Function at 0x140002b10
Capabilities:
Query environment variable

Disassembly:
push rbp
push r12
sub rsp, 0x48
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov r12, rax
test rax, rax
jne 0x140002b31
add rsp, 0x48
pop r12
pop rbp
ret
cmp word [rax], 0
mov rcx, r12
mov qword [rsp + 0x40], r13
je 0x140002b6a
nop
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140002b50
lea rcx, [rcx + rax*2]
add rcx, 2
cmp word [rcx], 0
jne 0x140002b40
sub rcx, r12
mov r8, rbp
add rcx, 2
sar rcx, 1
test rbp, rbp
je 0x140002ba9
nop dword [rax]
mov rdx, qword [r8]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140002b90
mov r8, qword [r8 + 8]
inc rcx
add rcx, rax
test r8, r8
jne 0x140002b80
add rcx, rcx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r13, rax
test rax, rax
jne 0x140002bd2
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov r13, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x48
pop r12
pop rbp
ret
mov qword [rsp + 0x68], rsi
mov rsi, 0xffffffffffffffff
mov qword [rsp + 0x38], r14
mov r14, r12
mov qword [rsp + 0x30], r15
mov r15, r13
nop
inc rsi
cmp word [r12 + rsi*2], 0
jne 0x140002bf0
inc rsi
test rbp, rbp
je 0x140002d67
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rdi
cmp word [r14], 0
je 0x140002d10
mov rdi, qword [rbp]
lea rdx, [0x140019268]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscspn]
lea rdx, [0x140019268]
mov rcx, r14
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscspn]
mov r8, r14
mov dword [rsp + 0x20], 1
mov r9d, eax
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
lea r9d, [rax - 2]
test r9d, r9d
jg 0x140002caa
mov rdx, qword [rbp]
mov r8, r15
nop dword [rax]
movzx ecx, word [rdx]
lea rdx, [rdx + 2]
mov word [r8], cx
lea r8, [r8 + 2]
test cx, cx
jne 0x140002c70
mov rcx, qword [rbp]
mov rax, 0xffffffffffffffff
nop
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140002c90
mov rbp, qword [rbp + 8]
lea r15, [r15 + rax*2]
add r15, 2
jmp 0x140002cd4
mov rdx, r15
mov rcx, r14
sub rdx, r14
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140002cc0
lea r15, [r15 + rsi*2]
test r9d, r9d
js 0x140002cfe
cmp word [r14 + rsi*2], 0
lea r14, [r14 + rsi*2]
je 0x140002cfe
mov rsi, 0xffffffffffffffff
nop dword [rax]
inc rsi
cmp word [r14 + rsi*2], 0
jne 0x140002cf0
inc rsi
test rbp, rbp
jne 0x140002c11
jmp 0x140002d5d
mov rcx, qword [rbp]
mov rdx, r15
nop word [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx + 2]
mov word [rdx], ax
lea rdx, [rdx + 2]
test ax, ax
jne 0x140002d20
mov rcx, qword [rbp]
mov rax, 0xffffffffffffffff
nop
cmp word [rcx + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140002d40
mov rbp, qword [rbp + 8]
lea r15, [r15 + rax*2]
add r15, 2
test rbp, rbp
jne 0x140002d10
mov rdi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
cmp word [r14], 0
mov rsi, qword [rsp + 0x68]
je 0x140002dd4
nop dword [rax]
nop word [rax + rax]
mov rdx, r15
mov rax, r14
sub rdx, r14
nop dword [rax]
movzx ecx, word [rax]
mov word [rdx + rax], cx
lea rax, [rax + 2]
test cx, cx
jne 0x140002d90
mov rax, 0xffffffffffffffff
nop word [rax + rax]
cmp word [r14 + rax*2 + 2], 0
lea rax, [rax + 1]
jne 0x140002db0
lea r14, [r14 + rax*2]
add r14, 2
lea r15, [r15 + rax*2]
add r15, 2
cmp word [r14], 0
jne 0x140002d80
xor eax, eax
mov rcx, r12
mov word [r15], ax
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov r15, qword [rsp + 0x30]
mov rax, r13
mov r13, qword [rsp + 0x40]
mov r14, qword [rsp + 0x38]
add rsp, 0x48
pop r12
pop rbp
ret