Function at 0x14005cda0
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x278
cmp byte [rcx + 0x23], 0
movaps xmmword [rax - 0x58], xmm6
movaps xmmword [rax - 0x68], xmm7
mov r12, rcx
movaps xmmword [rax - 0x78], xmm8
mov rax, rdx
jne 0x14005cdd7
mov r12, qword [rcx + 0x10]
movsd xmm7, qword [0x1401279a8]
movsd xmm8, qword [0x1401279e0]
movsd xmm6, qword [0x1401279d8]
mov r13, qword [rsp + 0x2c0]
mov rbp, qword [rsp + 0x2c0]
mov r15, qword [rsp + 0x2c0]
movzx r8d, word [0x14013b0ec]
xor edi, edi
lea r9, [0x140000000]
mov ecx, edi
lea r11d, [rdi + 8]
lea ebx, [rdi + 7]
mov dword [rsp + 0x2d8], ecx
lea esi, [rdi + 0xc]
mov r14d, 1
lea r10, [0x1401035ac]
test ecx, ecx
je 0x14005d1e9
movzx ecx, byte [r12 + 0x23]
mov rbx, r13
test cl, cl
jne 0x14005ce6a
mov rcx, qword [r12 + 0x10]
xor r9d, r9d
mov r8, r13
xor edx, edx
mov byte [rsp + 0x20], r14b
call fcn.1400e6e20
jmp 0x14005d18d
mov sil, 1
movzx edx, sil
cmp r13, 0xffffffffffffffff
jne 0x14005ce7f
xor dl, dl
xor ebp, ebp
mov ebx, ebp
jmp 0x14005ce84
xor sil, sil
xor ebp, ebp
lea rax, [rbx + 1]
lea rdi, [rax + rax]
cmp cl, 2
jne 0x14005cec2
test sil, sil
je 0x14005cea6
mov rdx, rbx
mov rcx, r10
call fcn.140006bc0
jmp 0x14005d18d
lea rcx, [0x140143dd0]
mov rdx, rax
call fcn.140006c80
mov edx, ebp
test rax, rax
setne dl
jmp 0x14005d18f
mov r9, qword [0x14013b0d0]
cmp rdi, r9
jbe 0x14005cee4
cmp rdi, qword [r12 + 0x18]
jbe 0x14005cee4
mov r8, r10
lea rdx, [0x140124720]
jmp 0x14005d181
cmp rax, 2
movzx eax, byte [r12 + 0x21]
jae 0x14005cf85
test dl, dl
mov edi, ebp
setne dil
add edi, 2
test al, 2
je 0x14005cf14
mov rcx, qword [r12]
and al, 0x3d
mov byte [r12 + 0x21], al
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
movzx ecx, byte [r12 + 0x20]
and byte [r12 + 0x21], 0x82
mov qword [r12 + 0x10], rbp
dec ecx
je 0x14005cf51
dec ecx
jne 0x14005d1ac
mov rax, qword [r12 + 0x18]
test rax, rax
je 0x14005d1ac
cmp edi, 1
jl 0x14005cf5e
cmp edi, 3
jne 0x14005cf51
cmp rax, 0x1000
ja 0x14005cf5e
mov rax, qword [r12 + 8]
mov word [rax], bp
jmp 0x14005d1ac
mov rcx, qword [r12 + 8]
call qword [sym.imp.MSVCR100.dll_free]
and byte [r12 + 0x21], 0x7f
lea rax, [0x140141fa8]
mov qword [r12 + 8], rax
mov qword [r12 + 0x18], rbp
jmp 0x14005d1ac
test al, 2
je 0x14005cfa7
mov rcx, qword [r12]
and al, 0x3d
mov byte [r12 + 0x21], al
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov r9, qword [0x14013b0d0]
mov r11d, 8
mov r8, qword [r12 + 0x18]
and byte [r12 + 0x21], 0x82
cmp rdi, r8
jbe 0x14005d123
movzx ecx, byte [r12 + 0x20]
movzx eax, cl
cmp cl, 1
jbe 0x14005cfd7
cmp al, 2
je 0x14005d01f
mov rax, qword [rsp + 0x38]
jmp 0x14005d113
cmp rdi, 0x80
ja 0x14005d01f
cmp rdi, 8
ja 0x14005cfeb
mov r15, r11
jmp 0x14005cffe
mov r15d, 0x80
cmp rdi, 0x10
mov eax, reloc.WSOCK32.dll_recv
cmovbe r15d, eax
mov rcx, r15
call fcn.1400dd290
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14005d194
mov byte [r12 + 0x20], 1
jmp 0x14005d113
cmp rdi, 0x20
jae 0x14005d030
mov r15d, SafeArrayAllocDescriptor
jmp 0x14005d0d1
cmp rdi, 0x208
jae 0x14005d044
mov r15d, 0x208
jmp 0x14005d0d1
cmp rdi, 0x50000
jae 0x14005d08d
pxor xmm0, xmm0
cvtsi2sd xmm0, rdi
test rdi, rdi
jns 0x14005d05f
addsd xmm0, xmm7
mulsd xmm0, xmm8
xor eax, eax
comisd xmm0, xmm6
jbe 0x14005d083
subsd xmm0, xmm6
comisd xmm0, xmm6
jae 0x14005d083
movabs rdx, 0x8000000000000000
mov rax, rdx
cvttsd2si r15, xmm0
add r15, rax
jmp 0x14005d0d1
cmp rdi, 0x320000
jae 0x14005d09f
lea r15, [rdi + 0x8000]
jmp 0x14005d0d1
cmp rdi, 0xc80000
jae 0x14005d0ca
movabs rax, 0x47ae147ae147ae15
mov r15, rdi
mul rdi
sub r15, rdx
shr r15, 1
add r15, rdx
shr r15, 6
add r15, rdi
jmp 0x14005d0d1
lea r15, [rdi + 0x20000]
cmp r15, r9
cmova r15, r9
cmp cl, 2
jne 0x14005d0f2
test r8, r8
je 0x14005d0f2
mov rcx, qword [r12 + 8]
mov dil, 1
call qword [sym.imp.MSVCR100.dll_free]
jmp 0x14005d0f5
xor dil, dil
test r15, r15
js 0x14005d14e
mov rcx, r15
call qword [sym.imp.MSVCR100.dll_malloc]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x14005d14e
mov byte [r12 + 0x20], 2
and byte [r12 + 0x21], 0x7f
mov qword [r12 + 8], rax
mov qword [r12 + 0x18], r15
test sil, sil
je 0x14005d19b
mov rcx, qword [r12 + 8]
lea rdx, [0x1401035ac]
cmp rcx, rdx
je 0x14005d143
lea r8, [rbx + rbx]
call qword [sym.imp.MSVCR100.dll_memmove]
mov rax, qword [r12 + 8]
mov word [rax + rbx*2], bp
jmp 0x14005d1a3
test dil, dil
je 0x14005d166
lea rax, [0x140141fa8]
mov qword [r12 + 0x18], rbp
mov qword [r12 + 8], rax
jmp 0x14005d16e
mov rax, qword [r12 + 8]
mov word [rax], bp
mov qword [r12 + 0x10], rbp
lea r8, [0x1401035ac]
lea rdx, str.Out_of_memory.
lea rcx, [0x140143150]
call fcn.14005f7b0
mov edx, eax
cmp edx, 1
je 0x14005d1ac
xor eax, eax
jmp 0x14005d5ae
mov rax, qword [r12 + 8]
mov word [rax], bp
lea rax, [rbx + rbx]
mov qword [r12 + 0x10], rax
xor r8d, r8d
mov edx, r14d
mov rcx, r12
call fcn.140001830
movzx r8d, word [0x14013b0ec]
mov ecx, dword [rsp + 0x2d8]
xor edi, edi
mov rbp, rax
mov rax, qword [rsp + 0x2c8]
lea r9, [0x140000000]
lea ebx, [rdi + 7]
lea esi, [rdi + 0xc]
lea r11d, [rdi + 8]
jmp 0x14005d1ec
mov r13, rdi
mov rdx, rax
movsxd r14, ecx
movzx eax, word [rdx]
test ax, ax
je 0x14005d22e
nop word [rax + rax]
cmp ax, word [0x14013b0f0]
je 0x14005d254
cmp ax, r8w
je 0x14005d254
test r14, r14
je 0x14005d21e
mov word [rbp], ax
add rbp, 2
jmp 0x14005d221
inc r13
movzx eax, word [rdx + 2]
add rdx, 2
test ax, ax
jne 0x14005d200
mov ecx, dword [rsp + 0x2d8]
inc ecx
mov dword [rsp + 0x2d8], ecx
cmp ecx, 2
jge 0x14005d515
mov rax, qword [rsp + 0x2c8]
jmp 0x14005ce2c
movzx eax, word [rdx]
test ax, ax
je 0x14005d22e
cmp ax, word [0x14013b0f0]
jne 0x14005d33a
test r14, r14
je 0x14005d32e
movzx edi, word [rdx + 2]
lea eax, [rdi - 0x61]
cmp eax, 0x15
ja case.0x14005d28f.99
cdqe
mov ecx, dword [r9 + rax*4 + 0x5d5d8]
add rcx, r9
jmp rcx
mov word [rbp], bx
add rbp, 2
add rdx, 2
jmp 0x14005d4f9
mov word [rbp], r11w
add rbp, 2
add rdx, 2
jmp 0x14005d4f9
mov word [rbp], si
add rbp, 2
add rdx, 2
jmp 0x14005d4f9
mov eax, 0xa
add rbp, 2
add rdx, 2
mov word [rbp - 2], ax
jmp 0x14005d4f9
mov eax, recv
add rbp, 2
add rdx, 2
mov word [rbp - 2], ax
jmp 0x14005d4f9
mov eax, 9
add rbp, 2
add rdx, 2
mov word [rbp - 2], ax
jmp 0x14005d4f9
mov eax, reloc.WSOCK32.dll_inet_ntoa
add rbp, 2
add rdx, 2
mov word [rbp - 2], ax
jmp 0x14005d4f9
mov word [rbp], di
add rbp, 2
add rdx, 2
jmp 0x14005d4f9
inc r13
add rdx, 2
jmp 0x14005d4f9
movzx eax, word [rdx + 2]
lea rsi, [rdx + 2]
test ax, ax
je 0x14005d4f9
nop dword [rax + rax]
cmp ax, r8w
je 0x14005d368
movzx eax, word [rsi + 2]
add rsi, 2
test ax, ax
jne 0x14005d350
jmp 0x14005d4f9
cmp word [rsi], 0
je 0x14005d4f9
mov rbx, rsi
sub rbx, rdx
sar rbx, 1
dec rbx
je 0x14005d4f6
cmp rbx, 0xfd
ja 0x14005d4f6
lea rcx, [rsp + 0x40]
mov r8, rbx
add rdx, 2
call qword [sym.imp.MSVCR100.dll_wcsncpy]
mov word [rsp + rbx*2 + 0x40], di
cmp word [rsp + 0x40], 0
je 0x14005d194
lea rax, [rsp + 0x2c0]
lea r9, [rsp + 0x30]
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rcx, [0x140143150]
mov r8, rbx
mov dword [rsp + 0x20], 3
call fcn.14004d390
mov rdi, rax
test rax, rax
jne 0x14005d416
cmp byte [rsp + 0x2c0], al
mov r9d, dword [rsp + 0x30]
lea rdx, [rsp + 0x40]
setne al
lea rcx, [0x140143150]
mov r8, rbx
inc eax
mov dword [rsp + 0x20], eax
call fcn.14004d950
mov rdi, rax
test rdi, rdi
je 0x14005d194
cmp byte [rdi + 0x23], 0
jne 0x14005d429
mov rdi, qword [rdi + 0x10]
cmp rdi, r12
je 0x14005d4ee
test r14, r14
je 0x14005d44c
mov rdx, rbp
mov rcx, rdi
call fcn.1400e7270
lea rbp, [rbp + rax*2]
jmp 0x14005d4ee
movzx ecx, byte [rdi + 0x23]
test ecx, ecx
je 0x14005d4e0
dec ecx
je 0x14005d489
dec ecx
je 0x14005d46f
dec ecx
je 0x14005d4ce
mov rdx, qword [rdi + 0x28]
xor ecx, ecx
call qword [rdi + reloc.OLEAUT32.dll_SafeArrayGetElement]
jmp 0x14005d4eb
xor ecx, ecx
call fcn.140006960
mov ecx, 0xffffffff
cmp rax, rcx
mov ecx, 0
cmove rax, rcx
jmp 0x14005d4eb
mov rcx, rdi
call fcn.140001130
cmp dword [0x14013b0c4], 0
jne 0x14005d4d2
cmp qword [rdi + 0x10], 0
jne 0x14005d4d2
mov rcx, qword [rdi + 0x28]
lea rdx, [rsp + 0x2d0]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14005d4c7
xor ecx, ecx
dec eax
mov qword [0x1401440e0], rcx
jmp 0x14005d4eb
mov qword [0x1401440e0], rdi
xor eax, eax
jmp 0x14005d4eb
mov rax, qword [rdi + 0x10]
shr rax, 1
jmp 0x14005d4eb
mov rcx, qword [rdi + 0x10]
xor edx, edx
call fcn.1400e7270
add r13, rax
movzx r8d, word [0x14013b0ec]
mov rdx, rsi
add rdx, 2
xor edi, edi
lea r9, [0x140000000]
lea ebx, [rdi + 7]
lea esi, [rdi + 0xc]
lea r11d, [rdi + 8]
jmp 0x14005d1f2
mov esi, 1
xor r8d, r8d
mov rcx, r12
mov edx, esi
mov word [rbp], di
call fcn.140001830
or rcx, 0xffffffffffffffff
mov rdi, rax
xor eax, eax
repne scasw ax, word [rdi]
not rcx
lea rbx, [rcx - 1]
cmp byte [r12 + 0x23], al
jne 0x14005d54c
mov rdi, qword [r12 + 0x10]
jmp 0x14005d54f
mov rdi, r12
cmp byte [rdi + 0x23], sil
jne 0x14005d569
test byte [rdi + 0x21], 8
je 0x14005d563
mov rcx, rdi
call fcn.140001130
add rdi, 0x10
jmp 0x14005d570
lea rdi, [0x140143ff8]
lea rax, [rbx + rbx]
mov qword [rdi], rax
cmp byte [r12 + 0x23], 0
jne 0x14005d584
mov r12, qword [r12 + 0x10]
cmp byte [r12 + 0x23], 2
jne 0x14005d5a6
cmp qword [0x140143de8], 0
je 0x14005d5a6
lea rcx, [0x140143dd0]
call fcn.140006d40
mov esi, eax
jmp 0x14005d5ac
and byte [r12 + 0x21], 0x86
mov eax, esi
lea r11, [rsp + 0x278]
movaps xmm6, xmmword [r11 - 0x18]
movaps xmm7, xmmword [r11 - 0x28]
movaps xmm8, xmmword [r11 - 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret