Function at 0x1000061b0
Capabilities:
Get comspec environment variable
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
xor r12d, r12d
cmp byte [rcx], 0x2a
mov edi, r8d
mov r13d, edx
mov rsi, rcx
lea ebp, [r12 + 1]
jne 0x1000062b4
mov byte [0x100011ce0], r12b
mov r12, rcx
lea rcx, [0x1000022b0]
mov byte [0x10000f420], 0x43
call qword [sym.imp.msvcrt.dll_getenv]
test rax, rax
je 0x100006232
cmp byte [rax], 0
je 0x100006232
cmp byte [rax + 1], 0x3a
jne 0x100006232
movsx ecx, byte [rax]
call qword [sym.imp.msvcrt.dll_tolower]
movzx edx, byte [0x10000f420]
lea ecx, [rax - 0x61]
movzx eax, al
cmp cl, 0x19
cmovbe edx, eax
mov byte [0x10000f420], dl
lea rdx, [0x1000022a8]
lea rcx, [0x10000f420]
call qword [sym.imp.msvcrt.dll__tempnam]
mov r11, rax
test rax, rax
jne 0x100006265
mov rax, qword [0x100011de0]
mov dword [rax + 0x60], 2
or rax, 0xffffffffffffffff
jmp 0x1000064ac
lea rbx, [0x100011ce0]
mov r8, rax
mov edx, 0x100
mov rcx, rbx
sub r8, rbx
lea rax, [rdx + 0x7ffffefe]
test rax, rax
je 0x100006298
mov al, byte [r8 + rcx]
test al, al
je 0x100006298
mov byte [rcx], al
add rcx, rbp
sub rdx, rbp
jne 0x10000627a
test rdx, rdx
jne 0x1000062a0
sub rcx, rbp
mov byte [rcx], 0
mov rcx, r11
call qword [sym.imp.msvcrt.dll_free]
mov r13d, 0x8102
jmp 0x1000062b7
mov rbx, rcx
mov r8d, edi
mov edx, r13d
mov rcx, rbx
call qword [sym.imp.msvcrt.dll__open]
or rbx, 0xffffffffffffffff
cmp byte [rsi], 0x2a
movsxd rdi, eax
jne 0x10000636c
cmp edi, ebx
jne 0x1000062f0
mov rax, qword [0x100011de0]
mov dword [rax + 0x60], 2
mov rax, rbx
jmp 0x1000064ac
mov edx, dword [r12 + 4]
mov qword [0x100011cc8], rdi
test edx, edx
jle 0x10000635f
dec edx
xor r8d, r8d
mov rcx, rdi
call fcn.1000060fc
cmp eax, ebx
jne 0x100006331
mov rdx, qword [0x100011de0]
mov dword [rdx + 0x60], 3
mov eax, dword [r12 + 4]
mov dword [rdx + 0x64], eax
mov rcx, rdi
call fcn.100006014
jmp 0x1000062e8
lea rdx, [0x1000022ac]
mov r8d, ebp
mov ecx, edi
call qword [sym.imp.msvcrt.dll__write]
cmp eax, ebp
je 0x10000635f
mov rcx, qword [0x100011de0]
mov dword [rcx + 0x60], 3
mov eax, dword [r12 + 4]
mov dword [rcx + 0x64], eax
jmp 0x100006327
mov rax, qword [0x100011de0]
and dword [rax + 0x60], 0
jmp 0x1000063ce
mov rax, qword [0x100011de0]
cmp dword [rax + 0x1c], 0
je 0x1000063ce
lea rdx, [rax + 0x68]
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__stricmp]
test eax, eax
jne 0x1000063c7
mov r8, qword [0x100011de0]
xor edx, edx
lea rcx, [r8 + 0x28]
cmp dword [rcx], ebx
je 0x1000063aa
add rdx, rbp
add eax, ebp
add rcx, 4
cmp rdx, 2
jl 0x100006397
cmp eax, 2
mov rcx, rdi
jge 0x10000632a
cdqe
xor edx, edx
mov dword [r8 + rax*4 + 0x28], edi
xor r8d, r8d
call fcn.1000060fc
mov rax, qword [0x100011de0]
cmp r13d, 0x8000
jne 0x1000064a9
cmp edi, ebx
je 0x1000064a9
cmp qword [0x10000f410], rbx
jne 0x100006492
cmp dword [rax + 0x1c], 0
mov rcx, rdi
mov qword [0x10000f410], rcx
je 0x10000640b
mov edx, dword [rax + 0x24]
mov dword [0x10000fa0c], edx
jmp 0x100006419
call qword [sym.imp.msvcrt.dll__filelength]
mov edx, eax
mov dword [0x10000fa0c], eax
and dword [0x10000fa04], 0
and dword [0x10000fa00], 0
mov ecx, 0x989680
mov dword [0x10000fa08], ebp
cmp edx, ecx
jbe 0x100006458
mov eax, 0xcccccccd
mul edx
lea eax, [rbp + rbp*4]
add eax, eax
shr edx, 3
mov ebp, eax
mov dword [0x10000fa08], eax
cmp edx, ecx
ja 0x100006436
mov dword [0x10000fa0c], edx
cmp qword [0x100011c90], 0
mov dword [0x10000f9fc], ebx
jne 0x1000064a9
mov rcx, qword [0x10000f9f0]
and qword [rsp + 0x20], 0
xor r8d, r8d
lea edx, [r8 + 0x65]
lea r9, [0x100006748]
call qword [sym.imp.USER32.dll_CreateDialogParamA]
mov qword [0x100011c90], rax
jmp 0x1000064a9
cmp qword [0x10000f418], rbx
jne 0x1000064a9
and dword [0x10000f9f8], 0
mov qword [0x10000f418], rdi
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret