Function at 0x14006c6d0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movzx r8d, byte [rcx + 1]
mov r13, rdx
xor edx, edx
mov r14, rcx
mov ebp, edx
mov esi, edx
test r8d, r8d
je 0x14006ca04
mov r12d, edx
mov r15, r13
mov r9d, 0xff
mov rax, qword [r14 + 8]
mov edi, 0xffffffff
lea rcx, [rax + r12]
movzx eax, byte [rax + r12]
cmp al, 2
jne 0x14006c747
mov r8b, 1
mov edx, ebp
mov rcx, r14
call fcn.140028850
mov qword [r15], rax
test rax, rax
jne 0x14006c9e3
or rax, 0xffffffffffffffff
jmp 0x14006ca07
cmp byte [rcx + 1], 0
mov qword [r15], rdx
je 0x14006c776
movzx eax, word [rcx + 2]
cmp ax, r9w
jae 0x14006c768
mov rax, r9
inc rsi
add rsi, rax
jmp 0x14006c9e9
movzx eax, ax
inc rsi
add rsi, rax
jmp 0x14006c9e9
cmp al, 1
jne 0x14006c791
xor r8d, r8d
mov edx, ebp
mov rcx, r14
call fcn.140028850
mov rbx, rax
test rax, rax
je 0x14006c73e
jmp 0x14006c7f2
cmp ebp, r8d
jge 0x14006c9e9
movzx eax, byte [rcx]
test al, al
jne 0x14006c7b6
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x14006c7b0
cmp qword [rax], 0
jne 0x14006c7c3
cmp byte [rcx + 1], 0
jmp 0x14006c7bd
cmp al, 1
sete al
test al, al
je 0x14006c9e9
mov rdi, qword [rcx + 0x10]
cmp qword [rdi + 0x18], 0
jne 0x14006c8fb
movzx eax, word [rcx + 2]
cmp word [rdi + 0x12], ax
jne 0x14006c8fb
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14006c8fb
mov edi, 0xffffffff
mov r9, r13
mov qword [r15], rbx
mov r8d, ebp
mov rdx, rbx
mov rcx, r14
call fcn.14006ca20
test eax, eax
je 0x14006c73e
cmp eax, 4
je 0x14006c9e3
movzx ecx, byte [rbx + 0x23]
test ecx, ecx
je 0x14006c8e5
sub ecx, 1
je 0x14006c87a
sub ecx, 1
je 0x14006c855
cmp ecx, 1
je 0x14006c846
mov rdx, qword [rbx + 0x28]
xor ecx, ecx
call qword [rbx + reloc.OLEAUT32.dll_SafeArrayGetElement]
inc rsi
add rsi, rax
jmp 0x14006c9e3
xor ecx, ecx
inc rsi
mov eax, ecx
add rsi, rcx
jmp 0x14006c9e3
xor edx, edx
lea rcx, [0x140107f00]
call fcn.1400050a0
cmp rax, rdi
mov ecx, 0
cmove rax, rcx
inc rsi
add rsi, rax
jmp 0x14006c9e3
mov rcx, rbx
call fcn.140001320
cmp dword [0x140105b28], 0
jne 0x14006c8d3
cmp qword [rbx + 0x10], 0
jne 0x14006c8d3
mov rcx, qword [rbx + 0x28]
lea rdx, [rsp + 0x60]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor ecx, ecx
test eax, eax
je 0x14006c8be
dec eax
mov qword [0x140109880], rcx
inc rsi
add rsi, rax
jmp 0x14006c9e3
inc rsi
mov qword [0x140109880], rbx
add rsi, rcx
mov rax, rcx
jmp 0x14006c9e3
mov rax, qword [rbx + 0x10]
inc rsi
shr rax, 1
add rsi, rax
jmp 0x14006c9e3
mov rcx, qword [rbx + 0x10]
xor edx, edx
call fcn.14008f470
inc rsi
add rsi, rax
jmp 0x14006c9e3
movzx eax, word [rcx + 2]
inc rsi
add rsi, rax
test rdi, rdi
je 0x14006c9e9
cmp qword [rdi], 0
je 0x14006c9e9
mov r13d, 0xffffffff
nop
mov rbx, qword [rdi + 8]
movzx eax, word [rdi + 0x12]
sub rsi, rax
movzx ecx, byte [rbx + 0x23]
test ecx, ecx
je 0x14006c9c0
sub ecx, 1
je 0x14006c96d
sub ecx, 1
je 0x14006c951
cmp ecx, 1
je 0x14006c9af
mov rdx, qword [rbx + 0x28]
xor ecx, ecx
call qword [rbx + reloc.OLEAUT32.dll_SafeArrayGetElement]
jmp 0x14006c9cb
xor edx, edx
lea rcx, [0x140107f00]
call fcn.1400050a0
cmp rax, r13
mov edx, 0
cmove rax, rdx
jmp 0x14006c9cd
mov rcx, rbx
call fcn.140001320
cmp dword [0x140105b28], 0
jne 0x14006c9b4
cmp qword [rbx + 0x10], 0
jne 0x14006c9b4
mov rcx, qword [rbx + 0x28]
lea rdx, [rsp + 0x70]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor edx, edx
test eax, eax
je 0x14006c9a8
mov qword [0x140109880], rdx
dec eax
jmp 0x14006c9cd
mov qword [0x140109880], rbx
mov rax, rdx
jmp 0x14006c9cd
mov rax, qword [rbx + 0x10]
shr rax, 1
jmp 0x14006c9cb
mov rcx, qword [rbx + 0x10]
xor edx, edx
call fcn.14008f470
xor edx, edx
add rdi, 0x18
add rsi, rax
cmp qword [rdi], 0
jne 0x14006c920
mov r13, qword [rsp + 0x68]
mov r9d, 0xff
movzx r8d, byte [r14 + 1]
inc ebp
add r12, 0x20
add r15, 8
cmp ebp, r8d
jge 0x14006ca04
xor edx, edx
jmp 0x14006c70f
mov rax, rsi
mov rbx, qword [rsp + 0x78]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret