Function at 0x1400ea020
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
movzx ecx, byte [rcx + 0x23]
mov rbx, rdx
test ecx, ecx
je 0x1400ea270
dec ecx
mov qword [rsp + 0x50], rsi
je 0x1400ea0ba
dec ecx
je 0x1400ea083
dec ecx
je 0x1400ea067
mov rdx, qword [rdi + 0x28]
mov rcx, rbx
call qword [rdi + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test rdx, rdx
je 0x1400ea071
xor esi, esi
mov word [rdx], si
xor eax, eax
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
lea rcx, [0x140171f30]
call fcn.1400056e0
xor esi, esi
mov ecx, 0xffffffff
cmp rax, rcx
cmove rax, rsi
test rbx, rbx
je 0x1400ea20d
mov word [rbx + rax*2], si
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rcx, rdi
call fcn.140001410
cmp dword [0x14016f9f4], 0
jne 0x1400ea1cb
cmp qword [rdi + 0x10], 0
jne 0x1400ea1cb
cmp qword [0x140176058], rdi
jne 0x1400ea0ec
test rbx, rbx
jne 0x1400ea177
mov rcx, qword [rdi + 0x28]
lea rdx, [rsp + 0x40]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1400ea172
xor esi, esi
mov qword [0x140176058], rsi
test rbx, rbx
je 0x1400ea160
cmp dword [0x14016f9d4], esi
je 0x1400ea142
lea rcx, str.e4z_4_3_547_4.z___3_86_z3_z8_34z_99_____az___zy
call fcn.1400dd2e0
mov r9, qword [rdi + 0x28]
mov edx, dword [0x14016f9d4]
lea rcx, [0x1401712e0]
mov r8, rax
mov qword [rsp + 0x20], rsi
call fcn.14003e000
mov rcx, qword [rdi + 0x28]
mov rdx, rbx
call fcn.1400e7930
mov rsi, qword [rsp + 0x50]
mov eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
dec eax
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
test rbx, rbx
je 0x1400ea1b2
cmp byte [rdi + 0x23], 0
jne 0x1400ea183
mov rax, qword [rdi + 0x10]
jmp 0x1400ea186
mov rax, rdi
test byte [rax + 0x21], 4
je 0x1400ea194
mov rcx, rdi
call fcn.14003e180
xor esi, esi
xor eax, eax
mov word [rbx], si
mov qword [0x140176058], rsi
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rsi, qword [rsp + 0x50]
mov qword [0x140176058], rdi
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov r8, qword [rdi + 0x10]
mov qword [rsp + 0x48], rbp
mov rbp, r8
shr rbp, 1
test rbx, rbx
je 0x1400ea26b
test r8, r8
jne 0x1400ea21d
xor esi, esi
mov rax, rdi
cmp byte [rdi + 0x23], sil
cmove rax, rsi
test byte [rax + 0x21], 4
je 0x1400ea203
mov rcx, rdi
call fcn.14003e180
mov word [rbx], si
xor eax, eax
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov rdx, qword [rdi + 8]
cmp rbx, rdx
je 0x1400ea26b
cmp r8, 0x186a0
jae 0x1400ea25d
movzx eax, word [rdx]
test ax, ax
je 0x1400ea253
nop word [rax + rax]
add rdx, 2
mov word [rbx], ax
add rbx, 2
movzx eax, word [rdx]
test ax, ax
jne 0x1400ea240
xor esi, esi
mov rax, rbp
mov word [rbx], si
jmp 0x1400ea208
mov rcx, rbx
call fcn.140109100
xor esi, esi
mov word [rbx + rbp*2], si
mov rax, rbp
jmp 0x1400ea208
mov rcx, qword [rdi + 0x10]
call fcn.1400ea020
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret