Function at 0x140028850
Capabilities:
Query environment variable

Disassembly:
push rbp
push r12
sub rsp, 0x458
movzx eax, byte [rcx + 1]
movzx ebp, r8b
mov r12, rcx
cmp edx, eax
jl 0x140028877
xor eax, eax
add rsp, 0x458
pop r12
pop rbp
ret
mov qword [rsp + 0x440], r13
movsxd r13, edx
shl r13, 5
add r13, qword [rcx + 8]
cmp byte [r13], 0
jne 0x1400288a6
xor eax, eax
mov r13, qword [rsp + 0x440]
add rsp, 0x458
pop r12
pop rbp
ret
mov qword [rsp + 0x448], rdi
mov rdi, qword [r13 + 8]
cmp word [rdi], 0
jne 0x1400288c1
mov rax, qword [r13 + 0x10]
jmp 0x140028c8c
mov qword [rsp + 0x480], rbx
lea rdx, [0x1401098b0]
mov qword [rsp + 0x450], rsi
mov qword [rsp + 0x438], r14
mov r14, qword [r13 + 0x10]
mov qword [rsp + 0x430], r15
xor r15d, r15d
mov ebx, r15d
test r14, r14
je 0x140028a3d
mov rax, qword [r14]
test rax, rax
je 0x140028a3d
cmp rdi, rax
jae 0x14002892c
nop dword [rax]
cmp rbx, 0xfd
jae 0x140028935
movzx eax, word [rdi]
add rdi, 2
mov word [rdx + rbx*2], ax
inc rbx
cmp rdi, qword [r14]
jb 0x140028910
cmp rbx, 0xfd
jb 0x14002893e
cmp rdi, qword [r14]
jb 0x140028a2d
mov rsi, qword [r14 + 8]
movzx ecx, byte [rsi + 0x23]
test ecx, ecx
je 0x1400289e2
sub ecx, 1
je 0x14002898a
sub ecx, 1
je 0x14002896b
cmp ecx, 1
je 0x1400289d4
mov rdx, qword [rsi + 0x28]
xor ecx, ecx
call qword [rsi + reloc.OLEAUT32.dll_SafeArrayGetElement]
jmp 0x1400289ed
xor edx, edx
lea rcx, [0x140107f00]
call fcn.1400050a0
mov rcx, rax
mov eax, 0xffffffff
cmp rcx, rax
cmove rcx, r15
jmp 0x1400289f0
mov rcx, rsi
call fcn.140001320
cmp dword [0x140105b28], r15d
jne 0x1400289d9
cmp qword [rsi + 0x10], r15
jne 0x1400289d9
mov rcx, qword [rsi + 0x28]
lea rdx, [rsp + 0x478]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rdx, [0x1401098b0]
test eax, eax
je 0x1400289cd
mov qword [0x140109880], r15
lea ecx, [rax - 1]
jmp 0x1400289f7
mov qword [0x140109880], rsi
mov rcx, r15
jmp 0x1400289f7
mov rcx, qword [rsi + 0x10]
shr rcx, 1
jmp 0x1400289f0
mov rcx, qword [rsi + 0x10]
xor edx, edx
call fcn.14008f470
mov rcx, rax
lea rdx, [0x1401098b0]
mov eax, 0xfd
sub rax, rbx
cmp rcx, rax
ja 0x140028a2d
mov rcx, qword [r14 + 8]
lea rdx, [rdx + rbx*2]
call fcn.14008f470
add rbx, rax
lea rdx, [0x1401098b0]
movzx eax, word [r14 + 0x12]
add r14, 0x18
lea rdi, [rdi + rax*2]
jmp 0x1400288fb
mov r9, qword [r13 + 8]
lea rdx, str.This_dynamically_built_variable_name_is_too_long.__If_this_variable_was_not_intended_to_be_dynamic__remove_the___symbols_from_it.
jmp 0x140028c5f
movzx eax, word [rdi]
test ax, ax
je 0x140028a61
cmp rbx, 0xfd
jae 0x140028a6a
add rdi, 2
mov word [rdx + rbx*2], ax
inc rbx
movzx eax, word [rdi]
test ax, ax
jne 0x140028a45
cmp rbx, 0xfd
jb 0x140028a70
cmp word [rdi], r15w
jne 0x140028a2d
test rbx, rbx
jne 0x140028a85
mov r9, qword [r13 + 8]
lea rdx, str.This_dynamic_variable_is_blank._If_this_variable_was_not_intended_to_be_dynamic__remove_the___symbols_from_it.
jmp 0x140028c5f
mov eax, dword [0x140109aac]
mov word [rdx + rbx*2], r15w
test al, 1
jne 0x140028aca
or eax, 1
mov dword [0x140109aac], eax
lea rax, [0x140107270]
mov qword [0x140109ab8], rax
mov qword [0x140109ac0], r15
mov dword [0x140109ad0], 0x1000400
mov qword [0x140109ad8], rdx
mov qword [0x140109ac8], r15
test bpl, bpl
jne 0x140028bc0
cmp word [0x1401098b0], r15w
je 0x140028c6a
mov rdi, rdx
movzx ebp, word [rdi]
mov esi, ebp
mov ecx, ebp
and esi, 0xffffff80
jne 0x140028afe
mov edx, 0x107
call fcn.1400ad844
test eax, eax
jne 0x140028b16
test esi, esi
jne 0x140028b16
movzx edx, bp
lea rcx, [0x1400ed7d0]
call fcn.1400a9d38
test rax, rax
je 0x140028b6b
add rdi, 2
cmp word [rdi], r15w
jne 0x140028ae4
lea rdi, [0x1401098b0]
mov qword [rsp + 0x28], r15
lea rcx, [0x1401072b0]
xor r9d, r9d
mov dword [rsp + 0x20], 3
mov r8, rbx
mov rdx, rdi
call fcn.140028d40
test rax, rax
jne 0x140028c6c
mov rcx, rdi
call fcn.1400295c0
test rax, rax
jne 0x140028bb9
lea rax, [0x140109ab0]
jmp 0x140028c6c
lea rdi, [0x1401098b0]
mov edx, 0x200
lea r9, str.variable
mov qword [rsp + 0x20], rdi
lea r8, str.The_following__s_name_contains_an_illegal_character:_n___1.300s_
lea rcx, [rsp + 0x30]
call fcn.14008b8a0
lea r8, [0x1400cef3c]
lea rdx, [rsp + 0x30]
lea rcx, [0x1401072b0]
call fcn.1400395c0
test eax, eax
je 0x140028c6a
jmp 0x140028b27
lea rdx, [0x1401098b0]
cmp word [0x1401098b0], r15w
je 0x140028c6a
lea rax, [rsp + 0x478]
mov r8, rbx
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x470]
lea rcx, [0x1401072b0]
mov dword [rsp + 0x20], 3
call fcn.140028d40
lea rdi, [0x1401098b0]
test rax, rax
jne 0x140028c39
cmp byte [rsp + 0x478], r15b
lea rcx, [0x1401072b0]
mov r9d, dword [rsp + 0x470]
mov r8, rbx
setne r15b
mov rdx, rdi
inc r15d
mov dword [rsp + 0x20], r15d
call fcn.140029030
test rax, rax
je 0x140028c6a
cmp byte [r13], 2
jne 0x140028c6c
movzx ecx, byte [rax + 0x23]
test cl, cl
jne 0x140028c50
mov rcx, qword [rax + 0x10]
movzx ecx, byte [rcx + 0x23]
cmp cl, 2
jbe 0x140028c6c
mov r9, rdi
lea rdx, str.Not_allowed_as_an_output_variable.
xor r8d, r8d
mov rcx, r12
call fcn.140039270
xor eax, eax
mov r14, qword [rsp + 0x438]
mov rbx, qword [rsp + 0x480]
mov rsi, qword [rsp + 0x450]
mov r15, qword [rsp + 0x430]
mov rdi, qword [rsp + 0x448]
mov r13, qword [rsp + 0x440]
add rsp, 0x458
pop r12
pop rbp
ret