Function at 0x1400bf8d0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r12
push r13
push r14
push r15
mov eax, 0x50
call fcn.1400b21a0
sub rsp, rax
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rdi
mov rax, qword [0x14021f0c0]
xor rax, rbp
mov qword [rbp + 8], rax
xor ebx, ebx
lea r14, str.RANDFILE
mov r12, rdx
mov r15, rcx
xor r8d, r8d
xor edx, edx
mov rcx, r14
mov edi, ebx
lea r13d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x1400bf987
lea r14, str.HOME
xor r8d, r8d
mov rcx, r14
xor edx, edx
mov r13d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x1400bf987
lea r14, str.USERPROFILE
xor r8d, r8d
mov rcx, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x1400bf987
lea r14, str.SYSTEMROOT
xor r8d, r8d
mov rcx, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
je 0x1400bfa5e
mov eax, esi
movabs rdx, 0xffffffffffffff0
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400bf9a2
mov rcx, rdx
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400b21a0
sub rsp, rcx
mov r8d, esi
mov rcx, r14
lea rax, [rsp + 0x40]
mov rdx, rax
mov qword [rbp], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, esi
jae 0x1400bfa54
mov rsi, qword [rbp]
or r9d, 0xffffffff
mov qword [rsp + 0x38], rbx
mov r8, rsi
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdx, eax
test eax, eax
je 0x1400bfa54
lea rax, [rdx + 0xf]
cmp rax, rdx
ja 0x1400bfa16
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1400b21a0
sub rsp, rax
or r9d, 0xffffffff
mov r8, rsi
mov ecx, 0xfde9
mov qword [rsp + 0x38], rbx
lea rdi, [rsp + 0x40]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], edx
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rdi, rbx
test r13d, r13d
jne 0x1400bfa67
test rdi, rdi
jne 0x1400bfa70
lea rdi, [0x1401b2968]
jmp 0x1400bfa78
test rdi, rdi
je 0x1400bfb19
cmp byte [rdi], bl
je 0x1400bfb19
mov eax, ebx
mov rcx, rdi
cmp byte [rdi], al
je 0x1400bfa91
cmp eax, 0x80000000
jae 0x1400bfa91
inc rcx
inc eax
cmp byte [rcx], bl
jne 0x1400bfa81
mov edx, eax
btr edx, 0x1f
test r13d, r13d
je 0x1400bfabc
lea rax, [rdx + 1]
cmp rax, r12
jae 0x1400bfabc
mov r8, r12
mov rdx, rdi
mov rcx, r15
call fcn.1400c8570
cmp rax, r12
jb 0x1400bfb1c
xor eax, eax
jmp 0x1400bfb26
lea rcx, str..rnd
mov eax, ebx
cmp eax, 0x80000000
jae 0x1400bfad5
inc rcx
inc eax
cmp byte [rcx], bl
jne 0x1400bfac5
btr eax, 0x1f
add rax, 2
add rax, rdx
cmp rax, r12
jae 0x1400bfb1c
mov r8, r12
mov rdx, rdi
mov rcx, r15
call fcn.1400c8570
mov r8, r12
lea rdx, [0x1401a7f1c]
mov rcx, r15
call fcn.1400c84f0
mov r8, r12
lea rdx, str..rnd
mov rcx, r15
call fcn.1400c84f0
jmp 0x1400bfb1c
mov byte [r15], bl
cmp byte [r15], bl
cmovne rbx, r15
mov rax, rbx
mov rcx, qword [rbp + 8]
xor rcx, rbp
call fcn.1400b1b60
mov rbx, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x50]
lea rsp, [rbp + 0x10]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret