Function at 0x140001320
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2a0
movaps xmmword [rsp + 0x290], xmm6
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [0x1400070b0]
test rcx, rcx
jne 0x140001458
lea rbx, [rsp + 0x60]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call fcn.140001030
lea rcx, str._WINDIR__system32cabinet.dll
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x104
jae 0x1400013a2
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
mov qword [0x1400070b0], rax
jmp 0x1400013a9
mov rcx, qword [0x1400070b0]
test rcx, rcx
jne 0x140001458
lea rdx, [rsp + 0x60]
mov word [rdx], 0
lea rcx, str._SYSTEMROOT__system32cabinet.dll
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x104
jae 0x1400013f7
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
mov qword [0x1400070b0], rax
jmp 0x1400013fe
mov rcx, qword [0x1400070b0]
test rcx, rcx
jne 0x140001458
lea rdx, [rsp + 0x60]
mov word [rdx], 0
lea rcx, str.C:Windows_system32cabinet.dll
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x104
jae 0x140001448
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
mov qword [0x1400070b0], rax
jmp 0x14000144f
mov rcx, qword [0x1400070b0]
test rcx, rcx
je 0x14000177a
lea rdx, str.FDICreate
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rbx
mov qword [0x140007098], rax
mov rcx, qword [0x1400070b0]
lea rdx, str.FDIDestroy
call rbx
mov qword [0x1400070a8], rax
mov rcx, qword [0x1400070b0]
lea rdx, str.FDICopy
call rbx
mov rcx, rax
mov qword [0x1400070a0], rax
xor eax, eax
cmp qword [0x140007098], 0
je 0x140001760
cmp qword [0x1400070a8], 0
je 0x140001760
test rcx, rcx
je 0x140001760
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cdqe
lea r14, [rdi + rax*2]
test eax, eax
jle 0x1400014ea
cmp word [r14], 0x5c
je 0x1400014ea
add r14, 0xfffffffffffffffe
cmp r14, rdi
ja 0x1400014da
cmp r14, rdi
je 0x140001729
add r14, 2
xorps xmm6, xmm6
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor ebx, ebx
mov ecx, 0xfde9
xor edx, edx
mov r8, r14
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x140001579
mov ebp, eax
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor ebx, ebx
mov rcx, rax
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140001579
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, r14
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rbx, r15
sub r14, rdi
shr r14, 1
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, rdi
mov r9d, r14d
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x140001720
mov r12d, eax
xor eax, eax
cmp r14d, 0xffffffff
setne al
add r12d, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140001720
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rdi
mov r9d, r14d
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp r14d, 0xffffffff
je 0x140001613
movsxd rax, r12d
mov byte [rax + r15 - 1], 0
test rbx, rbx
je 0x14000172d
lea rcx, [rsp + 0x50]
mov dword [rcx + 8], 0
mov qword [rcx], 0
mov rax, qword [0x140007098]
mov qword [rsp + 0x40], rcx
lea rcx, [0x140001790]
mov qword [rsp + 0x30], rcx
lea rcx, [0x1400017a0]
mov qword [rsp + 0x28], rcx
lea rcx, [0x1400017c0]
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x38], 0xffffffff
lea rcx, [0x1400019a0]
lea rdx, [0x140001970]
lea r8, [0x140001840]
lea r9, [0x140001800]
call qword [0x140009008]
test rax, rax
je 0x14000172d
mov r14, rax
lea rdi, [rsp + 0x68]
mov qword [rdi - 8], rsi
mov rcx, rdi
call fcn.140001c80
mov byte [rdi + 0x218], 0
mov rax, qword [0x1400070a0]
lea rsi, [rsp + 0x60]
mov qword [rsp + 0x30], rsi
lea rcx, [0x1400019d0]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], 0
mov rcx, r14
mov rdx, rbx
mov r8, r15
xor r9d, r9d
call qword [0x140009008]
mov rax, qword [0x1400070a8]
mov rcx, r14
call qword [0x140009008]
cmp byte [rsi + 0x220], 0
setne sil
jne 0x140001716
mov rcx, rdi
call fcn.140001d80
test al, al
je 0x140001716
mov rcx, rdi
call fcn.140001d90
mov rcx, rdi
call fcn.140001ca0
jmp 0x14000172f
xor esi, esi
mov eax, 0
jmp 0x140001745
xor eax, eax
jmp 0x140001760
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
test rbx, rbx
je 0x140001760
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
movaps xmm6, xmmword [rsp + 0x290]
add rsp, 0x2a0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, qword [0x1400070a0]
jmp 0x1400014a0