Function at 0x14005fe84
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov esi, 0x7f2bb707
cmp qword [rsp + 0xb8], 0
mov r14d, dword [rsp + 0xb0]
mov r15, rcx
mov r13, rdx
mov ebp, r8d
mov r12d, r9d
je 0x14006062f
mov rax, qword [rsp + 0xb8]
cmp dword [rax], 0x7f2bb707
jne 0x14006062f
lea rdx, [rsp + 0x38]
mov ecx, 0x160
call fcn.14005a7f5
mov esi, eax
test eax, eax
jne 0x14006062f
mov rbx, qword [rsp + 0x38]
mov ecx, 0x58
mov rdi, rbx
rep stosd dword [rdi], eax
mov eax, ebp
mov dword [rbx], 0x7f2bb701
lea rcx, str.E2FSPROGS_FAKE_TIME
mov dword [rbx + 0xa8], 0x12
or ah, 2
mov dword [rbx + 0x10], eax
call sub.msvcrt.dll_getenv
mov rcx, rax
test rax, rax
je 0x14005ff37
xor r8d, r8d
xor edx, edx
call sub.msvcrt.dll_strtoul
mov eax, eax
mov qword [rbx + 0xb0], rax
mov rcx, r15
call sub.msvcrt.dll_strlen
lea rdx, [rbx + 0x18]
lea ecx, [rax + 1]
call fcn.14005a7f5
mov edi, eax
test eax, eax
jne 0x140060606
mov rcx, qword [rbx + 0x18]
mov rdx, r15
call sub.msvcrt.dll_strcpy
mov rcx, qword [rbx + 0x18]
mov edx, 0x3f
call sub.msvcrt.dll_strchr
test r13, r13
jne 0x14005ff86
test rax, rax
je 0x14005ff86
cmp byte [rax + 1], 0x5c
je 0x14005ff86
mov byte [rax], 0
lea r13, [rax + 1]
mov r15d, ebp
and r15d, 1
bt ebp, 0xe
mov eax, r15d
jae 0x14005ff99
or eax, 2
mov edx, eax
mov rcx, qword [rbx + 0x18]
lea r8, [rbx + 8]
or edx, 4
test ebp, 0x80000
cmove edx, eax
mov rax, qword [rsp + 0xb8]
call qword [rax + 0x10]
mov edi, eax
test eax, eax
jne 0x140060606
mov rcx, qword [rbx + 8]
test r13, r13
jne 0x14005fff5
mov rcx, qword [rbx + 8]
lea r8, [rbx + 0x20]
mov edx, 0xfffffc00
mov qword [rbx + 0xe8], rcx
mov qword [rcx + 0x78], rbx
call fcn.14005ca56
mov edi, eax
test eax, eax
je 0x140060008
jmp 0x140060606
mov rdx, r13
call fcn.14005c880
mov edi, eax
test eax, eax
je 0x14005ffcd
jmp 0x140060606
mov eax, ebp
and eax, 0x2000
mov dword [rsp + 0x2c], eax
je 0x14006007b
lea rdx, [rbx + 0xa0]
mov ecx, 0x14c
call fcn.14005a7f5
mov edi, eax
test eax, eax
jne 0x140060606
mov rcx, qword [rbx + 8]
mov r9, qword [rbx + 0xa0]
mov r8d, 0xfffffeb4
xor edx, edx
mov rax, qword [rcx + 8]
call qword [rax + 0x28]
mov edi, eax
test eax, eax
jne 0x140060606
mov rax, qword [rbx + 0xa0]
mov esi, 0x7f2bb710
cmp dword [rax], 0x7f2bb710
jne 0x14006062f
mov r14d, dword [rax + 0xcc]
mov r12d, 1
jmp 0x140060080
test r12d, r12d
je 0x1400600a5
test r14d, r14d
je 0x1400605be
mov rcx, qword [rbx + 8]
mov edx, r14d
movsxd r13, r12d
mov rax, qword [rcx + 8]
call qword [rax + 0x20]
xor ecx, ecx
mov qword [rbx + 0x98], rcx
jmp 0x1400600d9
mov rcx, qword [rbx + 8]
mov edx, 0x400
mov rax, qword [rcx + 8]
call qword [rax + 0x20]
lea rdx, [rbx + 0x98]
mov ecx, 0x400
call fcn.14005a7f5
mov edi, eax
test eax, eax
jne 0x140060606
xor r13d, r13d
mov r12d, 1
mov dword [rsp + 0x28], 4
mov rcx, qword [rbx + 8]
mov r9, qword [rbx + 0x20]
mov r8d, 0xfffffc00
mov edx, r12d
mov rax, qword [rcx + 8]
call qword [rax + 0x28]
mov edi, eax
test eax, eax
jne 0x140060606
mov rax, qword [rbx + 0x98]
test rax, rax
je 0x14006011d
mov rsi, qword [rbx + 0x20]
mov ecx, 0x100
mov rdi, rax
rep movsd dword [rdi], dword [rsi]
mov esi, dword [rbx + 0x10]
and esi, 0x200000
jne 0x14006015b
mov rdx, qword [rbx + 0x20]
mov rcx, rbx
call fcn.140054390
mov rdx, qword [rbx + 0x20]
mov rcx, rbx
test eax, eax
mov eax, 0x7f2bb799
cmove esi, eax
call fcn.1400543ac
test eax, eax
jne 0x14006015d
dec dword [rsp + 0x28]
jne 0x1400600e1
mov esi, 0x7f2bb798
jmp 0x14006015d
xor esi, esi
test byte [rbx + 0x10], 0x40
jne 0x1400605c5
mov rax, qword [rbx + 0x20]
cmp word [rax + 0x38], 0xef53
jne 0x1400605cc
test esi, esi
jne 0x1400605d3
mov r8d, dword [rax + 0x4c]
cmp r8d, 1
ja 0x1400605d7
bt ebp, 0xa
jb 0x1400601ce
mov ecx, dword [rax + 0x60]
test ecx, 0xfffc1921
jne 0x1400605e5
bt ebp, 0xf
mov edx, dword [rax + 0x64]
jae 0x1400601ae
and dh, 0xf7
test r15d, r15d
je 0x1400601bf
and edx, 0xffff0884
jne 0x1400605de
bt ebp, 0xc
jb 0x1400601ce
and cl, 8
jne 0x1400605e5
mov r9d, dword [rax + 0x18]
cmp r9d, 6
jbe 0x1400601e2
mov edi, 0x7f2bb73c
jmp 0x140060606
test byte [rax + 0x65], 2
je 0x1400601f3
bt ebp, 0x11
jb 0x1400601f9
jmp 0x1400605ec
cmp r9d, dword [rax + 0x1c]
jne 0x1400601d8
mov edx, 0x400
mov ecx, r9d
shl edx, cl
mov dword [rbx + 0x28], edx
mov dword [rbx + 0x2c], edx
test r8d, r8d
je 0x140060229
movzx r8d, word [rax + 0x58]
cmp edx, r8d
jb 0x1400601d8
cmp r8d, 0x7f
jbe 0x1400601d8
lea ecx, [r8 - 1]
test ecx, r8d
jne 0x1400601d8
jmp 0x14006022f
mov r8d, pe_nt_image_headers64
test byte [rax + 0x60], 0x80
je 0x140060243
cmp word [rax + 0xfe], 0x3f
jbe 0x1400605f3
mov ecx, dword [rax + 0x1c]
mov edi, dword [rax + 0x24]
sub ecx, r9d
mov dword [rbx + 0xb8], ecx
shl edi, cl
cmp dword [rax + 0x20], edi
jne 0x1400601d8
imul r8d, dword [rax + 0x28]
lea ecx, [r9 + 0xa]
lea eax, [rdx + r8 - 1]
shr eax, cl
mov dword [rbx + 0x40], eax
cmp edx, r14d
je 0x14006027e
test r14d, r14d
jne 0x1400605fa
mov rcx, qword [rbx + 8]
mov rax, qword [rcx + 8]
call qword [rax + 0x20]
mov rax, qword [rbx + 0x20]
mov edi, dword [rax + 0x60]
and edi, 8
mov dword [rsp + 0x28], edi
je 0x1400602a3
xor edx, edx
mov dword [rbx + 0x30], edx
jmp 0x1400605b1
cmp dword [rax + 0x28], 0
je 0x1400601d8
mov rcx, rbx
call fcn.1400542de
mov r8, qword [rbx + 0x20]
mov r15d, dword [r8 + 0x20]
test r15d, r15d
je 0x1400601d8
mov ecx, dword [r8 + 0x18]
mov eax, 0x400
mov r9d, eax
shl r9d, cl
mov ecx, dword [r8 + 0x1c]
shl eax, cl
cdq
idiv r9d
imul eax, eax, 0xfff8
cmp eax, r15d
jb 0x1400601d8
cmp dword [r8 + 0x4c], 0
mov ecx, dword [rbx + 0x40]
mov r10d, pe_nt_image_headers64
je 0x140060303
movzx r10d, word [r8 + 0x58]
mov eax, r9d
cdq
idiv r10d
mov edx, 0x10000
sub edx, eax
cmp edx, ecx
jb 0x1400601d8
mov ecx, 0x20
test byte [r8 + 0x60], 0x80
je 0x14006032d
movzx ecx, word [r8 + 0xfe]
mov eax, r9d
cdq
idiv ecx
test eax, eax
je 0x1400601d8
mov edi, dword [r8 + 0x14]
mov rcx, r8
call fcn.14005223a
cmp rdi, rax
jae 0x1400601d8
mov rcx, qword [rbx + 0x20]
call fcn.14005223a
mov rdi, qword [rbx + 0x20]
mov edx, r15d
mov r8d, dword [rdi + 0x14]
sub rax, r8
mov rcx, rax
call fcn.14005aa09
mov rdx, rax
shr rdx, 0x20
jne 0x1400601d8
bt ebp, 0x17
mov dword [rbx + 0x30], eax
mov r8d, eax
jb 0x14006039a
mov edx, dword [rdi + 0x28]
imul rax, rdx
mov edx, dword [rdi]
cmp rax, rdx
jne 0x1400601d8
mov ecx, dword [rdi + 0x18]
mov eax, 0x400
shl eax, cl
mov ecx, 0x20
test byte [rdi + 0x60], 0x80
je 0x1400603b6
movzx ecx, word [rdi + 0xfe]
cdq
idiv ecx
mov ecx, r8d
mov edx, eax
call fcn.14005a9f8
bt ebp, 0xb
mov dword [rbx + 0x34], eax
mov ecx, eax
jb 0x14006053a
mov edx, dword [rbx + 0x28]
lea r8, [rbx + 0x38]
call fcn.14005a855
mov edi, eax
test eax, eax
jne 0x140060606
mov rax, qword [rbx + 0x20]
test r13, r13
jne 0x140060407
mov r13d, dword [rax + 0x14]
test r13, r13
jne 0x140060407
xor edi, edi
cmp dword [rbx + 0x28], 0x400
sete dil
mov r14, qword [rbx + 0x38]
mov r15d, dword [rbx + 0x34]
test byte [rax + 0x60], 0x10
je 0x140060429
cmp dword [rsp + 0x2c], 0
jne 0x140060429
mov eax, dword [rax + 0x104]
cmp r15d, eax
cmova r15d, eax
test r15d, r15d
je 0x140060458
mov rcx, qword [rbx + 8]
lea edx, [rdi + r13 + 1]
mov r9, r14
mov r8d, r15d
mov rax, qword [rcx + 8]
call qword [rax + 0x28]
mov edi, eax
test eax, eax
jne 0x140060606
mov eax, r15d
imul eax, dword [rbx + 0x28]
add r14, rax
mov edi, r15d
cmp edi, dword [rbx + 0x34]
jae 0x1400604ba
mov r8d, edi
mov rdx, r13
mov rcx, rbx
inc edi
call fcn.14005fd75
mov rcx, qword [rbx + 8]
mov r8d, 1
mov rdx, rax
call fcn.14005ca8f
jmp 0x14006045b
mov r8d, r15d
mov rdx, r13
mov rcx, rbx
call fcn.14005fd75
mov rcx, qword [rbx + 8]
mov r9, r14
mov r8d, 1
mov rdx, rax
call fcn.14005c994
mov edi, eax
test eax, eax
jne 0x140060606
mov eax, dword [rbx + 0x28]
inc r15d
add r14, rax
cmp r15d, dword [rbx + 0x34]
jb 0x140060484
mov rax, qword [rbx + 0x20]
dec r12d
movzx edx, word [rax + 0x164]
mov dword [rbx + 0x90], edx
jle 0x14006053a
test dword [rax + 0x64], 0x410
je 0x14006053a
mov eax, dword [rsp + 0x28]
cmp eax, dword [rbx + 0x30]
jae 0x14006052d
mov edx, dword [rsp + 0x28]
mov r8d, 2
mov rcx, rbx
call fcn.14005285c
mov edx, dword [rsp + 0x28]
mov r8d, 1
mov rcx, rbx
call fcn.14005285c
mov edx, dword [rsp + 0x28]
xor r8d, r8d
mov rcx, rbx
call fcn.1400527b5
mov edx, dword [rsp + 0x28]
mov rcx, rbx
call fcn.140054cb9
inc dword [rsp + 0x28]
jmp 0x1400604df
mov eax, dword [rbx + 0x10]
test al, 1
je 0x14006053a
or eax, 6
mov dword [rbx + 0x10], eax
mov rax, qword [rbx + 0x20]
test byte [rax + 0x61], 1
je 0x140060574
bt ebp, 0x14
jb 0x140060574
test ebp, 0x4001
je 0x140060574
mov rcx, rbx
call fcn.14005eb5e
mov edi, eax
test eax, eax
je 0x140060574
or dword [rbx + 0x10], 0x100000
mov rcx, rbx
call fcn.14005eb64
jmp 0x140060606
test byte [rbx + 0x12], 0x40
je 0x1400605aa
mov rcx, qword [0x1400b1800]
mov r8d, 0x1000
lea rdx, [0x14005fd70]
call fcn.14005972e
mov qword [rbx + 0x150], rax
test rax, rax
je 0x140060601
mov rax, qword [rbx + 0x20]
or dword [rax + 0x64], 0x4000
and dword [rbx + 0x10], 0xfffeffff
mov rax, qword [rsp + 0xc0]
mov qword [rax], rbx
jmp 0x14006062f
mov edi, 0x7f2bb747
jmp 0x140060606
mov edi, 0x7f2bb750
jmp 0x140060606
mov edi, 0x7f2bb713
jmp 0x140060606
mov edi, esi
jmp 0x140060606
mov edi, 0x7f2bb714
jmp 0x140060606
mov edi, 0x7f2bb744
jmp 0x140060606
mov edi, 0x7f2bb743
jmp 0x140060606
mov edi, 0x7f2bb789
jmp 0x140060606
mov edi, 0x7f2bb791
jmp 0x140060606
mov edi, 0x7f2bb722
jmp 0x140060606
mov edi, 0x7f2bb746
bt ebp, 0x10
jb 0x14006061d
mov rcx, qword [rsp + 0x38]
call fcn.140057b99
xor eax, eax
mov qword [rsp + 0x38], rax
mov rsi, qword [rsp + 0xc0]
mov rax, qword [rsp + 0x38]
mov qword [rsi], rax
mov esi, edi
mov eax, esi
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret