Function at 0x140059ef8
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x1a8]
sub rsp, 0x290
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
mov rax, qword [0x140083010]
xor rax, rsp
mov qword [rbp + 0x180], rax
xor r12d, r12d
mov dword [rsp + 0x40], r12d
xor ebx, ebx
cmp byte [0x1400858f8], bl
jne 0x14005a28f
mov byte [0x1400858f8], 1
mov edi, 0x104
mov r8d, edi
lea rdx, [rsp + 0x70]
lea rcx, str.LORI_099F5E083DF84BC98E90139DFB45C0B9
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
or r14, 0xffffffffffffffff
test eax, eax
je 0x14005a04f
nop dword [rax + rax]
cmp eax, edi
ja 0x14005a29f
and qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x40100000
lea esi, [rbx + 3]
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov edx, esi
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, r14
je 0x14005a071
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, esi
je 0x14005a071
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x40], r14
mov ecx, 0xb8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x14005a2b1
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.14000959c
mov rdi, rax
mov rcx, qword [rsp + 0x40]
cmp rcx, r14
je 0x14005a00f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test rdi, rdi
je 0x14005a27e
mov ecx, 0x18
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x14005a2bf
mov rdx, rdi
mov rcx, rax
call fcn.140008260
mov qword [0x140084d68], rax
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 0x10]
call qword [case.0x140015ba5.0]
nop
cmp byte [0x1400858f8], 0
je 0x14005a2c8
mov r15, qword [0x140084d68]
test r15, r15
jne 0x14005a084
lea edi, [r15 + 1]
jmp 0x14005a232
mov qword [rsp + 0x40], rdi
test rdi, rdi
je 0x14005a275
jmp 0x140059fda
mov dword [0x140085bc8], 1
call fcn.140021b00
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x10
xor r9d, r9d
mov edx, 0x1000
lea rcx, [rsp + 0x50]
call fcn.14000848c
mov ecx, 0x20
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
mov rcx, qword [rsp + 0x50]
test rax, rax
je 0x14005a0e7
and dword [rax + 8], 0
mov qword [rax + 0x10], rcx
lea rax, [0x140067438]
mov qword [rsi], rax
and qword [rsi + 0x18], 0
jmp 0x14005a0f9
xor esi, esi
test rcx, rcx
je 0x14005a202
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
test rsi, rsi
je 0x14005a202
mov eax, 1
lock xadd dword [rsi + 8], eax
mov rbx, rsi
xor r9d, r9d
mov r8d, 0x1388
mov rdx, rsi
mov rcx, r15
call fcn.14005bb88
mov edi, eax
test eax, eax
js 0x14005a207
mov rax, qword [rsi + 0x18]
mov edi, dword [rax]
test edi, edi
js 0x14005a207
mov ecx, 0x40
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x14005a18c
mov ecx, 8
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
test rax, rax
je 0x14005a2d9
lea rcx, [0x140067270]
mov qword [rax], rcx
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x48]
mov rdx, r15
mov rcx, rdi
call 0x14005a2e8
mov rdi, rax
mov r12d, 1
jmp 0x14005a18e
xor edi, edi
test r12b, 1
je 0x14005a1b0
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14005a1b0
mov rax, qword [rcx]
mov edx, 1
mov rax, qword [rax]
call qword [case.0x140015ba5.0]
nop
test rdi, rdi
je 0x14005a264
mov rcx, qword [rsi + 0x18]
mov eax, dword [rcx + 0x10]
mov dword [0x1400834cc], eax
mov rdx, qword [rcx + 0x14]
mov al, byte [rcx + 0x1c]
neg al
sbb ecx, ecx
neg ecx
inc ecx
mov dword [0x140086260], ecx
mov qword [0x140083920], rdx
mov rcx, qword [rdi + 0x28]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140015ba5.0]
test al, al
jne 0x14005a1fe
mov edi, 0x80004005
jmp 0x14005a207
xor edi, edi
jmp 0x14005a20d
mov edi, 0x8007000e
call fcn.1400081bc
nop
test rbx, rbx
je 0x14005a232
lock xadd dword [rbx + 8], r14d
cmp r14d, 1
jne 0x14005a232
mov rax, qword [rbx]
mov edx, r14d
mov rcx, rbx
mov rax, qword [rax + 0x10]
call qword [case.0x140015ba5.0]
nop
mov eax, edi
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.14005ccf0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
xor edx, edx
mov ecx, 0x5e1797
call fcn.140007ee0
nop
jmp 0x14005a274
nop
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor edx, edx
mov ecx, 0x314639c
call fcn.140007ee0
nop
jmp 0x14005a28e
nop
xor edx, edx
mov ecx, 0x6230776f
call fcn.140007ee0
nop
jmp 0x14005a29e
nop
xor edx, edx
mov ecx, 0x3120811
call fcn.140007ee0
nop
jmp 0x14005a2b0
nop
mov ecx, 0x1117748
call fcn.140007f74
nop
jmp 0x14005a2be
nop
call fcn.140058f9c
nop
jmp 0x14005a2c7
nop
xor edx, edx
mov ecx, 0x62307770
call fcn.140007ee0
nop
jmp 0x14005a2d8
nop
call fcn.140058f9c
nop
jmp 0x14005a2e4
nop
nop
nop
nop
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov qword [rcx + 0x10], rdx
lea rax, [0x1400672e8]
mov qword [rcx], rax
lea rdi, [rcx + 8]
lea rax, [0x1400672d0]
mov rbx, rcx
mov qword [rdi], rax
and qword [rcx + 0x18], 0
and qword [rcx + 0x20], 0
mov rax, qword [r8]
and qword [r8], 0
mov qword [rcx + 0x28], rax
and qword [rcx + 0x30], 0
and qword [rcx + 0x38], 0
call fcn.14005c570
cmp qword [0x140086c28], 0
je 0x14005a361
test rdi, rdi
je 0x14005a361
mov rax, qword [0x140083518]
lea rcx, [0x140083518]
mov edx, 0x2357880
mov rax, qword [rax + 8]
call qword [case.0x140015ba5.0]
mov eax, dword [0x140083088]
mov ecx, 0xfff3dfe9
cmp qword [0x140086c20], 0
mov qword [0x140086c28], rdi
cmovne eax, ecx
mov dword [0x140083088], eax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret