Function at 0x18003a1a0
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x280
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rax, qword [0x18008f100]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r13d, r8d
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
je 0x18003a54b
test rdx, rdx
je 0x18003a54b
test r8d, r8d
je 0x18003a54b
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
mov rdi, rcx
cmp ecx, r8d
jb 0x18003a21f
mov dword [0x1800a2db8], 0xea
mov ecx, 0xea
jmp 0x18003a55a
mov rcx, rbx
sub rdx, rbx
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, 2
test ax, ax
jne 0x18003a230
movzx eax, word [rbx]
xor r14d, r14d
cmp ax, 0x5c
jne 0x18003a492
lea r8d, [r14 + 0xc]
lea rdx, str.SystemRoot_
mov rcx, rbx
call fcn.18003ef6c
test eax, eax
jne 0x18003a27b
lea r8, [rbx + 0x18]
mov edx, r13d
mov rcx, rbp
call fcn.180039ec0
jmp 0x18003a562
mov r8d, 8
lea rdx, str.__UNC_
mov rcx, rbx
call fcn.18003ef6c
test eax, eax
je 0x18003a46e
mov r8d, 8
lea rdx, str._UNC_
mov rcx, rbx
call fcn.18003ef6c
test eax, eax
je 0x18003a46e
mov r8d, 8
lea rdx, str..UNC_
mov rcx, rbx
call fcn.18003ef6c
test eax, eax
je 0x18003a46e
mov r8d, 4
lea rdx, [0x180067bb8]
mov rcx, rbx
call fcn.18003ef6c
test eax, eax
je 0x18003a42a
mov r8d, 4
lea rdx, [0x180067ba8]
mov rcx, rbx
call fcn.18003ef6c
test eax, eax
je 0x18003a42a
mov r8d, 4
lea rdx, str.._
mov rcx, rbx
call fcn.18003ef6c
test eax, eax
je 0x18003a42a
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.DeviceHarddisk
mov rcx, rbx
call fcn.18003ef6c
test eax, eax
jne 0x18003a4ed
lea rcx, [rsp + 0x38]
call fcn.18002b910
nop
lea rcx, [rsp + 0x20]
call fcn.18002b910
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.18003e440
mov esi, r14d
mov ecx, dword [rsp + 0x28]
test ecx, ecx
jle 0x18003a410
mov rdi, r14
nop dword [rax]
mov r9, qword [rsp + 0x20]
mov rax, qword [rdi + r9]
mov r12d, dword [rax - 8]
test r12d, r12d
je 0x18003a3a8
mov r8d, r12d
mov rdx, rbx
mov rcx, rax
call fcn.18003ef6c
test eax, eax
je 0x18003a3b4
mov ecx, dword [rsp + 0x28]
inc esi
add rdi, 8
cmp esi, ecx
jge 0x18003a410
jmp 0x18003a380
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
sub ecx, r12d
add ecx, 2
cmp ecx, r13d
jae 0x18003a410
movsxd rcx, esi
mov rax, qword [rsp + 0x38]
mov r8d, 2
mov rdx, qword [rax + rcx*8]
mov rcx, rbp
call fcn.1800138cc
lea rcx, [rbx + r12*2]
lea rdx, [rbp + 4]
sub rdx, rcx
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, 2
test ax, ax
jne 0x18003a400
lea rcx, [rsp + 0x20]
call fcn.180010a40
nop
lea rcx, [rsp + 0x38]
call fcn.180010a40
jmp 0x18003a4ed
cmp edi, 7
jb 0x18003a465
cmp word [rbx + 0xa], 0x3a
jne 0x18003a465
cmp word [rbx + 0xc], 0x5c
jne 0x18003a465
lea rcx, [rbx + 8]
mov rdx, rbp
sub rdx, rcx
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, 2
test ax, ax
jne 0x18003a450
jmp 0x18003a4ed
mov dword [rbp + 2], 0x2e005c
jmp 0x18003a4ed
mov dword [rbp], 0x5c005c
lea rcx, [rbx + 0x10]
lea rdx, [rbp + 4]
sub rdx, rcx
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, 2
test ax, ax
jne 0x18003a480
jmp 0x18003a4ed
cmp ax, 0x25
jne 0x18003a4ed
mov edx, 0x25
lea rcx, [rbx + 2]
call fcn.180013f08
mov rsi, rax
mov edx, 0x5c
lea rcx, [rbx + 2]
call fcn.180013f08
test rsi, rsi
je 0x18003a4ed
test rax, rax
je 0x18003a4ed
cmp esi, eax
jae 0x18003a4ed
lea edi, [r13 - 1]
mov r8d, edi
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x18003a560
cmp eax, 0x104
jae 0x18003a560
mov word [rbp + rdi*2], r14w
mov rcx, rbp
call fcn.180039ce0
test eax, eax
je 0x18003a544
mov word [rsp + 0x60], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x62]
call fcn.180015150
mov r8d, 0x104
lea rdx, [rsp + 0x60]
mov rcx, rbp
call fcn.180039ff0
test eax, eax
je 0x18003a544
lea eax, [r13 - 1]
mov edi, eax
mov r8d, eax
lea rdx, [rsp + 0x60]
mov rcx, rbp
call fcn.1800138cc
mov word [rbp + rdi*2], r14w
mov eax, 1
jmp 0x18003a562
mov dword [0x1800a2db8], 0x57
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180013880
add rsp, 0x280
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret