Function at 0x1400beed0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r12
push r13
push r14
push r15
mov eax, 0x50
call fcn.1400b17d0
sub rsp, rax
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rdi
mov rax, qword [0x14021d0b8]
xor rax, rbp
mov qword [rbp + 8], rax
xor ebx, ebx
lea r14, str.RANDFILE
mov r12, rdx
mov r15, rcx
xor r8d, r8d
xor edx, edx
mov rcx, r14
mov edi, ebx
lea r13d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x1400bef87
lea r14, str.HOME
xor r8d, r8d
mov rcx, r14
xor edx, edx
mov r13d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x1400bef87
lea r14, str.USERPROFILE
xor r8d, r8d
mov rcx, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x1400bef87
lea r14, str.SYSTEMROOT
xor r8d, r8d
mov rcx, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
je 0x1400bf05e
mov eax, esi
movabs rdx, 0xffffffffffffff0
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400befa2
mov rcx, rdx
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400b17d0
sub rsp, rcx
mov r8d, esi
mov rcx, r14
lea rax, [rsp + 0x40]
mov rdx, rax
mov qword [rbp], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, esi
jae 0x1400bf054
mov rsi, qword [rbp]
or r9d, 0xffffffff
mov qword [rsp + 0x38], rbx
mov r8, rsi
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdx, eax
test eax, eax
je 0x1400bf054
lea rax, [rdx + 0xf]
cmp rax, rdx
ja 0x1400bf016
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1400b17d0
sub rsp, rax
or r9d, 0xffffffff
mov r8, rsi
mov ecx, 0xfde9
mov qword [rsp + 0x38], rbx
lea rdi, [rsp + 0x40]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], edx
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rdi, rbx
test r13d, r13d
jne 0x1400bf067
test rdi, rdi
jne 0x1400bf070
lea rdi, [0x1401b1838]
jmp 0x1400bf078
test rdi, rdi
je 0x1400bf119
cmp byte [rdi], bl
je 0x1400bf119
mov eax, ebx
mov rcx, rdi
cmp byte [rdi], al
je 0x1400bf091
cmp eax, 0x80000000
jae 0x1400bf091
inc rcx
inc eax
cmp byte [rcx], bl
jne 0x1400bf081
mov edx, eax
btr edx, 0x1f
test r13d, r13d
je 0x1400bf0bc
lea rax, [rdx + 1]
cmp rax, r12
jae 0x1400bf0bc
mov r8, r12
mov rdx, rdi
mov rcx, r15
call fcn.1400c7b70
cmp rax, r12
jb 0x1400bf11c
xor eax, eax
jmp 0x1400bf126
lea rcx, str..rnd
mov eax, ebx
cmp eax, 0x80000000
jae 0x1400bf0d5
inc rcx
inc eax
cmp byte [rcx], bl
jne 0x1400bf0c5
btr eax, 0x1f
add rax, 2
add rax, rdx
cmp rax, r12
jae 0x1400bf11c
mov r8, r12
mov rdx, rdi
mov rcx, r15
call fcn.1400c7b70
mov r8, r12
lea rdx, [0x1401a6e5c]
mov rcx, r15
call fcn.1400c7af0
mov r8, r12
lea rdx, str..rnd
mov rcx, r15
call fcn.1400c7af0
jmp 0x1400bf11c
mov byte [r15], bl
cmp byte [r15], bl
cmovne rbx, r15
mov rax, rbx
mov rcx, qword [rbp + 8]
xor rcx, rbp
call fcn.1400b1210
mov rbx, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x50]
lea rsp, [rbp + 0x10]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret