Function at 0x140024630
Capabilities:
Query environment variable

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x130
lea rbp, [rsp + 0x80]
vmovdqa xmmword [rbp + 0xa0], xmm6
mov qword [rbp + 0x98], 0xfffffffffffffffe
lea rcx, [0x14012145a]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1400246be
mov rdi, rax
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rbp + 0x50], ymm0
mov rcx, rax
vzeroupper
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x140024a5e
mov rsi, rax
cmp rax, 0xf
ja 0x1400247f1
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x68], 0xf
lea rcx, [rbp + 0x50]
mov rdx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
add rsi, rbp
add rsi, 0x50
jmp 0x14002484f
movzx eax, byte [0x14021e5d8]
test al, al
jne 0x140024a41
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rbp + 0x70], ymm0
vmovups ymmword [rbp + 0x50], ymm0
vmovups xmm0, xmmword [0x140120dcc]
vmovups xmmword [rbp + 0x1c], xmm0
vmovaps xmm0, xmmword [str.OTPInputClass]
vmovaps xmmword [rbp + 0x10], xmm0
lea rax, [0x140024bf0]
mov qword [rbp + 0x58], rax
mov rdi, qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor ecx, ecx
vzeroupper
call rdi
mov qword [rbp + 0x68], rax
lea rsi, [rbp + 0x10]
mov qword [rbp + 0x90], rsi
lea rcx, [rbp + 0x50]
call qword [sym.imp.USER32.dll_RegisterClassW]
xor ecx, ecx
call rdi
mov qword [rsp + 0x50], rax
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x58], 0
mov dword [rsp + 0x38], 0xc8
mov dword [rsp + 0x30], 0x190
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
lea r8, str.Verify
xor ecx, ecx
mov rdx, rsi
mov r9d, 0xcf0000
call qword [sym.imp.USER32.dll_CreateWindowExW]
test rax, rax
je 0x140024a46
mov rcx, rax
mov edx, 5
call qword [sym.imp.USER32.dll_ShowWindow]
lea rcx, [rbp - 0x20]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140024a46
lea rsi, [rbp - 0x20]
mov rdi, qword [sym.imp.USER32.dll_TranslateMessage]
mov rbx, qword [sym.imp.USER32.dll_DispatchMessageW]
mov r14, qword [sym.imp.USER32.dll_GetMessageW]
nop word cs:[rax + rax]
mov rcx, rsi
call rdi
mov rcx, rsi
call rbx
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call r14
test eax, eax
jne 0x1400247d0
jmp 0x140024a46
mov rax, rsi
or rax, 0xf
cmp rax, 0x17
mov r14d, 0x16
cmovae r14, rax
cmp r14, 0xfff
jb 0x140024826
lea rcx, [r14 + 0x28]
call fcn.1401189c0
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140024832
lea rcx, [r14 + 1]
call fcn.1401189c0
mov rbx, rax
mov qword [rbp + 0x50], rbx
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x68], r14
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
add rsi, rbx
mov byte [rsi], 0
mov rcx, qword [rbp + 0x60]
mov rdx, qword [rbp + 0x68]
mov rax, rdx
sub rax, rcx
cmp rax, 8
jae 0x140024886
mov qword [rsp + 0x20], 8
lea r9, str.Aimstar
lea rcx, [rbp + 0x50]
mov edx, 8
call fcn.140026340
jmp 0x1400248b3
lea rax, [rcx + 8]
mov qword [rbp + 0x60], rax
lea rax, [rbp + 0x50]
mov r8, rax
cmp rdx, 0x10
jb 0x14002489f
mov r8, qword [rbp + 0x50]
movabs rdx, 0x726174736d69415c
mov qword [r8 + rcx], rdx
mov byte [r8 + rcx + 8], 0
mov rbx, qword [rax]
vmovdqu xmm6, xmmword [rax + 8]
mov rdi, qword [rax + 0x18]
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rax, qword [0x14021e5f8]
cmp rax, 0x10
jb 0x140024917
mov rcx, qword [0x14021e5e0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140024912
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140024a66
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140118890
mov qword [0x14021e5e0], rbx
vmovdqu xmmword [0x14021e5e8], xmm6
mov qword [0x14021e5f8], rdi
mov rax, qword [rbp + 0x68]
cmp rax, 0x10
jb 0x140024983
mov rcx, qword [rbp + 0x50]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140024967
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140024a66
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140118890
mov rsi, qword [0x14021e5f0]
mov rdi, qword [0x14021e5f8]
mov rbx, qword [0x14021e5e0]
jmp 0x140024989
vpextrq rsi, xmm6, 1
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rbp + 0x30], ymm0
cmp rdi, 0x10
lea rdi, [0x14021e5e0]
cmovae rdi, rbx
test rsi, rsi
js 0x140024a5e
cmp rsi, 0xf
ja 0x1400249c7
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], 0xf
vmovups xmm0, xmmword [rdi]
vmovaps xmmword [rbp + 0x30], xmm0
jmp 0x140024a27
mov rax, rsi
or rax, 0xf
cmp rax, 0x17
mov ebx, 0x16
cmovae rbx, rax
cmp rbx, 0xfff
jb 0x1400249fe
lea rcx, [rbx + 0x28]
vzeroupper
call fcn.1401189c0
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140024a0d
lea rcx, [rbx + 1]
vzeroupper
call fcn.1401189c0
mov rcx, rax
mov qword [rbp + 0x30], rcx
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], rbx
inc rsi
mov rdx, rdi
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp + 0x30]
vzeroupper
call fcn.140024ab0
mov byte [0x14021e5d8], al
test al, al
je 0x1400246cd
call fcn.140022250
xor eax, eax
vmovaps xmm6, xmmword [rbp + 0xa0]
add rsp, 0x130
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
vzeroupper
call fcn.1400156e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3