Function at 0x1800b5480
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xd0
mov r14, rcx
mov qword [rbp - 0x19], rcx
mov dword [rbp - 0x71], 0
movabs rax, 0x9d7f8e2204a500d0
mov qword [rbp - 0x79], rax
mov rax, qword [rbp - 0x79]
mov qword [rbp - 0x59], rax
movabs r15, 0x2dc2983afe302706
mov qword [rbp - 0x79], r15
mov rax, qword [rbp - 0x79]
mov qword [rbp - 0x51], rax
movabs r12, 0x9d1efa4360d570b1
mov qword [rbp - 0x79], r12
mov rax, qword [rbp - 0x79]
mov qword [rbp + 0x27], rax
mov qword [rbp - 0x79], r15
mov rax, qword [rbp - 0x79]
mov qword [rbp + 0x2f], rax
movdqa xmm0, xmmword [rbp - 0x59]
pxor xmm0, xmmword [rbp + 0x27]
movdqa xmmword [rbp - 0x59], xmm0
lea rcx, [rbp - 0x59]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rsi, rax
mov rbx, 0xffffffffffffffff
mov rdi, rbx
inc rdi
cmp byte [rax + rdi], 0
jne 0x1800b5520
call fcn.1800c3948
mov qword [rbp - 0x49], rsi
mov qword [rbp - 0x41], rdi
lea r8, [rbp - 0x49]
mov edx, eax
mov rcx, r14
call fcn.18001e210
mov dword [rbp - 0x71], 7
movabs rax, 0xfb6c9f280eb400e2
mov qword [rbp - 0x79], rax
mov rax, qword [rbp - 0x79]
mov qword [rbp - 0x69], rax
movabs rax, 0x2dc2983a9a5c426f
mov qword [rbp - 0x79], rax
mov rax, qword [rbp - 0x79]
mov qword [rbp - 0x61], rax
mov qword [rbp - 0x79], r12
mov rax, qword [rbp - 0x79]
mov qword [rbp + 7], rax
mov qword [rbp - 0x79], r15
mov rax, qword [rbp - 0x79]
mov qword [rbp + 0xf], rax
movdqa xmm0, xmmword [rbp - 0x69]
pxor xmm0, xmmword [rbp + 7]
movdqa xmmword [rbp - 0x69], xmm0
lea rax, [rbp - 0x69]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1800b55a2
call fcn.1800c3948
lea rcx, [rbp - 0x69]
mov qword [rbp - 0x39], rcx
mov qword [rbp - 0x31], rbx
lea r8, [rbp - 0x39]
mov edx, eax
lea rcx, [rbp + 7]
call fcn.18001e210
mov dword [rbp - 0x71], 0x1f
lea rdx, [rbp + 7]
mov rcx, r14
call fcn.18001e490
nop
lea rcx, [rbp + 7]
call fcn.18003d340
mov rdx, r14
lea rcx, [rbp - 0x39]
call fcn.18001e810
mov rbx, rax
mov qword [rbp - 0x79], rax
mov rcx, rax
call fcn.18001f1f0
test al, al
jne 0x1800b5627
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1800b5614
mov rcx, qword [rbx]
call fcn.1800c3d0c
shr rax, 0x20
test eax, eax
jne 0x1800b56c6
jmp 0x1800b568d
mov rdx, rbx
lea rcx, [rbp - 0x11]
call fcn.18001f280
movsd xmm0, qword [rax]
movsd qword [rbp - 0x69], xmm0
mov edx, dword [rax + 8]
mov ecx, dword [rbp - 0x69]
test edx, edx
je 0x1800b5654
lea eax, [rcx - 1]
test eax, 0xfffffff7
jne 0x1800b56d8
cmp ecx, 3
je 0x1800b568d
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1800b5666
mov rcx, qword [rbx]
call fcn.1800c41b8
shr rax, 0x20
test eax, eax
jne 0x1800b56e8
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1800b5680
mov rcx, qword [rbx]
call fcn.1800c3d0c
shr rax, 0x20
test eax, eax
jne 0x1800b56b4
mov rcx, rbx
call fcn.18003d340
mov rax, r14
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov r8, rbx
mov edx, eax
lea rcx, str.create_directory
call fcn.18001edd0
int3
mov r8, rbx
mov edx, eax
lea rcx, str.create_directory
call fcn.18001edd0
int3
mov r8, rbx
lea rcx, str.status
call fcn.18001edd0
int3
mov r8, rbx
mov edx, eax
lea rcx, str.remove
call fcn.18001edd0
int3