Function at 0x18000edd0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x180079880]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov r13, qword [rbp + 0x140]
lea r14d, [rcx - 0xb]
movzx ebx, byte [rsp + 0x40]
mov r15, r8
mov qword [rsp + 0x58], r9
mov r12, rdx
mov qword [rsp + 0x48], rdx
mov edi, ecx
cmp ecx, r14d
jbe 0x18000f01b
mov r12, qword [rsp + 0x50]
lea esi, [rcx - 0x2c]
xor r8d, r8d
lea rdx, [0x180000000]
movabs r9, 0x5f0047004c005f
lea r11d, [r8 + 0x69]
lea r10d, [r8 + 0x4b]
nop
cmp esi, 0xf
ja case.0x18000ee63.5
mov ecx, dword [rdx + rsi*4 + 0xf214]
add rcx, rdx
jmp rcx
mov r9d, 0x7b
lea r8, [rbp - 0x80]
movabs rax, 0x64002e0032
xor ecx, ecx
mov qword [rbp - 0x72], rax
mov dword [rbp - 0x6c], 0x6c
lea edx, [r9 - 0xf]
mov dword [rbp - 0x6a], 0x6c
call fcn.18001dd90
xor r8d, r8d
lea rdx, [0x180000000]
mov r12, rax
movabs r9, 0x5f0047004c005f
lea r10d, [r8 + 0x4b]
lea r11d, [r8 + 0x69]
jmp case.0x18000ee63.5
movsd xmm0, qword [str.leay]
lea rdx, [rbp - 0x74]
movzx eax, word [0x18006ff88]
mov r8d, 0xa
movsd qword [rbp - 0x7c], xmm0
mov word [rbp - 0x74], ax
lea ecx, [r8 - 7]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itow]
xor r8d, r8d
lea rdx, [0x180000000]
movabs r9, 0x5f0047004c005f
lea r10d, [r8 + 0x4b]
lea r11d, [r8 + 0x69]
jmp case.0x18000ee63.5
movsd xmm0, qword [0x18007207e]
movzx eax, word [0x180072086]
movsd qword [rbp - 0x4c], xmm0
mov word [rbp - 0x44], ax
mov word [rbp - 0x42], r8w
jmp case.0x18000ee63.5
cmp qword [r15 + 0x18], 0x10
mov rdx, r15
jb 0x18000ef36
mov rdx, qword [r15]
mov rbx, qword [rsp + 0x48]
mov r8d, dword [r15 + 0x10]
mov rcx, rbx
call r12
cmp eax, dword [r15 + 0x10]
jne 0x18000f0a1
mov rax, qword [rsp + 0x58]
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov r8, r13
mov qword [rsp + 0x28], 0
mov edx, 0x114
xor ecx, ecx
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.180030930
mov r9d, 0xb5
mov r8, r13
xor edx, edx
xor ecx, ecx
call fcn.180014310
xor r8d, r8d
lea rdx, [0x180000000]
mov bl, 1
movabs r9, 0x5f0047004c005f
lea r10d, [r8 + 0x4b]
lea r11d, [r8 + 0x69]
jmp case.0x18000ee63.5
mov eax, dword [0x1800720be]
mov dword [rbp - 0x60], eax
movzx eax, word [0x1800720c2]
mov word [rbp - 0x5c], ax
mov dword [rbp - 0x5a], 0x50004d
jmp case.0x18000ee63.5
mov dword [rbp - 0x42], 0x69
mov dword [rsp + 0x60], 0x65746e49
jmp case.0x18000ee63.5
mov dword [rbp - 0x7e], 0x73
jmp case.0x18000ee63.5
mov dword [rbp - 0x80], 0x73
jmp case.0x18000ee63.5
mov byte [rsp + 0x64], 0
jmp case.0x18000ee63.5
mov word [rbp - 0x56], r10w
mov qword [rbp - 0x54], r9
dec esi
lea eax, [rsi + 0x2c]
cmp eax, r14d
ja 0x18000ee50
mov r12, qword [rsp + 0x48]
lea r14d, [rdi + 0x258]
cmp edi, r14d
jae case.0x18000ee63.10
movzx esi, byte [rsp + 0x40]
cmp edi, 0x15c
ja 0x18000f15b
je 0x18000f12b
mov eax, edi
sub eax, 0x30
je 0x18000f107
sub eax, 0x3c
je 0x18000f0fd
sub eax, 0x3c
je 0x18000f0c9
sub eax, 0x3c
je 0x18000f0a8
cmp eax, 0x3c
jne 0x18000f1da
lea r8d, [rax - 0x39]
lea rdx, [0x18007216b]
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
mov r8d, 2
lea rdx, [0x1800721a6]
lea rcx, [rsp + 0x75]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rsp + 0x77], 0
jmp 0x18000f1da
xor al, al
jmp 0x18000f1e9
movzx eax, word [0x1800721c5]
mov word [rsp + 0x6f], ax
movzx eax, byte [0x1800721c7]
mov byte [rsp + 0x71], al
mov byte [rsp + 0x72], 0
jmp 0x18000f1da
mov r8d, 1
lea rdx, [0x180072125]
lea rcx, [rsp + 0x6b]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
movzx eax, word [0x18007214c]
mov word [rsp + 0x6c], ax
movzx eax, byte [0x18007214e]
mov byte [rsp + 0x6e], al
jmp 0x18000f1da
mov byte [rsp + 0x6b], 0
jmp 0x18000f1da
movzx eax, word [0x180072109]
mov word [rsp + 0x64], ax
movzx eax, byte [0x18007210b]
mov byte [rsp + 0x66], al
mov dword [rsp + 0x67], 0x7465476c
jmp 0x18000f1da
movzx eax, word [0x1800721d7]
mov word [rsp + 0x77], ax
movzx eax, byte [0x1800721d9]
mov byte [rsp + 0x79], al
movzx eax, word [0x1800721f4]
mov word [rsp + 0x7a], ax
movzx eax, byte [0x1800721f6]
mov byte [rsp + 0x7c], al
jmp 0x18000f1da
mov eax, edi
sub eax, 0x198
je 0x18000f1c0
sub eax, 0x3c
je 0x18000f180
sub eax, 0x3c
je 0x18000f175
cmp eax, 0x3c
je case.0x18000ee63.10
jmp 0x18000f1da
cmp qword [r12 + 0x40], 0
setne bl
jmp 0x18000f1da
lea r8, [rbp - 0x60]
xor edx, edx
mov ecx, 0xf001f
call qword [sym.imp.KERNEL32.dll_OpenFileMappingW]
test rax, rax
jne 0x18000f19b
xor sil, sil
jmp 0x18000f1a9
test sil, sil
je 0x18000f1a9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, pe_nt_image_headers64
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x18000f1da
xor r8d, r8d
mov byte [rsp + 0x7d], 0
xor edx, edx
xor ecx, ecx
mov sil, 1
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [r12 + 0x40], rax
add edi, 0x3c
cmp edi, r14d
jb 0x18000f030
movzx eax, bl
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.180050c90
mov rbx, qword [rsp + 0x220]
add rsp, 0x1e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret