Function at 0x140080fc0
Capabilities:
Query environment variable

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3f8]
sub rsp, 0x4f8
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov rax, qword [0x1401222f0]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
mov qword [rsp + 0x50], r9
mov r13, r8
mov r12d, edx
mov r14, rcx
mov rax, qword [rbp + 0x460]
mov qword [rsp + 0x40], rax
mov rax, qword [0x140130fd8]
test rax, rax
je 0x1400811db
mov ecx, reloc.OLEAUT32.dll_SafeArrayGetElement
call rax
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400813a0
mov dword [rbp - 0x60], 0x438
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [0x140131048]
test eax, eax
je 0x1400811cd
or r15, 0xffffffffffffffff
mov r8d, 4
lea rdx, [0x1400d2368]
lea rcx, [rbp + 0x1d0]
call fcn.1400a9818
test eax, eax
jne 0x14008107c
lea rcx, [rbp + 0x1d8]
jmp 0x140081117
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
lea rdx, str.Systemroot_
lea rcx, [rbp + 0x1d0]
call fcn.1400a9d30
test eax, eax
jne 0x140081110
xor r8d, r8d
xor edx, edx
lea rcx, str._SystemRoot_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, eax
lea rdx, [rbp + 0x1d0]
mov rax, r15
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x1400810c0
lea rbx, [rcx + 1]
add rbx, rax
mov qword [rsp + 0x30], rbx
lea rcx, [rbx + rbx]
call fcn.1400a82f0
mov rdi, rax
mov qword [rsp + 0x48], rax
mov r8d, ebx
mov rdx, rax
lea rcx, str._SystemRoot_
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea r8, [rbp + 0x1e6]
mov rdx, qword [rsp + 0x30]
mov rcx, rdi
call fcn.1400abdb0
jmp 0x140081124
lea rcx, [rbp + 0x1d0]
call fcn.1400a8238
mov qword [rsp + 0x48], rax
mov rdi, rax
mov rax, qword [0x140130d98]
test rax, rax
je 0x140081174
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call rax
test eax, eax
je 0x140081174
lea esi, [rax + 1]
movsxd rcx, esi
add rcx, rcx
call fcn.1400a82f0
mov rbx, rax
mov qword [rbp - 0x78], rax
mov r8d, esi
mov rdx, rax
mov rcx, rdi
call qword [0x140130d98]
mov rcx, rdi
call fcn.1400a82b0
mov rdi, rbx
xor ecx, ecx
call fcn.1400a7cb8
cmp dword [rbp - 0x58], r12d
jne 0x140081189
mov rdx, rdi
mov rcx, r13
call fcn.1400a9bbc
test eax, eax
je 0x1400811a7
mov rcx, rdi
call fcn.1400a7cb8
lea rdx, [rbp - 0x60]
mov rcx, r14
call qword [0x140131058]
test eax, eax
je 0x1400811cd
jmp 0x140081053
mov rax, qword [rbp - 0x48]
mov rcx, qword [rsp + 0x50]
mov qword [rcx], rax
mov eax, dword [rbp - 0x40]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
mov rcx, rdi
call fcn.1400a7cb8
mov al, 1
jmp 0x1400813a2
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400813a0
xor r12d, r12d
mov qword [rsp + 0x58], r12
xor edx, edx
mov r9d, gethostbyaddr
lea r8, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x1400813a0
cmp dword [rbp - 0x80], 0x40000
jne 0x140081329
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8d, [r9 + 2]
mov rdx, qword [rsp + 0x58]
mov rcx, r14
call qword [0x140130d30]
cmp eax, 0xc0000004
jne 0x140081329
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
call fcn.1400a82f0
mov rbx, rax
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov r9, rbx
mov r8d, 2
mov rdx, qword [rsp + 0x58]
mov rcx, r14
call qword [0x140130d30]
test eax, eax
jne 0x140081321
movzx edi, word [rbx]
shr edi, 1
mov rsi, qword [rbx + 8]
call fcn.1400450d0
mov r9, rax
mov ecx, r12d
test rax, rax
setne cl
test ecx, ecx
je 0x140081395
test rsi, rsi
jne 0x1400812ad
test edi, edi
jne 0x140081340
mov rax, qword [rax]
mov r8d, 2
mov edx, edi
mov rcx, r9
call qword [rax]
test rax, rax
je 0x14008138f
lea rbx, [rax + 0x18]
mov qword [rbp - 0x68], rbx
test edi, edi
js 0x140081384
cmp edi, dword [rbx - 0xc]
jg 0x140081384
mov dword [rbx - 0x10], edi
lea rdx, [rdi + rdi]
mov word [rdx + rbx], r12w
mov r9, rdx
mov r8, rsi
mov rcx, rbx
call fcn.1400a9698
mov rdx, r13
mov rcx, rbx
call fcn.1400a9bbc
lea rdx, [rbx - 0x18]
test eax, eax
je 0x14008134b
lock add dword [rdx + 0x10], 0xffffffff
jg 0x14008131c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
call fcn.1400a7cb8
mov rdx, qword [rsp + 0x58]
add rdx, qword [rsp + 0x70]
mov qword [rsp + 0x58], rdx
mov rcx, r14
jmp 0x1400811e5
mov ecx, 0x80070057
call fcn.140044890
int3
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x50]
mov qword [rcx], rax
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x40]
mov qword [rcx], rax
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140081376
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rcx, qword [rsp + 0x38]
call fcn.1400a7cb8
mov al, 1
jmp 0x1400813a2
mov ecx, 0x80070057
call fcn.140044890
int3
call fcn.140096d70
int3
mov ecx, 0x80004005
call fcn.140044890
nop
xor al, al
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.1400ab140
add rsp, 0x4f8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp