Function at 0x14004a3d0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2e8
movaps xmmword [rsp + 0x2d0], xmm6
mov r14, rdx
mov r13, rcx
mov rax, qword [0x140113040]
xor rax, rsp
mov qword [rsp + 0x2c8], rax
mov ecx, 0xc0
call fcn.1400914ac
mov rdi, rax
add rax, 0x70
mov qword [rdi + 8], rax
lea rax, [0x1400f3c60]
mov qword [rdi], rax
lea rbp, [rdi + 0x10]
mov r8d, 0xb0
mov rcx, rbp
xor edx, edx
call fcn.1400c39c0
mov qword [rdi + 0x70], 0x50
lea rax, [0x1400fca30]
mov qword [rdi + 0x78], rax
mov qword [r13], rdi
movzx eax, byte [r14 + 0x17]
mov rsi, rax
test al, al
jns 0x14004a45d
mov rsi, qword [r14 + 8]
lea rbx, [rsp + 0xc0]
cmp rsi, 0x12
jbe 0x14004a570
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], r13
mov r15, r14
test al, al
jns 0x14004a483
mov r15, qword [r14]
add rsi, rsi
mov rbx, r15
neg rbx
lea r13, str.Application
jmp 0x14004a4ad
mov r12, qword [r14]
test eax, eax
je 0x14004a4d4
add r15, 0xfffffffffffffffe
add rbx, 2
cmp rbp, r12
je 0x14004a589
lea rbp, [r15 + rsi]
add rbp, 0xffffffffffffffe8
mov r8d, 0xc
mov rcx, rbp
mov rdx, r13
call fcn.140092188
movzx ecx, byte [r14 + 0x17]
mov r12, r14
test cl, cl
jns 0x14004a498
jmp 0x14004a495
lea rax, [r15 + rsi]
add rax, 0xffffffffffffffea
cmp rax, r12
je 0x14004a589
test cl, cl
jns 0x14004a4ed
mov rcx, qword [r14 + 8]
lea rax, [r15 + rsi]
add rax, 0xffffffffffffffe6
lea rcx, [r12 + rcx*2]
mov rdx, rsi
sub rdx, rcx
cmp rdx, rbx
mov r13, qword [rsp + 0x38]
je 0x14004a518
cmp word [r15 + rsi], 0x5c
mov rbp, qword [rsp + 0x30]
jne 0x14004a557
jmp 0x14004a51d
mov rbp, qword [rsp + 0x30]
lea rcx, [rax + 2]
cmp rcx, r12
je 0x14004a53a
lea rcx, [rax - 2]
cmp word [rax], 0x5c
mov rax, rcx
jne 0x14004a51d
add rcx, 4
mov r12, rcx
lea rdx, [0x1400fd6d0]
mov r8d, 7
mov rcx, r12
call fcn.140092188
test eax, eax
je 0x14004a995
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], 0
jmp 0x14004a5aa
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], 0
jmp 0x14004a5b2
xorps xmm0, xmm0
movaps xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], 0
mov r13, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
lea rbx, [rsp + 0xc0]
cmp byte [rsp + 0xd7], 0
js 0x14004a5c6
lea rcx, [rsp + 0xc0]
jmp 0x14004a5ce
mov rcx, qword [rsp + 0xc0]
lea rdx, [0x140104fec]
call fcn.1400a8078
cmp byte [rsp + 0xd7], 0
jns 0x14004a5f1
mov rcx, qword [rsp + 0xc0]
call fcn.1400914a4
lea r12, [rsp + 0xc0]
mov r8d, 0x208
mov rcx, r12
mov dl, 0xaa
call fcn.1400c39c0
mov word [r12], 0
lea rcx, str.PROGRAMFILES
mov rdx, r12
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x14004a664
mov r12d, eax
cmp word [rsp + r12*2 + 0xbe], 0x5c
je 0x14004ab74
cmp byte [r14 + 0x17], 0
mov rcx, r14
jns 0x14004a651
mov rcx, qword [r14]
mov rdx, rbx
mov r8, r12
call fcn.140092188
test eax, eax
je 0x14004aafe
lea rdx, [rsp + 0xc0]
mov word [rdx], 0
lea rcx, str.PROGRAMFILES_X86_
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x14004a6c2
mov r12d, eax
cmp word [rsp + r12*2 + 0xbe], 0x5c
je 0x14004ab82
cmp byte [r14 + 0x17], 0
mov rcx, r14
jns 0x14004a6af
mov rcx, qword [r14]
mov rdx, rbx
mov r8, r12
call fcn.140092188
test eax, eax
je 0x14004ab3b
lea rdx, [rsp + 0xc0]
mov word [rdx], 0
lea rcx, str.PROGRAMW6432
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x14004a720
mov r12d, eax
cmp word [rsp + r12*2 + 0xbe], 0x5c
je 0x14004ab90
cmp byte [r14 + 0x17], 0
mov rcx, r14
jns 0x14004a70d
mov rcx, qword [r14]
mov rdx, rbx
mov r8, r12
call fcn.140092188
test eax, eax
je 0x14004aac4
xor esi, esi
lea rax, [0x1400fd6e0]
mov qword [rdi + 0x80], rax
mov byte [rdi + 0xb8], sil
movabs rbx, 0xaaaaaaaaaaaaaaaa
lea r15, [rsp + 0xa0]
mov qword [r15 + 0x10], rbx
movaps xmm0, xmmword [0x1400f2c30]
movaps xmmword [r15], xmm0
lea rdx, [0x140104fec]
mov rcx, r15
call fcn.14004dd30
xor r12d, r12d
mov qword [rsp + 0x90], r12
xorps xmm6, xmm6
movaps xmmword [rsp + 0x80], xmm6
cmp byte [r15 + 0x17], 0
jns 0x14004a78c
mov r15, qword [rsp + 0xa0]
movzx eax, sil
mov ecx, 2
sub ecx, eax
lea r14, [rsp + 0x80]
mov qword [rsp + 0x20], r14
lea r9, str.channel
mov edx, 0x200
mov r8, r15
call fcn.1400226a0
mov qword [rsp + 0x70], r12
movaps xmmword [rsp + 0x60], xmm6
mov qword [rsp + 0x50], r12
movaps xmmword [rsp + 0x40], xmm6
mov qword [rsp + 0xd8], rbx
movaps xmmword [rsp + 0xc0], xmm6
movups xmmword [rsp + 0xcd], xmm6
cmp byte [rdi + 0x27], 0
js 0x14004aa5d
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], 0
movzx eax, byte [rdi + 0x27]
test al, al
jns 0x14004a80d
mov rbp, qword [rdi + 0x10]
mov rax, qword [rdi + 0x18]
mov qword [rdi + 0x88], rbp
mov qword [rdi + 0x90], rax
mov eax, dword [rsp + 0xd8]
mov dword [rdi + 0x98], eax
cmp eax, 1
jne 0x14004a875
lea rbx, [rdi + 0x28]
cmp byte [rdi + 0x3f], 0
movzx r8d, byte [rsp + 0x97]
js 0x14004aa9f
test r8b, r8b
jns 0x14004a979
mov rdx, qword [rsp + 0x80]
mov r8, qword [rsp + 0x88]
mov rcx, rbx
call fcn.14000d640
cmp byte [rdi + 0x3f], 0
jns 0x14004a86e
mov rbx, qword [rbx]
mov qword [rdi + 0xa0], rbx
mov al, byte [rsp + 0xdc]
mov byte [rdi + 0xb9], al
lea rbx, [rdi + 0x40]
cmp byte [rdi + 0x57], 0
js 0x14004aa75
mov rax, qword [rsp + 0x70]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [rsp + 0x60]
movups xmmword [rbx], xmm0
cmp byte [rdi + 0x57], 0
jns 0x14004a8aa
mov rbx, qword [rbx]
mov qword [rdi + 0xa8], rbx
mov rbx, rdi
add rbx, 0x58
cmp byte [rdi + 0x6f], 0
js 0x14004aa8a
mov rax, qword [rsp + 0x50]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [rsp + 0x40]
movups xmmword [rbx], xmm0
cmp byte [rdi + 0x6f], 0
jns 0x14004a8dc
mov rbx, qword [rbx]
mov qword [rdi + 0xb0], rbx
cmp byte [rsp + 0xd7], 0
jns 0x14004a8fa
mov rcx, qword [rsp + 0xc0]
call fcn.1400914a4
cmp byte [rsp + 0x57], 0
jns 0x14004a90b
mov rcx, qword [rsp + 0x40]
call fcn.1400914a4
cmp byte [rsp + 0x77], 0
jns 0x14004a91c
mov rcx, qword [rsp + 0x60]
call fcn.1400914a4
cmp byte [rsp + 0x97], 0
jns 0x14004a933
mov rcx, qword [rsp + 0x80]
call fcn.1400914a4
cmp byte [rsp + 0xb7], 0
jns 0x14004a94a
mov rcx, qword [rsp + 0xa0]
call fcn.1400914a4
mov rcx, qword [rsp + 0x2c8]
xor rcx, rsp
call fcn.1400935c0
mov rax, r13
movaps xmm6, xmmword [rsp + 0x2d0]
add rsp, 0x2e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x90]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [rsp + 0x80]
movups xmmword [rbx], xmm0
jmp 0x14004a865
movabs rbp, 0x7ffffffffffffff7
sub rsi, r12
mov r15, rsi
sub r15, rbx
add r15, 0xffffffffffffffe8
sar r15, 1
lea r13, [r15 - 7]
cmp r13, rbp
ja 0x14004ab9e
cmp r13, 0xb
jae 0x14004a9e5
add rsi, 0xffffffffffffffda
mov byte [rsp + 0xd7], r13b
lea rax, [rsp + 0xc0]
cmp rsi, rbx
mov rbx, rax
mov rbp, qword [rsp + 0x30]
jne 0x14004aa36
jmp 0x14004aa4b
mov rax, r13
or rax, 3
lea rsi, [rbp + 5]
and rsi, r13
add rsi, 4
cmp rax, 0xb
cmovne rsi, rax
lea rcx, [rsi*2 + 2]
inc rsi
call fcn.1400914ac
mov rbx, rax
mov qword [rsp + 0xc0], rax
add rbp, 9
or rbp, rsi
mov qword [rsp + 0xd0], rbp
mov qword [rsp + 0xc8], r13
mov rbp, qword [rsp + 0x30]
add r12, 0xe
add r13, r13
mov rcx, rbx
mov rdx, r12
mov r8, r13
call fcn.1400c3320
mov word [rbx + r15*2 - 0xe], 0
mov r13, qword [rsp + 0x38]
jmp 0x14004a5aa
lea rdx, [rsp + 0xc0]
mov rcx, rbp
xor r8d, r8d
call fcn.14000d700
jmp 0x14004a7fd
lea rdx, [rsp + 0x60]
mov rcx, rbx
xor r8d, r8d
call fcn.14000d700
jmp 0x14004a8a1
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call fcn.14000d700
jmp 0x14004a8d3
test r8b, r8b
cmovs r8, qword [rsp + 0x88]
cmovs r14, qword [rsp + 0x80]
mov rcx, rbx
mov rdx, r14
call fcn.14000d700
jmp 0x14004a865
movzx eax, byte [r14 + 0x17]
mov rcx, rax
test al, al
jns 0x14004aad4
mov rcx, qword [r14 + 8]
mov sil, 1
cmp rcx, r12
je 0x14004a722
jb 0x14004aba1
test al, al
jns 0x14004aaed
mov r14, qword [r14]
cmp word [r14 + r12*2], 0x5c
jne 0x14004a720
jmp 0x14004a722
movzx eax, byte [r14 + 0x17]
mov rcx, rax
test al, al
jns 0x14004ab0e
mov rcx, qword [r14 + 8]
mov sil, 1
cmp rcx, r12
je 0x14004a722
jb 0x14004aba1
mov rcx, r14
test al, al
jns 0x14004ab2a
mov rcx, qword [r14]
cmp word [rcx + r12*2], 0x5c
jne 0x14004a664
jmp 0x14004a722
movzx eax, byte [r14 + 0x17]
mov rcx, rax
test al, al
jns 0x14004ab4b
mov rcx, qword [r14 + 8]
mov sil, 1
cmp rcx, r12
je 0x14004a722
jb 0x14004aba1
mov rcx, r14
test al, al
jns 0x14004ab63
mov rcx, qword [r14]
cmp word [rcx + r12*2], 0x5c
jne 0x14004a6c2
jmp 0x14004a722
dec r12
jne 0x14004a634
jmp 0x14004a664
dec r12
jne 0x14004a692
jmp 0x14004a6c2
dec r12
jne 0x14004a6f0
jmp 0x14004a720
int3
int3