Function at 0x14002bf1c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
push r15
mov rax, reloc.WS2_32.dll_inet_addr
sub rsp, 8
mov qword [rsp], 0
dec rax
jne 0x14002bf2f
sub rsp, 0x28
call fcn.1400b3bf0
mov rcx, qword [rsp + 0xb0]
call fcn.140060928
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x28]
sub rsp, 0x10
call fcn.1400b3c90
add rsp, 0x10
push rcx
sub rsp, 0x28
call fcn.1400b3910
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400b3910
add rsp, 0x28
pop rcx
push rax
push 0x1f4
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400b0a30
add rsp, 0x28
lea rcx, [rsp + 0x38]
pop rdx
call fcn.1400b39d0
push 0x1f4
mov rax, qword [rsp + 0x38]
mov rax, rax
push rax
movabs rax, str.WINDIR
push rax
pop rcx
pop rdx
pop r8
call sub.KERNEL32.dll_GetEnvironmentVariableW
mov r15, qword [rsp + 0x98]
and r15, r15
jle 0x14002c088
push rcx
sub rsp, 0x28
call fcn.1400b3910
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 0x2e
mov rcx, qword [rsp + 0x48]
push rcx
sub rsp, 0x20
call fcn.1400b3910
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.1400b3960
add rsp, 0x20
movabs rcx, 0x1401b6200
sub rsp, 0x20
call fcn.1400b3960
add rsp, 0x20
call fcn.1400b3b70
push qword [rsp + 0x48]
movabs rax, str.wmic.exe
push rax
push rax
call fcn.1400b3b40
mov rdx, rax
pop rax
add qword [rsp + 0x10], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140081244
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140060928
add rsp, 0x28
pop rax
mov qword [rsp + 0x38], rax
jmp 0x14002c16e
push rcx
sub rsp, 0x28
call fcn.1400b3910
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push 0x2e
mov rcx, qword [rsp + 0x48]
push rcx
sub rsp, 0x20
call fcn.1400b3910
add rsp, 0x20
pop rcx
push rax
sub rsp, 0x20
call fcn.1400b3960
add rsp, 0x20
movabs rcx, 0x1401b6200
sub rsp, 0x20
call fcn.1400b3960
add rsp, 0x20
call fcn.1400b3b70
mov rcx, qword [rsp + 0x48]
push rcx
sub rsp, 0x28
call fcn.1400b3910
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400b3960
add rsp, 0x28
movabs rcx, str.__FORMAT:List
sub rsp, 0x28
call fcn.1400b3960
add rsp, 0x28
call fcn.1400b3b70
movabs rax, str.wmic.exe
push rax
push rax
call fcn.1400b3b40
mov rdx, rax
pop rax
add qword [rsp + 8], rdx
push rax
call fcn.1400b3b40
mov rdx, rax
pop rax
add qword [rsp + 0x10], rdx
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.140081244
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.140060928
add rsp, 0x28
pop rax
mov qword [rsp + 0x38], rax
movabs rdx, 0x1401aa098
lea rcx, [rsp + 0x40]
call fcn.1400b3820
cmp qword [rsp + 0x38], 0
je 0x14002c593
push 0x9c40
pop rcx
call fcn.1400b20f0
mov qword [rsp + 0x48], rax
push qword [rsp + 0x38]
pop rcx
call fcn.1400817c4
and rax, rax
je 0x14002c55d
push qword [rsp + 0x38]
pop rcx
call fcn.14008182c
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14002c523
push qword [rsp + 0x50]
push qword [rsp + 0x50]
push qword [rsp + 0x48]
pop rcx
pop rdx
pop r8
call fcn.140081908
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14002c523
push rcx
sub rsp, 0x28
call fcn.1400b3910
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400b3910
add rsp, 0x28
pop rcx
push rax
push 0x18
push qword [rsp + 0x70]
push qword [rsp + 0x70]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400b2380
add rsp, 0x28
lea rcx, [rsp + 0x60]
pop rdx
call fcn.1400b39d0
push qword [rsp + 0x58]
pop rcx
call fcn.1400b0ff0
mov r15, rax
add r15, 4
mov rax, r15
push rax
pop rcx
call fcn.1400b20f0
mov qword [rsp + 0x60], rax
push qword [rsp + 0x58]
pop rcx
call fcn.1400b0ff0
mov r15, rax
add r15, 4
mov rax, r15
push rax
pop rcx
call fcn.1400b20f0
mov qword [rsp + 0x68], rax
push 0x18
push 0xffffffffffffffff
push qword [rsp + 0x68]
push qword [rsp + 0x78]
pop rcx
pop rdx
pop r8
pop r9
call fcn.1400b2160
push qword [rsp + 0x68]
push qword [rsp + 0x68]
pop rcx
pop rdx
call sub.USER32.dll_OemToCharW
mov qword [rsp + 0x70], 0
jmp 0x14002c2b8
push qword [rsp + 0x58]
pop rcx
call fcn.1400b0ff0
mov r15, rax
add r15, 4
cmp r15, qword [rsp + 0x70]
jl 0x14002c474
mov r15, qword [rsp + 0x68]
add r15, qword [rsp + 0x70]
mov rax, r15
push rax
pop rcx
call fcn.1400b22f0
mov r15, rax
cmp r15, 0x6a
jne 0x14002c31a
mov r15, qword [rsp + 0x68]
add r15, qword [rsp + 0x70]
inc r15
mov rax, r15
push rax
pop rcx
call fcn.1400b22f0
mov r15, rax
cmp r15, 0x26
jne 0x14002c31a
mov rax, 1
jmp 0x14002c31d
xor rax, rax
and rax, rax
je 0x14002c359
push reloc.WS2_32.dll_listen
mov r15, qword [rsp + 0x70]
add r15, qword [rsp + 0x78]
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.1400b2300
push 0
mov r15, qword [rsp + 0x70]
add r15, qword [rsp + 0x78]
inc r15
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.1400b2300
mov r15, qword [rsp + 0x68]
add r15, qword [rsp + 0x70]
mov rax, r15
push rax
pop rcx
call fcn.1400b22f0
mov r15, rax
cmp r15, 0xd9
jne 0x14002c3a2
mov r15, qword [rsp + 0x68]
add r15, qword [rsp + 0x70]
inc r15
mov rax, r15
push rax
pop rcx
call fcn.1400b22f0
mov r15, rax
cmp r15, 0x25
jne 0x14002c3a2
mov rax, 1
jmp 0x14002c3a5
xor rax, rax
and rax, rax
je 0x14002c3e1
push reloc.WS2_32.dll_ioctlsocket
mov r15, qword [rsp + 0x70]
add r15, qword [rsp + 0x78]
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.1400b2300
push 0
mov r15, qword [rsp + 0x70]
add r15, qword [rsp + 0x78]
inc r15
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.1400b2300
mov r15, qword [rsp + 0x68]
add r15, qword [rsp + 0x70]
mov rax, r15
push rax
pop rcx
call fcn.1400b22f0
mov r15, rax
cmp r15, 0xcb
jne 0x14002c42a
mov r15, qword [rsp + 0x68]
add r15, qword [rsp + 0x70]
inc r15
mov rax, r15
push rax
pop rcx
call fcn.1400b22f0
mov r15, rax
cmp r15, 0x25
jne 0x14002c42a
mov rax, 1
jmp 0x14002c42d
xor rax, rax
and rax, rax
je 0x14002c469
push 9
mov r15, qword [rsp + 0x70]
add r15, qword [rsp + 0x78]
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.1400b2300
push 0
mov r15, qword [rsp + 0x70]
add r15, qword [rsp + 0x78]
inc r15
mov rax, r15
push rax
pop rcx
pop rdx
call fcn.1400b2300
inc qword [rsp + 0x70]
jno 0x14002c2b8
push rcx
sub rsp, 0x28
call fcn.1400b3910
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400b3910
add rsp, 0x28
pop rcx
push rax
push qword [rsp + 0x80]
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400b2310
add rsp, 0x28
lea rcx, [rsp + 0x60]
pop rdx
call fcn.1400b39d0
push qword [rsp + 0x60]
pop rcx
call fcn.1400b2140
push qword [rsp + 0x68]
pop rcx
call fcn.1400b2140
mov rcx, qword [rsp + 0x40]
push rcx
sub rsp, 0x28
call fcn.1400b3910
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400b3960
add rsp, 0x28
mov rcx, qword [rsp + 0x60]
sub rsp, 0x28
call fcn.1400b3960
add rsp, 0x28
movabs rcx, reloc.WS2_32.dll_listen
sub rsp, 0x28
call fcn.1400b3960
add rsp, 0x28
lea rcx, [rsp + 0x48]
pop rdx
call fcn.1400b39d0
push qword [0x1406478f4]
pop rcx
call fcn.140092a4c
and rax, rax
je 0x14002c558
call fcn.140093044
and rax, rax
je 0x14002c540
jmp 0x14002c534
call fcn.140093044
and rax, rax
je 0x14002c54c
jmp 0x14002c540
call fcn.140093044
and rax, rax
je 0x14002c558
jmp 0x14002c54c
jmp 0x14002c19e
push qword [rsp + 0x48]
pop rcx
call fcn.1400b2140
push qword [rsp + 0x38]
pop rcx
call fcn.140081988
and rax, rax
je 0x14002c593
push qword [rsp + 0x38]
pop rcx
call fcn.140081874
mov rax, rax
push rax
pop rax
mov dword [rsp + 0x78], eax
push qword [rsp + 0x38]
pop rcx
call fcn.140081898
mov r15, qword [rsp + 0x98]
and r15, r15
jle 0x14002c5f1
push rcx
sub rsp, 0x28
call fcn.1400b3910
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400b3910
add rsp, 0x28
pop rcx
push rax
movsxd rax, dword [rsp + 0x90]
push rax
pop rcx
pop rdx
sub rsp, 0x20
call fcn.1400b0f00
add rsp, 0x28
pop rax
push rax
call fcn.1400b3b10
pop rdx
add rax, rdx
jmp 0x14002c7a9
push rcx
sub rsp, 0x28
call fcn.1400b3910
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400b3910
add rsp, 0x28
pop rcx
push rax
movabs rax, reloc.WS2_32.dll_listen
push rax
push qword [rsp + 0x60]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.1400b1a00
add rsp, 0x28
lea rcx, [rsp + 0x48]
pop rdx
call fcn.1400b39d0
push rcx
sub rsp, 0x28
call fcn.1400b3910
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400b3910
add rsp, 0x28
pop rcx
push rax
movabs rax, reloc.WS2_32.dll_ioctlsocket
push rax
movabs rax, reloc.WS2_32.dll_ioctlsocket
push rax
push qword [rsp + 0x68]
pop rcx
pop rdx
pop r8
pop r9
sub rsp, 0x20
call fcn.1400b15e0
add rsp, 0x28
lea rcx, [rsp + 0x48]
pop rdx
call fcn.1400b39d0
movabs rax, reloc.WS2_32.dll_ioctlsocket
push rax
push qword [rsp + 0x48]
pop rcx
pop rdx
call fcn.1400b0c70
mov r15, rax
and r15, r15
jne 0x14002c640
push rcx
sub rsp, 0x28
call fcn.1400b3910
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400b3910
add rsp, 0x28
pop rcx
push rax
push 1
push qword [rsp + 0x60]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.1400b1cc0
add rsp, 0x28
call fcn.1400b3b70
movabs rcx, reloc.WS2_32.dll_ioctlsocket
pop rdx
push rcx
mov rcx, rdx
sub rsp, 0x20
call fcn.1400b3d30
add rsp, 0x20
pop rcx
mov rdx, rax
call fcn.1400b3ab0
or rax, rax
je 0x14002c770
push rcx
sub rsp, 0x28
call fcn.1400b3910
add rsp, 0x28
pop rcx
push rax
sub rsp, 8
push rcx
sub rsp, 0x28
call fcn.1400b3910
add rsp, 0x28
pop rcx
push rax
push 2
push qword [rsp + 0x60]
pop rcx
pop rdx
pop r8
sub rsp, 0x20
call fcn.1400b0e00
add rsp, 0x28
lea rcx, [rsp + 0x48]
pop rdx
call fcn.1400b39d0
mov rcx, qword [rsp + 0x40]
push rcx
sub rsp, 0x28
call fcn.1400b3910
add rsp, 0x28
pop rcx
push rax
sub rsp, 0x28
call fcn.1400b3960
add rsp, 0x28
pop rax
push rax
call fcn.1400b3b10
pop rdx
add rax, rdx
jmp 0x14002c7a9
push rax
mov rcx, qword [rsp + 0x48]
sub rsp, 0x28
call fcn.1400b3c60
add rsp, 0x28
mov rcx, qword [rsp + 0x30]
sub rsp, 0x28
call fcn.1400b3c60
add rsp, 0x28
mov rcx, qword [rsp + 0x38]
sub rsp, 0x28
call fcn.1400b3c60
add rsp, 0x28
mov rcx, qword [rsp + 0x60]
sub rsp, 0x28
call fcn.1400b3c60
add rsp, 0x28
pop rax
add rsp, 0x80
pop r15
ret