Function at 0x140001330
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2a0
movaps xmmword [rsp + 0x290], xmm6
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [0x140007058]
test rcx, rcx
je 0x140001691
lea rdx, str.FDICreate
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rbx
mov qword [0x140007040], rax
mov rcx, qword [0x140007058]
lea rdx, str.FDIDestroy
call rbx
mov qword [0x140007050], rax
mov rcx, qword [0x140007058]
lea rdx, str.FDICopy
call rbx
mov rcx, rax
mov qword [0x140007048], rax
xor eax, eax
cmp qword [0x140007040], 0
je 0x140001664
cmp qword [0x140007050], 0
je 0x140001664
test rcx, rcx
je 0x140001664
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cdqe
lea r14, [rdi + rax*2]
test eax, eax
jle 0x1400013f1
cmp word [r14], 0x5c
je 0x1400013f1
add r14, 0xfffffffffffffffe
cmp r14, rdi
ja 0x1400013e1
cmp r14, rdi
je 0x140001624
add r14, 2
xorps xmm6, xmm6
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor ebx, ebx
mov ecx, 0xfde9
xor edx, edx
mov r8, r14
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x140001480
mov ebp, eax
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor ebx, ebx
mov rcx, rax
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140001480
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, r14
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rbx, r15
sub r14, rdi
shr r14, 1
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, rdi
mov r9d, r14d
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x140001642
mov r12d, eax
xor eax, eax
cmp r14d, 0xffffffff
setne al
add r12d, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140001642
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rdi
mov r9d, r14d
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp r14d, 0xffffffff
je 0x14000151a
movsxd rax, r12d
mov byte [rax + r15 - 1], 0
test rbx, rbx
je 0x140001628
lea rcx, [rsp + 0x50]
mov dword [rcx + 8], 0
mov qword [rcx], 0
mov rax, qword [0x140007040]
mov qword [rsp + 0x40], rcx
lea rcx, [0x1400017b0]
mov qword [rsp + 0x30], rcx
lea rcx, [0x1400017c0]
mov qword [rsp + 0x28], rcx
lea rcx, [0x1400017e0]
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x38], 0xffffffff
lea rcx, [0x1400019c0]
lea rdx, [0x140001990]
lea r8, [0x140001860]
lea r9, [0x140001820]
call qword [0x140009008]
test rax, rax
je 0x140001628
mov r14, rax
lea rdi, [rsp + 0x68]
mov qword [rdi - 8], rsi
mov rcx, rdi
call fcn.140001d90
mov byte [rdi + 0x218], 0
mov rax, qword [0x140007048]
lea rsi, [rsp + 0x60]
mov qword [rsp + 0x30], rsi
lea rcx, [0x1400019f0]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], 0
mov rcx, r14
mov rdx, rbx
mov r8, r15
xor r9d, r9d
call qword [0x140009008]
mov rax, qword [0x140007050]
mov rcx, r14
call qword [0x140009008]
cmp byte [rsi + 0x220], 0
setne sil
mov rcx, rdi
je 0x14000167e
call fcn.140001f60
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rdi
call fcn.140001db0
jmp 0x14000162a
xor eax, eax
jmp 0x140001664
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
jmp 0x140001649
xor esi, esi
mov eax, 0
test rbx, rbx
je 0x140001664
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
movaps xmm6, xmmword [rsp + 0x290]
add rsp, 0x2a0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
call fcn.140001e90
test al, al
je 0x14000161a
mov rcx, rdi
call fcn.140001ea0
jmp 0x14000161a
lea rbx, [rsp + 0x60]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call fcn.140001030
lea rcx, str._WINDIR__system32cabinet.dll
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x104
jb 0x1400016ce
mov rcx, qword [0x140007058]
jmp 0x1400016eb
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
mov qword [0x140007058], rax
test rcx, rcx
jne 0x14000135f
lea rdx, [rsp + 0x60]
mov word [rdx], 0
lea rcx, str._SYSTEMROOT__system32cabinet.dll
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x104
jb 0x140001723
mov rcx, qword [0x140007058]
jmp 0x140001740
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
mov qword [0x140007058], rax
test rcx, rcx
jne 0x14000135f
lea rdx, [rsp + 0x60]
mov word [rdx], 0
lea rcx, str.C:Windows_system32cabinet.dll
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x104
jb 0x140001778
mov rcx, qword [0x140007058]
jmp 0x140001795
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
mov qword [0x140007058], rax
test rcx, rcx
jne 0x14000135f
mov rcx, qword [0x140007048]
jmp 0x1400013a7