Function at 0x14006bfe0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x570
mov rdi, rcx
xor r13d, r13d
mov ecx, 0x208
mov r12d, r8d
mov rbx, rdx
mov esi, r13d
call fcn.1401098fc
mov r14, rax
test rax, rax
je 0x14006c2dd
mov qword [rsp + 0x5a8], r15
lea r15, [rbx + 8]
mov rcx, r15
call fcn.140107090
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x5b8]
lea rdx, [rsp + 0x360]
mov r8d, 0x104
mov rcx, r15
mov qword [rsp + 0x20], rax
call fcn.140106790
test eax, eax
je 0x14006c2cb
mov qword [rsp + 0x5a0], rbp
mov ecx, dword [rsp + 0x5b8]
lea eax, [rcx - 1]
cmp eax, 1
ja 0x14006c277
cmp word [rsp + 0x50], r13w
je 0x14006c277
cmp ecx, 2
jne 0x14006c0e1
lea rcx, [rsp + 0x50]
mov r8d, 0x104
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rsp + 0x50]
mov rax, r14
sub rdx, r14
nop dword [rax]
nop dword [rax + rax]
movzx ecx, word [rax]
lea rax, [rax + 2]
mov word [rdx + rax - 2], cx
test cx, cx
jne 0x14006c0d0
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rbp, rax
test rax, rax
je 0x14006c1a7
lea r8, [rsp + 0x260]
mov r9d, 0x100
mov edx, r12d
mov rcx, rax
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x14006c1a7
cmp qword [rdi + 0x10], r13
jne 0x14006c13f
lea rdx, str...SynTPEnhCPopupMenu.cpp
lea rcx, str.m_hMenu
mov r8d, 0x6e
call fcn.1400be660
mov esi, dword [rdi + 8]
mov ecx, 0x18
lea eax, [rsi + 1]
mov dword [rdi + 8], eax
call fcn.14010a7e4
mov rbx, rax
test rax, rax
je 0x14006c24e
lea rax, vtable.CStringedMenuItem.0
mov qword [rbx + 0x10], r13
lea rcx, [rsp + 0x50]
mov qword [rbx], rax
mov dword [rbx + 8], esi
call fcn.14010a850
mov qword [rbx + 0x10], rax
test rax, rax
je 0x14006c251
lea rcx, [rdi + 0x18]
mov r8, rbx
xor edx, edx
call fcn.14006ca70
test rax, rax
je 0x14006c251
lea r9, [rsp + 0x260]
jmp 0x14006c220
cmp qword [rdi + 0x10], r13
jne 0x14006c1c6
lea rdx, str...SynTPEnhCPopupMenu.cpp
lea rcx, str.m_hMenu
mov r8d, 0x6e
call fcn.1400be660
mov esi, dword [rdi + 8]
mov ecx, 0x18
lea eax, [rsi + 1]
mov dword [rdi + 8], eax
call fcn.14010a7e4
mov rbx, rax
test rax, rax
je 0x14006c24e
lea rax, vtable.CStringedMenuItem.0
mov qword [rbx + 0x10], r13
lea rcx, [rsp + 0x50]
mov qword [rbx], rax
mov dword [rbx + 8], esi
call fcn.14010a850
mov qword [rbx + 0x10], rax
test rax, rax
je 0x14006c251
lea rcx, [rdi + 0x18]
mov r8, rbx
xor edx, edx
call fcn.14006ca70
test rax, rax
je 0x14006c251
lea r9, [rsp + 0x360]
mov rcx, qword [rdi + 0x10]
mov r8, rsi
xor edx, edx
call qword [sym.imp.USER32.dll_AppendMenuW]
test eax, eax
jne 0x14006c269
lea rdx, str...SynTPEnhCPopupMenu.cpp
lea rcx, str.bSuccess
mov r8d, 0x8b
call fcn.1400be660
jmp 0x14006c269
mov rbx, r13
dec dword [rdi + 8]
test rbx, rbx
je 0x14006c266
mov rax, qword [rbx]
mov edx, 1
mov rcx, rbx
call qword [rax]
mov esi, r13d
test rbp, rbp
je 0x14006c277
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rax, [rsp + 0x44]
lea r9, [rsp + 0x40]
lea rdx, [rsp + 0x360]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], 0x104
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x5b8]
mov r8d, 0x104
mov rcx, r15
mov qword [rsp + 0x20], rax
call fcn.140106790
test eax, eax
jne 0x14006c081
mov rbp, qword [rsp + 0x5a0]
mov rcx, r14
call fcn.14010e850
mov r15, qword [rsp + 0x5a8]
mov eax, esi
mov rbx, qword [rsp + 0x5b0]
add rsp, 0x570
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret