Function at 0x140123841
Capabilities:
Query environment variable

Disassembly:
push rax
pushf
mov eax, 0xd64fd3e4
pushf
not eax
add eax, 0xe37a26d8
xor eax, 0xea9e9088
rol eax, 0xd2
popf
pushf
not eax
add eax, 0xab22c5ab
xor eax, 0xa13326d7
rol eax, 0x44
popf
cmp eax, 4
jne 0x14012387e
popf
pop rax
jmp 0x140123b0f
cmp eax, 0
jne 0x14012388d
popf
pop rax
jmp 0x140123941
cmp eax, 3
jne 0x14012389c
popf
pop rax
jmp 0x140123ac5
cmp eax, 1
jne 0x1401238ab
popf
pop rax
jmp 0x1401239e4
cmp eax, 0xd
jne 0x1401238ba
popf
pop rax
jmp 0x140123ef9
cmp eax, 7
jne 0x1401238c9
popf
pop rax
jmp 0x140123cff
cmp eax, 6
jne 0x1401238d8
popf
pop rax
jmp 0x140123c2d
cmp eax, 0xb
jne 0x1401238e7
popf
pop rax
jmp 0x140123e43
cmp eax, 0xc
jne 0x1401238f6
popf
pop rax
jmp 0x140123ea9
cmp eax, 8
jne 0x140123905
popf
pop rax
jmp 0x140123d41
cmp eax, 5
jne 0x140123914
popf
pop rax
jmp 0x140123ba5
cmp eax, 2
jne 0x140123923
popf
pop rax
jmp 0x140123a31
cmp eax, 9
jne 0x140123932
popf
pop rax
jmp 0x140123db7
cmp eax, 0xa
jne 0x140123941
popf
pop rax
jmp 0x140123e1c
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
jmp 0x14012395b
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1401239b1
push rax
pushf
mov eax, 0x70f9cb6d
pushf
not eax
add eax, 0xb5e5e007
xor eax, 0xfd263a24
rol eax, 0x2e
popf
pushf
not eax
add eax, 0xb65e2871
xor eax, 0xe032da40
rol eax, 0xda
popf
pushf
not eax
add eax, 0x8ef3ce5d
xor eax, 0x93d95cce
rol eax, 0xac
popf
jmp 0x14012386f
push rax
pushf
mov eax, 0x60335395
pushf
not eax
add eax, 0xada8b5e5
xor eax, 0xd1d0454b
rol eax, 0x45
popf
pushf
not eax
add eax, 0x800651c7
xor eax, 0xeb616133
rol eax, 0xf5
popf
jmp 0x14012386f
xor eax, eax
jmp 0x140123f06
mov rbp, rbx
cmp word [rax], si
je 0x140123a6c
push rax
pushf
mov eax, 0xa1212107
pushf
not eax
add eax, 0x93d5e13a
xor eax, 0xf0c881b5
rol eax, 0xba
popf
pushf
not eax
add eax, 0xdc4a3630
xor eax, 0xc040452a
rol eax, 0x60
popf
jmp 0x14012386f
push rax
pushf
mov eax, 0x6e928b30
pushf
not eax
add eax, 0x94464218
xor eax, 0xd7ee824f
rol eax, 0xb1
popf
pushf
not eax
add eax, 0xa2036801
xor eax, 0xa2d4bf42
rol eax, 0x2e
popf
pushf
not eax
add eax, 0xfbf4e562
xor eax, 0xc3d0d884
rol eax, 0x64
popf
pushf
not eax
add eax, 0xe273ba6c
xor eax, 0xf03d5425
rol eax, 0x1a
popf
jmp 0x14012386f
or rax, 0xffffffffffffffff
push rax
pushf
mov eax, 0x78a08d57
pushf
not eax
add eax, 0xad5164cd
xor eax, 0xed2962f0
rol eax, 0x1f
popf
pushf
not eax
add eax, 0xaae97164
xor eax, 0x8085eec0
rol eax, 0x67
popf
pushf
not eax
add eax, 0xfe9af8c2
xor eax, 0xb1de8822
rol eax, 0xd4
popf
jmp 0x14012386f
inc rax
cmp word [rbp + rax*2], si
jne 0x140123b72
push rax
pushf
mov eax, 0xe7845828
pushf
not eax
add eax, 0xac2fad73
xor eax, 0xa75e0db1
rol eax, 0x18
popf
pushf
not eax
add eax, 0xff6cb676
xor eax, 0x92a79e29
rol eax, 0x15
popf
pushf
not eax
add eax, 0xc5dc6531
xor eax, 0xd3b25cc5
rol eax, 0x20
popf
pushf
not eax
add eax, 0xe1973f88
xor eax, 0xd49bcc07
rol eax, 0x73
popf
jmp 0x14012386f
push rax
pushf
mov eax, 0x7a71e0f1
pushf
not eax
add eax, 0x9102a9de
xor eax, 0xe68b65e5
rol eax, 8
popf
pushf
not eax
add eax, 0xbfb059c4
xor eax, 0xa40b4fd3
rol eax, 0xef
popf
jmp 0x14012386f
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x140123bfa
push rax
pushf
mov eax, 0xd54ba56c
pushf
not eax
add eax, 0xba3a7c13
xor eax, 0xf0e54446
rol eax, 0x2a
popf
pushf
not eax
add eax, 0xe3b60aa3
xor eax, 0xacf44e16
rol eax, 0x2f
popf
pushf
not eax
add eax, 0xe98987ef
xor eax, 0x87677b13
rol eax, 0xdf
popf
jmp 0x14012386f
push rax
pushf
mov eax, 0xe9e2ee1
pushf
not eax
add eax, 0xb1a486c5
xor eax, 0xb4821929
rol eax, 0x5d
popf
pushf
not eax
add eax, 0xc3d4574c
xor eax, 0x80e3fd72
rol eax, 0xd4
popf
jmp 0x14012386f
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14012c7bd
movsxd r14, eax
test eax, eax
jne 0x140123ca6
push rax
pushf
mov eax, 0x48f86911
pushf
not eax
add eax, 0xa5a08ae8
xor eax, 0x9f555213
rol eax, 0x70
popf
pushf
not eax
add eax, 0xb14c77a6
xor eax, 0xe1975263
rol eax, 0xad
popf
pushf
not eax
add eax, 0xf930e10b
xor eax, 0xbcf76568
rol eax, 0x9b
popf
jmp 0x14012386f
push rax
pushf
mov eax, 0x6417b5dd
pushf
not eax
add eax, 0xb94cbffc
xor eax, 0x8f792299
rol eax, 0xcc
popf
pushf
not eax
add eax, 0xaab5b642
xor eax, 0xc066d5dc
rol eax, 0x1c
popf
pushf
not eax
add eax, 0xa56bd9d9
xor eax, 0xed2e594f
rol eax, 0x29
popf
pushf
not eax
add eax, 0x8659b4a7
xor eax, 0xf3d50da7
rol eax, 0xb7
popf
jmp 0x14012386f
mov rcx, rbx
jmp 0x140123d03
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1401239e4
mov rcx, r14
call fcn.140115e7c
mov rdi, rax
test rax, rax
jne 0x140123d84
push rax
pushf
mov eax, 0x78755e7a
pushf
not eax
add eax, 0xa5989790
xor eax, 0xac7f81e8
rol eax, 0x54
popf
pushf
not eax
add eax, 0x80d81191
xor eax, 0xf0fb7bc5
rol eax, 0xb1
popf
jmp 0x14012386f
push rax
pushf
mov eax, 0x4e554c6f
pushf
not eax
add eax, 0x8a5fc0d9
xor eax, 0x86c7c351
rol eax, 0x3f
popf
pushf
not eax
add eax, 0xf1d4a732
xor eax, 0x943dcb95
rol eax, 0xad
popf
jmp 0x14012386f
xor ecx, ecx
call fcn.14012b976
jmp 0x140123cff
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14012c7bd
test eax, eax
jne 0x140123ea9
mov rcx, rdi
call fcn.14012b976
jmp 0x140123ef9
xor ecx, ecx
call fcn.14012b976
mov rsi, rdi
push rax
pushf
mov eax, 0xbff74f54
pushf
not eax
add eax, 0xaf873fde
xor eax, 0x96e6e57a
rol eax, 0xf6
popf
pushf
not eax
add eax, 0x8e2ada5f
xor eax, 0xd1d3a99e
rol eax, 0x6f
popf
pushf
not eax
add eax, 0xd558d412
xor eax, 0xe094f3c3
rol eax, 0x83
popf
jmp 0x14012386f
mov rcx, rbx
jmp 0x140123efd
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret