Function at 0x7ff8266a0034
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x2d0
mov rax, qword [0x7ff8266e2050]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov ebx, r9d
mov r14, r8
mov qword [rsp + 0x88], r8
mov r15, rdx
mov qword [rsp + 0x90], rdx
mov r13, rcx
mov qword [rsp + 0xa8], rcx
mov qword [rsp + 0xa0], rdx
mov qword [rsp + 0x98], r8
mov dil, 1
test byte [0x7ff8266e27f8], dil
jne 0x7ff8266af808
mov dword [r13 + 4], ebx
mov r8d, 0x104
lea rdx, [rsp + 0xb0]
mov rcx, r15
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsW]
nop dword [rax + rax]
test eax, eax
je 0x7ff8266af822
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0xb0]
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_LoadLibraryExW]
nop dword [rax + rax]
mov qword [r13 + 8], rax
test rax, rax
je 0x7ff8266af849
lea rdx, str.NSPStartup
mov rcx, rax
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetProcAddress]
nop dword [rax + rax]
test rax, rax
je 0x7ff8266af898
lea rdx, [r13 + 0x10]
mov rcx, r14
call qword [case.0x7ff8266a4768.0]
mov dword [rsp + 0x80], eax
jmp 0x7ff8266a013d
test eax, eax
jne 0x7ff8266af8c0
cmp qword [r13 + 0x20], 0
je 0x7ff8266a01c2
cmp qword [r13 + 0x28], 0
je 0x7ff8266a01c2
cmp qword [r13 + 0x30], 0
je 0x7ff8266a01c2
cmp qword [r13 + 0x38], 0
je 0x7ff8266a01c2
cmp qword [r13 + 0x40], 0
je 0x7ff8266a01c2
cmp qword [r13 + 0x48], 0
je 0x7ff8266a01c2
cmp qword [r13 + 0x50], 0
je 0x7ff8266a01c2
cmp qword [r13 + 0x58], 0
je 0x7ff8266a01c2
cmp dword [r13 + 0x10], 0x58
jae 0x7ff8266af961
and qword [r13 + 0x60], 0
movups xmm0, xmmword [r14]
movdqu xmmword [r13 + 0x68], xmm0
xor eax, eax
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.7ff8266a4480
mov rbx, qword [rsp + 0x318]
add rsp, 0x2d0
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
test byte [0x7ff8266e27f0], dil
je 0x7ff8266af9ec
mov ecx, 0x11
jmp 0x7ff8266af97a
mov ecx, 0xb
mov r8, r15
lea rdx, [0x7ff8266d87a8]
call 0x7ff8266d2064
nop
jmp 0x7ff8266a009e
test byte [0x7ff8266e27f0], dil
je 0x7ff8266af83f
mov ecx, 0xc
mov r8, r15
lea rdx, [0x7ff8266d87a8]
call 0x7ff8266d2064
mov eax, 0x277b
jmp 0x7ff8266a0199
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test byte [0x7ff8266e27f0], dil
je 0x7ff8266af87c
mov ecx, 0xe
mov r9d, eax
lea r8, [rsp + 0xb0]
lea rdx, [0x7ff8266d87a8]
call 0x7ff8266d2150
mov r15d, 8
cmp ebx, r15d
je 0x7ff8266af9f2
cmp ebx, 0x5af
jne 0x7ff8266af8b5
jmp 0x7ff8266af9f2
test byte [0x7ff8266e27f0], dil
je 0x7ff8266af8b5
mov ecx, 0xf
mov r8, r15
lea rdx, [0x7ff8266d87a8]
call 0x7ff8266d2064
mov r15d, 0x277a
jmp 0x7ff8266af9f2
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov r15d, eax
test byte [0x7ff8266e27f0], dil
je 0x7ff8266af953
movzx ecx, byte [r14 + 0xf]
movzx edx, byte [r14 + 0xe]
movzx r8d, byte [r14 + 0xd]
movzx r10d, byte [r14 + 0xc]
movzx r11d, byte [r14 + 0xb]
movzx ebx, byte [r14 + 0xa]
movzx edi, byte [r14 + 9]
movzx esi, byte [r14 + 8]
movzx eax, word [r14 + 6]
movzx r14d, word [r14 + 4]
mov dword [rsp + 0x70], r15d
mov dword [rsp + 0x68], ecx
mov dword [rsp + 0x60], edx
mov dword [rsp + 0x58], r8d
mov dword [rsp + 0x50], r10d
mov dword [rsp + 0x48], r11d
mov dword [rsp + 0x40], ebx
mov dword [rsp + 0x38], edi
mov dword [rsp + 0x30], esi
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], r14d
mov rax, qword [rsp + 0x88]
mov r9d, dword [rax]
mov r8, qword [rsp + 0x90]
call 0x7ff8266d4654
test r15d, r15d
jne 0x7ff8266af9f2
jmp 0x7ff8266af8b5
cmp qword [r13 + 0x60], 0
jne 0x7ff8266a018d
test byte [0x7ff8266e27f0], dil
je 0x7ff8266af9ec
mov ecx, 0x12
movzx eax, byte [r14 + 0xf]
movzx edx, byte [r14 + 0xe]
movzx r8d, byte [r14 + 0xd]
movzx r9d, byte [r14 + 0xc]
movzx r10d, byte [r14 + 0xb]
movzx r11d, byte [r14 + 0xa]
movzx ebx, byte [r14 + 9]
movzx edi, byte [r14 + 8]
movzx esi, word [r14 + 6]
movzx r14d, word [r14 + 4]
mov dword [rsp + 0x68], eax
mov dword [rsp + 0x60], edx
mov dword [rsp + 0x58], r8d
mov dword [rsp + 0x50], r9d
mov dword [rsp + 0x48], r10d
mov dword [rsp + 0x40], r11d
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], edi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], r14d
mov rax, qword [rsp + 0x88]
mov r9d, dword [rax]
mov r8, r15
call 0x7ff8266d4528
mov r15d, 0x2778
mov rcx, qword [r13 + 8]
test rcx, rcx
je 0x7ff8266afa0c
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_FreeLibrary]
nop dword [rax + rax]
and qword [r13 + 8], 0
mov eax, r15d
jmp 0x7ff8266a0199