Function at 0x1800bf3b0
Capabilities:
Query environment variable

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov qword [rbp - 0x71], 0xfffffffffffffffe
mov qword [rsp + 0x110], rbx
mov rax, qword [0x1802a8008]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rcx, str.APPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov qword [rbp + 0xf], 0xf
xor ebx, ebx
mov qword [rbp + 7], rbx
mov byte [rbp - 9], bl
cmp byte [rax], bl
jne 0x1800bf403
mov r8d, ebx
jmp 0x1800bf410
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], bl
jne 0x1800bf407
mov rdx, rax
lea rcx, [rbp - 9]
call fcn.18003d620
nop
lea r8, str..exFilLocat_
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x29]
call fcn.1800a9640
nop
mov qword [rbp - 0x51], 0xf
mov qword [rbp - 0x59], rbx
mov byte [rbp - 0x69], 0
mov r8d, 0xa
lea rdx, str.maping.ytd
lea rcx, [rbp - 0x69]
call fcn.18003d620
nop
lea r8, [rbp - 0x69]
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x49]
call fcn.1800ce550
nop
lea rcx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae rcx, qword [rbp - 0x49]
lea rdx, [rbp + 0x17]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jne 0x1800bf4b5
lea r9, [rbp - 0x69]
cmp qword [rbp - 0x51], 0x10
cmovae r9, qword [rbp - 0x69]
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae rdx, qword [rbp - 0x49]
mov byte [rsp + 0x20], al
mov r8b, 1
lea rcx, [rbp - 0x79]
call qword [0x18034e910]
nop
mov rax, qword [rbp - 0x31]
cmp rax, 0x10
jb 0x1800bf50f
inc rax
mov rcx, qword [rbp - 0x49]
cmp rax, 0x1000
jb 0x1800bf50a
test cl, 0x1f
je 0x1800bf4da
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800bf4ea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800bf4fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x1800bf507
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.1801e6034
mov qword [rbp - 0x31], 0xf
mov qword [rbp - 0x39], rbx
mov byte [rbp - 0x49], 0
mov rax, qword [rbp - 0x51]
cmp rax, 0x10
jb 0x1800bf579
inc rax
mov rcx, qword [rbp - 0x69]
cmp rax, 0x1000
jb 0x1800bf574
test cl, 0x1f
je 0x1800bf544
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800bf554
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800bf564
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x1800bf571
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.1801e6034
mov qword [rbp - 0x51], 0xf
mov qword [rbp - 0x59], rbx
mov byte [rbp - 0x69], 0
mov rax, qword [rbp - 0x11]
cmp rax, 0x10
jb 0x1800bf5e3
inc rax
mov rcx, qword [rbp - 0x29]
cmp rax, 0x1000
jb 0x1800bf5de
test cl, 0x1f
je 0x1800bf5ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800bf5be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800bf5ce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x1800bf5db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.1801e6034
mov qword [rbp - 0x11], 0xf
mov qword [rbp - 0x19], rbx
mov byte [rbp - 0x29], 0
mov rax, qword [rbp + 0xf]
cmp rax, 0x10
jb 0x1800bf64d
inc rax
mov rcx, qword [rbp - 9]
cmp rax, 0x1000
jb 0x1800bf648
test cl, 0x1f
je 0x1800bf618
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800bf628
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800bf638
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x1800bf645
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.1801e6034
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1801e6050
mov rbx, qword [rsp + 0x110]
add rsp, 0x100
pop rbp
ret