Function at 0x1400b8040
Capabilities:
Query environment variable
Read file on windows

Disassembly:
push r13
push r14
push r15
mov eax, 0x2760
call fcn.1400ec1b0
sub rsp, rax
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x2788], rbx
mov qword [rsp + 0x2790], rdi
mov qword [rsp + 0x2798], r12
mov rax, qword [0x14013b1d0]
xor rax, rsp
mov qword [rsp + 0x2750], rax
mov r12b, cl
xor edi, edi
test dl, dl
je 0x1400b80aa
cmp word [0x14015163e], di
je 0x1400b810e
cmp qword [0x140199fc8], rdi
je 0x1400b810e
mov word [0x14015163e], di
jmp 0x1400b810e
mov cl, 1
call fcn.1400be034
mov dword [0x140154788], 3
mov qword [0x140143d50], rdi
mov cl, byte [0x140142c44]
test cl, cl
jne 0x1400b8206
xor r8d, r8d
lea rdx, [0x14015aa68]
lea rcx, [0x140168030]
call fcn.14003fccc
cmp byte [0x1401690b2], dil
je 0x1400b810e
mov eax, dword [0x140154784]
mov r15d, 4
cmp dword [0x14015aa98], 1
cmova eax, r15d
mov dword [0x140154784], eax
jmp 0x1400b8114
mov r15d, 4
mov cl, byte [0x140142c44]
test cl, cl
jne 0x1400b820c
cmp word [0x140159a62], di
jne 0x1400b820c
mov r12b, dil
mov ebx, 0x800
mov r8d, ebx
lea rdx, [0x140159a62]
mov ecx, dword [0x140156a00]
call fcn.1400bdc1c
mov dword [rsp + 0x20], ebx
lea r13, [0x14010a100]
mov r9, r13
lea r8, [rsp + 0x1750]
lea rdx, str.DefFolder
lea rcx, [0x14010a8e0]
call fcn.14009dd5c
cmp word [rsp + 0x1750], di
jne 0x1400b819f
cmp byte [0x1401690b2], dil
je 0x1400b81dd
lea rcx, [rsp + 0x1750]
call fcn.14003ad10
cmp word [rsp + 0x1750], di
je 0x1400b81dd
mov rdx, rbx
lea rcx, [rsp + 0x1750]
call fcn.1400773b8
mov r8, rbx
lea rdx, [0x140159a62]
lea rcx, [rsp + 0x1750]
call fcn.14008c7b4
mov r8, rbx
lea rdx, [rsp + 0x1750]
lea rcx, [0x140159a62]
call fcn.14008c7ec
cmp word [0x14014f638], di
setne r8b
mov r9d, dword [0x140156a00]
mov rdx, rbx
lea rcx, [0x140159a62]
call fcn.1400c15d0
mov cl, byte [0x140142c44]
jmp 0x1400b8218
mov r15d, 4
lea r13, [0x14010a100]
mov ebx, 0x800
mov eax, dword [0x140154784]
mov edx, 5
test eax, eax
cmove eax, edx
mov dword [0x140154784], eax
test cl, cl
je 0x1400b838b
mov r14d, dword [0x140165254]
cmp r14d, 1
jbe 0x1400b8282
cmp dword [0x140154754], 3
je 0x1400b87c0
lea ecx, [rdx + 0x60]
call fcn.1400868b8
mov rbx, rax
mov ecx, 0x1fd
call fcn.1400868b8
mov rdx, rax
mov r9d, 0x30
mov r8, rbx
mov rcx, qword [0x140142ba0]
call fcn.1400c3b2c
jmp 0x1400b87c0
mov r8, rbx
lea rdx, [0x140159a62]
lea rcx, [0x140165250]
call fcn.140004e60
mov r8, rbx
lea rdx, [0x140152650]
lea rcx, [0x140165250]
call fcn.140005234
cmp word [0x140152650], di
je 0x1400b82c6
mov rdx, rbx
lea rcx, [0x140152650]
call fcn.1400773b8
mov byte [0x1401547f8], dil
lea rdx, [rsp + 0x100]
lea rcx, [0x140165250]
call fcn.140005254
mov eax, dword [rsp + 0x248]
mov dword [0x140156a00], eax
mov qword [rsp + 0x1310], rdi
mov qword [rsp + 0x1318], rdi
mov qword [rsp + 0x1320], rdi
xor r8d, r8d
lea rdx, [rsp + 0x300]
lea rcx, [0x140159a62]
call fcn.140069f68
test al, al
je 0x1400b832c
cmp qword [rsp + 0x1300], 0x18
je 0x1400b834d
cmp dword [rsp + 0x248], edi
jne 0x1400b8346
cmp byte [rsp + 0x180], dil
mov byte [0x1401547e0], 1
jne 0x1400b834d
mov byte [0x1401547e0], dil
test r14d, r14d
jne 0x1400b835b
cmp dword [rsp + 0x2d0], edi
je 0x1400b8369
movzx eax, byte [rsp + 0x242]
mov dword [0x140154774], eax
mov r14d, 0x2a
cmp qword [rsp + 0x238], rdi
je 0x1400b8382
mov dword [0x14014f638], r14d
jmp 0x1400b8391
mov word [0x14014f638], di
jmp 0x1400b8391
mov r14d, 0x2a
mov rcx, qword [0x140142ba0]
call qword [sym.imp.USER32.dll_IsWindowVisible]
neg eax
sbb rcx, rcx
and rcx, qword [0x140142ba0]
xor r8d, r8d
mov dl, r12b
call fcn.1400bb1dc
test al, al
je 0x1400b87a1
mov al, byte [0x140199fe7]
neg al
sbb ecx, ecx
and ecx, dword [0x140199fe8]
mov dword [0x140154768], ecx
mov eax, dword [0x140199fd4]
dec eax
cmp eax, 1
ja 0x1400b8432
mov eax, dword [0x140199fe0]
mov dword [rsp + 0x28], eax
mov eax, dword [0x140199fdc]
mov dword [rsp + 0x20], eax
mov r9d, dword [0x140199fd8]
lea r8, str._dd_dh_dm
mov edx, 0x50
lea rcx, [rsp + 0x40]
call fcn.1400026d0
lea rdx, [rsp + 0x40]
cmp dword [0x140199fd4], 1
lea rcx, [0x140154900]
je 0x1400b842d
lea rcx, [0x140154908]
call fcn.14008ddd4
mov rcx, qword [0x140199fc8]
test rcx, rcx
je 0x1400b8445
call fcn.1400c1f18
jmp 0x1400b8469
cmp byte [0x140142c44], dil
je 0x1400b8469
cmp qword [rsp + 0x238], rdi
je 0x1400b8469
cmp word [0x14014f638], r14w
jne 0x1400b8469
mov word [0x14014f638], di
cmp dword [0x14015aa98], edi
jne 0x1400b84a5
mov ecx, 0x65
call fcn.1400868b8
mov rbx, rax
mov ecx, 0x14b
call fcn.1400868b8
mov rdx, rax
mov r9d, 0x30
mov r8, rbx
mov rcx, qword [0x140142ba0]
call fcn.1400c3b2c
jmp 0x1400b87a1
cmp word [0x14015163e], di
je 0x1400b8596
cmp dword [0x140152640], edi
jne 0x1400b8596
lea rdx, [0x14010eb98]
lea rcx, [0x14015163e]
call fcn.1400699dc
mov r12, rax
test rax, rax
je 0x1400b8596
mov r9, rax
mov edx, 1
mov r8d, 0x400
lea rcx, [rsp + 0x1350]
call fcn.1400f7544
mov r14, rax
mov rcx, r12
call fcn.1400f3540
mov eax, 0x3ff
cmp r14, rax
cmovb rax, r14
cmp rax, 0x400
jae 0x1400b8590
mov byte [rsp + rax + 0x1350], dil
mov dword [rsp + 0x30], 0x30c
test r14, r14
je 0x1400b8552
lea r8, [rsp + 0x30]
mov edx, r14d
lea rcx, [rsp + 0x1350]
call qword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x1400b8552
mov dword [0x140152640], 3
jmp 0x1400b8596
cmp r14, 3
jbe 0x1400b8596
cmp byte [rsp + 0x1350], 0xef
jne 0x1400b8596
cmp byte [rsp + 0x1351], 0xbb
jne 0x1400b8596
cmp byte [rsp + 0x1352], 0xbf
jne 0x1400b8596
lea rcx, [rsp + 0x1350]
call fcn.14008f38c
test al, al
je 0x1400b8596
mov dword [0x140152640], r15d
jmp 0x1400b8596
call fcn.1400ebf90
nop
lea rcx, [rsp + 0x40]
call fcn.14008c830
nop
lea rcx, [0x14015aa68]
call fcn.14008ca70
mov r15d, 0x25
lea rcx, [0x14015aa68]
call fcn.14008c8e0
mov r14, rax
test rax, rax
je 0x1400b8663
mov r9, rbx
lea r8, [rsp + 0x1750]
mov rdx, rax
lea rcx, [0x140168030]
call fcn.140040320
mov edx, r15d
mov rcx, r14
call fcn.1400ed380
test rax, rax
je 0x1400b864c
mov edx, r15d
lea rcx, [rax + 2]
call fcn.1400ed380
test rax, rax
je 0x1400b864c
lea rcx, [rsp + 0x1750]
call fcn.140068a84
test al, al
jne 0x1400b864c
mov r8d, ebx
lea rdx, [rsp + 0x300]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x7ff
ja 0x1400b864c
mov r8, rbx
lea rdx, [rsp + 0x300]
lea rcx, [rsp + 0x1750]
call fcn.14008c7ec
lea rdx, [rsp + 0x1750]
lea rcx, [rsp + 0x40]
call fcn.14008c86c
jmp 0x1400b85b3
lea rdx, [rsp + 0x40]
lea rcx, [0x14015aa68]
call fcn.1400b7fe0
nop
lea rcx, [rsp + 0x40]
call fcn.140003ee0
nop
jmp 0x1400b8690
cmp byte [0x140158a15], dil
jne 0x1400b86b6
mov r9, rbx
lea r8, [0x140159a62]
lea rdx, [0x140159a62]
lea rcx, [0x140168030]
call fcn.140040320
mov al, byte [0x140153750]
mov byte [0x140167c20], al
lea rcx, [0x140167bf0]
call fcn.1400a6190
cmp byte [0x140158a31], dil
je 0x1400b86de
call fcn.1400b9058
jmp 0x1400b86f0
mov dl, byte [0x140158a13]
lea rcx, [0x140165250]
call fcn.14000403c
cmp qword [0x140199fc8], rdi
je 0x1400b8705
lea rcx, [0x14015163e]
call fcn.140068790
cmp dword [0x140142c48], 1
je 0x1400b87a1
cmp byte [0x140142c44], dil
je 0x1400b8729
lea rcx, [0x140168030]
call fcn.140043a04
jmp 0x1400b87a1
cmp byte [0x1401547de], dil
je 0x1400b873e
lea rcx, [0x14014e5f8]
call fcn.1400abca0
mov r8, rbx
lea rdx, [rsp + 0x1750]
lea rcx, [0x140168030]
call fcn.14003fc44
lea rax, [rsp + 0x1750]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], di
jne 0x1400b8761
lea rdx, [0x140159a62]
lea rcx, [rsp + 0x1750]
call fcn.14008f920
test eax, eax
jne 0x1400b8792
lea rcx, [0x140159a62]
call fcn.140078d7c
mov r13, rax
mov rdx, r13
lea rcx, [0x140168030]
call fcn.140042e08
mov rcx, qword [0x140199fc8]
call fcn.1400ec2cc
mov byte [0x140167c20], dil
lea rcx, [0x140167bf0]
call fcn.1400a6190
mov rcx, qword [rsp + 0x2750]
xor rcx, rsp
call fcn.1400ec220
lea r11, [rsp + 0x2760]
mov rbx, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret