Function at 0x1400021c0
Capabilities:
Query environment variable
Set environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x2c0]
sub rsp, 0x3c0
mov rax, qword [0x14003a010]
xor rax, rsp
mov qword [rbp + 0x2b0], rax
mov r15, rdx
mov dword [rsp + 0x40], ecx
mov ebx, ecx
xor edx, edx
lea rcx, [0x140030d08]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
mov r14, 0xffffffffffffffff
test eax, eax
je 0x1400022b5
mov eax, 2
mul rsi
cmovo rax, r14
mov rcx, rax
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov r8d, esi
lea rcx, [0x140030d08]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rsi - 1]
cmp ecx, eax
jne 0x1400022ac
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
test eax, eax
je 0x1400022a8
mov eax, 2
mul rbx
cmovo rax, r14
mov rcx, rax
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov r8d, ebx
mov rcx, rdi
mov rdx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x14000229f
mov rdx, rsi
lea rcx, [0x140030d08]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, rsi
call qword [sym.imp.mozglue.dll_free]
mov ebx, dword [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.mozglue.dll_free]
lea rcx, [0x140030df0]
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
movsxd rcx, ebx
mov eax, 8
inc rcx
mov rsi, r14
mul rcx
mov qword [rsp + 0x48], rcx
cmovo rax, r14
mov rcx, rax
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov r12, rax
test rax, rax
je 0x1400072fa
mov qword [rsp + 0x3f8], r13
movsxd r13, ebx
test ebx, ebx
jle 0x14000238a
xor r14d, r14d
mov rbx, rax
sub r15, rax
mov rdi, qword [r15 + rbx]
inc rsi
cmp word [rdi + rsi*2], 0
jne 0x140002311
lea eax, [rsi*2 + 1]
add eax, esi
movsxd rcx, eax
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov r11, rax
test rax, rax
je 0x140007408
mov ecx, esi
mov rdx, rax
lea r9, [rdi + rcx*2]
cmp rdi, r9
jae 0x14000236d
mov eax, 0xff80
nop dword [rax]
movzx ecx, word [rdi]
mov r8, rdi
test ax, cx
jne 0x140007304
mov byte [rdx], cl
inc rdx
add rdi, 2
cmp rdi, r9
jb 0x140002350
mov byte [rdx], 0
inc r14
mov qword [rbx], r11
mov rsi, 0xffffffffffffffff
add rbx, 8
cmp r14, r13
jl 0x14000230d
mov ebx, dword [rsp + 0x40]
mov eax, 8
mov qword [r12 + r13*8], 0
mul qword [rsp + 0x48]
cmovo rax, rsi
mov rcx, rax
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov r14, rax
test rax, rax
je 0x140007419
test r13, r13
jle 0x1400023d7
mov rdi, r12
mov rcx, rax
sub rdi, rax
mov rdx, r13
mov rax, qword [rdi + rcx]
mov qword [rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x1400023c6
lea rcx, str.PATH
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll___p__environ]
mov dl, 1
lea rcx, [rsp + 0x70]
mov r15, qword [rax]
call qword [sym.imp.mozglue.dll_private:_static_class_mozilla::TimeStamp___cdecl_mozilla::TimeStamp::Now_bool_]
cmp ebx, 1
jle 0x14000241c
mov rax, qword [r12 + 8]
mov rdx, rax
movzx ecx, byte [rax]
cmp cl, 0x2d
je 0x14000742d
cmp cl, 0x2f
je 0x140007452
xor ecx, ecx
call qword [sym.imp.mozglue.dll_void___cdecl_DllBlocklist_Initialize_unsigned_int_]
cmp byte [0x14003a938], 0
jne 0x140002451
mov r8d, 0x104
lea rdx, [0x14003a730]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x1400076eb
mov byte [0x14003a938], 1
lea r8, [0x14003a730]
mov edx, 0x104
lea rcx, [rbp + 0xa0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
test eax, eax
jne 0x1400076eb
mov qword [rsp + 0x38], 0
lea rax, [rbp - 0x70]
mov qword [rsp + 0x30], 0
lea r8, [rbp + 0xa0]
mov dword [rsp + 0x28], 0x104
mov r9d, esi
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rbp - 0x70]
call qword [sym.imp.mozglue.dll_strdup]
mov rbx, rax
test rax, rax
je 0x1400076ed
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400010c0
mov rdi, qword [rax]
mov qword [rax], 0
mov rsi, qword [0x14003c1c0]
mov qword [0x14003c1c0], rdi
test rsi, rsi
jne 0x1400074dd
mov rsi, qword [rsp + 0x48]
mov qword [rsp + 0x48], 0
test rsi, rsi
jne 0x1400074fe
test rdi, rdi
je 0x14000751f
mov rax, qword [rdi]
mov rsi, qword [rax + 0x10]
mov rcx, rsi
call qword [fcn.140006070]
mov rcx, rdi
call rsi
mov rcx, rbx
call qword [sym.imp.mozglue.dll_free]
movups xmm0, xmmword [rsp + 0x70]
mov rsi, qword [0x14003c1c0]
movsd xmm1, qword [rbp - 0x80]
movaps xmmword [rsp + 0x50], xmm0
movsd qword [rsp + 0x60], xmm1
mov rax, qword [rsi]
mov rdi, qword [rax + 0x28]
mov rcx, rdi
call qword [fcn.140006070]
lea r8, [rsp + 0x50]
mov edx, 1
mov rcx, rsi
call rdi
mov rsi, qword [0x14003c1c0]
mov rax, qword [rsi]
mov rdi, qword [rax + 0x60]
mov rcx, rdi
call qword [fcn.140006070]
mov rcx, rsi
call rdi
lea rcx, str.XUL_APP_FILE
mov rbx, r12
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rsi, rax
test rax, rax
jne 0x140007530
cmp dword [rsp + 0x40], 1
jle 0x1400025ee
mov rdi, qword [r12 + 8]
mov rax, rdi
movzx ecx, byte [rdi]
cmp cl, 0x2d
je 0x14000753e
cmp cl, 0x2f
je 0x140007563
cmp dword [rsp + 0x40], 1
jle 0x1400025ee
mov rax, qword [r12 + 8]
lea rdi, [r12 + 8]
mov rdx, rax
movzx ecx, byte [rax]
cmp cl, 0x2d
je 0x1400075fb
cmp cl, 0x2f
je 0x140007620
mov r15d, dword [rsp + 0x40]
test rsi, rsi
jne 0x14000768e
lea rax, str.Mozilla
mov qword [rsp + 0x60], rax
lea rax, str.browser
mov qword [rsp + 0x68], rax
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14003c27c], eax
jle 0x1400027ab
lea rcx, [0x14003c27c]
call fcn.140005c78
cmp dword [0x14003c27c], 0xffffffff
jne 0x1400027ab
lea rcx, str.MOZ_ENABLE_HANDLE_VERIFIER
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x1400076aa
mov rcx, qword [0x14003c170]
test rcx, rcx
jne 0x14000267b
call fcn.140002b50
mov rcx, qword [0x14003c170]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp qword [sym.firefox.exe_g_shared_section], 0
jne 0x1400076cb
mov rdi, qword [0x14003c178]
test rdi, rdi
jne 0x1400076c4
mov ecx, 0x80
call qword [sym.imp.mozglue.dll_moz_xmalloc]
xor esi, esi
mov rdi, rax
test rax, rax
je 0x1400076bc
lea rax, [0x140030d18]
mov qword [rdi], rax
lea ecx, [rsi + 0x18]
mov qword [rdi + 8], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
mov qword [rdi + 0x48], rsi
mov qword [rdi + 0x50], rsi
mov qword [rdi + 0x58], rsi
call qword [sym.imp.mozglue.dll_moz_xmalloc]
lea ecx, [rsi + 0x30]
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rdi + 0x50], rax
mov qword [rdi + 0x60], rsi
mov qword [rdi + 0x68], rsi
call qword [sym.imp.mozglue.dll_moz_xmalloc]
lea ecx, [rsi + 0x20]
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rdi + 0x60], rax
mov qword [rdi + 0x70], rsi
mov qword [rdi + 0x78], rsi
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rdi + 0x70], rax
lea rcx, [0x1400028a0]
mov qword [0x14003c178], rdi
call fcn.140005a28
mov rdi, qword [0x14003c178]
test rdi, rdi
je 0x1400076cd
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
test eax, eax
jne 0x1400076cd
mov rax, qword [rdi]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [rax + 8]
mov rcx, qword [rsp + 0x48]
mov dl, 1
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140002798
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [0x14003c27c]
mov qword [0x14003c1b0], rdi
call fcn.140005c18
mov rdi, qword [0x14003c1b0]
call fcn.140004590
test rdi, rdi
je 0x1400076d5
mov rsi, qword [0x14003c1c0]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rax
mov rax, qword [rsi]
mov rdi, qword [rax + 0x30]
mov rcx, rdi
call qword [fcn.140006070]
lea r9, [rsp + 0x50]
mov r8, rbx
mov edx, r15d
mov rcx, rsi
call rdi
mov ebx, eax
mov rsi, qword [0x14003c1c0]
mov rax, qword [rsi]
mov rdi, qword [rax + 0x18]
mov rcx, rdi
call qword [fcn.140006070]
mov rcx, rsi
call rdi
mov rsi, qword [0x14003c1c0]
mov qword [0x14003c1c0], 0
test rsi, rsi
je 0x14000283b
mov rax, qword [rsi]
mov rdi, qword [rax + 8]
mov rcx, rdi
call qword [fcn.140006070]
mov rcx, rsi
call rdi
mov rcx, r12
call qword [sym.imp.mozglue.dll_free]
test r13, r13
je 0x14000285c
mov rcx, qword [r14 + r13*8 - 8]
dec r13
call qword [sym.imp.mozglue.dll_free]
test r13, r13
jne 0x140002849
mov rcx, r14
call qword [sym.imp.mozglue.dll_free]
mov eax, ebx
mov r13, qword [rsp + 0x3f8]
mov rcx, qword [rbp + 0x2b0]
xor rcx, rsp
call fcn.1400057b0
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov eax, 0x7f
jmp 0x14000286f
mov eax, 0xf800
test ax, cx
jne 0x14000732b
movzx eax, cx
and cl, 0x3f
shr ax, 6
or cl, 0x80
or al, 0xc0
mov byte [rdx], al
mov byte [rdx + 1], cl
add rdx, 2
jmp 0x1400073ec
movzx r10d, cx
mov eax, r10d
and eax, 0xfffff800
cmp eax, 0xd800
je 0x140007365
movzx eax, cx
shr ax, 0xc
or al, 0xe0
mov byte [rdx], al
movzx eax, cx
shr ax, 6
and cl, 0x3f
and al, 0x3f
or al, 0x80
or cl, 0x80
mov byte [rdx + 1], al
mov byte [rdx + 2], cl
jmp 0x1400073e8
mov eax, r10d
and eax, 0xfffffc00
cmp eax, 0xd800
jne 0x1400073df
add rdi, 2
cmp rdi, r9
je 0x1400073f6
movzx ecx, word [rdi]
mov eax, ecx
and eax, 0xfffffc00
cmp eax, 0xdc00
jne 0x1400073dc
and r10d, 0x3ff
and ecx, 0x3ff
add r10d, 0x40
shl r10d, 0xa
add r10d, ecx
mov eax, r10d
shr eax, 0x12
or al, 0xf0
mov byte [rdx], al
mov eax, r10d
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [rdx + 1], al
mov eax, r10d
shr eax, 6
and r10b, 0x3f
and al, 0x3f
or r10b, 0x80
or al, 0x80
mov byte [rdx + 2], al
mov byte [rdx + 3], r10b
add rdx, 4
jmp 0x1400073ec
mov rdi, r8
mov word [rdx], 0xbfef
mov byte [rdx + 2], 0xbd
add rdx, 3
mov eax, 0xff80
jmp 0x140002364
mov word [rdx], 0xbfef
mov byte [rdx + 2], 0xbd
add rdx, 3
jmp 0x14000236d
mov qword [rbx], 0
mov eax, 0x7f
jmp 0x140002867
mov rdx, r12
mov ecx, ebx
call fcn.140009050
mov eax, 0x7f
jmp 0x140002867
xor ecx, ecx
cmp byte [rax + 1], 0x2d
sete cl
inc rdx
add rcx, rdx
lea rdx, str.contentproc
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14000746b
jmp 0x14000241c
lea rcx, [rax + 1]
lea rdx, str.contentproc
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14000241c
mov ecx, 1
call qword [sym.imp.mozglue.dll_void___cdecl_DllBlocklist_Initialize_unsigned_int_]
cmp qword [sym.firefox.exe_g_shared_section], 0
je 0x14000749b
call fcn.14002ed5c
test rax, rax
jne 0x14000749b
lea rcx, str.Failed_to_initialize_the_sandbox_target_services.
call fcn.140009284
jmp 0x140007707
call fcn.14000915c
test eax, eax
js 0x140007707
mov rcx, qword [0x14003c1c0]
mov r8, r12
mov edx, ebx
call fcn.140009390
mov rsi, qword [0x14003c1c0]
mov ebx, eax
mov rax, qword [rsi]
mov rdi, qword [rax + 0x18]
mov rcx, rdi
call qword [fcn.140006070]
mov rcx, rsi
call rdi
nop
jmp 0x14000283b
mov rax, qword [rsi]
mov rdi, qword [rax + 8]
mov rcx, rdi
call qword [fcn.140006070]
mov rcx, rsi
call rdi
mov rdi, qword [0x14003c1c0]
jmp 0x1400024f0
mov rax, qword [rsi]
mov rdi, qword [rax + 8]
mov rcx, rdi
call qword [fcn.140006070]
mov rcx, rsi
call rdi
mov rdi, qword [0x14003c1c0]
jmp 0x140002507
lea rcx, str.Couldnt_load_XPCOM._n
call fcn.140009284
jmp 0x1400076fe
cmp byte [rax], 0
jne 0x1400025c5
jmp 0x1400025a1
xor ecx, ecx
lea rdx, [0x1400317f0]
cmp byte [rdi + 1], 0x2d
sete cl
inc rax
add rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14000757c
jmp 0x1400025c5
lea rcx, [rdi + 1]
lea rdx, [0x1400317f0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x1400025c5
mov r15d, dword [rsp + 0x40]
cmp r15d, 2
jne 0x14000759d
lea rcx, str.Incorrect_number_of_arguments_passed_to__app
call fcn.140009284
mov ebx, 0xff
jmp 0x1400027f3
mov rsi, qword [r12 + 0x10]
lea rbx, [r12 + 0x10]
mov r8, rsi
lea rdx, str.XUL_APP_FILE_s
lea rcx, [rbp - 0x70]
call fcn.140008ff0
lea rcx, [rbp - 0x70]
call qword [sym.imp.mozglue.dll_strdup]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
test eax, eax
je 0x1400075eb
lea rdx, [rbp - 0x70]
lea rcx, str.Couldnt_set__s._n
call fcn.140009284
mov ebx, 0xff
jmp 0x1400027f3
mov rax, qword [r12]
add r15d, 0xfffffffe
mov qword [rbx], rax
jmp 0x1400025f3
xor ecx, ecx
cmp byte [rax + 1], 0x2d
sete cl
inc rdx
add rcx, rdx
lea rdx, str.xpcshell
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140007639
jmp 0x1400025ee
lea rcx, [rax + 1]
lea rdx, str.xpcshell
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x1400025ee
cmp r13, 1
jle 0x14000764b
lea rsi, [r12 + 0x10]
lea rcx, [r13 - 1]
rep movsq qword [rdi], qword [rsi]
call fcn.14002ed00
mov rbx, qword [0x14003c1c0]
mov edi, dword [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov rax, qword [rbx]
mov rsi, qword [rax + 0x40]
mov rcx, rsi
call qword [fcn.140006070]
lea rax, [rsp + 0x48]
mov r9, r15
mov r8, r12
mov qword [rsp + 0x20], rax
lea edx, [rdi - 1]
mov rcx, rbx
call rsi
nop
jmp 0x1400027f1
cmp byte [rsi], 0
je 0x1400025fc
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], rsi
jmp 0x140002614
call fcn.14002eab4
test al, al
jne 0x140002681
jmp 0x140002663
mov rdi, rsi
jmp 0x14000273a
xor esi, esi
jmp 0x140002754
xor esi, esi
mov rdi, rsi
jmp 0x140002798
lea rcx, str.Couldnt_initialize_the_broker_services._n
call fcn.140009284
mov ebx, 0xff
jmp 0x1400027f3
xor ebx, ebx
lea rcx, str.Couldnt_find_the_application_directory._n
call fcn.140009284
test rbx, rbx
je 0x140007707
mov rcx, rbx
call qword [sym.imp.mozglue.dll_free]
mov ebx, 0xff
jmp 0x14000283b