Function at 0x14006b438
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov r12, rcx
lea rbx, [0x140132120]
mov edi, r9d
mov rcx, rbx
mov r14, r8
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov bpl, byte [r12 + 0xd]
xor r13d, r13d
cmp edi, r13d
setl al
and bpl, 0x11
mov byte [rsp + 0xf8], al
cmp al, r13b
jne 0x14006b494
test dil, 0x40
je 0x14006b497
mov bpl, r13b
mov eax, 0x26
mov rdi, rsi
cmp ax, word [rsi]
jne 0x14006b4ad
add rdi, 2
cmp ax, word [rdi]
je 0x14006b4a4
lea rdx, str.RANDOM
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
cmp eax, r13d
jne 0x14006b4d8
call fcn.14005bbd8
movabs rcx, 0x7fffffffffffffff
and rax, rcx
xor edi, edi
jmp 0x14006b4f6
lea rdx, str.__THIS
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor edi, edi
cmp eax, edi
jne 0x14006b55d
lea rax, [r12 + 0x75bd036]
lea rcx, [rsp + 0x20]
mov rdx, rax
mov word [rsp + 0x20], di
call fcn.1400dcf94
lea rcx, [rsp + 0x20]
mov word [rsp + 0x9a], di
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
cmp eax, 1
cmovl esi, edi
lea ecx, [rsi + 2]
movsxd rdx, ecx
mov rcx, r14
call fcn.140061610
sub esi, 1
mov r12, qword [r14]
mov rdi, r12
js 0x14006b6c2
lea rcx, [rsp + 0x20]
sub rcx, r12
movzx eax, word [rcx + rdi]
mov word [rdi], ax
add rdi, 2
sub esi, 1
jns 0x14006b548
jmp 0x14006b6c2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsx r15d, bpl
cmp byte [rsp + 0xf8], dil
jne 0x14006b58b
mov eax, 0x26
cmp word [rsi], ax
je 0x14006b668
cmp bpl, dil
jne 0x14006b63f
mov edx, 0x52
mov rcx, r14
call fcn.140061610
mov r12, qword [r14]
xor eax, eax
xor ecx, ecx
mov word [r12], ax
mov rdi, r12
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdx, qword [r14]
mov r8d, 0x50
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebp, eax
xor eax, eax
cmp ebp, eax
jle 0x14006b60d
cmp word [r12], ax
jne 0x14006b605
lea ecx, [rbp + 0xc]
movsxd rdx, ecx
mov rcx, r14
call fcn.140061610
mov r12, qword [r14]
xor eax, eax
xor ecx, ecx
mov word [r12], ax
mov rdi, r12
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rdx, qword [r14]
lea r8d, [rbp + 0xa]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ebp, eax
xor eax, eax
cmp ebp, eax
jg 0x14006b6bb
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
jne 0x14006b6b5
xor eax, eax
cmp r13b, al
jne 0x14006b6b1
mov r13b, 1
cmp byte [rsp + 0xf8], al
jne 0x14006b6b1
mov r12, qword [rsp + 0xe0]
xor edi, edi
or r9d, 0xffffffff
xor r8d, r8d
mov rdx, rsi
mov rcx, r12
call fcn.14001ddc4
cmp rax, rdi
jne 0x14006b678
cmp r15d, edi
jne 0x14006b674
cmp r13b, dil
jne 0x14006b674
mov r13b, 1
jmp 0x14006b58b
add rsi, 2
mov r15d, 1
jmp 0x14006b63f
mov ebp, edi
jmp 0x14006b686
mov rsi, qword [rax]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, eax
lea ecx, [rbp + 2]
movsxd rdx, ecx
mov rcx, r14
call fcn.140061610
mov r12, qword [r14]
mov rdi, r12
jmp 0x14006b6aa
movzx ecx, word [rsi]
mov word [rdi], cx
add rdi, 2
add rsi, 2
sub ebp, 1
jns 0x14006b69c
jmp 0x14006b6c2
mov ebp, eax
jmp 0x14006b6b7
xor eax, eax
cmp ebp, eax
jle 0x14006b6c2
movsxd rcx, ebp
lea rdi, [r12 + rcx*2]
xor eax, eax
mov word [rdi], ax
cmp rbx, rax
je 0x14006b6d5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, r12
mov rbx, qword [rsp + 0xe8]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret