Function at 0x140005440
Capabilities:
Query environment variable
Read .ini file

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xf0
mov rax, qword [0x14004f678]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop
mov rcx, rax
mov edx, 8
mov r8d, 0x7fff
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop
mov qword [rbp - 0x79], rax
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x69]
call fcn.140001360
nop
mov r9, qword [rbp - 0x29]
test r9, r9
jne 0x1400054d0
lea ecx, [r9 + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x14000565a
mov qword [rbp - 0x79], rax
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x140005705
jmp 0x14000564f
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x3fff
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
nop
test eax, eax
jne 0x14000551f
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop
test eax, eax
je 0x14000551f
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x14000565a
mov qword [rbp - 0x79], rax
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x14000570b
jmp 0x14000564f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop
mov rcx, rax
mov edx, 8
mov r8d, 0x7fff
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop
mov qword [rbp - 0x79], rax
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x19]
call fcn.140001360
nop
mov rdx, qword [rbp + 0x27]
test rdx, rdx
jne 0x1400055c8
lea ecx, [rdx + 0xe]
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov rax, qword [rbp + 0x27]
test rax, rax
je 0x140005585
mov qword [rbp - 0x79], rax
mov rcx, qword [rbp + 0x1f]
test rcx, rcx
je 0x140005717
mov rax, qword [rcx]
lea rdx, [rbp - 0x79]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp + 0x1f]
test rcx, rcx
je 0x1400055a5
mov rax, qword [rcx]
lea rdx, [rbp - 0x19]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
nop
xor ebx, ebx
mov qword [rbp + 0x1f], rbx
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x14000565a
mov qword [rbp - 0x79], rax
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x140005711
jmp 0x14000564f
mov r8d, 0x3fff
mov rcx, qword [rbp - 0x29]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
nop
cmp eax, 0x3fff
jbe 0x140005678
mov ecx, 0x64a
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop
mov rax, qword [rbp + 0x27]
test rax, rax
je 0x140005615
mov qword [rbp - 0x79], rax
mov rcx, qword [rbp + 0x1f]
test rcx, rcx
je 0x14000571d
mov rax, qword [rcx]
lea rdx, [rbp - 0x79]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp + 0x1f]
test rcx, rcx
je 0x140005635
mov rax, qword [rcx]
lea rdx, [rbp - 0x19]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
nop
xor ebx, ebx
mov qword [rbp + 0x1f], rbx
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x14000565a
mov qword [rbp - 0x79], rax
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x140005723
mov rax, qword [rcx]
lea rdx, [rbp - 0x79]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x140005674
lea rdx, [rbp - 0x69]
cmp rcx, rdx
mov rax, qword [rcx]
setne dl
call qword [rax + 0x20]
nop
xor eax, eax
jmp 0x1400056df
mov rdi, qword [rbp + 0x27]
xor ebx, ebx
mov qword [rbp + 0x27], rbx
mov rcx, qword [rbp + 0x1f]
test rcx, rcx
je 0x1400056a0
mov rax, qword [rcx]
lea rdx, [rbp - 0x19]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
nop
mov qword [rbp + 0x1f], rbx
mov rax, qword [rbp - 0x29]
test rax, rax
je 0x1400056c1
mov qword [rbp - 0x79], rax
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x1400056ff
mov rax, qword [rcx]
lea rdx, [rbp - 0x79]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp - 0x31]
test rcx, rcx
je 0x1400056dc
mov r8, qword [rcx]
lea rax, [rbp - 0x69]
cmp rcx, rax
setne dl
call qword [r8 + 0x20]
nop
mov rax, rdi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1400153e0
nop
mov rbx, qword [rsp + 0x128]
add rsp, 0xf0
pop rdi
pop rsi
pop rbp
ret
call fcn.140014ea8
nop
call fcn.140014ea8
nop
call fcn.140014ea8
nop
call fcn.140014ea8
nop
call fcn.140014ea8
nop
call fcn.140014ea8
nop
call fcn.140014ea8
nop
int3