Function at 0x14010d410
Capabilities:
Parse pe header
Query environment variable
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov rax, qword [0x1401be040]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov qword [rbp - 0x59], r8
mov rdi, rdx
mov qword [rbp - 0x61], rdx
xor r15d, r15d
mov r12d, r15d
mov dword [rbp - 0x69], r15d
lea r9, [rbp - 0x69]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call fcn.14014aab6
cmp eax, 0xc0000004
jne 0x14010d4b5
nop
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp - 0x69]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
lea r9, [rbp - 0x69]
mov r8d, dword [rbp - 0x69]
mov rdx, rax
mov ecx, 0xb
call fcn.14014aab6
cmp eax, 0xc0000004
je 0x14010d470
test eax, eax
js 0x14010d82e
mov r13d, r15d
cmp dword [r12], r15d
jbe 0x14010d82e
nop word [rax + rax]
mov eax, r13d
imul rcx, rax, 0x128
lea rbx, [rcx + r12]
mov qword [rbp - 0x51], rbx
movzx edx, word [rbx + 0x2e]
add rdx, 0x30
add rdx, rcx
add rdx, r12
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], r15
mov qword [rbp - 1], r15
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x14010d506
lea rcx, [rbp - 0x19]
call fcn.1400defe0
nop
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova rcx, qword [rbp - 0x19]
mov rdx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14010d7e6
lea rdx, [rbx + 0x30]
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], r15
mov qword [rbp - 0x21], r15
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x14010d553
lea rcx, [rbp - 0x39]
call fcn.1400defe0
nop
mov byte [rbp - 0x49], 0x32
mov al, 0x61
mov cl, 0x6b
movzx edx, al
mov r8b, 0x66
mov r9b, 0x77
mov r10b, 0x7f
mov r11b, 0x60
mov bl, 0x7d
movzx edi, bl
movzx esi, r8b
xor r14d, r14d
xor al, 0x32
mov byte [rbp - 0x48], al
xor cl, 0x32
mov byte [rbp - 0x47], cl
xor dl, 0x32
mov byte [rbp - 0x46], dl
xor r8b, 0x32
mov byte [rbp - 0x45], r8b
xor r9b, 0x32
mov byte [rbp - 0x44], r9b
xor r10b, 0x32
mov byte [rbp - 0x43], r10b
xor r11b, 0x32
mov byte [rbp - 0x42], r11b
xor bl, 0x32
mov byte [rbp - 0x41], bl
xor dil, 0x32
mov byte [rbp - 0x40], dil
xor sil, 0x32
mov byte [rbp - 0x3f], sil
mov byte [rbp - 0x3e], r14b
lea rcx, [rbp - 0x48]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rbp + 7], xmm0
mov qword [rbp + 0x17], r15
mov qword [rbp + 0x1f], r15
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r14b
jne 0x14010d5f5
mov rdx, rax
lea rcx, [rbp + 7]
call fcn.1400defe0
nop
mov r8d, 1
lea rdx, [0x1401adfdc]
lea rcx, [rbp + 7]
call fcn.1400de200
mov rsi, rax
lea r14, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova r14, qword [rbp - 0x39]
mov rax, qword [rbp - 0x29]
cmp rax, 0xc
jb 0x14010d69c
lea rdi, [rax + r14]
lea r8, [rdi - 0xb]
sub r8, r14
mov edx, 0x5c
mov rcx, r14
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x14010d69c
nop dword [rax]
mov r8d, 0xc
lea rdx, str.SystemRoot_
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14010d86e
inc rbx
lea r8, [rdi - 0xb]
sub r8, rbx
mov edx, 0x5c
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x14010d660
mov rbx, 0xffffffffffffffff
mov rax, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0xf
jbe 0x14010d6b1
mov rsi, qword [rsi]
mov qword [rsp + 0x20], rax
mov r9, rsi
mov rdx, rbx
lea rcx, [rbp - 0x39]
call fcn.140136eb0
nop
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0xf
jbe 0x14010d701
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010d6fc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010d876
call fcn.14014b9a4
lea rcx, [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova rcx, qword [rbp - 0x39]
xor edx, edx
lea r8d, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rbx, rax
mov eax, 0x5a4d
cmp word [rbx], ax
jne 0x14010d8ab
movsxd rcx, dword [rbx + 0x3c]
cmp dword [rcx + rbx], 0x4550
jne 0x14010d8ab
mov eax, dword [rcx + rbx + 0x88]
test eax, eax
je 0x14010d8ab
mov r11d, dword [rax + rbx + 0x1c]
lea rdi, [rbx + r11]
mov r9d, dword [rax + rbx + 0x20]
add r9, rbx
mov esi, dword [rax + rbx + 0x24]
add rsi, rbx
mov r10d, r15d
test r11d, r11d
je 0x14010d7a7
nop dword [rax]
mov r8d, dword [r9]
add r8, rbx
mov rax, qword [rbp - 0x59]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14010d793
inc rax
test ecx, ecx
jne 0x14010d780
test edx, edx
je 0x14010d87d
inc r10d
add r9, 4
cmp r10d, r11d
jb 0x14010d770
mov rdx, qword [rbp - 0x21]
cmp rdx, 0xf
jbe 0x14010d7e2
inc rdx
mov rcx, qword [rbp - 0x39]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010d7dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010d8ee
call fcn.14014b9a4
mov rdi, qword [rbp - 0x61]
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14010d821
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010d81c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14010d902
call fcn.14014b9a4
inc r13d
cmp r13d, dword [r12]
jb 0x14010d4d0
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.14014b630
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
sub rbx, r14
jmp 0x14010d6a3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov eax, r10d
movzx ecx, word [rsi + rax*2]
mov r15d, dword [rdi + rcx*4]
mov rax, qword [rbp - 0x51]
add r15, qword [rax + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rcx, [rbp - 0x39]
call fcn.1400de030
nop
mov rdx, qword [rbp - 1]
cmp rdx, 0xf
jbe 0x14010d8fa
inc rdx
mov rcx, qword [rbp - 0x19]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010d8f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010d8f5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14014b9a4
mov rax, r15
jmp 0x14010d841
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3