Function at 0x12865440
Capabilities:
Query environment variable

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x128
mov qword [rsp + 0xc0], 0xfffffffffffffffe
mov rax, qword [0x12a52ee0]
xor rax, rsp
mov qword [rsp + 0x118], rax
mov qword [rsp + 0x30], r9
mov r12, r8
mov qword [rsp + 0xb0], rdx
mov rbx, rcx
mov r13, qword [rsp + 0x190]
mov qword [rsp + 0xa8], r13
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0xa0], rax
xor ebp, ebp
mov qword [rsp + 0x80], rbp
mov edi, dword [rdx]
shr edi, 0xa
and dil, 1
lea ecx, [rbp + 8]
call fcn.12958d80
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x128654dc
lea rcx, [rsp + 0x40]
mov qword [rax], rcx
jmp 0x128654df
mov rax, rbp
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x40]
call fcn.1282af00
mov qword [rsp + 0x70], rax
mov byte [rax + 0x69], 1
mov rax, qword [rsp + 0x70]
mov qword [rax + 8], rax
mov rax, qword [rsp + 0x70]
mov qword [rax], rax
mov rax, qword [rsp + 0x70]
mov qword [rax + 0x10], rax
mov qword [rsp + 0x78], rbp
test rbx, rbx
jne 0x1286552e
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov qword [rsp + 0x80], rax
mov rbx, rax
jmp 0x12865537
test dil, dil
je 0x128656c7
xor eax, eax
or r14, 0xffffffffffffffff
mov rcx, r14
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rbp, rcx
mov qword [rsp + 0xe8], 7
mov rdi, rax
mov qword [rsp + 0xe0], rax
mov word [rsp + 0xd0], di
je 0x1286568e
mov r15d, 0x3d
xor r13d, r13d
nop
mov edx, r15d
lea rcx, [rbx + 2]
call fcn.1295be3c
mov rsi, rax
test rax, rax
je 0x12865684
lea rdx, [rax + 2]
test rdx, rdx
je 0x128655c2
xor eax, eax
mov rcx, r14
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0xc8]
call fcn.12803dc0
jmp 0x128655cf
lea rcx, [rsp + 0xc8]
call fcn.12803f90
mov qword [rsp + 0x110], 7
mov qword [rsp + 0x108], r13
mov word [rsp + 0xf8], r13w
sub rsi, rbx
sar rsi, 1
mov r8, rsi
mov rdx, rbx
lea rcx, [rsp + 0xf0]
call fcn.12803dc0
nop
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x40]
call fcn.1281d330
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0xc8]
mov rcx, rax
call fcn.12803c90
nop
cmp qword [rsp + 0x110], 8
jb 0x12865647
mov rcx, qword [rsp + 0xf8]
call fcn.12958250
mov qword [rsp + 0x110], 7
mov qword [rsp + 0x108], r13
mov word [rsp + 0xf8], r13w
lea rbx, [rbx + rbp*2 + 2]
xor eax, eax
mov rcx, r14
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
sub rcx, 1
mov rbp, rcx
jne 0x12865580
mov r13, qword [rsp + 0xa8]
xor edi, edi
cmp qword [rsp + 0xe8], 8
jb 0x128656a6
mov rcx, qword [rsp + 0xd0]
call fcn.12958250
mov qword [rsp + 0xe8], 7
mov qword [rsp + 0xe0], rdi
mov word [rsp + 0xd0], di
jmp 0x12865815
xor eax, eax
or r14, 0xffffffffffffffff
mov rcx, r14
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov rsi, rcx
mov qword [rsp + 0xe8], 7
mov qword [rsp + 0xe0], rbp
mov word [rsp + 0xd0], bp
mov qword [rsp + 0x110], 7
mov qword [rsp + 0x108], rbp
mov word [rsp + 0xf8], bp
je 0x128657ad
mov r15d, 0x3d
lea rcx, [rbx + 1]
mov edx, r15d
call fcn.1295c690
mov rdi, rax
test rax, rax
je 0x128657ad
lea rcx, [rax + 1]
mov r9d, r14d
xor r8d, r8d
lea rdx, [rsp + 0xc8]
call fcn.128ab270
sub edi, ebx
mov r9d, edi
xor r8d, r8d
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.128ab270
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x40]
call fcn.1281d330
mov r9, r14
xor r8d, r8d
lea rdx, [rsp + 0xc8]
mov rcx, rax
call fcn.12803c90
lea rbx, [rbx + rsi + 1]
xor eax, eax
mov rcx, r14
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov rsi, rcx
jne 0x12865723
cmp qword [rsp + 0x110], 8
jb 0x128657c5
mov rcx, qword [rsp + 0xf8]
call fcn.12958250
mov qword [rsp + 0x110], 7
mov qword [rsp + 0x108], rbp
mov word [rsp + 0xf8], bp
cmp qword [rsp + 0xe8], 8
jb 0x128657f9
mov rcx, qword [rsp + 0xd0]
call fcn.12958250
mov qword [rsp + 0xe8], 7
mov qword [rsp + 0xe0], rbp
mov word [rsp + 0xd0], bp
mov rbp, qword [r12 + 0x30]
mov rdi, qword [rbp]
mov rbx, qword [r12]
xor r15d, r15d
test rbx, rbx
je 0x1286582f
cmp rbx, rbx
je 0x12865834
call fcn.1295850c
cmp rdi, rbp
je 0x1286590b
test rbx, rbx
jne 0x1286584c
call fcn.1295850c
mov r11, r15
jmp 0x1286584f
mov r11, qword [rbx]
cmp rdi, qword [r11 + 0x30]
jne 0x1286585a
call fcn.1295850c
test rbx, rbx
jne 0x12865869
call fcn.1295850c
mov r11, r15
jmp 0x1286586c
mov r11, qword [rbx]
cmp rdi, qword [r11 + 0x30]
jne 0x12865877
call fcn.1295850c
lea rdx, [rdi + 0x18]
lea rcx, [rsp + 0x40]
call fcn.1281d330
lea rdx, [rdi + 0x40]
mov r9, r14
xor r8d, r8d
mov rcx, rax
call fcn.12803c90
test rbx, rbx
jne 0x128658a1
call fcn.1295850c
cmp byte [rdi + 0x69], r15b
je 0x128658b1
call fcn.1295850c
jmp 0x12865825
mov rax, qword [rdi + 0x10]
cmp byte [rax + 0x69], r15b
jne 0x128658e1
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x69], r15b
jne 0x12865825
nop dword [rax + rax]
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x69], r15b
je 0x128658d0
jmp 0x12865825
mov rax, qword [rdi + 8]
cmp byte [rax + 0x69], r15b
jne 0x12865903
nop dword [rax + rax]
cmp rdi, qword [rax + 0x10]
jne 0x12865903
mov rdi, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x69], r15b
je 0x128658f0
mov rdi, rax
jmp 0x12865825
test r13, r13
mov r15, qword [rsp + 0x30]
je 0x128659b6
mov rbp, qword [r13 + 0x28]
mov rsi, qword [r13]
mov rax, qword [rbp]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
cmp qword [rsp + 0x78], 0
je 0x128659b6
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
xor r15d, r15d
nop
test rdi, rdi
je 0x1286595a
cmp rdi, rsi
je 0x1286595f
call fcn.1295850c
cmp rbx, rbp
je 0x128659b1
test rdi, rdi
jne 0x12865973
call fcn.1295850c
mov r11, r15
jmp 0x12865976
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x28]
jne 0x12865981
call fcn.1295850c
lea rdx, [rbx + 0x10]
lea rcx, [rsp + 0x40]
call fcn.128603a0
test rdi, rdi
jne 0x1286599e
call fcn.1295850c
mov r11, r15
jmp 0x128659a1
mov r11, qword [rdi]
cmp rbx, qword [r11 + 0x28]
jne 0x128659ac
call fcn.1295850c
mov rbx, qword [rbx]
jmp 0x12865950
mov r15, qword [rsp + 0x30]
xor r13d, r13d
mov r12d, r13d
mov rbp, qword [rsp + 0x70]
mov rdi, qword [rbp]
mov rbx, qword [rsp + 0x40]
nop word [rax + rax]
test rbx, rbx
je 0x128659da
cmp rbx, rbx
je 0x128659df
call fcn.1295850c
cmp rdi, rbp
je 0x12865a9b
test rbx, rbx
jne 0x128659f7
call fcn.1295850c
mov r11, r13
jmp 0x128659fa
mov r11, qword [rbx]
cmp rdi, qword [r11 + 0x30]
jne 0x12865a05
call fcn.1295850c
mov rsi, qword [rdi + 0x30]
test rbx, rbx
jne 0x12865a18
call fcn.1295850c
mov r11, r13
jmp 0x12865a1b
mov r11, qword [rbx]
cmp rdi, qword [r11 + 0x30]
jne 0x12865a26
call fcn.1295850c
mov eax, dword [rdi + 0x58]
add eax, esi
lea r12d, [r12 + rax + 2]
test rbx, rbx
jne 0x12865a3a
call fcn.1295850c
cmp byte [rdi + 0x69], r13b
je 0x12865a47
call fcn.1295850c
jmp 0x128659d0
mov rax, qword [rdi + 0x10]
cmp byte [rax + 0x69], r13b
jne 0x12865a72
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x69], r13b
jne 0x128659d0
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x69], r13b
je 0x12865a61
jmp 0x128659d0
mov rax, qword [rdi + 8]
cmp byte [rax + 0x69], r13b
jne 0x12865a93
nop dword [rax]
cmp rdi, qword [rax + 0x10]
jne 0x12865a93
mov rdi, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x69], r13b
je 0x12865a80
mov rdi, rax
jmp 0x128659d0
inc r12d
mov ecx, r12d
mov eax, 2
mul rcx
cmovo rax, r14
mov rcx, rax
call fcn.12958238
mov rsi, rax
mov rcx, qword [r15]
cmp rax, rcx
je 0x12865ac5
call fcn.12958250
mov qword [r15], rsi
mov rbp, qword [rsp + 0x70]
mov rdi, qword [rbp]
mov rbx, qword [rsp + 0x40]
mov r13d, 0x3d
xor r14d, r14d
nop
test rbx, rbx
je 0x12865aea
cmp rbx, rbx
je 0x12865aef
call fcn.1295850c
cmp rdi, rbp
je 0x12865c5b
test rbx, rbx
jne 0x12865b07
call fcn.1295850c
mov r11, r14
jmp 0x12865b0a
mov r11, qword [rbx]
cmp rdi, qword [r11 + 0x30]
jne 0x12865b15
call fcn.1295850c
cmp qword [rdi + 0x38], 8
jb 0x12865b22
mov rcx, qword [rdi + 0x20]
jmp 0x12865b26
lea rcx, [rdi + 0x20]
mov rdx, rsi
nop dword [rax]
movzx eax, word [rcx]
mov word [rdx], ax
add rcx, 2
add rdx, 2
test ax, ax
jne 0x12865b30
test rbx, rbx
jne 0x12865b52
call fcn.1295850c
mov r11, r14
jmp 0x12865b55
mov r11, qword [rbx]
cmp rdi, qword [r11 + 0x30]
jne 0x12865b60
call fcn.1295850c
mov rax, qword [rdi + 0x30]
lea rsi, [rsi + rax*2]
mov word [rsi], r13w
test rbx, rbx
jne 0x12865b7b
call fcn.1295850c
mov r11, r14
jmp 0x12865b7e
mov r11, qword [rbx]
cmp rdi, qword [r11 + 0x30]
jne 0x12865b89
call fcn.1295850c
cmp qword [rdi + 0x60], 8
jb 0x12865b96
mov rcx, qword [rdi + 0x48]
jmp 0x12865b9a
lea rcx, [rdi + 0x48]
lea rdx, [rsi + 2]
nop
movzx eax, word [rcx]
mov word [rdx], ax
add rcx, 2
add rdx, 2
test ax, ax
jne 0x12865ba0
test rbx, rbx
jne 0x12865bc2
call fcn.1295850c
mov r11, r14
jmp 0x12865bc5
mov r11, qword [rbx]
cmp rdi, qword [r11 + 0x30]
jne 0x12865bd0
call fcn.1295850c
mov rax, qword [rdi + 0x58]
lea rsi, [rsi + rax*2 + 2]
mov word [rsi], r14w
add rsi, 2
test rbx, rbx
jne 0x12865beb
call fcn.1295850c
cmp byte [rdi + 0x69], r14b
je 0x12865bfb
call fcn.1295850c
jmp 0x12865ae0
mov rax, qword [rdi + 0x10]
cmp byte [rax + 0x69], r14b
jne 0x12865c31
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x69], r14b
jne 0x12865ae0
nop word [rax + rax]
mov rdi, rax
mov rax, qword [rax]
cmp byte [rax + 0x69], r14b
je 0x12865c20
jmp 0x12865ae0
mov rax, qword [rdi + 8]
cmp byte [rax + 0x69], r14b
jne 0x12865c53
nop dword [rax + rax]
cmp rdi, qword [rax + 0x10]
jne 0x12865c53
mov rdi, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x69], r14b
je 0x12865c40
mov rdi, rax
jmp 0x12865ae0
mov word [rsi], r14w
mov rax, qword [rsp + 0x80]
test rax, rax
je 0x12865c75
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x12865c88
lea eax, [r12 + r12]
mov dword [rcx], eax
mov rax, qword [rsp + 0xb0]
or dword [rax], 0x400
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x20], rcx
mov rax, qword [rax]
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x90], rcx
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
movaps xmm1, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0x90], xmm1
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x40]
call fcn.1281d560
mov rcx, qword [rsp + 0x70]
call fcn.12958250
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
mov rcx, qword [rsp + 0x40]
call fcn.12958250
mov eax, 1
mov rcx, qword [rsp + 0x118]
xor rcx, rsp
call fcn.12959850
add rsp, 0x128
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret