Function at 0x140266ef8
Capabilities:
Query environment variable

Disassembly:
push rdi
push rsi
push rbx
mov eax, 0x5050
call fcn.1402919f0
sub rsp, 0x5050
mov ebx, ecx
mov eax, dword [0x1403febe4]
cmp eax, 1
je 0x140267810
mov rdi, qword [0x1403c2b70]
lea rsi, [0x1403f67e0]
mov rax, rsi
mov dl, byte [rdi]
add rdi, 1
mov byte [rsi], dl
add rsi, 1
test dl, dl
jne 0x140266f2e
mov rdi, qword [0x1403c2b78]
lea rsi, [0x1403f77e0]
mov rax, rsi
mov dl, byte [rdi]
add rdi, 1
mov byte [rsi], dl
add rsi, 1
test dl, dl
jne 0x140266f4f
mov rdi, qword [0x1403c2b80]
lea rsi, [0x1403f87e0]
mov rax, rsi
mov dl, byte [rdi]
add rdi, 1
mov byte [rsi], dl
add rsi, 1
test dl, dl
jne 0x140266f70
mov rdi, qword [0x1403c2b88]
lea rsi, [0x1403f98e0]
mov rax, rsi
mov dl, byte [rdi]
add rdi, 1
mov byte [rsi], dl
add rsi, 1
test dl, dl
jne 0x140266f91
mov rdi, qword [0x1403c2b90]
lea rsi, [0x1403fa8e0]
mov rax, rsi
mov dl, byte [rdi]
add rdi, 1
mov byte [rsi], dl
add rsi, 1
test dl, dl
jne 0x140266fb2
mov rdi, qword [0x1403c2b98]
lea rsi, [0x1403fb8e0]
mov rax, rsi
mov dl, byte [rdi]
add rdi, 1
mov byte [rsi], dl
add rsi, 1
test dl, dl
jne 0x140266fd3
mov rdi, qword [0x1403c2ba0]
lea rsi, [0x1403fb9e0]
mov rax, rsi
mov dl, byte [rdi]
add rdi, 1
mov byte [rsi], dl
add rsi, 1
test dl, dl
jne 0x140266ff4
mov rdi, qword [0x1403c2ba8]
lea rsi, [0x1403fc9e0]
mov rax, rsi
mov dl, byte [rdi]
add rdi, 1
mov byte [rsi], dl
add rsi, 1
test dl, dl
jne 0x140267015
mov rdi, qword [0x1403c2bb0]
lea rsi, [0x1403fdae0]
mov rax, rsi
mov dl, byte [rdi]
add rdi, 1
mov byte [rsi], dl
add rsi, 1
test dl, dl
jne 0x140267036
mov dword [0x1403c2bb8], 1
lea rdi, [rsp + 0x2030]
xor eax, eax
mov byte [rdi], al
mov dword [0x1403febe0], eax
mov dword [reloc.OLEAUT32.dll_SysReAllocString], 2
lea rcx, [0x140429088]
mov rdx, rdi
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1402670a3
lea rsi, [rsp + 0x1030]
mov rax, rsi
mov dl, byte [rdi]
add rdi, 1
mov byte [rsi], dl
add rsi, 1
test dl, dl
jne 0x140267091
jmp 0x1402670c5
lea rsi, [rsp + 0x1030]
lea rdi, [0x140429098]
mov rax, rsi
mov dl, byte [rdi]
add rdi, 1
mov byte [rsi], dl
add rsi, 1
test dl, dl
jne 0x1402670b5
lea rcx, [rsp + 0x1030]
lea rdx, [0x1404290a0]
call sub.MSVCR100.dll_fopen
test rax, rax
je 0x14026773c
mov qword [rsp + 0x5040], r12
mov r12d, ebx
mov qword [rsp + 0x5038], r13
mov rbx, rax
lea rcx, [rsp + 0x4030]
mov edx, 0x1000
mov r8, rbx
call sub.MSVCR100.dll_fgets
test rax, rax
je 0x14026781d
lea rsi, [rsp + 0x3030]
lea rdi, [rsp + 0x4030]
mov rax, rsi
mov dl, byte [rdi]
add rdi, 1
mov byte [rsi], dl
add rsi, 1
test dl, dl
jne 0x140267129
lea rcx, [rsp + 0x3030]
xor eax, eax
movzx edx, byte [rcx + rax]
test edx, edx
je 0x14026715c
movzx edx, byte [rcx + rax + 1]
add rax, 2
test edx, edx
jne 0x140267143
add rax, 0xffffffffffffffff
movsx rdx, byte [rsp + rax + 0x302f]
cmp edx, 0xa
je 0x14026719b
lea rcx, [rsp + 0x3030]
xor eax, eax
movzx edx, byte [rcx + rax]
test edx, edx
je 0x14026718d
movzx edx, byte [rcx + rax + 1]
add rax, 2
test edx, edx
jne 0x140267174
add rax, 0xffffffffffffffff
movsx rdx, byte [rsp + rax + 0x302f]
cmp edx, 0xd
jne 0x1402671c6
lea rcx, [rsp + 0x3030]
xor eax, eax
movzx edx, byte [rcx + rax]
test edx, edx
je 0x1402671be
movzx edx, byte [rcx + rax + 1]
add rax, 2
test edx, edx
jne 0x1402671a5
add rax, 0xffffffffffffffff
mov byte [rsp + rax + 0x302f], 0
lea rcx, [rsp + 0x3030]
call fcn.1402678c0
lea rcx, [rsp + 0x4030]
xor eax, eax
movzx edx, byte [rcx + rax]
test edx, edx
je 0x1402671f6
movzx edx, byte [rcx + rax + 1]
add rax, 2
test edx, edx
jne 0x1402671dd
add rax, 0xffffffffffffffff
movsx rdx, byte [rsp + rax + 0x402f]
cmp edx, 0xa
je 0x140267235
lea rcx, [rsp + 0x4030]
xor eax, eax
movzx edx, byte [rcx + rax]
test edx, edx
je 0x140267227
movzx edx, byte [rcx + rax + 1]
add rax, 2
test edx, edx
jne 0x14026720e
add rax, 0xffffffffffffffff
movsx rdx, byte [rsp + rax + 0x402f]
cmp edx, 0xd
jne 0x140267260
lea rcx, [rsp + 0x4030]
xor eax, eax
movzx edx, byte [rcx + rax]
test edx, edx
je 0x140267258
movzx edx, byte [rcx + rax + 1]
add rax, 2
test edx, edx
jne 0x14026723f
add rax, 0xffffffffffffffff
mov byte [rsp + rax + 0x402f], 0
lea rcx, [rsp + 0x4030]
call fcn.140267910
lea rcx, [rsp + 0x4030]
xor eax, eax
movzx edx, byte [rcx + rax]
test edx, edx
je 0x140267290
movzx edx, byte [rcx + rax + 1]
add rax, 2
test edx, edx
jne 0x140267277
add rax, 0xffffffffffffffff
movsx rdx, byte [rsp + rax + 0x402f]
cmp edx, 0xa
je 0x1402672cf
lea rcx, [rsp + 0x4030]
xor eax, eax
movzx edx, byte [rcx + rax]
test edx, edx
je 0x1402672c1
movzx edx, byte [rcx + rax + 1]
add rax, 2
test edx, edx
jne 0x1402672a8
add rax, 0xffffffffffffffff
movsx rdx, byte [rsp + rax + 0x402f]
cmp edx, 0xd
jne 0x1402672fa
lea rcx, [rsp + 0x4030]
xor eax, eax
movzx edx, byte [rcx + rax]
test edx, edx
je 0x1402672f2
movzx edx, byte [rcx + rax + 1]
add rax, 2
test edx, edx
jne 0x1402672d9
add rax, 0xffffffffffffffff
mov byte [rsp + rax + 0x402f], 0
lea rcx, [rsp + 0x4030]
call fcn.140267844
test r12d, r12d
jne 0x140267578
lea rcx, [rsp + 0x4030]
lea rdx, [0x1404290b0]
mov r8d, 0x10
call sub.MSVCR100.dll_strncmp
test eax, eax
jne 0x140267368
lea rcx, [rsp + 0x3030]
mov edx, 0x3d
call sub.MSVCR100.dll_strchr
add rax, 1
movzx edx, byte [rax]
test edx, edx
je 0x140267368
lea rsi, [0x1403f67e0]
mov rdi, rax
mov rax, rsi
mov dl, byte [rdi]
add rdi, 1
mov byte [rsi], dl
add rsi, 1
test dl, dl
jne 0x140267358
lea rcx, [rsp + 0x4030]
lea rdx, [0x1404290c4]
mov r8d, shutdown
call sub.MSVCR100.dll_strncmp
test eax, eax
jne 0x1402673c0
lea rcx, [rsp + 0x3030]
mov edx, 0x3d
call sub.MSVCR100.dll_strchr
add rax, 1
movzx edx, byte [rax]
test edx, edx
je 0x1402673c0
lea rsi, [0x1403f77e0]
mov rdi, rax
mov rax, rsi
mov dl, byte [rdi]
add rdi, 1
mov byte [rsi], dl
add rsi, 1
test dl, dl
jne 0x1402673b0
lea rcx, [rsp + 0x4030]
lea rdx, [0x1404290d8]
mov r8d, shutdown
call sub.MSVCR100.dll_strncmp
test eax, eax
jne 0x140267418
lea rcx, [rsp + 0x3030]
mov edx, 0x3d
call sub.MSVCR100.dll_strchr
add rax, 1
movzx edx, byte [rax]
test edx, edx
je 0x140267418
lea rsi, [0x1403f98e0]
mov rdi, rax
mov rax, rsi
mov dl, byte [rdi]
add rdi, 1
mov byte [rsi], dl
add rsi, 1
test dl, dl
jne 0x140267408
lea rcx, [rsp + 0x4030]
lea rdx, [0x1404290f0]
mov r8d, shutdown
call sub.MSVCR100.dll_strncmp
test eax, eax
jne 0x140267470
lea rcx, [rsp + 0x3030]
mov edx, 0x3d
call sub.MSVCR100.dll_strchr
add rax, 1
movzx edx, byte [rax]
test edx, edx
je 0x140267470
lea rsi, [0x1403fa8e0]
mov rdi, rax
mov rax, rsi
mov dl, byte [rdi]
add rdi, 1
mov byte [rsi], dl
add rsi, 1
test dl, dl
jne 0x140267460
lea rcx, [rsp + 0x4030]
lea rdx, [0x140429108]
mov r8d, 0x10
call sub.MSVCR100.dll_strncmp
test eax, eax
jne 0x1402674c8
lea rcx, [rsp + 0x3030]
mov edx, 0x3d
call sub.MSVCR100.dll_strchr
add rax, 1
movzx edx, byte [rax]
test edx, edx
je 0x1402674c8
lea rsi, [0x1403fdae0]
mov rdi, rax
mov rax, rsi
mov dl, byte [rdi]
add rdi, 1
mov byte [rsi], dl
add rsi, 1
test dl, dl
jne 0x1402674b8
lea rcx, [rsp + 0x4030]
lea rdx, [0x14042911c]
mov r8d, 0x10
call sub.MSVCR100.dll_strncmp
test eax, eax
jne 0x140267520
lea rcx, [rsp + 0x3030]
mov edx, 0x3d
call sub.MSVCR100.dll_strchr
add rax, 1
movzx edx, byte [rax]
test edx, edx
je 0x140267520
lea rsi, [0x1403fb9e0]
mov rdi, rax
mov rax, rsi
mov dl, byte [rdi]
add rdi, 1
mov byte [rsi], dl
add rsi, 1
test dl, dl
jne 0x140267510
lea rcx, [rsp + 0x4030]
lea rdx, [0x140429130]
mov r8d, 0x10
call sub.MSVCR100.dll_strncmp
test eax, eax
jne 0x140267578
lea rcx, [rsp + 0x3030]
mov edx, 0x3d
call sub.MSVCR100.dll_strchr
add rax, 1
movzx edx, byte [rax]
test edx, edx
je 0x140267578
lea rsi, [0x1403fc9e0]
mov rdi, rax
mov rax, rsi
mov dl, byte [rdi]
add rdi, 1
mov byte [rsi], dl
add rsi, 1
test dl, dl
jne 0x140267568
lea rcx, [rsp + 0x4030]
lea rdx, [0x140429144]
mov r8d, 0x10
call sub.MSVCR100.dll_strncmp
test eax, eax
jne 0x140267637
lea r13, [rsp + 0x4040]
movzx edx, byte [r13]
test edx, edx
je 0x140267637
mov rcx, r13
call fcn.140267844
mov rdi, r13
lea rsi, [0x14042915c]
mov dl, byte [rdi]
cmp dl, byte [rsi]
jne 0x1402675e3
or dl, dl
je 0x1402675df
mov dl, byte [rdi + 1]
cmp dl, byte [rsi + 1]
jne 0x1402675e3
add rdi, 2
add rsi, 2
or dl, dl
jne 0x1402675c1
xor eax, eax
jmp 0x1402675e8
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1402675f8
mov dword [0x1403c2bb8], 1
jmp 0x140267637
mov rdi, r13
lea rsi, [0x140429158]
mov dl, byte [rdi]
cmp dl, byte [rsi]
jne 0x140267624
or dl, dl
je 0x140267620
mov dl, byte [rdi + 1]
cmp dl, byte [rsi + 1]
jne 0x140267624
add rdi, 2
add rsi, 2
or dl, dl
jne 0x140267602
xor eax, eax
jmp 0x140267629
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140267637
mov dword [0x1403c2bb8], 0
lea rcx, [rsp + 0x4030]
lea rdx, [0x140429160]
mov r8d, VariantTimeToDosDateTime
call sub.MSVCR100.dll_strncmp
test eax, eax
jne 0x1402670f8
lea r13, [rsp + 0x403b]
movzx edx, byte [r13]
test edx, edx
je 0x1402670f8
mov rcx, r13
call fcn.140267844
mov rdi, r13
lea rsi, [0x14042916c]
mov dl, byte [rdi]
cmp dl, byte [rsi]
jne 0x1402676a2
or dl, dl
je 0x14026769e
mov dl, byte [rdi + 1]
cmp dl, byte [rsi + 1]
jne 0x1402676a2
add rdi, 2
add rsi, 2
or dl, dl
jne 0x140267680
xor eax, eax
jmp 0x1402676a7
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1402676b5
mov dword [reloc.OLEAUT32.dll_SysReAllocString], 1
mov rdi, r13
lea rsi, [0x140429170]
mov dl, byte [rdi]
cmp dl, byte [rsi]
jne 0x1402676e1
or dl, dl
je 0x1402676dd
mov dl, byte [rdi + 1]
cmp dl, byte [rsi + 1]
jne 0x1402676e1
add rdi, 2
add rsi, 2
or dl, dl
jne 0x1402676bf
xor eax, eax
jmp 0x1402676e6
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1402676f4
mov dword [reloc.OLEAUT32.dll_SysReAllocString], 0
mov rdi, r13
lea rsi, [0x140429174]
mov dl, byte [rdi]
cmp dl, byte [rsi]
jne 0x140267720
or dl, dl
je 0x14026771c
mov dl, byte [rdi + 1]
cmp dl, byte [rsi + 1]
jne 0x140267720
add rdi, 2
add rsi, 2
or dl, dl
jne 0x1402676fe
xor eax, eax
jmp 0x140267725
sbb eax, eax
or eax, 1
test eax, eax
jne 0x1402670f8
mov dword [reloc.OLEAUT32.dll_SysReAllocString], 2
jmp 0x1402670f8
lea rdi, [rsp + 0x1030]
lea rdx, [0x1404290a4]
mov rsi, rdi
mov ecx, 0xffffffff
xor eax, eax
repne scasb al, byte [rdi]
add rdi, 0xffffffffffffffff
mov al, byte [rdx]
add rdx, 1
mov byte [rdi], al
add rdi, 1
test al, al
jne 0x14026775b
mov rax, rsi
lea rcx, [rsp + 0x1030]
lea rdx, [0x1404290a0]
call sub.MSVCR100.dll_fopen
test rax, rax
jne 0x1402670e2
lea rsi, [rsp + 0x1030]
lea rdi, [0x140429098]
mov rax, rsi
mov dl, byte [rdi]
add rdi, 1
mov byte [rsi], dl
add rsi, 1
test dl, dl
jne 0x14026779d
lea rsi, [rsp + 0x30]
mov qword [rsp + 0x20], rsi
lea rax, [rsp + 0x5030]
xor ecx, ecx
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x1030]
mov r9d, 0x1000
call qword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
jne 0x1402677fb
mov dword [0x1403febe4], 1
mov eax, 0xffffffff
add rsp, 0x5050
pop rbx
pop rsi
pop rdi
ret
mov rcx, rsi
lea rdx, [0x1404290a0]
call sub.MSVCR100.dll_fopen
nop
jmp 0x1402670e2
xor eax, eax
add rsp, 0x5050
pop rbx
pop rsi
pop rdi
ret
mov r12, qword [rsp + 0x5040]
mov r13, qword [rsp + 0x5038]
mov dword [0x1403febe4], 1
xor eax, eax
add rsp, 0x5050
pop rbx
pop rsi
pop rdi
ret