Function at 0x1800bf490
Capabilities:
Query environment variable

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x100
mov qword [rbp - 0x71], 0xfffffffffffffffe
mov qword [rsp + 0x110], rbx
mov rax, qword [0x1802a8008]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rcx, str.APPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov qword [rbp + 0xf], 0xf
xor ebx, ebx
mov qword [rbp + 7], rbx
mov byte [rbp - 9], bl
cmp byte [rax], bl
jne 0x1800bf4e3
mov r8d, ebx
jmp 0x1800bf4f0
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], bl
jne 0x1800bf4e7
mov rdx, rax
lea rcx, [rbp - 9]
call fcn.18003d620
nop
lea r8, str..exFilLocat_
lea rdx, [rbp - 9]
lea rcx, [rbp - 0x29]
call fcn.1800a97a0
nop
mov qword [rbp - 0x51], 0xf
mov qword [rbp - 0x59], rbx
mov byte [rbp - 0x69], 0
mov r8d, 0xa
lea rdx, str.maping.ytd
lea rcx, [rbp - 0x69]
call fcn.18003d620
nop
lea r8, [rbp - 0x69]
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x49]
call fcn.1800ce630
nop
lea rcx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae rcx, qword [rbp - 0x49]
lea rdx, [rbp + 0x17]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32]
test eax, eax
jne 0x1800bf595
lea r9, [rbp - 0x69]
cmp qword [rbp - 0x51], 0x10
cmovae r9, qword [rbp - 0x69]
lea rdx, [rbp - 0x49]
cmp qword [rbp - 0x31], 0x10
cmovae rdx, qword [rbp - 0x49]
mov byte [rsp + 0x20], al
mov r8b, 1
lea rcx, [rbp - 0x79]
call qword [0x18034e908]
nop
mov rax, qword [rbp - 0x31]
cmp rax, 0x10
jb 0x1800bf5ef
inc rax
mov rcx, qword [rbp - 0x49]
cmp rax, 0x1000
jb 0x1800bf5ea
test cl, 0x1f
je 0x1800bf5ba
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800bf5ca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800bf5da
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x1800bf5e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.1801e6174
mov qword [rbp - 0x31], 0xf
mov qword [rbp - 0x39], rbx
mov byte [rbp - 0x49], 0
mov rax, qword [rbp - 0x51]
cmp rax, 0x10
jb 0x1800bf659
inc rax
mov rcx, qword [rbp - 0x69]
cmp rax, 0x1000
jb 0x1800bf654
test cl, 0x1f
je 0x1800bf624
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800bf634
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800bf644
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x1800bf651
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.1801e6174
mov qword [rbp - 0x51], 0xf
mov qword [rbp - 0x59], rbx
mov byte [rbp - 0x69], 0
mov rax, qword [rbp - 0x11]
cmp rax, 0x10
jb 0x1800bf6c3
inc rax
mov rcx, qword [rbp - 0x29]
cmp rax, 0x1000
jb 0x1800bf6be
test cl, 0x1f
je 0x1800bf68e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800bf69e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800bf6ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x1800bf6bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.1801e6174
mov qword [rbp - 0x11], 0xf
mov qword [rbp - 0x19], rbx
mov byte [rbp - 0x29], 0
mov rax, qword [rbp + 0xf]
cmp rax, 0x10
jb 0x1800bf72d
inc rax
mov rcx, qword [rbp - 9]
cmp rax, 0x1000
jb 0x1800bf728
test cl, 0x1f
je 0x1800bf6f8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800bf708
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800bf718
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rcx, 0x27
jbe 0x1800bf725
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rax
call fcn.1801e6174
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1801e6190
mov rbx, qword [rsp + 0x110]
add rsp, 0x100
pop rbp
ret