Function at 0x1403f2160
Capabilities:
Query environment variable

Disassembly:
push r12
push r14
push r15
sub rsp, 0x20
mov r14d, r8d
mov r15, rdx
mov r12, rcx
call fcn.1403efb40
test eax, eax
je 0x1403f218c
mov eax, reloc.WS2_32.dll_setsockopt
add rsp, 0x20
pop r15
pop r14
pop r12
ret
mov qword [rsp + 0x40], rbx
mov ecx, 0x12218
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
call qword [0x14060c6e8]
mov rbx, rax
test rax, rax
jne 0x1403f21bc
xor esi, esi
lea eax, [rbx + 0xf]
mov qword [r12], rsi
jmp 0x1403f23da
mov qword [rsp + 0x48], rbp
call fcn.1403f89f0
xor esi, esi
mov qword [rbx], 0xffffffffffffffff
mov qword [rbx + 8], 0xffffffffffffffff
mov qword [rbx + 0x10], 0xffffffffffffffff
mov qword [rbx + 0x18], 0xffffffffffffffff
mov dword [rbx + 0x50], 0xffffffff
mov dword [rbx + 0x20], 0xffffffff
mov dword [rbx + 0x98], 0xffffffff
mov dword [rbx + 0x30], 0xffffffff
mov dword [rbx + 0x40], 0xffffffff
mov dword [rbx + 0x1a0], esi
mov qword [rbx + 0x48], rsi
mov qword [rbx + 0x28], rsi
mov qword [rbx + 0x38], rsi
mov qword [rbx + 0x90], rsi
mov qword [rbx + 0x121d0], rsi
mov qword [rbx + 0x121d8], rsi
mov qword [rbx + 0x121e0], rsi
mov qword [rbx + 0x121e8], rsi
mov qword [rbx + 0x121f0], rsi
mov qword [rbx + 0x121f8], rsi
mov qword [rbx + 0x12200], rsi
mov qword [rbx + 0x12208], rsi
mov qword [rbx + 0x12210], rsi
mov dword [rbx + 0x1b0], esi
movsxd rcx, eax
xor eax, eax
mov qword [rbx + 0x1a8], rcx
lea rcx, [rbx + 0x1b8]
mov qword [rbx + 0x54], rax
mov qword [rbx + 0x5c], rax
mov qword [rbx + 0x64], rax
mov qword [rbx + 0x6c], rax
mov dword [rbx + 0x74], esi
mov qword [rbx + 0x78], rax
mov qword [rbx + 0x80], rax
call fcn.1403f8670
lea rdi, [rbx + 0x1d0]
mov ebp, 0x800
nop dword [rax]
mov rcx, rdi
call fcn.1403f8670
add rdi, 0x18
sub rbp, 1
jne 0x1403f22b0
lea rdi, [rbx + 0xc1d0]
mov ebp, 0x400
nop
mov rcx, rdi
call fcn.1403f8670
add rdi, 0x18
sub rbp, 1
jne 0x1403f22d0
mov r8d, r14d
mov rdx, r15
mov rcx, rbx
call fcn.1403f37d0
mov edi, eax
test eax, eax
jne 0x1403f2373
lea rcx, str.LOCALDOMAIN
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1403f231d
cmp dword [rbx + 0x30], 0xffffffff
jne 0x1403f231d
mov rdx, rax
mov rcx, rbx
call fcn.1403f3f00
test eax, eax
jne 0x1403f2346
lea rcx, str.RES_OPTIONS
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1403f233e
mov rdx, rax
mov rcx, rbx
call fcn.1403f3d60
test eax, eax
jne 0x1403f2346
mov rcx, rbx
call fcn.1403f3b20
mov rcx, rbx
call fcn.1403f3540
mov edi, eax
test eax, eax
jne 0x1403f2373
lea ecx, [rax + 0x1f]
lea rbp, [rbx + 0x9e]
call qword [0x14060c6e8]
mov r14, rax
test rax, rax
jne 0x1403f23f4
lea edi, [rax + 0xf]
mov rcx, qword [rbx + 0x90]
test rcx, rcx
je 0x1403f2385
call qword [0x14060c6f8]
movsxd rax, dword [rbx + 0x30]
cmp eax, 0xffffffff
je 0x1403f239a
mov rcx, qword [rbx + 0x28]
mov rdx, rax
call fcn.1403f89a0
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1403f23a9
call qword [0x14060c6f8]
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x1403f23b8
call qword [0x14060c6f8]
mov rcx, qword [rbx + 0x12210]
test rcx, rcx
je 0x1403f23ca
call qword [0x14060c6f8]
mov rcx, rbx
call qword [0x14060c6f8]
mov eax, edi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
xor eax, eax
mov rcx, rbp
mov qword [r14], rax
mov r15d, 0x100
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], rax
mov dword [r14 + 0x18], eax
mov word [r14 + 0x1c], ax
mov byte [r14 + 0x1e], al
nop word [rax + rax]
mov byte [rcx], al
lea rcx, [rcx + 1]
inc ax
cmp ax, r15w
jl 0x1403f2420
mov rax, qword [0x140635218]
test rax, rax
je 0x1403f2449
mov edx, 0x1f
mov rcx, rbp
call rax
test al, al
jne 0x1403f2472
mov rdi, rsi
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x1403f2466
dec eax
or eax, 0xffffff00
inc eax
mov byte [rdi + rbp], al
inc rdi
cmp rdi, 0x1f
jl 0x1403f2450
xor r8b, r8b
mov word [rbp + 0x100], si
xor r10b, r10b
mov r9, rbp
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
movzx eax, r8b
movzx r8d, r8b
inc r8d
movzx ecx, byte [rax + r14]
add cl, dl
add r10b, cl
movzx ecx, r10b
movzx eax, byte [rcx + rbp]
mov byte [r9 - 1], al
mov eax, 0x8421085
mov byte [rcx + rbp], dl
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
imul eax, eax, 0x1f
sub r8d, eax
sub r15, 1
jne 0x1403f2490
mov rcx, r14
call qword [0x14060c6f8]
mov rcx, rbp
call fcn.1403efb60
mov word [rbx + 0x9c], ax
test byte [rbx], 2
je 0x1403f250c
cmp dword [rbx + 0x98], 1
jle 0x1403f250c
mov dword [rbx + 0x98], 1
mov ebp, esi
cmp dword [rbx + 0x98], esi
jle 0x1403f2583
mov r14, rsi
nop dword [rax]
mov rdi, qword [rbx + 0x90]
add rdi, r14
mov qword [rdi + 0x20], 0xffffffffffffffff
lea rcx, [rdi + 0x68]
mov qword [rdi + 0x28], 0xffffffffffffffff
inc dword [rbx + 0x1a0]
mov eax, dword [rbx + 0x1a0]
mov dword [rdi + 0x60], eax
mov qword [rdi + 0x34], rsi
mov dword [rdi + 0x48], esi
mov qword [rdi + 0x40], rsi
mov qword [rdi + 0x50], rsi
mov qword [rdi + 0x58], rsi
call fcn.1403f8670
inc ebp
mov qword [rdi + 0x80], rbx
add r14, 0x90
mov dword [rdi + 0x88], esi
cmp ebp, dword [rbx + 0x98]
jl 0x1403f2520
mov qword [r12], rbx
xor eax, eax
jmp 0x1403f23d5