Function at 0x1400623e4
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov esi, 0x7f2bb707
cmp qword [rsp + 0xb8], 0
mov r14d, dword [rsp + 0xb0]
mov r15, rcx
mov r13, rdx
mov ebp, r8d
mov r12d, r9d
je 0x140062b8f
mov rax, qword [rsp + 0xb8]
cmp dword [rax], 0x7f2bb707
jne 0x140062b8f
lea rdx, [rsp + 0x38]
mov ecx, 0x160
call fcn.14005cd65
mov esi, eax
test eax, eax
jne 0x140062b8f
mov rbx, qword [rsp + 0x38]
mov ecx, 0x58
mov rdi, rbx
rep stosd dword [rdi], eax
mov eax, ebp
mov dword [rbx], 0x7f2bb701
lea rcx, str.E2FSPROGS_FAKE_TIME
mov dword [rbx + 0xa8], 0x12
or ah, 2
mov dword [rbx + 0x10], eax
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x140062497
xor r8d, r8d
xor edx, edx
call sub.msvcrt.dll_strtoul
mov eax, eax
mov qword [rbx + 0xb0], rax
mov rcx, r15
call sub.msvcrt.dll_strlen
lea rdx, [rbx + 0x18]
lea ecx, [rax + 1]
call fcn.14005cd65
mov edi, eax
test eax, eax
jne 0x140062b66
mov rcx, qword [rbx + 0x18]
mov rdx, r15
call sub.msvcrt.dll_strcpy
mov rcx, qword [rbx + 0x18]
mov edx, 0x3f
call sub.msvcrt.dll_strchr
test r13, r13
jne 0x1400624e6
test rax, rax
je 0x1400624e6
cmp byte [rax + 1], 0x5c
je 0x1400624e6
mov byte [rax], 0
lea r13, [rax + 1]
mov r15d, ebp
and r15d, 1
bt ebp, 0xe
mov eax, r15d
jae 0x1400624f9
or eax, 2
mov edx, eax
mov rcx, qword [rbx + 0x18]
lea r8, [rbx + 8]
or edx, 4
test ebp, 0x80000
cmove edx, eax
mov rax, qword [rsp + 0xb8]
call qword [rax + 0x10]
mov edi, eax
test eax, eax
jne 0x140062b66
mov rcx, qword [rbx + 8]
test r13, r13
jne 0x140062555
mov rcx, qword [rbx + 8]
lea r8, [rbx + 0x20]
mov edx, 0xfffffc00
mov qword [rbx + 0xe8], rcx
mov qword [rcx + 0x78], rbx
call fcn.14005efb6
mov edi, eax
test eax, eax
je 0x140062568
jmp 0x140062b66
mov rdx, r13
call fcn.14005ede0
mov edi, eax
test eax, eax
je 0x14006252d
jmp 0x140062b66
mov eax, ebp
and eax, 0x2000
mov dword [rsp + 0x2c], eax
je 0x1400625db
lea rdx, [rbx + 0xa0]
mov ecx, 0x14c
call fcn.14005cd65
mov edi, eax
test eax, eax
jne 0x140062b66
mov rcx, qword [rbx + 8]
mov r9, qword [rbx + 0xa0]
mov r8d, 0xfffffeb4
xor edx, edx
mov rax, qword [rcx + 8]
call qword [rax + 0x28]
mov edi, eax
test eax, eax
jne 0x140062b66
mov rax, qword [rbx + 0xa0]
mov esi, 0x7f2bb710
cmp dword [rax], 0x7f2bb710
jne 0x140062b8f
mov r14d, dword [rax + 0xcc]
mov r12d, 1
jmp 0x1400625e0
test r12d, r12d
je 0x140062605
test r14d, r14d
je 0x140062b1e
mov rcx, qword [rbx + 8]
mov edx, r14d
movsxd r13, r12d
mov rax, qword [rcx + 8]
call qword [rax + 0x20]
xor ecx, ecx
mov qword [rbx + 0x98], rcx
jmp 0x140062639
mov rcx, qword [rbx + 8]
mov edx, 0x400
mov rax, qword [rcx + 8]
call qword [rax + 0x20]
lea rdx, [rbx + 0x98]
mov ecx, 0x400
call fcn.14005cd65
mov edi, eax
test eax, eax
jne 0x140062b66
xor r13d, r13d
mov r12d, 1
mov dword [rsp + 0x28], 4
mov rcx, qword [rbx + 8]
mov r9, qword [rbx + 0x20]
mov r8d, 0xfffffc00
mov edx, r12d
mov rax, qword [rcx + 8]
call qword [rax + 0x28]
mov edi, eax
test eax, eax
jne 0x140062b66
mov rax, qword [rbx + 0x98]
test rax, rax
je 0x14006267d
mov rsi, qword [rbx + 0x20]
mov ecx, 0x100
mov rdi, rax
rep movsd dword [rdi], dword [rsi]
mov esi, dword [rbx + 0x10]
and esi, 0x200000
jne 0x1400626bb
mov rdx, qword [rbx + 0x20]
mov rcx, rbx
call fcn.140056900
mov rdx, qword [rbx + 0x20]
mov rcx, rbx
test eax, eax
mov eax, 0x7f2bb799
cmove esi, eax
call fcn.14005691c
test eax, eax
jne 0x1400626bd
dec dword [rsp + 0x28]
jne 0x140062641
mov esi, 0x7f2bb798
jmp 0x1400626bd
xor esi, esi
test byte [rbx + 0x10], 0x40
jne 0x140062b25
mov rax, qword [rbx + 0x20]
cmp word [rax + 0x38], 0xef53
jne 0x140062b2c
test esi, esi
jne 0x140062b33
mov r8d, dword [rax + 0x4c]
cmp r8d, 1
ja 0x140062b37
bt ebp, 0xa
jb 0x14006272e
mov ecx, dword [rax + 0x60]
test ecx, 0xfffc1921
jne 0x140062b45
bt ebp, 0xf
mov edx, dword [rax + 0x64]
jae 0x14006270e
and dh, 0xf7
test r15d, r15d
je 0x14006271f
and edx, 0xffff0884
jne 0x140062b3e
bt ebp, 0xc
jb 0x14006272e
and cl, 8
jne 0x140062b45
mov r9d, dword [rax + 0x18]
cmp r9d, 6
jbe 0x140062742
mov edi, 0x7f2bb73c
jmp 0x140062b66
test byte [rax + 0x65], 2
je 0x140062753
bt ebp, 0x11
jb 0x140062759
jmp 0x140062b4c
cmp r9d, dword [rax + 0x1c]
jne 0x140062738
mov edx, 0x400
mov ecx, r9d
shl edx, cl
mov dword [rbx + 0x28], edx
mov dword [rbx + 0x2c], edx
test r8d, r8d
je 0x140062789
movzx r8d, word [rax + 0x58]
cmp edx, r8d
jb 0x140062738
cmp r8d, 0x7f
jbe 0x140062738
lea ecx, [r8 - 1]
test ecx, r8d
jne 0x140062738
jmp 0x14006278f
mov r8d, pe_nt_image_headers64
test byte [rax + 0x60], 0x80
je 0x1400627a3
cmp word [rax + 0xfe], 0x3f
jbe 0x140062b53
mov ecx, dword [rax + 0x1c]
mov edi, dword [rax + 0x24]
sub ecx, r9d
mov dword [rbx + 0xb8], ecx
shl edi, cl
cmp dword [rax + 0x20], edi
jne 0x140062738
imul r8d, dword [rax + 0x28]
lea ecx, [r9 + 0xa]
lea eax, [rdx + r8 - 1]
shr eax, cl
mov dword [rbx + 0x40], eax
cmp edx, r14d
je 0x1400627de
test r14d, r14d
jne 0x140062b5a
mov rcx, qword [rbx + 8]
mov rax, qword [rcx + 8]
call qword [rax + 0x20]
mov rax, qword [rbx + 0x20]
mov edi, dword [rax + 0x60]
and edi, 8
mov dword [rsp + 0x28], edi
je 0x140062803
xor edx, edx
mov dword [rbx + 0x30], edx
jmp 0x140062b11
cmp dword [rax + 0x28], 0
je 0x140062738
mov rcx, rbx
call fcn.14005684e
mov r8, qword [rbx + 0x20]
mov r15d, dword [r8 + 0x20]
test r15d, r15d
je 0x140062738
mov ecx, dword [r8 + 0x18]
mov eax, 0x400
mov r9d, eax
shl r9d, cl
mov ecx, dword [r8 + 0x1c]
shl eax, cl
cdq
idiv r9d
imul eax, eax, 0xfff8
cmp eax, r15d
jb 0x140062738
cmp dword [r8 + 0x4c], 0
mov ecx, dword [rbx + 0x40]
mov r10d, pe_nt_image_headers64
je 0x140062863
movzx r10d, word [r8 + 0x58]
mov eax, r9d
cdq
idiv r10d
mov edx, 0x10000
sub edx, eax
cmp edx, ecx
jb 0x140062738
mov ecx, 0x20
test byte [r8 + 0x60], 0x80
je 0x14006288d
movzx ecx, word [r8 + 0xfe]
mov eax, r9d
cdq
idiv ecx
test eax, eax
je 0x140062738
mov edi, dword [r8 + 0x14]
mov rcx, r8
call fcn.1400547aa
cmp rdi, rax
jae 0x140062738
mov rcx, qword [rbx + 0x20]
call fcn.1400547aa
mov rdi, qword [rbx + 0x20]
mov edx, r15d
mov r8d, dword [rdi + 0x14]
sub rax, r8
mov rcx, rax
call fcn.14005cf79
mov rdx, rax
shr rdx, 0x20
jne 0x140062738
bt ebp, 0x17
mov dword [rbx + 0x30], eax
mov r8d, eax
jb 0x1400628fa
mov edx, dword [rdi + 0x28]
imul rax, rdx
mov edx, dword [rdi]
cmp rax, rdx
jne 0x140062738
mov ecx, dword [rdi + 0x18]
mov eax, 0x400
shl eax, cl
mov ecx, 0x20
test byte [rdi + 0x60], 0x80
je 0x140062916
movzx ecx, word [rdi + 0xfe]
cdq
idiv ecx
mov ecx, r8d
mov edx, eax
call fcn.14005cf68
bt ebp, 0xb
mov dword [rbx + 0x34], eax
mov ecx, eax
jb 0x140062a9a
mov edx, dword [rbx + 0x28]
lea r8, [rbx + 0x38]
call fcn.14005cdc5
mov edi, eax
test eax, eax
jne 0x140062b66
mov rax, qword [rbx + 0x20]
test r13, r13
jne 0x140062967
mov r13d, dword [rax + 0x14]
test r13, r13
jne 0x140062967
xor edi, edi
cmp dword [rbx + 0x28], 0x400
sete dil
mov r14, qword [rbx + 0x38]
mov r15d, dword [rbx + 0x34]
test byte [rax + 0x60], 0x10
je 0x140062989
cmp dword [rsp + 0x2c], 0
jne 0x140062989
mov eax, dword [rax + 0x104]
cmp r15d, eax
cmova r15d, eax
test r15d, r15d
je 0x1400629b8
mov rcx, qword [rbx + 8]
lea edx, [rdi + r13 + 1]
mov r9, r14
mov r8d, r15d
mov rax, qword [rcx + 8]
call qword [rax + 0x28]
mov edi, eax
test eax, eax
jne 0x140062b66
mov eax, r15d
imul eax, dword [rbx + 0x28]
add r14, rax
mov edi, r15d
cmp edi, dword [rbx + 0x34]
jae 0x140062a1a
mov r8d, edi
mov rdx, r13
mov rcx, rbx
inc edi
call fcn.1400622d5
mov rcx, qword [rbx + 8]
mov r8d, 1
mov rdx, rax
call fcn.14005efef
jmp 0x1400629bb
mov r8d, r15d
mov rdx, r13
mov rcx, rbx
call fcn.1400622d5
mov rcx, qword [rbx + 8]
mov r9, r14
mov r8d, 1
mov rdx, rax
call fcn.14005eef4
mov edi, eax
test eax, eax
jne 0x140062b66
mov eax, dword [rbx + 0x28]
inc r15d
add r14, rax
cmp r15d, dword [rbx + 0x34]
jb 0x1400629e4
mov rax, qword [rbx + 0x20]
dec r12d
movzx edx, word [rax + 0x164]
mov dword [rbx + 0x90], edx
jle 0x140062a9a
test dword [rax + 0x64], 0x410
je 0x140062a9a
mov eax, dword [rsp + 0x28]
cmp eax, dword [rbx + 0x30]
jae 0x140062a8d
mov edx, dword [rsp + 0x28]
mov r8d, 2
mov rcx, rbx
call fcn.140054dcc
mov edx, dword [rsp + 0x28]
mov r8d, 1
mov rcx, rbx
call fcn.140054dcc
mov edx, dword [rsp + 0x28]
xor r8d, r8d
mov rcx, rbx
call fcn.140054d25
mov edx, dword [rsp + 0x28]
mov rcx, rbx
call fcn.140057229
inc dword [rsp + 0x28]
jmp 0x140062a3f
mov eax, dword [rbx + 0x10]
test al, 1
je 0x140062a9a
or eax, 6
mov dword [rbx + 0x10], eax
mov rax, qword [rbx + 0x20]
test byte [rax + 0x61], 1
je 0x140062ad4
bt ebp, 0x14
jb 0x140062ad4
test ebp, 0x4001
je 0x140062ad4
mov rcx, rbx
call fcn.1400610be
mov edi, eax
test eax, eax
je 0x140062ad4
or dword [rbx + 0x10], 0x100000
mov rcx, rbx
call fcn.1400610c4
jmp 0x140062b66
test byte [rbx + 0x12], 0x40
je 0x140062b0a
mov rcx, qword [0x1400b49c0]
mov r8d, 0x1000
lea rdx, [0x1400622d0]
call fcn.14005bc9e
mov qword [rbx + 0x150], rax
test rax, rax
je 0x140062b61
mov rax, qword [rbx + 0x20]
or dword [rax + 0x64], 0x4000
and dword [rbx + 0x10], 0xfffeffff
mov rax, qword [rsp + 0xc0]
mov qword [rax], rbx
jmp 0x140062b8f
mov edi, 0x7f2bb747
jmp 0x140062b66
mov edi, 0x7f2bb750
jmp 0x140062b66
mov edi, 0x7f2bb713
jmp 0x140062b66
mov edi, esi
jmp 0x140062b66
mov edi, 0x7f2bb714
jmp 0x140062b66
mov edi, 0x7f2bb744
jmp 0x140062b66
mov edi, 0x7f2bb743
jmp 0x140062b66
mov edi, 0x7f2bb789
jmp 0x140062b66
mov edi, 0x7f2bb791
jmp 0x140062b66
mov edi, 0x7f2bb722
jmp 0x140062b66
mov edi, 0x7f2bb746
bt ebp, 0x10
jb 0x140062b7d
mov rcx, qword [rsp + 0x38]
call fcn.14005a109
xor eax, eax
mov qword [rsp + 0x38], rax
mov rsi, qword [rsp + 0xc0]
mov rax, qword [rsp + 0x38]
mov qword [rsi], rax
mov esi, edi
mov eax, esi
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret