Function at 0x140064770
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0x100
mov rax, qword [0x1401a9600]
xor rax, rsp
mov qword [rbp + 0x27], rax
xor r13d, r13d
mov dword [rsp + 0x34], r13d
lea rcx, str.LOCALAPPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xorps xmm0, xmm0
movups xmmword [rbp - 0x19], xmm0
mov qword [rbp - 9], r13
mov qword [rbp - 1], r13
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x1400647d0
mov rdx, rax
lea rcx, [rbp - 0x19]
call fcn.140050470
nop
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov rsi, qword [rbp - 9]
sub rax, rsi
cmp rax, 0xc
jb 0x140064d2b
lea r12, [rbp - 0x19]
mov r15, qword [rbp - 0x19]
cmp qword [rbp - 1], 0xf
cmova r12, r15
xorps xmm0, xmm0
movups xmmword [rbp - 0x39], xmm0
mov qword [rbp - 0x29], r13
mov qword [rbp - 0x21], r13
lea r14, [rsi + 0xc]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rbp - 0x39]
movabs rdx, 0x8000000000000000
lea eax, [rbx + 7]
cmp r14, rbx
jbe 0x1400648ae
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x140064875
mov rbx, rcx
lea rax, [rdx + 0x27]
mov rcx, rax
call fcn.1400e9dac
test rax, rax
je 0x140064c84
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400648aa
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140064898
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140064d09
jmp 0x140064856
test rcx, rcx
je 0x1400648a7
call fcn.1400e9dac
mov rdi, rax
jmp 0x1400648aa
mov rdi, r13
mov qword [rbp - 0x39], rdi
mov qword [rbp - 0x29], r14
mov qword [rbp - 0x21], rbx
mov r8, rsi
mov rdx, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str._slotscoding]
movsd qword [rsi + rdi], xmm0
mov eax, dword [0x140165230]
mov dword [rsi + rdi + 8], eax
mov byte [rdi + r14], 0
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r13, qword [rbp - 0x29]
sub rax, r13
cmp rax, 0xd
jb 0x140064d31
lea r12, [rbp - 0x39]
mov rsi, qword [rbp - 0x39]
cmp qword [rbp - 0x21], 0xf
cmova r12, rsi
xorps xmm0, xmm0
movups xmmword [rbp - 0x59], xmm0
xor eax, eax
mov qword [rbp - 0x49], rax
mov qword [rbp - 0x41], rax
lea r14, [r13 + 0xd]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rbp - 0x59]
cmp r14, rbx
jbe 0x1400649a8
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x14006496e
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400e9dac
test rax, rax
je 0x140064c39
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400649a4
cmp rbx, 0x16
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140064997
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140064d0f
jmp 0x14006494f
test rcx, rcx
je 0x1400649a1
call fcn.1400e9dac
mov rdi, rax
mov qword [rbp - 0x59], rdi
mov qword [rbp - 0x49], r14
mov qword [rbp - 0x41], rbx
mov r8, r13
mov rdx, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.license.json]
movsd qword [rdi + r13], xmm0
mov eax, dword [0x140165308]
mov dword [rdi + r13 + 8], eax
movzx eax, byte [0x14016530c]
mov byte [rdi + r13 + 0xc], al
mov byte [rdi + r14], 0
lea rax, [rbp - 0x79]
mov qword [rsp + 0x40], rax
mov rdi, qword [rbp - 0x49]
lea r14, [rbp - 0x59]
cmp qword [rbp - 0x41], 0xf
cmova r14, qword [rbp - 0x59]
call fcn.1400eb3dc
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x79], xmm0
xor r13d, r13d
mov qword [rbp - 0x69], r13
mov edx, 7
mov qword [rbp - 0x61], rdx
mov word [rbp - 0x79], r13w
mov dword [rsp + 0x34], reloc.WS2_32.dll_send
test rdi, rdi
je 0x140064aa7
cmp rdi, 0x7fffffff
ja 0x140064d37
mov dword [rsp + 0x20], r13d
xor r9d, r9d
mov r8d, edi
mov rdx, r14
mov ecx, eax
call fcn.1400eb404
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x140064d42
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rbp - 0x79]
call fcn.140071100
lea r9, [rbp - 0x79]
cmp qword [rbp - 0x61], 7
cmova r9, qword [rbp - 0x79]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, r14
mov ecx, r12d
call fcn.1400eb404
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x140064cff
mov rdx, qword [rbp - 0x61]
lea rcx, [rbp - 0x79]
cmp rdx, 7
cmova rcx, qword [rbp - 0x79]
mov r9d, 0xffffffff
mov r8d, 3
lea rdx, [rbp + 7]
call fcn.1400eb590
mov edx, eax
test eax, eax
jne 0x140064b1a
mov eax, dword [rbp + 0x17]
test al, 1
mov ecx, 0x1ff
mov r8d, 0x16d
cmovne ecx, r8d
mov dword [rsp + 0x44], ecx
bt eax, 0xa
jae 0x140064b0c
mov ecx, dword [rbp + 0x1b]
cmp ecx, 0xa000000c
jne 0x140064afd
lea eax, [rdx + 4]
jmp 0x140064b3e
cmp ecx, 0xa0000003
jne 0x140064b0c
mov eax, 0xa
jmp 0x140064b3e
movzx eax, al
and eax, 0x10
or eax, 0x20
shr eax, 4
jmp 0x140064b3e
mov dword [rsp + 0x44], 0xffff
sub eax, 2
je 0x140064b39
sub eax, 1
je 0x140064b39
sub eax, 0x32
je 0x140064b39
cmp eax, 0x46
mov eax, r13d
jne 0x140064b3e
mov eax, 1
mov dword [rsp + 0x40], edx
lea rcx, [0x1401a9218]
mov qword [rsp + 0x48], rcx
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
test eax, eax
je 0x140064bf2
cmp eax, 1
setne bl
lea rcx, [rbp - 0x79]
call fcn.14006a160
test bl, bl
je 0x140064c07
lea rdx, [rbp - 0x59]
lea rcx, [rbp - 0x79]
call fcn.140065250
cmp qword [rbp - 0x69], 0xff
jae 0x140064bb9
lea r8, [rbp - 0x79]
cmp qword [rbp - 0x61], 0xf
cmova r8, qword [rbp - 0x79]
mov edx, 0xff
mov r9d, edx
lea rcx, [0x1401aa561]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy_s]
mov byte [0x1401aa65f], 0
mov rdx, qword [rbp - 0x61]
cmp rdx, 0xf
jbe 0x140064c07
inc rdx
mov rcx, qword [rbp - 0x79]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140064c01
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140064c01
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
xor bl, bl
test edx, edx
jne 0x140064d15
jmp 0x140064b67
call fcn.1400e970c
nop
mov rdx, qword [rbp - 0x41]
cmp rdx, 0xf
jbe 0x140064c45
inc rdx
mov rcx, qword [rbp - 0x59]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140064c40
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140064c40
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400e970c
mov qword [rbp - 0x49], r13
mov qword [rbp - 0x41], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x59], 0
mov rax, qword [rbp - 0x21]
cmp rax, 0xf
jbe 0x140064c94
lea rdx, [rax + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140064c8b
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140064c8b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400e970c
nop
mov rax, qword [rbp - 1]
cmp rax, 0xf
jbe 0x140064cd2
lea rdx, [rax + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140064cca
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140064cca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.1400e970c
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1400e9b80
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
shr rcx, 0x20
call fcn.14006a060
nop
call fcn.140069f10
nop
call fcn.140069f10
nop
lea r8, [rbp - 0x79]
lea rdx, [rsp + 0x40]
lea rcx, str.exists
call fcn.140069f50
nop
call fcn.14006a210
nop
call fcn.14006a210
nop
mov ecx, reloc.WLDAP32.dll_Ordinal_22
call fcn.14006a020
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.14006a060
int3