Function at 0x1400cf5d8
Capabilities:
Create thread
Query environment variable

Disassembly:
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x3060
call fcn.1400fe810
sub rsp, rax
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rsp + 0x3090], rbx
mov qword [rsp + 0x30a0], rbp
mov qword [rsp + 0x30a8], rsi
mov rax, qword [0x140132350]
xor rax, rsp
mov qword [rsp + 0x3050], rax
mov bpl, r8b
mov r12, rdx
mov r14d, 0x800
xor r13d, r13d
cmp r9, r13
jne 0x1400cf68c
mov dword [rsp + 0x20], r14d
lea r9, [0x1401096a0]
lea r8, [rsp + 0x50]
lea rdx, str.ExternalViewer
lea rcx, [0x14010f370]
call fcn.14009b844
mov r8d, r14d
lea rdx, [rsp + 0x2050]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp eax, r13d
jbe 0x1400cf6a7
mov r8, r14
lea rdx, [rsp + 0x2050]
lea rcx, [rsp + 0x50]
call fcn.140065d2c
jmp 0x1400cf6a7
lea rcx, [rsp + 0x50]
sub rcx, r9
movzx eax, word [r9]
mov word [rcx + r9], ax
add r9, 2
cmp ax, r13w
jne 0x1400cf694
cmp word [rsp + 0x50], r13w
jne 0x1400cf6b6
xor al, al
jmp 0x1400cf889
mov r8, r14
mov rdx, r12
lea rcx, [rsp + 0x1050]
call fcn.140065d2c
mov rdx, r14
lea rcx, [rsp + 0x1050]
call fcn.1400a3e94
lea rcx, [rsp + 0x50]
call fcn.140042584
cmp al, r13b
jne 0x1400cf7dd
mov r15d, 0x22
cmp word [rsp + 0x50], r15w
jne 0x1400cf709
mov edx, r15d
lea rcx, [rsp + 0x52]
call fcn.1400ed378
jmp 0x1400cf70e
lea rax, [rsp + 0x50]
cmp rax, r13
je 0x1400cf7dd
lea rdx, [0x1401174f0]
mov rcx, rax
call fcn.1400edbf4
mov rdi, rax
cmp rax, r13
je 0x1400cf7dd
mov rbx, rax
movzx ecx, word [rax]
call fcn.140065a14
cmp al, r13b
je 0x1400cf753
add rbx, 2
movzx ecx, word [rbx]
call fcn.140065a14
cmp al, r13b
jne 0x1400cf742
mov r8, r14
mov rdx, rbx
lea rcx, [rsp + 0x2050]
call fcn.140065d2c
mov r8, r14
lea rdx, [0x14011013c]
lea rcx, [rsp + 0x2050]
call fcn.140065dac
mov r8, r14
lea rdx, [rsp + 0x1050]
lea rcx, [rsp + 0x2050]
call fcn.140065dac
movzx esi, word [rdi]
mov word [rdi], r13w
cmp word [rsp + 0x50], r15w
je 0x1400cf7c5
lea rcx, [rsp + 0x50]
call fcn.140042584
cmp al, r13b
jne 0x1400cf7c5
mov word [rdi], si
lea rax, [rbx + 2]
cmp rax, r13
jne 0x1400cf717
jmp 0x1400cf7dd
mov r8, r14
lea rdx, [rsp + 0x2050]
lea rcx, [rsp + 0x1050]
call fcn.140065d2c
mov eax, dword [0x1401973a0]
test al, 1
jne 0x1400cf80a
or eax, 1
mov dword [0x1401973a0], eax
lea rcx, [0x14019729e]
call fcn.1400634a4
nop
lea rcx, [0x1401076a0]
call fcn.1400ee7f4
nop
mov r8b, 1
mov rdx, r12
lea rbx, [0x140193270]
mov rcx, rbx
call fcn.1400cd8ac
cmp bpl, r13b
sete al
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], rbx
mov byte [rsp + 0x20], al
lea r9, [rsp + 0x1050]
xor r8d, r8d
lea rdx, [rsp + 0x50]
xor ecx, ecx
call fcn.1400cd058
cmp al, r13b
jne 0x1400cf85b
mov rcx, rbx
call fcn.1400ccd48
xor al, al
jmp 0x1400cf889
cmp bpl, r13b
je 0x1400cf87f
cmp qword [0x140193270], r13
je 0x1400cf87f
mov r8, rbx
mov edx, 0x10000
lea rcx, [0x1400cecb0]
call fcn.1400efe18
jmp 0x1400cf887
mov rcx, rbx
call fcn.1400ccd48
mov al, 1
mov rcx, qword [rsp + 0x3050]
xor rcx, rsp
call fcn.1400e9d00
lea r11, [rsp + 0x3060]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret