Function at 0x7ff6f9cd4270
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x498
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x410], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x60]
mov r8d, 0xe
call fcn.7ff6f9cd1600
mov rax, qword [rbp - 0x60]
mov qword [rbp + 0x400], rax
test rax, rax
je 0x7ff6f9cd43f4
mov qword [rbp + 0x3f8], rsi
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x3e8], rax
mov qword [rbp + 0x3d0], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d8], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x408], rax
xor r13d, r13d
xor r12d, r12d
xor ebx, ebx
cmp r8, 0x201
jae 0x7ff6f9cd4330
jmp 0x7ff6f9cd431f
jae 0x7ff6f9cd446f
cmp r8, 0x201
jae 0x7ff6f9cd4330
mov r14d, 0x200
lea rdi, [rbp - 0x60]
mov rsi, r8
jmp 0x7ff6f9cd4387
sub r8, rbx
sub r12, rbx
cmp r12, r8
jae 0x7ff6f9cd435f
lea rcx, [rbp + 0x3d0]
mov rdx, rbx
call fcn.7ff6f9cf09e0
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x408], rax
mov r13, qword [rbp + 0x3d8]
mov eax, 0xffffffff
cmp r13, rax
mov ebx, 0xffffffff
cmovb rbx, r13
mov qword [rbp + 0x3e0], rbx
mov r12, r13
mov r14, rbx
mov rdi, qword [rbp + 0x408]
mov rsi, rbx
xor ecx, ecx
call qword [sym.imp.kernel32.dll_SetLastError]
mov rcx, qword [rbp + 0x400]
mov rdx, rdi
mov r8d, esi
call qword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov r15d, eax
test eax, eax
jne 0x7ff6f9cd43b6
call sub.kernel32.dll_GetLastError
test eax, eax
jne 0x7ff6f9cd45b9
mov r8d, r15d
cmp rsi, r8
jne 0x7ff6f9cd4310
call sub.kernel32.dll_GetLastError
cmp eax, 0x7a
jne 0x7ff6f9cd45d8
add rsi, rsi
mov eax, 0xffffffff
cmp rsi, rax
cmovae rsi, rax
mov r8, rsi
cmp r8, 0x201
jb 0x7ff6f9cd431f
jmp 0x7ff6f9cd4330
mov rdx, qword [rbp - 0x58]
mov eax, edx
and eax, 3
cmp eax, 1
jne 0x7ff6f9cd4466
lea rax, [rdx - 1]
mov qword [rbp + 0x400], rax
mov rcx, qword [rdx - 1]
mov qword [rbp + 0x408], rdx
mov rax, qword [rdx + 7]
call qword [rax]
mov rax, qword [rbp + 0x408]
mov rax, qword [rax + 7]
cmp qword [rax + 8], 0
mov rdi, qword [rbp + 0x400]
je 0x7ff6f9cd4454
mov r8, qword [rdi]
cmp qword [rax + 0x10], 0x11
jb 0x7ff6f9cd4445
mov r8, qword [r8 - 8]
mov rcx, qword [0x7ff6f9d20580]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x7ff6f9d20580]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
mov byte [rsi + 0x18], 2
jmp 0x7ff6f9cd45a4
cmp r14, r8
jb 0x7ff6f9cd45f2
lea rcx, [rbp + 0x3b0]
mov rdx, rdi
call fcn.7ff6f9cd2e50
mov rsi, qword [rbp + 0x3b0]
movups xmm0, xmmword [rbp + 0x3b8]
movaps xmmword [rbp + 0x3a0], xmm0
movzx ebx, byte [rbp + 0x3c8]
mov eax, dword [rbp + 0x3c9]
mov dword [rbp + 0x3f0], eax
mov eax, dword [rbp + 0x3cc]
mov dword [rbp + 0x3f3], eax
test r13, r13
je 0x7ff6f9cd44d6
mov rcx, qword [0x7ff6f9d20580]
xor edx, edx
mov r8, qword [rbp + 0x408]
call qword [sym.imp.kernel32.dll_HeapFree]
cmp bl, 2
jne 0x7ff6f9cd455a
mov rax, qword [rbp + 0x3f8]
mov byte [rax + 0x18], 2
mov eax, esi
and eax, 3
cmp eax, 1
jne 0x7ff6f9cd4584
lea rax, [rsi - 1]
mov qword [rbp + 0x408], rax
mov rcx, qword [rsi - 1]
mov rax, qword [rsi + 7]
mov qword [rbp + 0x3f8], rsi
call qword [rax]
mov rax, qword [rbp + 0x3f8]
mov rax, qword [rax + 7]
cmp qword [rax + 8], 0
mov rsi, qword [rbp + 0x408]
je 0x7ff6f9cd4546
mov r8, qword [rsi]
cmp qword [rax + 0x10], 0x11
jb 0x7ff6f9cd4537
mov r8, qword [r8 - 8]
mov rcx, qword [0x7ff6f9d20580]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [0x7ff6f9d20580]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x7ff6f9cd4584
movaps xmm0, xmmword [rbp + 0x3a0]
mov rdx, qword [rbp + 0x3f8]
movups xmmword [rdx + 8], xmm0
mov eax, dword [rbp + 0x3f0]
mov ecx, dword [rbp + 0x3f3]
mov dword [rdx + 0x19], eax
mov dword [rdx + 0x1c], ecx
mov qword [rdx], rsi
mov byte [rdx + 0x18], bl
cmp qword [rbp + 0x3e8], 0
je 0x7ff6f9cd45a4
mov rcx, qword [0x7ff6f9d20580]
xor edx, edx
mov r8, qword [rbp + 0x400]
call qword [sym.imp.kernel32.dll_HeapFree]
nop
add rsp, 0x498
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call sub.kernel32.dll_GetLastError
mov esi, eax
shl rsi, 0x20
or rsi, 2
mov bl, 2
test r13, r13
jne 0x7ff6f9cd44c0
jmp 0x7ff6f9cd44d6
lea rcx, [0x7ff6f9d1669c]
lea r8, [0x7ff6f9d15a88]
mov edx, 0x28
call fcn.7ff6f9cee040
jmp 0x7ff6f9cd4607
lea rax, [0x7ff6f9d15aa0]
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.7ff6f9cee030
ud2