Function at 0x1401178d0
Capabilities:
Query environment variable

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsp
push rsi
push rdi
push rbx
sub rsp, 0x4a8
test al, 4
add byte [rax], al
lea rbp, [rsp + 0x80]
and al, 0x80
add byte [rax], al
add byte [rax - 0x39], cl
test dword [rax], esp
add al, 0
add dh, bh
invalid
invalid
dec dword [rax - 0x77]
invalid
lea rcx, [rbp - 0x60]
movabs al, byte [0x458b48000003fee8]
movabs al, byte [0xbf48]
add byte [rax + 0x75f83948], al
invalid
lea rcx, [rbp - 0x58]
call fcn.140112c50
mov qword [rsi], rdi
jmp 0x140117b65
mov qword [rbp + 0x3f8], rsi
mov qword [rbp + 0x3f0], rax
mov rax, qword [rbp - 0x58]
mov qword [rbp + 0x400], rax
mov qword [rbp + 0x408], 0
mov qword [rbp + 0x410], 2
mov qword [rbp + 0x418], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r14d, r14d
cmp r8, 0x201
jae 0x1401179b0
jmp 0x14011799f
jae 0x140117a74
cmp r8, 0x201
jae 0x1401179b0
mov r15d, 0x200
lea r12, [rbp - 0x60]
invalid
invalid
mov r13, r8
jmp 0x140117a08
sub r8, r14
sub rbx, r14
cmp rbx, r8
ret
jae 0x1401179df
lea rcx, [rbp + 0x408]
mov rdx, r14
call fcn.1402e3370
mov rdi, qword [rbp + 0x408]
add byte [rax], al
mov rax, qword [rbp + 0x410]
mov qword [rbp + 0x3e8], rax
mov dword [rbp + 0x3e8], eax
add eax, dword [rax]
invalid
mov eax, 0xffffffff
cmp rdi, rax
mov r14d, 0xffffffff
invalid
invalid
dec dword [rdi + rcx + 0x42]
test dword [rcx + rcx*4 - 0x4b], 0x418
mov qword [rbp + 0x418], r14
add al, 0
invalid
mov rbx, rdi
mov r15, r14
mov edi, esi
test dword [rbx + rcx*4 - 0x5b], 0x3e8
call 0x18d117a09
mov r13, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
and bh, 0x1c
out 0x1c, eax
add byte [rax - 0x75], cl
mov ecx, dword [rbp + 0x400]
add byte [rax], al
mov rdx, r12
loop 0x140117a60
mov eax, ebp
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
adc eax, 0x1ce78d
sbb al, 0
mov esi, eax
test eax, eax
jne 0x140117a36
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x140117af4
invalid
invalid
add byte [rax], al
invalid
mov r8d, esi
cmp r13, r8
jne 0x140117990
test dword [rsi - 1], ecx
invalid
invalid
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jp 0x140117a5a
test dword [rdx], ebp
add dword [rax], eax
invalid
add r13, r13
mov eax, 0xffffffff
invalid
invalid
invalid
dec dword [rcx + 0x39]
invalid
cmovae r13, rax
mov r8, r13
cmp r8, 0x201
jb 0x14011799f
jmp 0x1401179b0
cmp r15, r8
jb 0x140117b94
invalid
add dword [rax], eax
invalid
lea rcx, [rbp + 0x3a0]
mov rdx, r12
mov edx, esp
call fcn.140115ab0
movups xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
movaps xmmword [rbp + 0x3d0], xmm1
invalid
rol byte [rbx], 1
add byte [rax], al
movaps xmmword [rbp + 0x3c0], xmm0
cmp qword [rbp + 0x408], 0
invalid
je 0x140117ac3
mov rcx, qword [rbp + 0x410]
mov edx, 2
add al, ch
fucom st(2)
invalid
invalid
movabs rsi, 0x8000000000000000
cmp qword [rbp + 0x3c0], rsi
mov rax, qword [rbp + 0x3f8]
test eax, edi
clc
add eax, dword [rax]
invalid
je 0x140117b3b
movaps xmm0, xmmword [rbp + 0x3c0]
movaps xmm1, xmmword [rbp + 0x3d0]
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
jmp 0x140117b4a
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
enter 0x4802, 0xffffffffffffff89
test eax, ecx
add eax, dword [rax]
add byte [rax - 0x42], cl
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax - 0x3f4a76b8], al
add eax, dword [rax]
add byte [rax - 0x7d], cl
mov ebp, 0x408
invalid
je 0x140117b34
mov rcx, qword [rbp + 0x410]
mov edx, 2
call fcn.140055da0
loop 0x140117b26
invalid
mov rax, qword [rbp + 0x3f8]
mov qword [rax], rsi
lea rcx, [rbp + 0x3c8]
call fcn.140112c50
cmp qword [rbp + 0x3f0], 0
je 0x140117b65
mov edx, 2
mov rcx, qword [rbp + 0x400]
call fcn.140055da0
nop
add rsp, 0x4a8
invalid
test al, 4
add byte [rax], al
add byte [rbx + 0x5f], bl
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rcx, [0x1403b08ee]
lea r8, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov edx, 0x28
call fcn.1402df840
jmp 0x140117ba9
lea rax, str.library_std_src_syspalwindowsmod.rsstrings_passed_to_WinAPI_cannot_contain_NULs
mov rcx, r8
mov rdx, r15
cli
mov r8, rax
call fcn.1402df7d0
invalid
ud2