Function at 0x14030b439
Capabilities:
Query environment variable

Disassembly:
push rax
pushf
mov eax, 0x7cb36a82
pushf
not eax
add eax, 0xdde692b1
xor eax, 0xc8a4673f
rol eax, 0xd4
popf
pushf
not eax
add eax, 0xe28355e9
xor eax, 0xf168bc74
rol eax, 0x53
popf
cmp eax, 4
jne 0x14030b476
popf
pop rax
jmp 0x14030b6f4
cmp eax, 0
jne 0x14030b485
popf
pop rax
jmp 0x14030b539
cmp eax, 3
jne 0x14030b494
popf
pop rax
jmp 0x14030b6aa
cmp eax, 1
jne 0x14030b4a3
popf
pop rax
jmp 0x14030b5ef
cmp eax, 0xd
jne 0x14030b4b2
popf
pop rax
jmp 0x14030bb3d
cmp eax, 7
jne 0x14030b4c1
popf
pop rax
jmp 0x14030b8e4
cmp eax, 6
jne 0x14030b4d0
popf
pop rax
jmp 0x14030b838
cmp eax, 0xb
jne 0x14030b4df
popf
pop rax
jmp 0x14030ba87
cmp eax, 0xc
jne 0x14030b4ee
popf
pop rax
jmp 0x14030bada
cmp eax, 8
jne 0x14030b4fd
popf
pop rax
jmp 0x14030b94c
cmp eax, 5
jne 0x14030b50c
popf
pop rax
jmp 0x14030b79d
cmp eax, 2
jne 0x14030b51b
popf
pop rax
jmp 0x14030b629
cmp eax, 9
jne 0x14030b52a
popf
pop rax
jmp 0x14030b9fb
cmp eax, 0xa
jne 0x14030b539
popf
pop rax
jmp 0x14030ba60
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
jmp 0x14030b553
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14030b5bc
push rax
pushf
mov eax, 0x2bf0ec13
pushf
not eax
add eax, 0x8ae5b89d
xor eax, 0x963b447a
rol eax, 0x50
popf
pushf
not eax
add eax, 0x9339bb10
xor eax, 0xfe66b451
rol eax, 0x3f
popf
pushf
not eax
add eax, 0xd4a1a114
xor eax, 0xe258c87f
rol eax, 0x18
popf
pushf
not eax
add eax, 0xf6afdebd
xor eax, 0x82760786
rol eax, 0x50
popf
jmp 0x14030b467
push rax
pushf
mov eax, 0x153943e6
pushf
not eax
add eax, 0x90c93833
xor eax, 0x8c4746f2
rol eax, 0xae
popf
pushf
not eax
add eax, 0xf97f4a69
xor eax, 0xeccf8c76
rol eax, 0xe4
popf
jmp 0x14030b467
xor eax, eax
jmp 0x14030bb4a
mov rbp, rbx
cmp word [rax], si
je 0x14030b677
push rax
pushf
mov eax, 0x53d5abe1
pushf
not eax
add eax, 0x96aefd1f
xor eax, 0xe7a7c275
rol eax, 0xae
popf
pushf
not eax
add eax, 0xbf2023fa
xor eax, 0xcc87499c
rol eax, 0x98
popf
pushf
not eax
add eax, 0xc9d207dd
xor eax, 0xc2f83d29
rol eax, 0x90
popf
jmp 0x14030b467
push rax
pushf
mov eax, 0xd34d144b
pushf
not eax
add eax, 0xc4f082b4
xor eax, 0xb2d10330
rol eax, 0x91
popf
pushf
not eax
add eax, 0xc5db1a38
xor eax, 0xeb2a9393
rol eax, 0xfb
popf
jmp 0x14030b467
or rax, 0xffffffffffffffff
push rax
pushf
mov eax, 0x944cc82d
pushf
not eax
add eax, 0xd058586c
xor eax, 0xa32b0d0e
rol eax, 0xb1
popf
pushf
not eax
add eax, 0xcb42d11c
xor eax, 0xc61c7433
rol eax, 0x8d
popf
pushf
not eax
add eax, 0xadb892b7
xor eax, 0xf0db47d7
rol eax, 0x15
popf
jmp 0x14030b467
inc rax
cmp word [rbp + rax*2], si
jne 0x14030b744
push rax
pushf
mov eax, 0xb4c15208
pushf
not eax
add eax, 0xa35b3084
xor eax, 0xa8501608
rol eax, 0xe4
popf
pushf
not eax
add eax, 0xa272f0be
xor eax, 0x85863b7e
rol eax, 0xec
popf
pushf
not eax
add eax, 0xd15b0af6
xor eax, 0xcc2b8af0
rol eax, 0xf8
popf
jmp 0x14030b467
push rax
pushf
mov eax, 0x102d7b67
pushf
not eax
add eax, 0xe9feb525
xor eax, 0x8eaa8556
rol eax, 0x95
popf
pushf
not eax
add eax, 0x9c72b85e
xor eax, 0xe0001118
rol eax, 0x63
popf
pushf
not eax
add eax, 0xbd097dca
xor eax, 0xa12e509b
rol eax, 0xd0
popf
pushf
not eax
add eax, 0x91fb1699
xor eax, 0x94b8a0b4
rol eax, 0x56
popf
jmp 0x14030b467
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14030b7f2
push rax
pushf
mov eax, 0xc508728f
pushf
not eax
add eax, 0xcbeff362
xor eax, 0xea326866
rol eax, 0xd9
popf
pushf
not eax
add eax, 0xf523fbca
xor eax, 0xf5c2e3d9
rol eax, 0x37
popf
pushf
not eax
add eax, 0xfd991178
xor eax, 0xecd90d21
rol eax, 0x33
popf
jmp 0x14030b467
push rax
pushf
mov eax, 0x305bbf04
pushf
not eax
add eax, 0xfbe1f754
xor eax, 0xcc3e2d51
rol eax, 0x1d
popf
pushf
not eax
add eax, 0xd2196380
xor eax, 0xa1b16dbe
rol eax, 0x72
popf
pushf
not eax
add eax, 0xfbba5879
xor eax, 0xc62c962c
rol eax, 0xb0
popf
jmp 0x14030b467
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.14035812d
movsxd r14, eax
test eax, eax
jne 0x14030b8b1
push rax
pushf
mov eax, 0x79525000
pushf
not eax
add eax, 0xd2995e2c
xor eax, 0xfa9146ff
rol eax, 0xd
popf
pushf
not eax
add eax, 0x89f958bb
xor eax, 0xece0fa95
rol eax, 0xac
popf
pushf
not eax
add eax, 0x80ef857d
xor eax, 0x9de232b9
rol eax, 0xcb
popf
jmp 0x14030b467
push rax
pushf
mov eax, 0x5b1919a0
pushf
not eax
add eax, 0xf987c37c
xor eax, 0x83cf9a3d
rol eax, 0x3a
popf
pushf
not eax
add eax, 0x890b1b6d
xor eax, 0xb094969d
rol eax, 0x65
popf
jmp 0x14030b467
mov rcx, rbx
jmp 0x14030b8e8
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14030b5ef
mov rcx, r14
call fcn.1402cf482
mov rdi, rax
test rax, rax
jne 0x14030b9a2
push rax
pushf
mov eax, 0x44f0b4c5
pushf
not eax
add eax, 0xf8b5d218
xor eax, 0x8f799abb
rol eax, 0xb9
popf
pushf
not eax
add eax, 0x80943803
xor eax, 0xb60625e1
rol eax, 0x6e
popf
pushf
not eax
add eax, 0xc1e2bc79
xor eax, 0x9b563671
rol eax, 0xad
popf
jmp 0x14030b467
push rax
pushf
mov eax, 0x2692706e
pushf
not eax
add eax, 0xd26ae1d3
xor eax, 0xc3f8a0fd
rol eax, 0x1f
popf
pushf
not eax
add eax, 0xa3803b89
xor eax, 0x9624a561
rol eax, 0xdd
popf
pushf
not eax
add eax, 0xc12ac78a
xor eax, 0xc346a6f9
rol eax, 0xbd
popf
pushf
not eax
add eax, 0xcc72f477
xor eax, 0xd2e9f4a8
rol eax, 0xc
popf
jmp 0x14030b467
xor ecx, ecx
call fcn.14034ab66
jmp 0x14030b8e4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.14035812d
test eax, eax
jne 0x14030bada
mov rcx, rdi
call fcn.14034ab66
jmp 0x14030bb3d
xor ecx, ecx
call fcn.14034ab66
mov rsi, rdi
push rax
pushf
mov eax, 0xf435265e
pushf
not eax
add eax, 0xd75d7153
xor eax, 0xc85ed149
rol eax, 0xf5
popf
pushf
not eax
add eax, 0xfca7cc02
xor eax, 0xc43c567d
rol eax, 0x3b
popf
pushf
not eax
add eax, 0xe79d2853
xor eax, 0x8203cf21
rol eax, 0x67
popf
pushf
not eax
add eax, 0x9698d3ee
xor eax, 0xce1c7d06
rol eax, 0x97
popf
jmp 0x14030b467
mov rcx, rbx
jmp 0x14030bb41
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret