Function at 0x1400c0100
Capabilities:
Query environment variable

Disassembly:
push rbp
push r12
push r13
push r14
push r15
mov eax, 0x50
call fcn.1400b2870
sub rsp, rax
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rsi
mov qword [rbp + 0x50], rdi
mov rax, qword [0x14021e0c0]
xor rax, rbp
mov qword [rbp + 8], rax
xor ebx, ebx
lea r14, str.RANDFILE
mov r12, rdx
mov r15, rcx
xor r8d, r8d
xor edx, edx
mov rcx, r14
mov edi, ebx
lea r13d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x1400c01b7
lea r14, str.HOME
xor r8d, r8d
mov rcx, r14
xor edx, edx
mov r13d, ebx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x1400c01b7
lea r14, str.USERPROFILE
xor r8d, r8d
mov rcx, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
jne 0x1400c01b7
lea r14, str.SYSTEMROOT
xor r8d, r8d
mov rcx, r14
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test eax, eax
je 0x1400c028e
mov eax, esi
movabs rdx, 0xffffffffffffff0
add rax, rax
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400c01d2
mov rcx, rdx
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400b2870
sub rsp, rcx
mov r8d, esi
mov rcx, r14
lea rax, [rsp + 0x40]
mov rdx, rax
mov qword [rbp], rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp eax, esi
jae 0x1400c0284
mov rsi, qword [rbp]
or r9d, 0xffffffff
mov qword [rsp + 0x38], rbx
mov r8, rsi
mov qword [rsp + 0x30], rbx
xor edx, edx
mov dword [rsp + 0x28], ebx
mov ecx, 0xfde9
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rdx, eax
test eax, eax
je 0x1400c0284
lea rax, [rdx + 0xf]
cmp rax, rdx
ja 0x1400c0246
movabs rax, 0xffffffffffffff0
and rax, 0xfffffffffffffff0
call fcn.1400b2870
sub rsp, rax
or r9d, 0xffffffff
mov r8, rsi
mov ecx, 0xfde9
mov qword [rsp + 0x38], rbx
lea rdi, [rsp + 0x40]
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], edx
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rdi, rbx
test r13d, r13d
jne 0x1400c0297
test rdi, rdi
jne 0x1400c02a0
lea rdi, [0x1401b2868]
jmp 0x1400c02a8
test rdi, rdi
je 0x1400c0349
cmp byte [rdi], bl
je 0x1400c0349
mov eax, ebx
mov rcx, rdi
cmp byte [rdi], al
je 0x1400c02c1
cmp eax, 0x80000000
jae 0x1400c02c1
inc rcx
inc eax
cmp byte [rcx], bl
jne 0x1400c02b1
mov edx, eax
btr edx, 0x1f
test r13d, r13d
je 0x1400c02ec
lea rax, [rdx + 1]
cmp rax, r12
jae 0x1400c02ec
mov r8, r12
mov rdx, rdi
mov rcx, r15
call fcn.1400c8da0
cmp rax, r12
jb 0x1400c034c
xor eax, eax
jmp 0x1400c0356
lea rcx, str..rnd
mov eax, ebx
cmp eax, 0x80000000
jae 0x1400c0305
inc rcx
inc eax
cmp byte [rcx], bl
jne 0x1400c02f5
btr eax, 0x1f
add rax, 2
add rax, rdx
cmp rax, r12
jae 0x1400c034c
mov r8, r12
mov rdx, rdi
mov rcx, r15
call fcn.1400c8da0
mov r8, r12
lea rdx, [0x1401a6c8c]
mov rcx, r15
call fcn.1400c8d20
mov r8, r12
lea rdx, str..rnd
mov rcx, r15
call fcn.1400c8d20
jmp 0x1400c034c
mov byte [r15], bl
cmp byte [r15], bl
cmovne rbx, r15
mov rax, rbx
mov rcx, qword [rbp + 8]
xor rcx, rbp
call fcn.1400b2240
mov rbx, qword [rbp + 0x40]
mov rsi, qword [rbp + 0x48]
mov rdi, qword [rbp + 0x50]
lea rsp, [rbp + 0x10]
pop r15
pop r14
pop r13
pop r12
pop rbp
ret