Function at 0x14000bec0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x488
mov r14, rcx
movabs r15, 0x8000000000000000
lea rcx, [rsp + 0x88]
call fcn.140009770
mov rax, qword [rsp + 0x88]
cmp rax, r15
jne 0x14000bf65
mov rax, qword [rsp + 0x90]
mov ecx, eax
and ecx, 3
lea rdx, [rcx - 2]
cmp rdx, 2
jb 0x14000bf5d
test rcx, rcx
je 0x14000bf5d
lea rdi, [rax - 1]
mov rbx, qword [rax - 1]
mov rsi, qword [rax + 7]
mov rcx, rbx
call qword [rsi]
cmp qword [rsi + 8], 0
je 0x14000bf4b
cmp qword [rsi + 0x10], 0x11
jb 0x14000bf39
mov rbx, qword [rbx - 8]
mov rcx, qword [0x140026178]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x140026178]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
mov qword [r14], r15
jmp 0x14000c487
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x80], r14
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 2
mov qword [rsp + 0x78], 0
mov r12d, 0x200
mov eax, 2
mov qword [rsp + 0x58], rax
xor r14d, r14d
xor esi, esi
xor r13d, r13d
cmp r12, 0x201
jae 0x14000bff0
jmp 0x14000bfcf
jae 0x14000c0b5
cmp r12, 0x201
jae 0x14000bff0
mov edi, 0x200
lea rbx, [rsp + 0x88]
mov rbp, r12
jmp 0x14000c024
sub r12, r13
sub rsi, r13
cmp rsi, r12
jb 0x14000c091
mov eax, 0xffffffff
cmp r14, rax
mov r13d, 0xffffffff
cmovb r13, r14
mov qword [rsp + 0x78], r13
mov rsi, r14
mov rdi, r13
mov rbx, qword [rsp + 0x58]
mov rbp, r13
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, qword [rsp + 0x60]
mov rdx, rbx
mov r8d, ebp
call qword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov r15d, eax
test eax, eax
jne 0x14000c052
call qword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x14000c0fc
mov r12d, r15d
cmp rbp, r12
jne 0x14000bfc0
call qword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000c0fa
add rbp, rbp
mov eax, 0xffffffff
cmp rbp, rax
cmovae rbp, rax
mov r12, rbp
cmp r12, 0x201
jb 0x14000bfcf
jmp 0x14000bff0
lea rcx, [rsp + 0x68]
mov rdx, r13
mov r8, r12
call fcn.14001f490
mov r14, qword [rsp + 0x68]
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x58], rax
jmp 0x14000bfff
cmp rdi, r12
jb 0x14000c0fa
test r15d, r15d
je 0x14000c127
movzx eax, byte [0x140026190]
mov rcx, qword [0x140026178]
test rcx, rcx
jne 0x14000c0e7
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x14000c0fa
mov rcx, rax
mov qword [0x140026178], rax
xor edx, edx
mov r8, r12
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov r13, rax
test rax, rax
jne 0x14000c12d
ud2
call qword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
shl rbx, 0x20
or rbx, 2
movabs rdi, 0x8000000000000000
mov rsi, rdi
test r14, r14
jne 0x14000c3d3
jmp 0x14000c3e7
mov r13d, 1
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], 0
mov byte [rsp + 0x48], 1
lea r14, [rbx + r12*2]
xor r12d, r12d
lea r15, [rsp + 0x20]
xor edi, edi
test di, di
jne 0x14000c194
jmp 0x14000c1c0
mov byte [rsp + 0x20], cl
mov ebp, 1
mov rax, qword [rsp + 0x30]
sub rax, r12
cmp rax, rbp
jb 0x14000c198
lea rcx, [r12 + r13]
mov rdx, r15
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
add r12, rbp
mov qword [rsp + 0x40], r12
xor edi, edi
test di, di
je 0x14000c1c0
mov ecx, esi
jmp 0x14000c1d0
lea rcx, [rsp + 0x30]
mov rdx, r12
mov r8, rbp
call fcn.14001f540
mov r13, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
jmp 0x14000c176
cmp rbx, r14
je 0x14000c3a8
movzx ecx, word [rbx]
add rbx, 2
mov edx, ecx
and edx, 0xf800
movzx eax, cx
cmp edx, 0xd800
jne 0x14000c250
cmp eax, 0xdbff
ja 0x14000c310
cmp rbx, r14
je 0x14000c314
movzx edx, word [rbx]
add rbx, 2
mov r8d, edx
add r8d, 0x2000
movzx r8d, r8w
cmp r8d, 0xfc00
jb 0x14000c31b
movzx eax, dx
and ecx, 0x3ff
and eax, 0x3ff
shl rcx, 0x1a
shl rax, 0x10
or rax, rcx
movabs rcx, 0x100000000
add rax, rcx
jmp 0x14000c254
shl rax, 0x10
mov rcx, rax
shr rcx, 0x10
mov dword [rsp + 0x20], 0
cmp ecx, 0x80
jb 0x14000c160
cmp ecx, 0x800
jae 0x14000c2a0
shr eax, 0x16
or al, 0xc0
mov byte [rsp + 0x20], al
and cl, 0x3f
or cl, 0x80
mov byte [rsp + 0x21], cl
mov ebp, 2
jmp 0x14000c169
mov rdx, rax
cmp ecx, 0xffff
ja 0x14000c2d5
shr rdx, 0x1c
or dl, 0xe0
mov byte [rsp + 0x20], dl
shr eax, 0x16
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x21], al
and cl, 0x3f
or cl, 0x80
mov byte [rsp + 0x22], cl
mov ebp, 3
jmp 0x14000c169
shr rdx, 0x22
or dl, 0xf0
mov byte [rsp + 0x20], dl
mov rdx, rax
shr rdx, 0x1c
and dl, 0x3f
or dl, 0x80
mov byte [rsp + 0x21], dl
shr eax, 0x16
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x22], al
and cl, 0x3f
or cl, 0x80
mov byte [rsp + 0x23], cl
mov ebp, 4
jmp 0x14000c169
xor edi, edi
jmp 0x14000c321
xor edi, edi
mov rbx, r14
jmp 0x14000c321
mov di, 1
mov esi, edx
mov byte [rsp + 0x48], 0
mov dword [rsp + 0x20], 0
mov edx, eax
shr edx, 0xc
or dl, 0xe0
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rsp + 0x21], al
and cl, 0x3f
or cl, 0x80
mov byte [rsp + 0x22], cl
mov byte [rsp + 0x20], dl
mov rax, qword [rsp + 0x30]
sub rax, r12
cmp rax, 2
jbe 0x14000c38e
mov r13, qword [rsp + 0x38]
movzx eax, byte [rsp + 0x22]
mov byte [r13 + r12 + 2], al
movzx eax, word [rsp + 0x20]
mov word [r13 + r12], ax
add r12, 3
mov qword [rsp + 0x40], r12
test di, di
jne 0x14000c194
jmp 0x14000c1c0
mov r8d, 3
lea rcx, [rsp + 0x30]
mov rdx, r12
call fcn.14001f540
mov r12, qword [rsp + 0x40]
jmp 0x14000c35d
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x20], xmm0
mov r14, qword [rsp + 0x68]
movabs rdi, 0x8000000000000000
test r14, r14
je 0x14000c3e7
mov r8, qword [rsp + 0x70]
mov rcx, qword [0x140026178]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp rsi, rdi
mov rax, qword [rsp + 0x80]
jne 0x14000c459
mov qword [rax], rdi
mov eax, ebx
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
mov rdi, qword [rsp + 0x50]
jb 0x14000c46e
test rax, rax
je 0x14000c46e
lea r15, [rbx - 1]
mov r14, qword [rbx - 1]
mov rsi, qword [rbx + 7]
mov rcx, r14
call qword [rsi]
cmp qword [rsi + 8], 0
je 0x14000c445
cmp qword [rsi + 0x10], 0x11
jb 0x14000c433
mov r14, qword [r14 - 8]
mov rcx, qword [0x140026178]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x140026178]
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x14000c46e
mov qword [rax], rsi
mov qword [rax + 8], rbx
movaps xmm0, xmmword [rsp + 0x20]
movups xmmword [rax + 0x10], xmm0
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x14000c487
mov rcx, qword [0x140026178]
xor edx, edx
mov r8, qword [rsp + 0x60]
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x488
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret