Function at 0x1400047e0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2f0]
sub rsp, 0x3f0
mov rax, qword [0x140045020]
xor rax, rsp
mov qword [rbp + 0x2e0], rax
mov r12, rcx
xor esi, esi
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], rsi
movdqu xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rsi
mov r8d, 0x104
lea rdx, [rbp + 0x1d0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea r8, str..vmoptions
mov edx, 0x104
lea rcx, [rbp + 0x1d0]
call fcn.140017ad4
mov r9d, 0x104
lea r8, [rbp - 0x50]
lea edx, [rsi + 0x71]
mov rcx, qword [0x1400479c0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r8d, 0x104
lea rdx, [rbp + 0xc0]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1400048be
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0xc0]
call fcn.140003480
test al, al
je 0x1400048be
lea r15, [rbp + 0xc0]
mov r13, qword [rsp + 0x58]
jmp 0x140004c14
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x1d0]
call fcn.140003480
lea rbx, [rbp + 0x1d0]
test al, al
cmove rbx, rsi
lea r8, [rbp + 0x1d0]
mov edx, 0x104
lea rcx, [rbp - 0x50]
call fcn.1400179cc
mov edx, 0x5c
lea rcx, [rbp - 0x50]
call fcn.140010e18
sub rax, 4
lea rdx, [rbp + 0xb4]
sub rdx, rax
lea r8, str..vmoptions
mov rcx, rax
call fcn.1400179cc
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x50]
call fcn.140003480
test al, al
je 0x140004934
lea r15, [rbp - 0x50]
jmp 0x1400049aa
mov r9d, 0x104
lea r8, [rbp - 0x50]
mov edx, 0x69
mov rcx, qword [0x1400479c0]
call qword [sym.imp.USER32.dll_LoadStringA]
mov r8d, 0x104
lea rdx, [rbp + 0xc0]
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov edx, 0x5c
lea rcx, [rbp + 0x1d0]
call fcn.140010e18
mov r8, rax
mov edx, 0x104
lea rcx, [rbp + 0xc0]
call fcn.140017ad4
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0xc0]
call fcn.140003480
lea r15, [rbp + 0xc0]
test al, al
cmove r15, rbx
mov r14, qword [rsp + 0x50]
mov r13, qword [rsp + 0x58]
cmp r14, r13
je 0x140004c0b
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x30], rax
je 0x140004bf4
mov rbx, r14
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1400049dd
mov rcx, qword [rbx]
mov r8d, 8
lea rdx, str._XX:Use
call fcn.140017a40
test eax, eax
jne 0x140004a18
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x140004a00
mov rcx, qword [rbx]
mov rax, qword [rbx + 0x10]
cmp byte [rax + rcx - 2], 0x47
jne 0x140004a18
cmp byte [rax + rcx - 1], 0x43
jne 0x140004a18
cmp byte [rax + rcx], 0
je 0x140004a27
add rbx, 0x20
cmp rbx, r13
je 0x140004bf4
jmp 0x1400049d0
cmp rbx, r13
je 0x140004bf4
mov rbx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
cmp rdi, rbx
je 0x140004bf4
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140004a50
mov rcx, qword [rdi]
mov r8d, 8
lea rdx, str._XX:Use
call fcn.140017a40
test eax, eax
jne 0x140004a8b
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140004a73
mov rcx, qword [rdi]
mov rax, qword [rdi + 0x10]
cmp byte [rax + rcx - 2], 0x47
jne 0x140004a8b
cmp byte [rax + rcx - 1], 0x43
jne 0x140004a8b
cmp byte [rax + rcx], 0
je 0x140004a94
add rdi, 0x20
cmp rdi, rbx
jne 0x140004a43
cmp rdi, rbx
je 0x140004bf4
lea rsi, [rdi + 0x20]
cmp rsi, rbx
je 0x140004b79
nop word [rax + rax]
mov rcx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x140004abd
mov rcx, qword [rsi]
mov r8d, 8
lea rdx, str._XX:Use
call fcn.140017a40
test eax, eax
jne 0x140004af8
mov rcx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x140004ae0
mov rcx, qword [rsi]
mov rax, qword [rsi + 0x10]
cmp byte [rax + rcx - 2], 0x47
jne 0x140004af8
cmp byte [rax + rcx - 1], 0x43
jne 0x140004af8
cmp byte [rax + rcx], 0
je 0x140004b67
cmp rdi, rsi
je 0x140004b63
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x140004b37
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140004b32
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000507c
mov rcx, r8
call fcn.14000ee50
xor eax, eax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], 0xf
mov byte [rdi], al
movups xmm0, xmmword [rsi]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], 0xf
mov byte [rsi], al
add rdi, 0x20
add rsi, 0x20
cmp rsi, rbx
jne 0x140004ab0
cmp rdi, rbx
je 0x140004bf4
mov r8, rdi
mov rdx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.14000c000
mov rsi, rax
mov rdi, qword [rsp + 0x38]
mov rbx, rax
cmp rax, rdi
je 0x140004bef
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140004bd3
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140004bce
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000507c
mov rcx, r8
call fcn.14000ee50
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
add rbx, 0x20
cmp rbx, rdi
jmp 0x140004b97
mov qword [rsp + 0x38], rsi
mov r9, r13
mov r8, r14
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x30]
call fcn.14000d210
xor esi, esi
test r15, r15
je 0x140004d5c
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], 0xf
mov byte [rsp + 0x68], 0
mov ecx, 0x20
call fcn.14000ee58
mov qword [rsp + 0x78], 0x13
mov qword [rbp - 0x80], 0x1f
movups xmm0, xmmword [str._Djb.vmOptionsFile]
movups xmmword [rax], xmm0
movzx ecx, word [0x14003e4b8]
mov word [rax + 0x10], cx
movzx ecx, byte [0x14003e4ba]
mov byte [rax + 0x12], cl
mov byte [rax + 0x13], 0
mov qword [rsp + 0x68], rax
mov r8, 0xffffffffffffffff
inc r8
cmp byte [r15 + r8], 0
jne 0x140004c75
mov rdx, r15
lea rcx, [rsp + 0x68]
call fcn.14000b6b0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x38]
cmp rdx, qword [rsp + 0x40]
je 0x140004cce
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm1
mov edx, 0xf
mov byte [rbp - 0x78], 0
add qword [rsp + 0x38], 0x20
jmp 0x140004ce0
lea r8, [rbp - 0x78]
lea rcx, [rsp + 0x30]
call fcn.14000c0c0
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x140004d18
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004d12
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005082
call fcn.14000ee50
nop
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x140004e09
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004e04
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005076
jmp 0x140004e04
mov qword [rsp + 0x48], rsi
xor r9d, r9d
lea r8, [rsp + 0x48]
lea edx, [r9 + 0x72]
mov rcx, qword [0x1400479c0]
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x140004e09
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], 7
movsxd r8, eax
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x68]
call fcn.14000b210
lea r8, [rsp + 0x68]
cmp qword [rbp - 0x80], 8
cmovae r8, qword [rsp + 0x68]
xor r9d, r9d
lea rdx, str.Cannot_find_VM_options_file
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rdx, qword [rbp - 0x80]
cmp rdx, 8
jb 0x140004e09
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004e04
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005088
call fcn.14000ee50
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.140003a20
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.140003c50
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.140004030
mov rax, qword [rsp + 0x38]
sub rax, qword [rsp + 0x30]
sar rax, 5
inc eax
mov dword [0x1400479dc], eax
movsxd rcx, eax
mov r14d, 0x10
mov edx, r14d
call fcn.140015338
mov r15, rax
mov qword [0x1400479e0], rax
lea rax, str.exit
mov qword [r15], rax
lea rax, [0x1400047d0]
mov qword [r15 + 8], rax
mov r12d, esi
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
sub rcx, rbx
sar rcx, 5
test rcx, rcx
je 0x140004ee2
lea rcx, [rsi + rbx]
cmp qword [rcx + 0x18], 0x10
jb 0x140004ea0
mov rcx, qword [rcx]
call fcn.1400162e8
mov qword [r14 + r15], rax
mov qword [r14 + r15 + 8], 0
inc r12d
add r14, 0x10
add rsi, 0x20
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
sub rcx, rbx
sar rcx, 5
movsxd rax, r12d
cmp rax, rcx
jae 0x140004ee2
mov r15, qword [0x1400479e0]
jmp 0x140004e92
mov rsi, qword [rsp + 0x50]
test rsi, rsi
je 0x140004f99
mov rbx, rsi
cmp rsi, r13
je 0x140004f56
nop dword [rax + rax]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140004f3a
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140004f35
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000508e
mov rcx, r8
call fcn.14000ee50
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
add rbx, 0x20
cmp rbx, r13
jne 0x140004f00
mov rdx, qword [rsp + 0x60]
sub rdx, rsi
and rdx, 0xffffffffffffffe0
mov rax, rsi
cmp rdx, 0x1000
jb 0x140004f87
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000508e
mov rcx, rsi
call fcn.14000ee50
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x140005040
cmp rbx, rdi
je 0x14000500b
nop word [rax + rax]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140004fea
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140004fe5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140005070
mov rcx, r8
call fcn.14000ee50
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
add rbx, 0x20
cmp rbx, rdi
jne 0x140004fb0
mov rbx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x140005038
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005070
mov rcx, rbx
call fcn.14000ee50
mov rcx, qword [rbp + 0x2e0]
xor rcx, rsp
call fcn.14000ee30
lea r11, [rsp + 0x3f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140017d80
nop
call fcn.140017d80
nop
call fcn.140017d80
nop
call fcn.140017d80
nop
call fcn.140017d80
nop
call fcn.140017d80
int3