Function at 0x140001551
Capabilities:
Query environment variable
Write file on windows

Disassembly:
push rbp
sub rsp, 0x2c0
lea rbp, [rsp + 0x80]
mov dword [rbp + 0x250], ecx
mov qword [rbp + 0x258], rdx
call dbg.__main
mov dword [rbp + 0x23c], 0
mov word [rbp + 0x23a], 0
call dbg.init_cmd_colors
mov word [rbp + 0x23a], ax
call dbg.print_header
mov rax, qword [rbp + 0x180]
mov rdx, qword [rbp + 0x188]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rdx
mov rax, qword [rbp + 0x190]
mov rdx, qword [rbp + 0x198]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
mov rax, qword [rbp + 0x1a0]
mov rdx, qword [rbp + 0x1a8]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rdx
mov rax, qword [rbp + 0x1b0]
mov rdx, qword [rbp + 0x1b8]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rdx
mov rax, qword [rbp + 0x1c0]
mov rdx, qword [rbp + 0x1c8]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rdx
mov rax, qword [rbp + 0x1d0]
mov rdx, qword [rbp + 0x1d8]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rdx
mov rax, qword [rbp + 0x1e0]
mov rdx, qword [rbp + 0x1e8]
mov qword [rbp], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 0x1f0]
mov rdx, qword [rbp + 0x1f8]
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x200]
mov rdx, qword [rbp + 0x208]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rdx
mov eax, dword [rbp + 0x210]
mov dword [rbp + 0x30], eax
lea rax, [rbp - 0x60]
mov rcx, rax
call dbg.printInfoSO
lea rax, str.____Timing:_n
mov rcx, rax
call sym.printf
call dbg.timing
or dword [rbp + 0x23c], eax
lea rax, [0x14004102c]
mov rcx, rax
call sym.printf
lea rax, [0x14004102e]
mov rcx, rax
call sym.getenv
mov qword [rbp + 0x230], rax
cmp qword [rbp + 0x230], 0
jne 0x1400016d4
lea rax, str.ERROR__Debugger_not_set_
mov rcx, rax
call sym.puts
mov ecx, 0
call sym.exit
lea rax, str.USERNAME
mov rcx, rax
call sym.getenv
mov qword [rbp + 0x228], rax
cmp qword [rbp + 0x228], 0
jne 0x14000170d
lea rax, str.ERROR__Username_not_set_
mov rcx, rax
call sym.puts
mov ecx, 0
call sym.exit
lea rax, [rbp + 0x40]
movabs rdx, 0x73726573552f3a43
mov qword [rax], rdx
mov word [rax + 8], 0x2f
lea rax, str.USERNAME
mov rcx, rax
call sym.getenv
mov rdx, rax
lea rax, [rbp + 0x40]
mov rcx, rax
call sym.strcat
lea rax, [rbp + 0x40]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x40]
add rax, rdx
mov word [rax], 0x2f
mov rdx, qword [rbp + 0x230]
lea rax, [rbp + 0x40]
mov rcx, rax
call sym.strcat
lea rax, [rbp + 0x40]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x40]
add rax, rdx
mov word [rax], 0x2f
cmp dword [rbp + 0x23c], 0
jne 0x1400017cf
lea rax, str.Im_running_the_program:_n_n
mov rcx, rax
call dbg.print_not_traced
lea rax, [rbp + 0x40]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x40]
add rax, rdx
movabs rdx, 0x646176655f746f6e
mov qword [rax], rdx
mov dword [rax + 8], 0x2f6465
jmp 0x140001801
lea rax, str.We_are_under_analysis._n_n
mov rcx, rax
call dbg.print_not_traced
lea rax, [rbp + 0x40]
mov rcx, rax
call sym.strlen
mov rdx, rax
lea rax, [rbp + 0x40]
add rax, rdx
movabs rdx, 0x2f646564617665
mov qword [rax], rdx
lea rdx, [rbp + 0x40]
lea rax, [rbp + 0x110]
mov rcx, rax
call sym.strcpy
mov rax, qword [rbp + 0x258]
mov rax, qword [rax]
mov edx, 0x5c
mov rcx, rax
call sym.strrchr
mov qword [rbp + 0x220], rax
add qword [rbp + 0x220], 1
mov rdx, qword [rbp + 0x220]
lea rax, [rbp + 0x110]
mov rcx, rax
call sym.strcat
lea rax, [rbp + 0x110]
mov rcx, rax
call sym.puts
mov ecx, 1
mov rax, qword [dbg.__acrt_iob_func]
call rax
mov rcx, rax
call sym.fflush
lea rax, [rbp + 0x110]
lea rdx, section..rdata
mov rcx, rax
call sym.fopen
mov qword [rbp + 0x218], rax
cmp qword [rbp + 0x218], 0
jne 0x1400018b5
lea rax, str.Error_opening_file__n
mov rcx, rax
call sym.printf
mov ecx, 1
call sym.exit
mov rax, qword [rbp + 0x218]
mov r9, rax
mov r8d, 0x12
mov edx, 1
lea rax, [0x140041017]
mov rcx, rax
call sym.fwrite
mov rax, qword [rbp + 0x218]
mov rcx, rax
call sym.fclose
mov ecx, 0
call sym.exit
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop