Function at 0x1400b03c0
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0x50
movsxd rax, r8d
mov rbx, rdx
shl rax, 5
add rax, qword [rcx + 8]
test r9, r9
je 0x1400b03ec
mov rcx, r9
call fcn.1400e7270
lea rax, [rbx + rax*2 + 2]
add rsp, 0x50
pop rbx
ret
mov qword [rsp + 0x60], rbp
mov rbp, qword [rax + 8]
mov qword [rsp + 0x40], r13
mov r13, qword [rax + 0x10]
mov qword [rsp + 0x38], r14
xor r14d, r14d
test r13, r13
je 0x1400b065d
mov rcx, qword [r13]
test rcx, rcx
je 0x1400b065d
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x30], r15
mov r15d, 0xffffffff
cmp rbp, rcx
jae 0x1400b0455
nop dword [rax + rax]
movzx eax, word [rbp]
add rbp, 2
add rbx, 2
mov word [rbx - 2], ax
cmp rbp, rcx
jb 0x1400b0440
mov rdi, qword [r13 + 8]
mov r12, rbx
movzx ecx, byte [rdi + 0x23]
test ecx, ecx
je 0x1400b061b
dec ecx
je 0x1400b04b9
dec ecx
je 0x1400b0494
dec ecx
je 0x1400b0483
mov rdx, qword [rdi + 0x28]
mov rcx, rbx
call qword [rdi + reloc.OLEAUT32.dll_SafeArrayGetElement]
jmp 0x1400b0627
test rbx, rbx
je 0x1400b048c
mov word [rbx], r14w
mov rsi, r14
jmp 0x1400b062a
mov rcx, rbx
call fcn.140006960
cmp rax, r15
mov rsi, rax
cmove rsi, r14
test rbx, rbx
je 0x1400b062a
mov word [rbx + rsi*2], r14w
jmp 0x1400b062a
mov rcx, rdi
call fcn.140001130
cmp dword [0x14013b0c4], r14d
jne 0x1400b0594
cmp qword [rdi + 0x10], r14
jne 0x1400b0594
cmp qword [0x1401440e0], rdi
jne 0x1400b04e6
test rbx, rbx
jne 0x1400b054e
mov rcx, qword [rdi + 0x28]
lea rdx, [rsp + 0x70]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1400b0549
mov qword [0x1401440e0], r14
test rbx, rbx
je 0x1400b0541
mov edx, dword [0x14013f868]
test edx, edx
je 0x1400b052e
mov r9, qword [rdi + 0x28]
lea r8, str.An_environment_variable_is_being_accessed__see_NoEnv.
lea rcx, [0x140143150]
mov qword [rsp + 0x20], r14
call fcn.1400600d0
mov rcx, qword [rdi + 0x28]
mov rdx, rbx
call fcn.1400e1df0
mov esi, eax
jmp 0x1400b062a
lea esi, [rax - 1]
jmp 0x1400b062a
test rbx, rbx
je 0x1400b0585
cmp byte [rdi + 0x23], r14b
jne 0x1400b055a
mov rax, qword [rdi + 0x10]
jmp 0x1400b055d
mov rax, rdi
test byte [rax + 0x21], 4
je 0x1400b0572
lea rcx, [0x140143150]
mov rdx, rdi
call fcn.140060290
mov word [rbx], r14w
mov qword [0x1401440e0], r14
mov rsi, r14
jmp 0x1400b062a
mov qword [0x1401440e0], rdi
mov rsi, r14
jmp 0x1400b062a
mov r8, qword [rdi + 0x10]
mov rsi, r8
shr rsi, 1
test rbx, rbx
je 0x1400b062a
test r8, r8
jne 0x1400b05d5
cmp byte [rdi + 0x23], r14b
mov rax, rdi
cmove rax, r14
test byte [rax + 0x21], 4
je 0x1400b05cc
lea rcx, [0x140143150]
mov rdx, rdi
call fcn.140060290
mov word [rbx], r14w
mov rsi, r14
jmp 0x1400b062a
mov rdx, qword [rdi + 8]
cmp rbx, rdx
je 0x1400b062a
cmp r8, 0x186a0
jae 0x1400b060c
movzx eax, word [rdx]
test ax, ax
je 0x1400b0605
nop
add rdx, 2
mov word [r12], ax
add r12, 2
movzx eax, word [rdx]
test ax, ax
jne 0x1400b05f0
mov word [r12], r14w
jmp 0x1400b062a
mov rcx, rbx
call sub.MSVCR100.dll_memcpy
mov word [rbx + rsi*2], r14w
jmp 0x1400b062a
mov rcx, qword [rdi + 0x10]
mov rdx, rbx
call fcn.1400e7270
mov rsi, rax
movzx eax, word [r13 + 0x12]
mov rcx, qword [r13 + 0x18]
add r13, 0x18
lea rbx, [rbx + rsi*2]
lea rbp, [rbp + rax*2]
test rcx, rcx
jne 0x1400b0436
mov r15, qword [rsp + 0x30]
mov r12, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x68]
movzx eax, word [rbp]
mov r13, qword [rsp + 0x40]
test ax, ax
je 0x1400b0681
sub rbp, rbx
nop
mov word [rbx], ax
movzx eax, word [rbx + rbp + 2]
add rbx, 2
test ax, ax
jne 0x1400b0670
mov rbp, qword [rsp + 0x60]
mov word [rbx], r14w
mov r14, qword [rsp + 0x38]
lea rax, [rbx + 2]
add rsp, 0x50
pop rbx
ret