Function at 0x140004e30
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], r12
push rbp
lea rbp, [rsp - 0x350]
sub rsp, 0x450
mov rax, qword [0x140033aa0]
xor rax, rsp
mov qword [rbp + 0x340], rax
lea rcx, [rsp + 0x22]
xor r12d, r12d
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], r12w
call fcn.1400132a0
lea rcx, [rbp + 0x132]
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x130], r12w
call fcn.1400132a0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x20]
mov rcx, rax
mov r9d, 0x104
xor edx, edx
call qword [0x1400272e8]
test eax, eax
jne 0x140004eb5
or eax, 0xffffffff
jmp 0x1400050e3
mov qword [rsp + 0x460], rbx
mov qword [rsp + 0x468], rsi
mov qword [rsp + 0x470], rdi
cmp word [rsp + 0x20], r12w
je 0x140004f6a
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
xor eax, eax
repne scasw ax, word [rdi]
lea rbx, [rsp + 0x20]
not rcx
lea rdi, [rcx - 1]
cmp edi, 0x11
jl 0x140004f1d
lea rdx, str.SSLVPNSessions_
mov r8d, 0x11
mov rcx, rbx
call fcn.140010314
test eax, eax
je 0x140004ff9
dec edi
add rbx, 2
jne 0x140004ef3
cmp word [rsp + 0x20], r12w
je 0x140004f6a
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
xor eax, eax
repne scasw ax, word [rdi]
lea rbx, [rsp + 0x20]
not rcx
lea rdi, [rcx - 1]
nop
cmp edi, 0xc
jl 0x140004f6a
lea rdx, str.SangforVDI_
mov r8d, 0xc
mov rcx, rbx
call fcn.140010314
test eax, eax
je 0x14000502b
dec edi
add rbx, 2
jne 0x140004f40
lea rdx, [rbp + 0x130]
lea rcx, str._temp__
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x1400050c8
cmp word [rsp + 0x20], r12w
je 0x140005047
cmp word [rbp + 0x130], r12w
je 0x140005047
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
lea rdi, [rbp + 0x130]
lea rbx, [rsp + 0x20]
not rcx
lea rsi, [rcx - 1]
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx - 1]
cmp esi, edi
jl 0x140005047
lea rdx, [rbp + 0x130]
movsxd r8, edi
mov rcx, rbx
call fcn.140010314
test eax, eax
je 0x14000503e
dec esi
add rbx, 2
jne 0x140004fd5
jmp 0x140005047
test rbx, rbx
je 0x140004f1d
lea rcx, [rbx + 0x22]
mov edx, 0x5c
call fcn.140010648
test rax, rax
je 0x1400050c8
lea rcx, [rbx + 0x22]
mov word [rax], r12w
and al, ch
mov sil, 0
add cl, ch
invalid
add byte [rax], al
invalid
test rbx, rbx
je 0x140004f6a
mov eax, 0x3e8
jmp 0x1400050cb
test rbx, rbx
jne 0x140005108
lea rdx, [rbp + 0x130]
lea rcx, str._appdata_SangforSSLTemp_
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x1400050c8
cmp word [rsp + 0x20], r12w
je 0x1400050c8
cmp word [rbp + 0x130], r12w
je 0x1400050c8
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
lea rdi, [rbp + 0x130]
lea rbx, [rsp + 0x20]
not rcx
lea rsi, [rcx - 1]
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
not rcx
lea rdi, [rcx - 1]
cmp esi, edi
jl 0x1400050c8
lea rdx, [rbp + 0x130]
movsxd r8, edi
mov rcx, rbx
call fcn.140010314
test eax, eax
je 0x140005103
dec esi
add rbx, 2
jne 0x1400050a6
or eax, 0xffffffff
test rbx, rbx
je 0x1400050c8
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rbp + 0x130]
repne scasw ax, word [rdi]
lea edx, [rax + 0x5c]
not rcx
lea rbx, [rbx + rcx*2 - 2]
mov rcx, rbx
call fcn.140010648
test rax, rax
je 0x1400050c8
or rcx, 0xffffffffffffffff
mov word [rax], r12w
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
dec rcx
cmp rcx, 1
ja 0x1400050c8