Function at 0x1400071b6
Capabilities:
Query environment variable

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rbp, rdx
mov rbx, r8
test rcx, rcx
je 0x14000723b
test rdx, rdx
je 0x14000726e
test r8, r8
je 0x14000729e
mov r8, qword [r8]
test r8, r8
je 0x1400072ce
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov r9d, eax
test eax, eax
je 0x140007349
mov eax, eax
mov rdx, qword [rbx]
cmp rdx, rax
jb 0x14000741c
lea eax, [r9 - 1]
mov qword [rbx], rax
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
mov r9, rbp
mov r8, rsi
lea rdx, str.fs_path_expand
lea rcx, str._I____s_____Done_path_s_xpath_s_xpath_sz_llu__n
call fcn.140002ef2
mov edi, 0
jmp 0x14000733e
mov dword [rsp + 0x20], 0x515
lea r9, str.C:_Projects_rdp_bot_codebase_fs.c
lea r8, str._path___NULL_
lea rdx, str.fs_path_expand
lea rcx, [0x1400113e0]
call fcn.140002ef2
mov edi, 0x40000004
jmp 0x1400072fc
mov dword [rsp + 0x20], 0x516
lea r9, str.C:_Projects_rdp_bot_codebase_fs.c
lea r8, str._xpath___NULL_
lea rdx, str.fs_path_expand
lea rcx, [0x1400113e0]
call fcn.140002ef2
mov edi, 0x40000004
jmp 0x1400072fc
mov dword [rsp + 0x20], 0x517
lea r9, str.C:_Projects_rdp_bot_codebase_fs.c
lea r8, str._xpath_sz___NULL_
lea rdx, str.fs_path_expand
lea rcx, [0x1400113e0]
call fcn.140002ef2
mov edi, 0x40000004
jmp 0x1400072fc
mov dword [rsp + 0x20], 0x518
lea r9, str.C:_Projects_rdp_bot_codebase_fs.c
lea r8, str.__xpath_sz____0_
lea rdx, str.fs_path_expand
lea rcx, [0x1400113e0]
call fcn.140002ef2
mov edi, 0x40000004
mov eax, edi
and eax, 0x3fffffff
test rbx, rbx
je 0x140007491
mov r9, qword [rbx]
mov dword [rsp + 0x20], eax
mov r8, rsi
lea rdx, str.fs_path_expand
lea rcx, str._E____s_____Failed_path_s_xpath_sz_llu_err_08x__n
call fcn.140002ef2
test rbx, rbx
je 0x140007335
mov qword [rbx], 0
test rbp, rbp
je 0x14000733e
mov byte [rbp], 0
mov eax, edi
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov r9d, eax
mov r8, rsi
lea rdx, str.fs_path_expand
lea rcx, str._E____s_____ExpandEnvironmentStringsA_failed_path_s_gle_lu__n
call fcn.140002ef2
cmp edi, 0x20
ja 0x140007391
ja case.0x140007385.1
mov edi, edi
lea rdx, [0x140012c2c]
movsxd rax, dword [rdx + rdi*4]
add rax, rdx
jmp rax
mov edi, 0x40000008
jmp 0x1400072fc
cmp edi, 0x94
je 0x14000744b
cmp edi, 0x94
jbe 0x1400073d3
cmp edi, 0xb7
je 0x140007473
cmp edi, 0x80070005
je 0x14000747d
cmp edi, 0xaa
jne 0x140007487
mov edi, 0x4000000d
jmp 0x1400072fc
cmp edi, 0x7f
ja 0x1400073ec
cmp edi, 0x7e
jae 0x140007455
cmp edi, 0x50
jne 0x14000745f
mov edi, 0x40000007
jmp 0x1400072fc
cmp edi, 0x91
jne 0x140007469
mov edi, 0x4000000d
jmp 0x1400072fc
mov edi, 0x40000003
jmp 0x1400072fc
mov edi, 0x40000009
jmp 0x1400072fc
mov edi, 0x4000000d
jmp 0x1400072fc
mov qword [rsp + 0x20], rdx
mov r8, rsi
lea rdx, str.fs_path_expand
lea rcx, str._E____s_____ExpandEnvironmentStringsA_buffer_is_too_small_path_s_res_lu_xpath_sz_llu__n
call fcn.140002ef2
mov edi, 0x4000000b
jmp 0x1400072fc
mov edi, 0x40000001
jmp 0x1400072fc
mov edi, 0x4000000d
jmp 0x1400072fc
mov edi, 0x40000003
jmp 0x1400072fc
mov edi, 0x40000001
jmp 0x1400072fc
mov edi, 0x40000001
jmp 0x1400072fc
mov edi, 0x40000007
jmp 0x1400072fc
mov edi, 0x40000009
jmp 0x1400072fc
mov edi, 0x40000001
jmp 0x1400072fc
mov r9d, 0
jmp 0x14000730f