Function at 0x140005cc0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x20], rbx
push r12
push r14
push r15
sub rsp, 0x540
mov eax, dword [str.____n]
mov r12, r9
mov dword [rsp + 0x20], eax
mov r15, r8
movzx eax, byte [0x1401300d8]
mov r14d, edx
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x24], al
mov qword [rsp + 0x560], rbp
call sub.api_ms_win_crt_string_l1_1_0.dll_strtok
lea rcx, str.USERPROFILE
mov rbx, rax
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
lea rdx, [rsp + 0x28]
sub rdx, rax
nop dword [rax]
movzx ecx, byte [rax]
mov byte [rdx + rax], cl
lea rax, [rax + 1]
test cl, cl
jne 0x140005d20
lea rcx, [rsp + 0x28]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140005d36
movsd xmm0, qword [str.AppData]
xor ebp, ebp
movzx eax, byte [0x1401300e8]
movsd qword [rcx], xmm0
mov byte [rcx + 8], al
mov qword [rsp + 0x570], rdi
test rbx, rbx
je 0x140005e71
mov qword [rsp + 0x568], rsi
movsxd rax, ebp
lea rcx, [rsp + 0x120]
lea rdi, [rax + rax*2]
shl rdi, 5
mov rax, rdi
sub rax, rbx
add rcx, rax
nop dword [rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x140005d90
lea rdx, [rsp + 0x20]
xor ecx, ecx
call sub.api_ms_win_crt_string_l1_1_0.dll_strtok
mov rsi, rax
lea rbx, [rsp + 0x140]
add rbx, rdi
lea rax, [rsp + 0x28]
mov rdi, rbx
lea rdx, str.Green
mov rcx, rsi
sub rdi, rax
call sub.VCRUNTIME140.dll_strstr
lea rcx, [rsp + 0x28]
test rax, rax
je 0x140005e20
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdi + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140005de0
lea rcx, [rbx - 1]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140005df2
mov eax, dword [str.Local]
mov dword [rcx], eax
movzx eax, word [0x1401300f8]
mov word [rcx + 4], ax
movzx eax, byte [0x1401300fa]
mov byte [rcx + 6], al
jmp 0x140005e2e
movzx eax, byte [rcx]
mov byte [rdi + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140005e20
dec rbx
cmp byte [rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x140005e31
xor ecx, ecx
nop dword [rax]
movzx eax, byte [rsi + rcx]
mov byte [rbx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140005e40
lea rdx, [rsp + 0x20]
xor ecx, ecx
call sub.api_ms_win_crt_string_l1_1_0.dll_strtok
inc ebp
mov rbx, rax
test rax, rax
jne 0x140005d71
mov rsi, qword [rsp + 0x568]
mov rbp, qword [rsp + 0x560]
test r14d, r14d
jle 0x140005f75
lea rbx, [rsp + 0x140]
mov rdi, r14
nop dword [rax]
mov rcx, rbx
call fcn.140002750
test rax, rax
je 0x140005f67
lea rdx, [rsp + 0x50]
mov rcx, r12
sub rdx, r12
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140005eb0
lea rcx, [rsp + 0x50]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140005ec6
movzx eax, word [0x14012edc4]
mov word [rcx], ax
lea rcx, [rsp + 0x50]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140005ee2
xor edx, edx
nop
movzx eax, byte [rbx + rdx - 0x20]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140005ef0
lea rdx, [0x1401300fc]
mov rcx, r15
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x140005f23
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140004570
jmp 0x140005f67
lea rdx, [0x140130100]
mov rcx, r15
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x140005f46
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.1400043b0
jmp 0x140005f67
lea rdx, [0x140130104]
mov rcx, r15
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x140005f67
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140004710
add rbx, 0x60
sub rdi, 1
jne 0x140005e90
mov rdi, qword [rsp + 0x570]
xor eax, eax
mov rbx, qword [rsp + 0x578]
add rsp, 0x540
pop r15
pop r14
pop r12
ret