor ebp, ebp
mov word [rsp + 0x162], bp
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
lea ecx, [rbp + 1]
cmp eax, ecx
mov esi, eax
lea rcx, [rsp + 0x90]
cmovl esi, ebp
lea edx, [rsi + 2]
call fcn.140062bc8
mov ebp, 1
lea r11, [rsp + 0xc0]
sub esi, ebp
js 0x14006e585
mov rdx, qword [rsp + 0x48]
movzx eax, word [r11]
add r11, 2
mov word [rdx], ax
mov rdx, qword [rsp + 0x48]
add rdx, 2
sub esi, ebp
mov qword [rsp + 0x48], rdx
jns 0x14006e1d5
jmp 0x14006e637
mov r9d, 0x25
movzx eax, word [rdi]
cmp ax, r8w
je 0x14006e218
cmp ax, r9w
je 0x14006e218
cmp ax, 0x3d
je 0x14006e218
add rdi, 2
jmp 0x14006e1fd
mov r12, rdi
mov rsi, rdi
mov qword [rsp + 0x70], rdi
sub r12, r14
mov r13b, r8b
movsx r15d, r15b
sar r12, 1
cmp word [rdi], r9w
jne 0x14006e505
mov al, byte [rsp + 0x50]
cmp al, r8b
jne 0x14006e27e
mov ecx, 0x26
cmp word [rbp], cx
je 0x14006e25e
cmp byte [rsp + 0x40], r8b
je 0x14006e27e
lea edx, [rcx + 0x38]
cmp dx, word [rbp]
je 0x14006e27e
add rdi, 2
mov r14, rbp
cmp word [rbp], cx
jne 0x14006e344
add rbp, 2
mov r15d, 1
jmp 0x14006e344
mov ecx, 0x5e
add rdi, 2
cmp cx, word [rbp]
jne 0x14006e294
add rbp, 2
mov r13b, 8
mov r14, rbp
mov word [rbx], r8w
cmp byte [rsp + 0x51], r8b
jne 0x14006e32f
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov r8d, dword [rsp + 0x78]
xor ecx, ecx
mov word [rsi], cx
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
mov esi, eax
xor eax, eax
cmp esi, eax
jle 0x14006e304
cmp word [rbx], ax
jne 0x14006e304
lea ebx, [rsi + 0x64]
lea rcx, [rsp + 0x58]
movsxd rdx, ebx
mov qword [rsp + 0x78], rbx
call fcn.14005a250
xor ecx, ecx
call qword [sym.imp.KERNEL32.DLL_SetLastError]
mov r8d, ebx
mov rbx, qword [rsp + 0x58]
mov rdx, rbx
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
mov esi, eax
mov rax, qword [rsp + 0x70]
mov ecx, 0x25
mov word [rax], cx
call qword [sym.imp.KERNEL32.DLL_GetLastError]
xor r8d, r8d
cmp esi, r8d
jg 0x14006e394
cmp eax, 0xcb
jne 0x14006e394
mov rsi, qword [rsp + 0x70]
mov al, byte [rsp + 0x50]
cmp r13b, r8b
jne 0x14006e4d9
mov r13b, 1
cmp al, r8b
jne 0x14006e4d9
mov rcx, qword [rsp + 0x1b0]
mov word [rsi], r8w
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, r14
call fcn.14001c5dc
xor r8d, r8d
mov ecx, 0x25
mov word [rsi], cx
cmp rax, r8
jne 0x14006e463
cmp r15d, r8d
jne 0x14006e5b8
cmp r13b, r8b
jne 0x14006e442
lea eax, [rcx - 0x24]
mov r13b, al
mov al, byte [rsp + 0x50]
jmp 0x14006e297
mov r12, qword [rsp + 0x1d8]
mov r13, qword [rsp + 0x1b0]
cmp r12, r8
je 0x14006e3d2
cmp byte [r13 + 0xda], r8b
jne 0x14006e3d2
mov edx, 0x25
mov rcx, rbx
call qword [sym.imp.SHLWAPI.DLL_StrChrW]
xor r8d, r8d
lea ecx, [r8 + 1]
cmp rax, r8
je 0x14006e3d7
mov byte [r12], cl
jmp 0x14006e3d7
mov ecx, 1
mov r14d, dword [rsp + 0x44]
cmp esi, r8d
lea edx, [rsi + 2]
movzx r14d, r14b
mov rbp, rbx
cmovg r14d, ecx
lea rcx, [rsp + 0x90]
mov dword [rsp + 0x44], r14d
call fcn.140062bc8
mov ecx, 1
sub esi, ecx
js 0x14006e5f5
mov rdx, qword [rsp + 0x48]
movzx eax, word [rbp]
add rbp, 2
mov word [rdx], ax
mov rdx, qword [rsp + 0x48]
add rdx, 2
sub esi, ecx
mov qword [rsp + 0x48], rdx
jns 0x14006e411
mov r15b, byte [rsp + 0x40]
mov sil, byte [rsp + 0x1d0]
mov ebp, ecx
jmp 0x14006de01
mov r15b, byte [rsp + 0x40]
mov ebp, 1
cmp r15b, bpl
je 0x14006e5d7
mov r14, qword [rsp + 0x60]
sub rdi, 2
jmp 0x14006e50f
mov rbp, qword [rax]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_lstrlenW]
lea rcx, [rsp + 0x90]
lea edx, [rax + 2]
mov esi, eax
call fcn.140062bc8
mov eax, 1
sub esi, eax
js 0x14006e5a4
mov rdx, qword [rsp + 0x48]
movzx ecx, word [rbp]
add rbp, 2
mov word [rdx], cx
mov rdx, qword [rsp + 0x48]
add rdx, 2
sub esi, eax
mov qword [rsp + 0x48], rdx
jns 0x14006e493
mov r13, qword [rsp + 0x1b0]
mov r12, qword [rsp + 0x1d8]
mov r15b, byte [rsp + 0x40]
mov sil, byte [rsp + 0x1d0]
mov r14d, dword [rsp + 0x44]
mov ebp, eax
jmp 0x14006de01
mov r15b, byte [rsp + 0x40]
mov ebp, 1
cmp r15b, bpl
jne 0x14006e4f1
cmp r8b, r8b
je 0x14006e5d7
mov r14, qword [rsp + 0x60]
sub rdi, 2
cmp r8b, r8b
je 0x14006e50f
sub rdi, 2
jmp 0x14006e50f
mov r15b, byte [rsp + 0x40]
mov ebp, 1
lea edx, [r12 + 3]
lea rcx, [rsp + 0x90]
call fcn.140062bc8
mov r9d, 0x25
cmp r9w, word [rdi]
jne 0x14006e56c
movzx eax, word [rdi + 2]
cmp r9w, ax
je 0x14006e565
lea edx, [r9 + 5]
cmp dx, ax
je 0x14006e565
lea edx, [r9 + 0x1b]
cmp dx, ax
je 0x14006e565
lea edx, [r9 - 2]
cmp dx, ax
je 0x14006e565
lea edx, [r9 + 0x59]
cmp dx, ax
je 0x14006e565
sub ax, 0x30
cmp ax, 9
ja 0x14006e56c
add rdi, 2
add r12d, ebp
sub r12d, ebp
jns 0x14006e604
mov r13, qword [rsp + 0x1b0]
mov r12, qword [rsp + 0x1d8]
xor r8d, r8d
mov sil, byte [rsp + 0x1d0]
mov r14d, dword [rsp + 0x44]
mov rdx, qword [rsp + 0x48]
mov r15b, byte [rsp + 0x40]
jmp 0x14006de04
mov r13, qword [rsp + 0x1b0]
mov r12, qword [rsp + 0x1d8]
mov ebp, eax
jmp 0x14006e585
mov r13, qword [rsp + 0x1b0]
mov sil, byte [rsp + 0x1d0]
mov r12, qword [rsp + 0x1d8]
mov ebp, 1
jmp 0x14006e590
mov r13, qword [rsp + 0x1b0]
mov r12, qword [rsp + 0x1d8]
jmp 0x14006e588
mov r12, qword [rsp + 0x1d8]
mov ebp, ecx
jmp 0x14006e585
mov sil, byte [rsp + 0x1d0]
xor r8d, r8d
mov ebp, ecx
jmp 0x14006e595
mov rdx, qword [rsp + 0x48]
movzx eax, word [r14]
add r14, 2
mov word [rdx], ax
mov rdx, qword [rsp + 0x48]
add rdx, 2
sub r12d, ebp
mov qword [rsp + 0x48], rdx
jns 0x14006e609
mov r13, qword [rsp + 0x1b0]
mov r12, qword [rsp + 0x1d8]
mov sil, byte [rsp + 0x1d0]
mov r14d, dword [rsp + 0x44]
jmp 0x14006de01
mov word [rdx], r8w
cmp r14b, r8b
jne 0x14006e664
cmp r12, r8
je 0x14006e664
cmp byte [r13 + 0xda], r8b
jne 0x14006e664
mov byte [r12], bpl
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x1c0]
sub rdx, qword [rsp + 0x68]
sar rdx, 1
add rdx, 2
call fcn.14005a250
mov rbx, qword [rsp + 0x48]
lea rcx, [rsp + 0x58]
sub rbx, qword [rsp + 0x68]
sar rbx, 1
call fcn.140052160
mov rax, rbx
mov rbx, qword [rsp + 0x1b8]
add rsp, 0x170
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret