Function at 0x14014060f
Capabilities:
Query environment variable

Disassembly:
push rax
pushf
mov eax, 0x14b663ff
pushf
not eax
add eax, 0x433ac425
xor eax, 0x3289ae99
rol eax, 0x55
popf
pushf
not eax
add eax, 0x6f07e04d
xor eax, 0x2d1c831f
rol eax, 0x1d
popf
pushf
not eax
add eax, 0xed92b60
xor eax, 0x4bd8ee12
rol eax, 0x9c
popf
pushf
not eax
add eax, 0x1343c3a5
xor eax, 0x4f7dd589
rol eax, 0x8d
popf
cmp eax, 4
jne 0x140140672
popf
pop rax
jmp 0x14014090e
cmp eax, 2
jne 0x140140681
popf
pop rax
jmp 0x14014082f
cmp eax, 8
jne 0x140140690
popf
pop rax
jmp 0x140140b30
cmp eax, 6
jne 0x14014069f
popf
pop rax
jmp 0x140140a59
cmp eax, 3
jne 0x1401406ae
popf
pop rax
jmp 0x140140879
cmp eax, 1
jne 0x1401406bd
popf
pop rax
jmp 0x1401407ae
cmp eax, 5
jne 0x1401406cc
popf
pop rax
jmp 0x1401409ba
cmp eax, 0
jne 0x1401406db
popf
pop rax
jmp 0x1401406ea
cmp eax, 7
jne 0x1401406ea
popf
pop rax
jmp 0x140140ac3
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
jmp 0x1401406ff
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140140768
push rax
pushf
mov eax, 0xbf298b3e
pushf
not eax
add eax, 0x29d4ef40
xor eax, 0x4e4af426
rol eax, 0x5f
popf
pushf
not eax
add eax, 0x648d7bef
xor eax, 0x5f200745
rol eax, 0x39
popf
pushf
not eax
add eax, 0x7a08aebe
xor eax, 0x78a12a63
rol eax, 0x13
popf
pushf
not eax
add eax, 0x421861e
xor eax, 0xa6763e5
rol eax, 0xda
popf
jmp 0x140140663
push rax
pushf
mov eax, 0x1d1148c
pushf
not eax
add eax, 0x23fc6f68
xor eax, 0x48647461
rol eax, 0x97
popf
pushf
not eax
add eax, 0x9aad85a
xor eax, 0x5c31d4ca
rol eax, 0x17
popf
pushf
not eax
add eax, 0x551d8ca5
xor eax, 0x50a52a72
rol eax, 0x35
popf
jmp 0x140140663
mov rsi, rbx
cmp word [rax], bp
je 0x1401407e9
push rax
pushf
mov eax, 0x5f2a150f
pushf
not eax
add eax, 0x7c174943
xor eax, 0x613f4712
rol eax, 0x29
popf
pushf
not eax
add eax, 0x788a3d5
xor eax, 0x62a268d9
rol eax, 0x76
popf
jmp 0x140140663
push rax
pushf
mov eax, 0x7f0ad9d9
pushf
not eax
add eax, 0x22505150
xor eax, 0x4cff10f7
rol eax, 0x67
popf
pushf
not eax
add eax, 0x6e4bb666
xor eax, 0x75361d21
rol eax, 0x5f
popf
pushf
not eax
add eax, 0x2a740432
xor eax, 0x7863100b
rol eax, 2
popf
jmp 0x140140663
or rax, 0xffffffffffffffff
push rax
pushf
mov eax, 0x65b09e7e
pushf
not eax
add eax, 0x594c8342
xor eax, 0x5c85c584
rol eax, 0x44
popf
pushf
not eax
add eax, 0x37fa96f1
xor eax, 0x4ec3f16a
rol eax, 0x51
popf
pushf
not eax
add eax, 0x1a94a0f6
xor eax, 0x345c8f5f
rol eax, 0xfb
popf
jmp 0x140140663
inc rax
cmp word [rsi + rax*2], bp
jne 0x1401408db
push rax
pushf
mov eax, 0xafc52bfd
pushf
not eax
add eax, 0x336b3522
xor eax, 0x3673fd3d
rol eax, 0x3c
popf
pushf
not eax
add eax, 0x1fdda3a2
xor eax, 0x352d0420
rol eax, 0x2c
popf
pushf
not eax
add eax, 0x9600464
xor eax, 0xbab3939
rol eax, 0x72
popf
pushf
not eax
add eax, 0x305ec5a2
xor eax, 0x6e9dc9de
rol eax, 0xa4
popf
jmp 0x140140663
push rax
pushf
mov eax, 0x3566e41d
pushf
not eax
add eax, 0x1c69cf6c
xor eax, 0x50d2d5ca
rol eax, 0x27
popf
pushf
not eax
add eax, 0x6ee72d8
xor eax, 0x1eceb07c
rol eax, 0xf1
popf
jmp 0x140140663
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140140961
push rax
pushf
mov eax, 0x491b9d8
pushf
not eax
add eax, 0x18f5eaa
xor eax, 0x389a0ee2
rol eax, 0xb0
popf
pushf
not eax
add eax, 0x5abc05a4
xor eax, 0x416ee809
rol eax, 0x6b
popf
pushf
not eax
add eax, 0x59072f6
xor eax, 0x7046c366
rol eax, 0x83
popf
jmp 0x140140663
push rax
pushf
mov eax, 0xfb3c5689
pushf
not eax
add eax, 0x6cf625af
xor eax, 0x67b87d18
rol eax, 0xe9
popf
pushf
not eax
add eax, 0x4c82f7d
xor eax, 0x1ad67261
rol eax, 0x59
popf
pushf
not eax
add eax, 0x31e5c767
xor eax, 0x5e7e29be
rol eax, 0x99
popf
pushf
not eax
add eax, 0x227aa84d
xor eax, 0x55572768
rol eax, 0x14
popf
jmp 0x140140663
push rbx
not rbx
add rsi, rbx
pop rbx
add rsi, 1
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.140119cc6
mov rdi, rax
test rax, rax
je 0x140140a26
push rax
pushf
mov eax, 0x34d9f3aa
pushf
not eax
add eax, 0x16486dbe
xor eax, 0x754a4b98
rol eax, 0xfa
popf
pushf
not eax
add eax, 0x3c30f424
xor eax, 0x303f14e8
rol eax, 0xdb
popf
pushf
not eax
add eax, 0x7aad09d5
xor eax, 0x50be0e16
rol eax, 2
popf
jmp 0x140140663
push rax
pushf
mov eax, 0x53af8ac0
pushf
not eax
add eax, 0x286b1c09
xor eax, 0x66dcb299
rol eax, 3
popf
pushf
not eax
add eax, 0x19c3e7fe
xor eax, 0x68ac973
rol eax, 0xc1
popf
jmp 0x140140663
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140029e30
mov rbp, rdi
push rax
pushf
mov eax, 0xe890021
pushf
not eax
add eax, 0x6f3191a0
xor eax, 0x43deded7
rol eax, 0xda
popf
pushf
not eax
add eax, 0x3aedfe72
xor eax, 0x634f544c
rol eax, 0x23
popf
pushf
not eax
add eax, 0x4d290781
xor eax, 0x2e63ad02
rol eax, 0x87
popf
pushf
not eax
add eax, 0x4e05fb09
xor eax, 0x7a9ab942
rol eax, 0x46
popf
jmp 0x140140663
xor ecx, ecx
call fcn.140107465
mov rcx, rbx
jmp 0x140140ace
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
push rax
pushf
mov eax, 0x8c6f8018
pushf
not eax
add eax, 0x702e0eca
xor eax, 0x373a7bcb
rol eax, 0xe0
popf
pushf
not eax
add eax, 0x54cb7d6c
xor eax, 0x76e7dd0f
rol eax, 0x18
popf
pushf
not eax
add eax, 0x91b6884
xor eax, 0x7587659d
rol eax, 0x6f
popf
pushf
not eax
add eax, 0x45549082
xor eax, 0x73fa54b0
rol eax, 0xb9
popf
jmp 0x140140663
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret