Function at 0x140004da5
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x478
mov r15, rcx
lea rsi, [rsp + 0x78]
mov rcx, rsi
call fcn.1400051ec
mov rdi, qword [rsi]
test rdi, rdi
je 0x140005058
mov qword [rsp + 0x50], r15
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x70], rax
mov esi, 0x200
mov eax, 2
mov qword [rsp + 0x28], rax
xor r14d, r14d
mov rbx, qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor r15d, r15d
cmp rsi, 0x201
jae 0x140004e1d
lea r12, [rsp + 0x78]
mov ebp, 0x200
mov r13, rsi
jmp 0x140004ecf
sub rsi, r15
mov rax, r14
sub rax, r15
cmp rax, rsi
jae 0x140004eb1
add r15, rsi
jb 0x1400051e8
lea rax, [r14 + r14]
mov rsi, rax
cmp rax, r15
ja 0x140004e47
mov rsi, r15
cmp rsi, 5
jae 0x140004e52
mov esi, 4
xor edx, edx
mov rcx, rsi
shr rcx, 0x3e
sete cl
test r14, r14
je 0x140004e79
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x40], rax
mov eax, 2
jmp 0x140004e7b
xor eax, eax
lea r8, [rsi + rsi]
mov dl, cl
add rdx, rdx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x58]
lea r9, [rsp + 0x30]
call fcn.140002835
cmp qword [rsp + 0x58], 0
jne 0x1400051e2
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x28], rax
mov r14, rsi
mov eax, 0xffffffff
mov r15, r14
cmp r14, rax
jb 0x140004ec4
mov r15d, 0xffffffff
mov r12, qword [rsp + 0x28]
mov rbp, r15
mov r13, r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rcx, rdi
mov rdx, r12
mov r8d, r13d
call rbx
mov esi, eax
test eax, eax
jne 0x140004ef6
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140005090
mov esi, esi
cmp r13, rsi
jne 0x140004f27
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1400051e8
add r13, r13
mov eax, 0xffffffff
cmp r13, rax
jb 0x140004f1f
mov r13d, 0xffffffff
mov rsi, r13
jmp 0x140004e02
jb 0x140004e02
cmp rbp, rsi
jb 0x1400051e8
mov rcx, rsi
xor edx, edx
call fcn.14000269e
lea rbx, [rsp + 0x30]
mov qword [rbx], rax
mov qword [rbx + 8], rdx
and qword [rbx + 0x10], 0
mov byte [rbx + 0x18], 1
lea rax, [r12 + rsi*2]
lea r13, [rsp + 0x58]
mov qword [r13], r12
mov qword [r13 + 8], rax
and word [r13 + 0x10], 0
lea rbp, [rsp + 0x20]
mov r15, qword [rsp + 0x50]
mov rcx, r13
call fcn.1400025f6
test ax, ax
je 0x140004f99
movzx ecx, ax
cmp ecx, 2
je 0x14000506a
shr eax, 0x10
mov byte [rsp + 0x48], 0
jmp 0x140004f9d
shr rax, 0x20
and dword [rsp + 0x20], 0
cmp eax, 0x80
jae 0x140004fb7
mov byte [rsp + 0x20], al
mov eax, 1
jmp 0x140005040
mov ecx, eax
cmp eax, 0x800
jae 0x140004fd9
shr ecx, 6
or cl, 0xc0
mov byte [rsp + 0x20], cl
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x21], al
mov eax, 2
jmp 0x140005040
cmp eax, 0x10000
jae 0x140005008
shr ecx, 0xc
or cl, 0xe0
mov byte [rsp + 0x20], cl
mov ecx, eax
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [rsp + 0x21], cl
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x22], al
mov eax, 3
jmp 0x140005040
shr ecx, 0x12
and cl, 7
or cl, 0xf0
mov byte [rsp + 0x20], cl
mov ecx, eax
shr ecx, 0xc
and cl, 0x3f
or cl, 0x80
mov byte [rsp + 0x21], cl
mov ecx, eax
shr ecx, 6
and cl, 0x3f
or cl, 0x80
mov byte [rsp + 0x22], cl
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x23], al
mov eax, 4
lea r8, [rsp + rax]
add r8, 0x20
mov rcx, rbx
mov rdx, rbp
call fcn.1400028f1
jmp 0x140004f76
mov rcx, qword [rsp + 0x80]
call fcn.1400041f6
jmp 0x1400050f0
mov r12, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov bpl, byte [rsp + 0x48]
mov eax, dword [rsp + 0x49]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x4c]
mov dword [rsp + 0x5b], eax
jmp 0x1400050a0
mov bpl, 2
call fcn.14000545c
mov r12, rax
mov r15, qword [rsp + 0x50]
test r14, r14
je 0x1400050ba
add r14, r14
mov edx, 2
mov rcx, qword [rsp + 0x28]
mov r8, r14
call fcn.140003f72
cmp bpl, 2
jne 0x1400050cd
mov rcx, r12
call fcn.1400041f6
mov bpl, 2
jmp 0x1400050dd
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x5b]
mov dword [rsp + 0x23], ecx
mov dword [rsp + 0x20], eax
mov rcx, rdi
mov rdx, qword [rsp + 0x70]
call fcn.140003f5c
cmp bpl, 2
jne 0x140005109
mov byte [r15 + 0x18], 2
add rsp, 0x478
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov al, 2
test bpl, bpl
je 0x14000513c
mov qword [r15], r12
mov qword [r15 + 8], rbx
mov qword [r15 + 0x10], rsi
cmp al, 2
jne 0x140005126
mov byte [r15 + 0x18], 3
jmp 0x1400050f5
mov byte [r15 + 0x18], al
mov eax, dword [rsp + 0x30]
mov ecx, dword [rsp + 0x33]
mov dword [r15 + 0x19], eax
mov dword [r15 + 0x1c], ecx
jmp 0x1400050f5
lea rcx, [r12 + rsi]
mov rdx, r12
cmp rdx, rcx
je 0x140005110
mov r8, rdx
inc rdx
mov r9b, byte [r8]
test r9b, r9b
jns 0x140005143
cmp r9b, 0xe0
jae 0x140005169
add r8, 2
cmp rdx, rcx
cmovne rdx, r8
jmp 0x140005143
cmp r9b, 0xed
jne 0x140005190
cmp rdx, rcx
mov rdx, rcx
je 0x140005143
lea r9, [r8 + 2]
mov rdx, rcx
cmp r9, rcx
je 0x140005143
lea rdx, [r8 + 3]
cmp byte [r8 + 1], 0x9f
jbe 0x140005143
jmp 0x1400051bb
add r8, 2
cmp rdx, rcx
cmove r8, rdx
xor edx, edx
cmp r8, rcx
setne dl
add rdx, r8
cmp r9b, 0xf0
jb 0x140005143
xor r8d, r8d
cmp rdx, rcx
setne r8b
add rdx, r8
jmp 0x140005143
mov eax, dword [rsp + 0x20]
mov ecx, dword [rsp + 0x23]
mov dword [rsp + 0x7b], ecx
mov dword [rsp + 0x78], eax
mov eax, dword [rsp + 0x78]
mov ecx, dword [rsp + 0x7b]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x33], ecx
xor eax, eax
jmp 0x140005110
cmp qword [rsp + 0x60], 0
ud2