Function at 0x1401a13a0
Capabilities:
Set environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xf8
mov qword [rsp + 0x38], rcx
mov rcx, qword [0x1402505f8]
mov rsi, rdx
mov qword [rsp + 0x30], r8
test rcx, rcx
je 0x1401a1658
lea rdx, str.environ
call qword [sym.imp.python39.dll_PyObject_GetAttrString]
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.python39.dll_PyUnicode_FromString]
cmp qword [rsp + 0x30], 0
mov rbp, rax
movzx eax, byte [rsi]
je 0x1401a1534
xor r8d, r8d
mov word [rsp + 0x50], r8w
test al, al
je 0x1401a1697
lea rdx, [rsp + 0x44]
xor r13d, r13d
lea r15, [rsp + 0x50]
mov r12d, 0x28
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x48]
mov qword [rsp + 0x28], rdx
nop
mov rdx, qword [rsp + 0x20]
mov r14, r12
mov byte [rsp + 0x44], al
lea rbx, [r15 + r13*2]
mov rcx, qword [rsp + 0x28]
mov r8d, 2
sub r14, r13
mov byte [rsp + 0x45], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x140217f04
cmp word [r15 + r13*2], 0
movzx eax, word [rsp + 0x48]
je 0x1401a147e
nop
add rbx, 2
sub r14, 1
cmp word [rbx], 0
jne 0x1401a1470
test r14, r14
je 0x140217f04
add r13, 1
mov word [rbx], ax
xor ecx, ecx
movzx eax, byte [rsi + r13]
mov word [rbx + 2], cx
test al, al
jne 0x1401a1430
mov rsi, qword [rsp + 0x30]
mov rcx, r15
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, 0xffffffffffffffff
mov rcx, rsi
call qword [sym.imp.python39.dll_PyUnicode_FromWideChar]
mov rdx, rbp
mov rcx, rdi
mov rbx, rax
mov r8, rax
call qword [sym.imp.python39.dll_PyObject_SetItem]
test eax, eax
jne 0x1401a16a1
sub qword [rbx], 1
jne 0x1401a14e8
mov rax, qword [rbx + 8]
mov rcx, rbx
call qword [rax + 0x30]
sub qword [rbp], 1
jne 0x1401a14f9
mov rax, qword [rbp + 8]
mov rcx, rbp
call qword [rax + 0x30]
sub qword [rdi], 1
jne 0x1401a1520
mov rax, qword [rdi + 8]
mov rcx, rdi
mov rax, qword [rax + 0x30]
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp rax
add rsp, 0xf8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor edx, edx
mov word [rsp + 0xa0], dx
test al, al
je 0x1401a16b7
lea rdx, [rsp + 0x46]
lea rcx, [rsp + 0x4c]
xor r14d, r14d
mov r13d, 0x28
mov qword [rsp + 0x20], rdx
lea r12, [rsp + 0xa0]
mov qword [rsp + 0x28], rcx
nop dword [rax + rax]
mov rdx, qword [rsp + 0x20]
mov r15, r13
mov byte [rsp + 0x46], al
lea rbx, [r12 + r14*2]
mov rcx, qword [rsp + 0x28]
mov r8d, 2
sub r15, r14
mov byte [rsp + 0x47], 0
call sub.msvcrt.dll_mbstowcs
cmp rax, 1
jne 0x140217f04
cmp word [r12 + r14*2], 0
movzx eax, word [rsp + 0x4c]
je 0x1401a15be
nop
add rbx, 2
sub r15, 1
cmp word [rbx], 0
jne 0x1401a15b0
test r15, r15
je 0x140217f04
mov word [rbx], ax
add r14, 1
xor eax, eax
mov word [rbx + 2], ax
movzx eax, byte [rsi + r14]
test al, al
jne 0x1401a1570
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.python39.dll_PyObject_DelItem]
test eax, eax
je 0x1401a14e8
mov rax, qword [rsp + 0x38]
pxor xmm0, xmm0
mov rcx, qword [rax + 0x58]
mov rsi, qword [rax + 0x60]
movups xmmword [rax + 0x58], xmm0
mov rbx, qword [rax + 0x68]
mov qword [rax + 0x68], 0
test rcx, rcx
je 0x1401a162f
sub qword [rcx], 1
jne 0x1401a162f
mov rax, qword [rcx + 8]
call qword [rax + 0x30]
test rsi, rsi
je 0x1401a1644
sub qword [rsi], 1
jne 0x1401a1644
mov rax, qword [rsi + 8]
mov rcx, rsi
call qword [rax + 0x30]
test rbx, rbx
jne 0x1401a14d8
jmp 0x1401a14e8
lea rcx, [0x1402278c0]
call qword [sym.imp.python39.dll_PyImport_ImportModule]
mov qword [0x1402505f8], rax
mov rcx, rax
test rax, rax
jne 0x1401a13d0
lea r8, str._Unexpected_failure_of_hard_import_of_os_
lea rdx, str.IMPORT_HARD_OS
lea rcx, str._s_:__s_n
call fcn.1401a09f0
call sub.msvcrt.dll_abort
lea r15, [rsp + 0x50]
jmp 0x1401a149d
mov ecx, 1
call qword [sym.imp.python39.dll_PyErr_PrintEx]
mov ecx, 1
call qword [sym.imp.python39.dll_Py_Exit]
lea r12, [rsp + 0xa0]
jmp 0x1401a15dd
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop
call sub.msvcrt.dll_abort
nop