Function at 0x140048a70
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2d8
vmovaps xmmword [rsp + 0x2c0], xmm6
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140113040]
xor rax, rsp
mov qword [rsp + 0x2b8], rax
mov ecx, 0xc0
call fcn.1400910bc
mov rdi, rax
add rax, 0x70
mov qword [rdi + 8], rax
lea rax, [0x1400f3820]
mov qword [rdi], rax
vxorps xmm0, xmm0, xmm0
vmovups ymmword [rdi + 0x70], ymm0
vmovups ymmword [rdi + 0x10], ymm0
vmovups ymmword [rdi + 0x30], ymm0
vmovups ymmword [rdi + 0x50], ymm0
vmovups ymmword [rdi + 0x90], ymm0
vmovups ymmword [rdi + 0xa0], ymm0
mov qword [rdi + 0x70], 0x50
lea rax, [0x1400fc5b0]
mov qword [rdi + 0x78], rax
mov qword [rsp + 0x28], rsi
mov qword [rsi], rdi
movzx eax, byte [rbx + 0x17]
mov rbp, rax
test al, al
jns 0x140048b15
mov rbp, qword [rbx + 8]
lea r14, [rsp + 0xb0]
cmp rbp, 0x12
jbe 0x140048c14
mov rsi, rbx
test al, al
jns 0x140048b31
mov rsi, qword [rbx]
add rbp, rbp
mov r14, rsi
neg r14
lea r12, str.Application
jmp 0x140048b5b
mov r15, qword [rbx]
test eax, eax
je 0x140048b84
add rsi, 0xfffffffffffffffe
add r14, 2
cmp r13, r15
je 0x140048bf1
lea r13, [rsi + rbp]
add r13, 0xffffffffffffffe8
mov r8d, 0xc
mov rcx, r13
mov rdx, r12
vzeroupper
call fcn.140091d98
movzx ecx, byte [rbx + 0x17]
mov r15, rbx
test cl, cl
jns 0x140048b46
jmp 0x140048b43
lea rax, [rsi + rbp]
add rax, 0xffffffffffffffea
cmp rax, r15
je 0x140048bf1
test cl, cl
jns 0x140048b99
mov rcx, qword [rbx + 8]
lea rax, [rsi + rbp]
add rax, 0xffffffffffffffe6
lea rcx, [r15 + rcx*2]
mov rdx, rbp
sub rdx, rcx
cmp rdx, r14
je 0x140048bb7
cmp word [rsi + rbp], 0x5c
jne 0x140048bf1
lea rcx, [rax + 2]
cmp rcx, r15
je 0x140048bd4
lea rcx, [rax - 2]
cmp word [rax], 0x5c
mov rax, rcx
jne 0x140048bb7
add rcx, 4
mov r15, rcx
lea rdx, [0x1400fd280]
mov r8d, 7
mov rcx, r15
call fcn.140091d98
test eax, eax
je 0x140049016
vxorps xmm0, xmm0, xmm0
vmovaps xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], 0
lea r14, [rsp + 0xb0]
jmp 0x140048c2d
vxorps xmm0, xmm0, xmm0
vmovaps xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], 0
cmp byte [rsp + 0xc7], 0
js 0x140048c41
lea rcx, [rsp + 0xb0]
jmp 0x140048c49
mov rcx, qword [rsp + 0xb0]
lea rdx, [0x140104b6c]
vzeroupper
call fcn.1400a7b68
cmp byte [rsp + 0xc7], 0
jns 0x140048c6f
mov rcx, qword [rsp + 0xb0]
call fcn.1400910b4
lea r15, [rsp + 0xb0]
mov r8d, 0x208
mov rcx, r15
mov dl, 0xaa
call fcn.1400c3300
mov word [r15], 0
lea rcx, str.PROGRAMFILES
mov rdx, r15
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140048ce0
mov r15d, eax
cmp word [rsp + r15*2 + 0xae], 0x5c
je 0x1400491da
cmp byte [rbx + 0x17], 0
mov rcx, rbx
jns 0x140048ccd
mov rcx, qword [rbx]
mov rdx, r14
mov r8, r15
call fcn.140091d98
test eax, eax
je 0x140049166
lea rdx, [rsp + 0xb0]
mov word [rdx], 0
lea rcx, str.PROGRAMFILES_X86_
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140048d3d
mov r15d, eax
cmp word [rsp + r15*2 + 0xae], 0x5c
je 0x1400491e8
cmp byte [rbx + 0x17], 0
mov rcx, rbx
jns 0x140048d2a
mov rcx, qword [rbx]
mov rdx, r14
mov r8, r15
call fcn.140091d98
test eax, eax
je 0x1400491a2
lea rdx, [rsp + 0xb0]
mov word [rdx], 0
lea rcx, str.PROGRAMW6432
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rax - 1]
cmp ecx, 0x102
ja 0x140048d9a
mov r15d, eax
cmp word [rsp + r15*2 + 0xae], 0x5c
je 0x1400491f6
cmp byte [rbx + 0x17], 0
mov rcx, rbx
jns 0x140048d87
mov rcx, qword [rbx]
mov rdx, r14
mov r8, r15
call fcn.140091d98
test eax, eax
je 0x14004912d
xor esi, esi
lea rax, [0x1400fd290]
mov qword [rdi + 0x80], rax
mov byte [rdi + 0xb8], sil
movabs r12, 0xaaaaaaaaaaaaaaaa
lea r15, [rsp + 0x90]
mov qword [r15 + 0x10], r12
vbroadcastss xmm0, dword [0x1400f27f0]
vmovaps xmmword [r15], xmm0
lea rdx, [0x140104b6c]
mov rcx, r15
call fcn.14004c320
xor r13d, r13d
mov qword [rsp + 0x80], r13
vxorps xmm6, xmm6, xmm6
vmovaps xmmword [rsp + 0x70], xmm6
cmp byte [r15 + 0x17], 0
jns 0x140048e08
mov r15, qword [rsp + 0x90]
lea r14, [rdi + 0x10]
movzx eax, sil
mov ecx, 2
sub ecx, eax
lea rbx, [rsp + 0x70]
mov qword [rsp + 0x20], rbx
lea r9, str.channel
mov edx, 0x200
mov r8, r15
call fcn.140022500
mov qword [rsp + 0x60], r13
vmovaps xmmword [rsp + 0x50], xmm6
mov qword [rsp + 0x40], r13
vmovaps xmmword [rsp + 0x30], xmm6
mov qword [rsp + 0xc8], r12
vmovaps xmmword [rsp + 0xb0], xmm6
vmovups xmmword [rsp + 0xbd], xmm6
cmp byte [rdi + 0x27], 0
js 0x1400490cc
vxorps xmm0, xmm0, xmm0
vmovups xmmword [r14], xmm0
mov qword [r14 + 0x10], 0
movzx eax, byte [rdi + 0x27]
test al, al
jns 0x140048e90
mov r14, qword [rdi + 0x10]
mov rax, qword [rdi + 0x18]
mov qword [rdi + 0x88], r14
mov qword [rdi + 0x90], rax
mov eax, dword [rsp + 0xc8]
mov dword [rdi + 0x98], eax
cmp eax, 1
jne 0x140048ef2
lea r14, [rdi + 0x28]
cmp byte [rdi + 0x3f], 0
movzx r8d, byte [rsp + 0x87]
js 0x14004910e
test r8b, r8b
jns 0x140048ffa
mov rdx, qword [rsp + 0x70]
mov r8, qword [rsp + 0x78]
mov rcx, r14
call fcn.14000d5f0
cmp byte [rdi + 0x3f], 0
jns 0x140048eeb
mov r14, qword [r14]
mov qword [rdi + 0xa0], r14
mov al, byte [rsp + 0xcc]
mov byte [rdi + 0xb9], al
lea rbx, [rdi + 0x40]
cmp byte [rdi + 0x57], 0
js 0x1400490e4
mov rax, qword [rsp + 0x60]
mov qword [rbx + 0x10], rax
vmovaps xmm0, xmmword [rsp + 0x50]
vmovups xmmword [rbx], xmm0
cmp byte [rdi + 0x57], 0
jns 0x140048f29
mov rbx, qword [rbx]
mov qword [rdi + 0xa8], rbx
mov rbx, rdi
add rbx, 0x58
cmp byte [rdi + 0x6f], 0
js 0x1400490f9
mov rax, qword [rsp + 0x40]
mov qword [rbx + 0x10], rax
vmovaps xmm0, xmmword [rsp + 0x30]
vmovups xmmword [rbx], xmm0
cmp byte [rdi + 0x6f], 0
jns 0x140048f5d
mov rbx, qword [rbx]
mov qword [rdi + 0xb0], rbx
cmp byte [rsp + 0xc7], 0
jns 0x140048f7b
mov rcx, qword [rsp + 0xb0]
call fcn.1400910b4
cmp byte [rsp + 0x47], 0
jns 0x140048f8c
mov rcx, qword [rsp + 0x30]
call fcn.1400910b4
cmp byte [rsp + 0x67], 0
jns 0x140048f9d
mov rcx, qword [rsp + 0x50]
call fcn.1400910b4
cmp byte [rsp + 0x87], 0
jns 0x140048fb1
mov rcx, qword [rsp + 0x70]
call fcn.1400910b4
cmp byte [rsp + 0xa7], 0
jns 0x140048fc8
mov rcx, qword [rsp + 0x90]
call fcn.1400910b4
mov rcx, qword [rsp + 0x2b8]
xor rcx, rsp
call fcn.1400931d0
mov rax, qword [rsp + 0x28]
vmovaps xmm6, xmmword [rsp + 0x2c0]
add rsp, 0x2d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0x80]
mov qword [r14 + 0x10], rax
vmovaps xmm0, xmmword [rsp + 0x70]
vmovups xmmword [r14], xmm0
jmp 0x140048ee2
movabs r13, 0x7ffffffffffffff7
sub rbp, r15
mov rsi, rbp
sub rsi, r14
add rsi, 0xffffffffffffffe8
sar rsi, 1
lea r12, [rsi - 7]
cmp r12, r13
ja 0x140049204
cmp r12, 0xb
jae 0x14004905e
add rbp, 0xffffffffffffffda
mov byte [rsp + 0xc7], r12b
lea r13, [rsp + 0xb0]
cmp rbp, r14
jne 0x1400490aa
jmp 0x1400490bf
mov rax, r12
or rax, 3
lea r14, [r13 + 5]
and r14, r12
add r14, 4
cmp rax, 0xb
cmovne r14, rax
lea rcx, [r14*2 + 2]
inc r14
call fcn.1400910bc
mov qword [rsp + 0xb0], rax
add r13, 9
or r13, r14
mov qword [rsp + 0xc0], r13
mov r13, rax
mov qword [rsp + 0xb8], r12
add r15, 0xe
add r12, r12
mov rcx, r13
mov rdx, r15
mov r8, r12
call fcn.1400c2c60
mov word [r13 + rsi*2 - 0xe], 0
jmp 0x140048c0a
lea rdx, [rsp + 0xb0]
mov rcx, r14
xor r8d, r8d
call fcn.14000d6b0
jmp 0x140048e80
lea rdx, [rsp + 0x50]
mov rcx, rbx
xor r8d, r8d
call fcn.14000d6b0
jmp 0x140048f20
lea rdx, [rsp + 0x30]
mov rcx, rbx
xor r8d, r8d
call fcn.14000d6b0
jmp 0x140048f54
test r8b, r8b
cmovs r8, qword [rsp + 0x78]
cmovs rbx, qword [rsp + 0x70]
mov rcx, r14
mov rdx, rbx
call fcn.14000d6b0
jmp 0x140048ee2
movzx eax, byte [rbx + 0x17]
mov rcx, rax
test al, al
jns 0x14004913c
mov rcx, qword [rbx + 8]
mov sil, 1
cmp rcx, r15
je 0x140048d9c
jb 0x140049207
test al, al
jns 0x140049155
mov rbx, qword [rbx]
cmp word [rbx + r15*2], 0x5c
jne 0x140048d9a
jmp 0x140048d9c
movzx eax, byte [rbx + 0x17]
mov rcx, rax
test al, al
jns 0x140049175
mov rcx, qword [rbx + 8]
mov sil, 1
cmp rcx, r15
je 0x140048d9c
jb 0x140049207
mov rcx, rbx
test al, al
jns 0x140049191
mov rcx, qword [rbx]
cmp word [rcx + r15*2], 0x5c
jne 0x140048ce0
jmp 0x140048d9c
movzx eax, byte [rbx + 0x17]
mov rcx, rax
test al, al
jns 0x1400491b1
mov rcx, qword [rbx + 8]
mov sil, 1
cmp rcx, r15
je 0x140048d9c
jb 0x140049207
mov rcx, rbx
test al, al
jns 0x1400491c9
mov rcx, qword [rbx]
cmp word [rcx + r15*2], 0x5c
jne 0x140048d3d
jmp 0x140048d9c
dec r15
jne 0x140048cb1
jmp 0x140048ce0
dec r15
jne 0x140048d0e
jmp 0x140048d3d
dec r15
jne 0x140048d6b
jmp 0x140048d9a
int3
int3