Function at 0x1400346c0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x478
mov r14, rcx
movabs r15, 0x8000000000000000
lea rcx, [rsp + 0x78]
call fcn.1400278f0
mov rax, qword [rsp + 0x78]
cmp rax, r15
jne 0x140034764
mov rdi, qword [rsp + 0x80]
mov eax, edi
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x14003475c
test rax, rax
je 0x14003475c
mov rbx, qword [rdi - 1]
mov rsi, qword [rdi + 7]
mov rax, qword [rsi]
test rax, rax
je 0x140034725
mov rcx, rbx
call rax
dec rdi
cmp qword [rsi + 8], 0
je 0x14003474b
cmp qword [rsi + 0x10], 0x11
jb 0x14003473a
mov rbx, qword [rbx - 8]
mov rcx, qword [0x141d940e8]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x141d940e8]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov qword [r14], r15
jmp 0x1400349c0
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r14
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 2
mov qword [rsp + 0x38], 0
mov r8d, 0x200
mov r14d, 2
xor ebx, ebx
mov esi, 0xffffffff
xor r15d, r15d
cmp r8, 0x201
jae 0x1400347e0
jmp 0x1400347cf
jae 0x140034884
cmp r8, 0x201
jae 0x1400347e0
mov edi, 0x200
lea r12, [rsp + 0x78]
mov r13, r8
jmp 0x140034809
sub r8, r15
mov rax, rbx
sub rax, r15
cmp r8, rax
ja 0x140034868
cmp rbx, rsi
mov r15d, 0xffffffff
cmovb r15, rbx
mov qword [rsp + 0x38], r15
mov rdi, r15
mov r12, r14
mov r13, r15
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, qword [rsp + 0x50]
mov rdx, r12
mov r8d, r13d
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov ebp, eax
test eax, eax
jne 0x140034833
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x140034946
mov r8d, ebp
cmp r13, r8
jne 0x1400347c0
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x1400349d5
add r13, r13
cmp r13, rsi
cmovae r13, rsi
mov r8, r13
cmp r8, 0x201
jb 0x1400347cf
jmp 0x1400347e0
lea rcx, [rsp + 0x28]
mov rdx, r15
call fcn.140045090
mov rbx, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
jmp 0x1400347ee
cmp rdi, r8
jb 0x1400349d5
lea rcx, [rsp + 0x58]
mov rdx, r12
call fcn.140030540
cmp qword [rsp + 0x28], 0
mov rsi, qword [rsp + 0x48]
movabs rdi, 0x8000000000000000
je 0x1400348c4
mov r8, qword [rsp + 0x30]
mov rcx, qword [0x141d940e8]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov r14, qword [rsp + 0x40]
cmp qword [rsp + 0x58], rdi
jne 0x140034997
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x60]
mov eax, esi
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1400349a8
test rax, rax
je 0x1400349a8
mov rbx, qword [rsi - 1]
mov rdi, qword [rsi + 7]
mov rax, qword [rdi]
test rax, rax
je 0x14003490d
mov rcx, rbx
call rax
dec rsi
cmp qword [rdi + 8], 0
je 0x140034933
cmp qword [rdi + 0x10], 0x11
jb 0x140034922
mov rbx, qword [rbx - 8]
mov rcx, qword [0x141d940e8]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [0x141d940e8]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
jmp 0x1400349a8
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x60], rax
movabs rdi, 0x8000000000000000
mov qword [rsp + 0x58], rdi
cmp qword [rsp + 0x28], 0
je 0x140034982
mov r8, qword [rsp + 0x30]
mov rcx, qword [0x141d940e8]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsp + 0x40]
cmp qword [rsp + 0x58], rdi
je 0x1400348d4
movups xmm0, xmmword [rsp + 0x58]
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test r14, r14
je 0x1400349c0
mov rcx, qword [0x141d940e8]
xor edx, edx
mov r8, qword [rsp + 0x50]
call sub.KERNEL32.dll_HeapFree
nop
add rsp, 0x478
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2