Function at 0x140150290
Capabilities:
Query environment variable

Disassembly:
push rax
pushf
mov eax, 0xf1617af0
pushf
not eax
add eax, 0x72210167
xor eax, 0x4668fe2c
rol eax, 5
popf
pushf
not eax
add eax, 0x39a135c1
xor eax, 0x5eb22a68
rol eax, 0xdd
popf
cmp eax, 2
jne 0x1401502cd
popf
pop rax
jmp 0x14015049d
cmp eax, 6
jne 0x1401502dc
popf
pop rax
jmp 0x140150713
cmp eax, 3
jne 0x1401502eb
popf
pop rax
jmp 0x1401504fa
cmp eax, 1
jne 0x1401502fa
popf
pop rax
jmp 0x14015041c
cmp eax, 4
jne 0x140150309
popf
pop rax
jmp 0x1401505a2
cmp eax, 7
jne 0x140150318
popf
pop rax
jmp 0x14015077d
cmp eax, 0
jne 0x140150327
popf
pop rax
jmp 0x140150345
cmp eax, 8
jne 0x140150336
popf
pop rax
jmp 0x1401507d7
cmp eax, 5
jne 0x140150345
popf
pop rax
jmp 0x140150661
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
jmp 0x14015035a
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1401503c3
push rax
pushf
mov eax, 0x8de3a579
pushf
not eax
add eax, 0x62ca8256
xor eax, 0x48df80d3
rol eax, 0xe9
popf
pushf
not eax
add eax, 0x2d105188
xor eax, 0x5d494231
rol eax, 0x6e
popf
pushf
not eax
add eax, 0x58cd6ae5
xor eax, 0x6b8c0c34
rol eax, 0xa6
popf
pushf
not eax
add eax, 0xf235e04
xor eax, 0x46b018de
rol eax, 0x2e
popf
jmp 0x1401502be
push rax
pushf
mov eax, 0xd7a4e830
pushf
not eax
add eax, 0x3803b907
xor eax, 0xf619949
rol eax, 0x98
popf
pushf
not eax
add eax, 0x695b281e
xor eax, 0x23135c2d
rol eax, 0x49
popf
pushf
not eax
add eax, 0x48f16fae
xor eax, 0x70819a7
rol eax, 0xe
popf
pushf
not eax
add eax, 0x3e9ed644
xor eax, 0x65fe0220
rol eax, 0x93
popf
jmp 0x1401502be
mov rsi, rbx
cmp word [rax], bp
je 0x14015046a
push rax
pushf
mov eax, 0x4dd57490
pushf
not eax
add eax, 0x4617df7a
xor eax, 0x1e8163dc
rol eax, 0x3a
popf
pushf
not eax
add eax, 0x2f694df
xor eax, 0x1b80af19
rol eax, 0x71
popf
pushf
not eax
add eax, 0x59608051
xor eax, 0xa1a1e9b
rol eax, 0xa1
popf
jmp 0x1401502be
push rax
pushf
mov eax, 0x73e6f0a3
pushf
not eax
add eax, 0x34f234cb
xor eax, 0x2178cff6
rol eax, 0xba
popf
pushf
not eax
add eax, 0x25513c3e
xor eax, 0x5dcf6e0c
rol eax, 0x81
popf
jmp 0x1401502be
or rax, 0xffffffffffffffff
push rax
pushf
mov eax, 0x3e179dfd
pushf
not eax
add eax, 0x2f93e92b
xor eax, 0x7e1c98c2
rol eax, 7
popf
pushf
not eax
add eax, 0x294f0a58
xor eax, 0x795ec3e
rol eax, 0xcf
popf
pushf
not eax
add eax, 0xdda168c
xor eax, 0x7fec22fb
rol eax, 0xe5
popf
pushf
not eax
add eax, 0x6dfde043
xor eax, 0x581f5b24
rol eax, 5
popf
jmp 0x1401502be
inc rax
cmp word [rsi + rax*2], bp
jne 0x140150549
push rax
pushf
mov eax, 0xdce98a8b
pushf
not eax
add eax, 0x6b38fbdc
xor eax, 0x36dfcfcf
rol eax, 6
popf
pushf
not eax
add eax, 0x4e8dd2af
xor eax, 0x39c305a
rol eax, 0xb1
popf
pushf
not eax
add eax, 0x4f8feb0b
xor eax, 0x1a4b9786
rol eax, 0xe
popf
jmp 0x1401502be
push rax
pushf
mov eax, 0x9e9066
pushf
not eax
add eax, 0x76c397d2
xor eax, 0x4888f44e
rol eax, 0xcd
popf
pushf
not eax
add eax, 0x61a8fa1f
xor eax, 0x5c574add
rol eax, 0x16
popf
pushf
not eax
add eax, 0x51b255d
xor eax, 0x124569e5
rol eax, 0x41
popf
pushf
not eax
add eax, 0x1a7d8140
xor eax, 0x7f416e5e
rol eax, 0x3f
popf
jmp 0x1401502be
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140150608
push rax
pushf
mov eax, 0x71851afa
pushf
not eax
add eax, 0x47e40887
xor eax, 0x5b03183e
rol eax, 0x35
popf
pushf
not eax
add eax, 0x4015dc98
xor eax, 0x248cd858
rol eax, 0xab
popf
pushf
not eax
add eax, 0x8aca710
xor eax, 0x127b574
rol eax, 0x71
popf
pushf
not eax
add eax, 0x7b83f7f1
xor eax, 0x21f47752
rol eax, 0x2e
popf
jmp 0x1401502be
push rax
pushf
mov eax, 0x32d350af
pushf
not eax
add eax, 0x445fa626
xor eax, 0x4b1afd81
rol eax, 0x61
popf
pushf
not eax
add eax, 0x63e09f37
xor eax, 0x107bd126
rol eax, 0x1e
popf
pushf
not eax
add eax, 0x1d7fbf50
xor eax, 0x3832cc53
rol eax, 0x8c
popf
pushf
not eax
add eax, 0x73b7cce8
xor eax, 0x7e735788
rol eax, 0x50
popf
jmp 0x1401502be
push rbx
not rbx
add rsi, rbx
pop rbx
add rsi, 1
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140129956
mov rdi, rax
test rax, rax
je 0x1401506ba
push rax
pushf
mov eax, 0x96646679
pushf
not eax
add eax, 0x6222ba79
xor eax, 0x24c43e20
rol eax, 0x72
popf
pushf
not eax
add eax, 0x1e060a51
xor eax, 0x66854c67
rol eax, 0xb1
popf
jmp 0x1401502be
push rax
pushf
mov eax, 0xb64e77a3
pushf
not eax
add eax, 0x41a23073
xor eax, 0x4ef290ef
rol eax, 0x23
popf
pushf
not eax
add eax, 0x15fad0c2
xor eax, 0x3a50d91e
rol eax, 0xb6
popf
pushf
not eax
add eax, 0x60cd3c6d
xor eax, 0x52acfcd7
rol eax, 0xde
popf
pushf
not eax
add eax, 0x6975c6c7
xor eax, 0x2ff8ac98
rol eax, 0x9f
popf
jmp 0x1401502be
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140029ea0
mov rbp, rdi
push rax
pushf
mov eax, 0x35614281
pushf
not eax
add eax, 0x36719af8
xor eax, 0x5ffee25a
rol eax, 0xf5
popf
pushf
not eax
add eax, 0x7def2655
xor eax, 0x600d14c4
rol eax, 0x5c
popf
pushf
not eax
add eax, 0x2f63caa8
xor eax, 0x1d186b2b
rol eax, 0x18
popf
pushf
not eax
add eax, 0x68fb59c9
xor eax, 0x716a9539
rol eax, 0x2e
popf
jmp 0x1401502be
xor ecx, ecx
call fcn.140117085
mov rcx, rbx
jmp 0x140150788
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
push rax
pushf
mov eax, 0xe179f8c4
pushf
not eax
add eax, 0x7a320447
xor eax, 0x735b9416
rol eax, 0xe8
popf
pushf
not eax
add eax, 0x439799b
xor eax, 0x385d485e
rol eax, 0xc6
popf
pushf
not eax
add eax, 0x56b8ecef
xor eax, 0x25cdb0a8
rol eax, 0xad
popf
jmp 0x1401502be
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret