Function at 0x180023ea0
Capabilities:
Query environment variable
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 8], ecx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov eax, ecx
mov r14d, ecx
imul ecx, ecx, 0xd6e
mov rsi, r9
mov r13, rdx
mov dword [rsp + 0x30], ecx
cmp eax, ecx
ja 0x180024568
mov r15, qword [rsp + 0x48]
xor ebx, ebx
mov r12, qword [rsp + 0x50]
lea rbp, [0x18007de20]
lea rdx, str.___dty
cmp r14d, 0x1283a
ja 0x1800242fb
je 0x180024568
cmp r14d, 0x66c0
ja 0x1800241f3
je 0x180023fcb
mov eax, r14d
sub eax, 0x89
je 0x180023fb8
sub eax, 0x1b
je 0x180023f85
sub eax, 0x22
je 0x180023f58
cmp eax, 0x4e
jne 0x18002453f
xor edx, edx
mov r8d, 0x104
mov rcx, r13
call fcn.180043230
jmp 0x18002453b
cmp byte [rsi], 0
mov rax, rbx
mov qword [rsp + 0x60], rbx
je 0x180023f75
inc rsi
inc rax
cmp byte [rsi], 0
jne 0x180023f65
mov qword [rsp + 0x60], rax
inc rsi
mov qword [rsp + 0xd8], rsi
jmp 0x18002453f
mov r8d, dword [0x18007d708]
mov rcx, rsi
mov rdx, qword [0x18007d700]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, eax
mov qword [rsp + 0x58], rcx
test eax, eax
jne 0x18002453b
nop dword [rax + rax]
mov rax, rbx
jmp 0x18002456d
cmp dword [rsi], 6
lea r12, str.V550_BufferA
cmove r12, rdx
jmp 0x18002453f
lea rdx, [0x180064974]
mov rcx, r13
call fcn.1800489a8
mov qword [0x18007ddf8], rax
test rax, rax
je 0x1800241df
mov r8d, dword [rsi]
xor r9d, r9d
mov rcx, qword [0x18007de08]
xor edx, edx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
je 0x1800241c2
mov eax, dword [0x18007de20]
lea r9, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x50], rax
xor ecx, ecx
lea edx, [r8 + 0x1a]
call fcn.18003ea40
mov qword [0x18007de18], rax
test rax, rax
je 0x1800241ce
mov ebp, 0x31
lea r15, [0x18007de20]
nop dword [rax + rax]
mov eax, ebp
sub eax, 0x2f
je 0x18002419a
sub eax, 1
je 0x18002417d
cmp eax, 1
jne 0x1800241a1
mov rax, qword [0x18007de18]
xor r9d, r9d
mov r8d, dword [rsi]
xor edx, edx
mov rcx, qword [0x18007de08]
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptExportKey]
test eax, eax
je 0x1800241a1
mov rbx, qword [rsp + 0xd0]
mov esi, 0xba
nop dword [rax + rax]
mov eax, esi
sub eax, 0xba
je 0x1800240cb
sub eax, 1
je 0x1800240ff
cmp eax, 1
jne 0x180024104
mov r14d, 0x66c0
jmp 0x180024104
mov edx, dword [0x18007de20]
lea rcx, str.LC_ENCRYPTION_INFO_command
mov r8, r13
call fcn.18003efe0
mov ecx, dword [rbx]
test ecx, ecx
je 0x1800240ed
cmp ecx, 1
je 0x18002413c
jmp 0x180024104
mov edi, 0x53
cmp edi, 0x53
je 0x18002411d
cmp edi, 0x1228
jne 0x18002412e
mov esi, 0xbb
inc esi
cmp esi, 0xbd
jb 0x1800240b0
mov rsi, qword [rsp + 0xd8]
xor ebx, ebx
jmp 0x1800241a1
xor r8d, r8d
mov r9, r12
xor ecx, ecx
lea edx, [r8 + 0x52]
call fcn.180014430
add edi, 0x11d5
cmp edi, 0x23aa
jbe 0x1800240f2
mov edi, 0x105
mov eax, edi
sub eax, 0x105
je 0x180024151
cmp eax, 0x2d
je 0x1800240ff
jmp 0x180024170
mov r8d, dword [0x18007de20]
mov edx, 1
mov r9, qword [0x18007ddf8]
mov rcx, qword [0x18007de18]
call fcn.180048bf4
add edi, 0x2d
cmp edi, 0x15f
jb 0x180024141
jmp 0x180024104
mov r9, qword [0x18007de18]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbx
mov ecx, 0xc8
call fcn.18000fad0
jmp 0x1800241a1
mov qword [0x18007de18], rbx
dec ebp
cmp ebp, 0x2e
ja 0x180024050
mov rcx, qword [0x18007ddf8]
mov r15, qword [rsp + 0x48]
call fcn.18004886c
jmp 0x18002453b
lea rcx, str.PxdManagerSetInt
call fcn.18003edc0
mov rcx, qword [0x18007ddf8]
call fcn.18004886c
jmp 0x18002453b
mov rdx, r13
lea rcx, str.fopen__s_
call fcn.18003edc0
jmp 0x18002453b
cmp r14d, 0x7b00
je 0x18002424d
cmp r14d, 0x9480
je 0x18002423e
cmp r14d, 0xcf00
je 0x180024220
cmp r14d, 0xf55c
je 0x180024568
jmp 0x18002453f
lea rcx, [r13 + 0x104]
xor edx, edx
mov r8d, 0x104
call fcn.180043230
mov qword [rsp + 0x70], r13
jmp 0x18002453b
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
jmp 0x18002453f
mov rcx, qword [rsp + 0x58]
cmp rcx, qword [0x18007d708]
jbe 0x1800242ea
mov edi, 0xa9
mov eax, edi
sub eax, 0xa9
je 0x1800242ac
sub eax, 0x1a
je 0x18002429e
sub eax, 0x1a
je 0x180024295
cmp eax, 0x1a
jne 0x1800242db
mov r8d, dword [0x18007d708]
mov rcx, rsi
mov rdx, qword [0x18007d700]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
jmp 0x1800242d6
mov qword [0x18007d708], rcx
jmp 0x1800242db
mov rax, qword [rsp + 0x68]
mov qword [0x18007d700], rax
jmp 0x1800242db
mov r8, qword [0x18007d700]
mov edx, 0x6b
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x50]
call fcn.180027a60
mov qword [rsp + 0x68], rax
cmp rax, 0
je 0x180023fb0
mov rcx, qword [rsp + 0x58]
add edi, 0x1a
cmp edi, 0x111
jb 0x180024264
mov rax, qword [0x18007d700]
mov qword [rsp + 0x38], rax
jmp 0x18002453b
cmp r14d, 0x4d49c
ja 0x1800244a9
je 0x180024466
cmp r14d, 0x19cec
je 0x180024455
cmp r14d, 0x26ad8
je 0x18002443b
cmp r14d, 0x338c4
je 0x1800243c0
cmp r14d, 0x406b0
jne 0x18002453f
mov r14d, ebx
lea rsi, [rsp + 0x70]
mov rbp, rbx
nop dword [rax]
test r15, r15
je 0x1800243b0
mov edi, 0x14
nop word [rax + rax]
mov eax, edi
sub eax, 0x13
je 0x180024387
cmp eax, 1
jne 0x180024399
xor edx, edx
mov ecx, 0xf6
call fcn.18000ac80
mov qword [rsp + 0x48], rax
mov r15, rax
test rax, rax
je 0x1800243b0
jmp 0x180024399
mov rcx, qword [rsi]
mov r8d, 0x104
mov rdx, r15
call qword [sym.imp.SHLWAPI.dll_StrCpyNW]
dec edi
cmp edi, 0x12
ja 0x180024360
inc r14d
inc rbp
add rsi, 8
cmp rbp, 2
jl 0x180024350
mov dword [rsp + 0x34], r14d
mov r14d, 0x406b0
jmp 0x18002453b
test r15, r15
je 0x180024560
mov rdx, r15
lea rcx, [0x1800617cc]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x1800243ea
mov dword [rsp + 0x40], 3
jmp 0x18002453b
mov rdx, r15
lea rcx, [0x1800617c8]
call qword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x18002440b
mov dword [rsp + 0x40], 2
jmp 0x18002453b
mov ecx, 0x101
mov eax, ecx
sub eax, 0x101
je 0x180024424
cmp eax, 1
je 0x180024568
jmp 0x18002442c
mov dword [rsp + 0x38], 0xffffffff
inc ecx
cmp ecx, 0x103
jb 0x180024410
jmp 0x18002453b
mov rdx, rsi
mov ecx, 0xf6
call fcn.18000ac80
mov r15, rax
mov qword [rsp + 0x48], rax
jmp 0x18002453b
lea rax, [r13 + 0x104]
mov qword [rsp + 0x78], rax
jmp 0x18002453f
cmp dword [rsp + 0x34], 0
jne 0x18002453f
mov ecx, 0x10d
nop word [rax + rax]
mov eax, ecx
sub eax, 0x10c
je 0x180024568
cmp eax, 1
jne 0x18002449a
mov dword [rsp + 0x38], 0xffffffff
dec ecx
cmp ecx, 0x10b
ja 0x180024480
jmp 0x18002453b
cmp r14d, 0x5a288
je 0x1800244d4
cmp r14d, 0x67074
je 0x1800244ca
cmp r14d, 0x73e60
je 0x180024568
jmp 0x18002453f
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x38], eax
jmp 0x18002453f
cmp dword [rsp + 0x34], 1
jne 0x18002453f
mov edi, 0x68
cmp edi, 0x68
je 0x180024516
cmp edi, 0x7b8
jne 0x180024528
lea rcx, [r13 + 0x104]
mov r8d, 0x104
test r15, r15
je 0x18002450b
lea rdx, [r15 + 2]
call qword [sym.imp.SHLWAPI.dll_StrCpyNW]
jmp 0x180024528
mov rdx, r13
call qword [sym.imp.SHLWAPI.dll_StrCpyNW]
jmp 0x180024528
xor edx, edx
mov rcx, r13
lea r8d, [rdx + 0x5c]
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov r15, rax
add edi, 0x750
cmp edi, 0xea0
jbe 0x1800244e0
mov qword [rsp + 0x48], r15
mov ecx, dword [rsp + 0x30]
imul eax, dword [rsp + 0xc0], 0xbf
add r14d, eax
cmp r14d, ecx
ja 0x180024568
mov rsi, qword [rsp + 0xd8]
jmp 0x180023eee
mov dword [rsp + 0x38], 0xffffffff
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret