Function at 0x14032f290
Capabilities:
Query environment variable

Disassembly:
push r12
push r14
push r15
sub rsp, 0x20
mov r14d, r8d
mov r15, rdx
mov r12, rcx
call fcn.14032cc70
test eax, eax
je 0x14032f2bc
mov eax, reloc.WS2_32.dll_setsockopt
add rsp, 0x20
pop r15
pop r14
pop r12
ret
mov qword [rsp + 0x40], rbx
mov ecx, 0x12218
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
call qword [0x1404fe858]
mov rbx, rax
test rax, rax
jne 0x14032f2ec
xor esi, esi
lea eax, [rbx + 0xf]
mov qword [r12], rsi
jmp 0x14032f50a
mov qword [rsp + 0x48], rbp
call fcn.140335b20
xor esi, esi
mov qword [rbx], 0xffffffffffffffff
mov qword [rbx + 8], 0xffffffffffffffff
mov qword [rbx + 0x10], 0xffffffffffffffff
mov qword [rbx + 0x18], 0xffffffffffffffff
mov dword [rbx + 0x50], 0xffffffff
mov dword [rbx + 0x20], 0xffffffff
mov dword [rbx + 0x98], 0xffffffff
mov dword [rbx + 0x30], 0xffffffff
mov dword [rbx + 0x40], 0xffffffff
mov dword [rbx + 0x1a0], esi
mov qword [rbx + 0x48], rsi
mov qword [rbx + 0x28], rsi
mov qword [rbx + 0x38], rsi
mov qword [rbx + 0x90], rsi
mov qword [rbx + 0x121d0], rsi
mov qword [rbx + 0x121d8], rsi
mov qword [rbx + 0x121e0], rsi
mov qword [rbx + 0x121e8], rsi
mov qword [rbx + 0x121f0], rsi
mov qword [rbx + 0x121f8], rsi
mov qword [rbx + 0x12200], rsi
mov qword [rbx + 0x12208], rsi
mov qword [rbx + 0x12210], rsi
mov dword [rbx + 0x1b0], esi
movsxd rcx, eax
xor eax, eax
mov qword [rbx + 0x1a8], rcx
lea rcx, [rbx + 0x1b8]
mov qword [rbx + 0x54], rax
mov qword [rbx + 0x5c], rax
mov qword [rbx + 0x64], rax
mov qword [rbx + 0x6c], rax
mov dword [rbx + 0x74], esi
mov qword [rbx + 0x78], rax
mov qword [rbx + 0x80], rax
call fcn.1403357a0
lea rdi, [rbx + 0x1d0]
mov ebp, 0x800
nop dword [rax]
mov rcx, rdi
call fcn.1403357a0
add rdi, 0x18
sub rbp, 1
jne 0x14032f3e0
lea rdi, [rbx + 0xc1d0]
mov ebp, 0x400
nop
mov rcx, rdi
call fcn.1403357a0
add rdi, 0x18
sub rbp, 1
jne 0x14032f400
mov r8d, r14d
mov rdx, r15
mov rcx, rbx
call fcn.140330900
mov edi, eax
test eax, eax
jne 0x14032f4a3
lea rcx, str.LOCALDOMAIN
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14032f44d
cmp dword [rbx + 0x30], 0xffffffff
jne 0x14032f44d
mov rdx, rax
mov rcx, rbx
call fcn.140331030
test eax, eax
jne 0x14032f476
lea rcx, str.RES_OPTIONS
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14032f46e
mov rdx, rax
mov rcx, rbx
call fcn.140330e90
test eax, eax
jne 0x14032f476
mov rcx, rbx
call fcn.140330c50
mov rcx, rbx
call fcn.140330670
mov edi, eax
test eax, eax
jne 0x14032f4a3
lea ecx, [rax + 0x1f]
lea rbp, [rbx + 0x9e]
call qword [0x1404fe858]
mov r14, rax
test rax, rax
jne 0x14032f524
lea edi, [rax + 0xf]
mov rcx, qword [rbx + 0x90]
test rcx, rcx
je 0x14032f4b5
call qword [0x1404fe868]
movsxd rax, dword [rbx + 0x30]
cmp eax, 0xffffffff
je 0x14032f4ca
mov rcx, qword [rbx + 0x28]
mov rdx, rax
call fcn.140335ad0
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x14032f4d9
call qword [0x1404fe868]
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x14032f4e8
call qword [0x1404fe868]
mov rcx, qword [rbx + 0x12210]
test rcx, rcx
je 0x14032f4fa
call qword [0x1404fe868]
mov rcx, rbx
call qword [0x1404fe868]
mov eax, edi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
xor eax, eax
mov rcx, rbp
mov qword [r14], rax
mov r15d, 0x100
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], rax
mov dword [r14 + 0x18], eax
mov word [r14 + 0x1c], ax
mov byte [r14 + 0x1e], al
nop word [rax + rax]
mov byte [rcx], al
lea rcx, [rcx + 1]
inc ax
cmp ax, r15w
jl 0x14032f550
mov rax, qword [0x140523858]
test rax, rax
je 0x14032f579
mov edx, 0x1f
mov rcx, rbp
call rax
test al, al
jne 0x14032f5a2
mov rdi, rsi
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x14032f596
dec eax
or eax, 0xffffff00
inc eax
mov byte [rdi + rbp], al
inc rdi
cmp rdi, 0x1f
jl 0x14032f580
xor r8b, r8b
mov word [rbp + 0x100], si
xor r10b, r10b
mov r9, rbp
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
movzx eax, r8b
movzx r8d, r8b
inc r8d
movzx ecx, byte [rax + r14]
add cl, dl
add r10b, cl
movzx ecx, r10b
movzx eax, byte [rcx + rbp]
mov byte [r9 - 1], al
mov eax, 0x8421085
mov byte [rcx + rbp], dl
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
imul eax, eax, 0x1f
sub r8d, eax
sub r15, 1
jne 0x14032f5c0
mov rcx, r14
call qword [0x1404fe868]
mov rcx, rbp
call fcn.14032cc90
mov word [rbx + 0x9c], ax
test byte [rbx], 2
je 0x14032f63c
cmp dword [rbx + 0x98], 1
jle 0x14032f63c
mov dword [rbx + 0x98], 1
mov ebp, esi
cmp dword [rbx + 0x98], esi
jle 0x14032f6b3
mov r14, rsi
nop dword [rax]
mov rdi, qword [rbx + 0x90]
add rdi, r14
mov qword [rdi + 0x20], 0xffffffffffffffff
lea rcx, [rdi + 0x68]
mov qword [rdi + 0x28], 0xffffffffffffffff
inc dword [rbx + 0x1a0]
mov eax, dword [rbx + 0x1a0]
mov dword [rdi + 0x60], eax
mov qword [rdi + 0x34], rsi
mov dword [rdi + 0x48], esi
mov qword [rdi + 0x40], rsi
mov qword [rdi + 0x50], rsi
mov qword [rdi + 0x58], rsi
call fcn.1403357a0
inc ebp
mov qword [rdi + 0x80], rbx
add r14, 0x90
mov dword [rdi + 0x88], esi
cmp ebp, dword [rbx + 0x98]
jl 0x14032f650
mov qword [r12], rbx
xor eax, eax
jmp 0x14032f505