Function at 0x1401bfa49
Capabilities:
Query environment variable

Disassembly:
push rax
pushf
mov eax, 0x8d1594a3
pushf
not eax
add eax, 0xa5de156b
xor eax, 0xe39ad27a
rol eax, 4
popf
pushf
not eax
add eax, 0xf4db3429
xor eax, 0xa9bf9c8c
rol eax, 0x43
popf
pushf
not eax
add eax, 0xb9985901
xor eax, 0xb4ca6320
rol eax, 0x6c
popf
pushf
not eax
add eax, 0xd852227d
xor eax, 0xbb32d6a4
rol eax, 0xf5
popf
cmp eax, 4
jne 0x1401bfaac
popf
pop rax
jmp 0x1401bfd50
cmp eax, 0
jne 0x1401bfabb
popf
pop rax
jmp 0x1401bfb6f
cmp eax, 3
jne 0x1401bfaca
popf
pop rax
jmp 0x1401bfd06
cmp eax, 1
jne 0x1401bfad9
popf
pop rax
jmp 0x1401bfc12
cmp eax, 0xd
jne 0x1401bfae8
popf
pop rax
jmp 0x1401c00ee
cmp eax, 7
jne 0x1401bfaf7
popf
pop rax
jmp 0x1401bff1a
cmp eax, 6
jne 0x1401bfb06
popf
pop rax
jmp 0x1401bfe81
cmp eax, 0xb
jne 0x1401bfb15
popf
pop rax
jmp 0x1401c005e
cmp eax, 0xc
jne 0x1401bfb24
popf
pop rax
jmp 0x1401c00b1
cmp eax, 8
jne 0x1401bfb33
popf
pop rax
jmp 0x1401bff82
cmp eax, 5
jne 0x1401bfb42
popf
pop rax
jmp 0x1401bfdd3
cmp eax, 2
jne 0x1401bfb51
popf
pop rax
jmp 0x1401bfc5f
cmp eax, 9
jne 0x1401bfb60
popf
pop rax
jmp 0x1401bfff8
cmp eax, 0xa
jne 0x1401bfb6f
popf
pop rax
jmp 0x1401c0037
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
jmp 0x1401bfb89
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x1401bfbcc
push rax
pushf
mov eax, 0x3ccc9be4
pushf
not eax
add eax, 0xb69566c8
xor eax, 0xbe8729ee
rol eax, 0x2d
popf
pushf
not eax
add eax, 0xd64cdee2
xor eax, 0xc9eb25f8
rol eax, 0xc4
popf
jmp 0x1401bfa9d
push rax
pushf
mov eax, 0xe457ca4f
pushf
not eax
add eax, 0xe52a283b
xor eax, 0xd815c21f
rol eax, 0x97
popf
pushf
not eax
add eax, 0xf31056e9
xor eax, 0x8afc8683
rol eax, 0xe4
popf
pushf
not eax
add eax, 0xb9b09003
xor eax, 0x93b93e5b
rol eax, 0x96
popf
jmp 0x1401bfa9d
xor eax, eax
jmp 0x1401c00fb
mov rbp, rbx
cmp word [rax], si
je 0x1401bfcad
push rax
pushf
mov eax, 0xda82088
pushf
not eax
add eax, 0xaf3369c6
xor eax, 0xd0024524
rol eax, 0xe3
popf
pushf
not eax
add eax, 0xa12e8ba9
xor eax, 0xb0204803
rol eax, 0xac
popf
pushf
not eax
add eax, 0xf3d6c311
xor eax, 0x81a8d8c4
rol eax, 0xa6
popf
jmp 0x1401bfa9d
push rax
pushf
mov eax, 0x14245596
pushf
not eax
add eax, 0xd0b3d51f
xor eax, 0x866edbca
rol eax, 0xcf
popf
pushf
not eax
add eax, 0xc74474ed
xor eax, 0x94976320
rol eax, 0x32
popf
pushf
not eax
add eax, 0xc8a284cb
xor eax, 0xb9eeeb84
rol eax, 0x50
popf
pushf
not eax
add eax, 0xec5ad924
xor eax, 0xd5dc8a43
rol eax, 0x40
popf
jmp 0x1401bfa9d
or rax, 0xffffffffffffffff
push rax
pushf
mov eax, 0xb54975e4
pushf
not eax
add eax, 0xf43427e8
xor eax, 0xb60ba242
rol eax, 0x58
popf
pushf
not eax
add eax, 0xca9b86b2
xor eax, 0xa6eb6edd
rol eax, 0xa5
popf
pushf
not eax
add eax, 0xfb33e1a9
xor eax, 0xfbf87223
rol eax, 0x91
popf
jmp 0x1401bfa9d
inc rax
cmp word [rbp + rax*2], si
jne 0x1401bfd8d
push rax
pushf
mov eax, 0x170db6cc
pushf
not eax
add eax, 0x8900194f
xor eax, 0x8167639d
rol eax, 0xc9
popf
pushf
not eax
add eax, 0xdfeea31a
xor eax, 0xb5ec6368
rol eax, 0xfc
popf
jmp 0x1401bfa9d
push rax
pushf
mov eax, 0x429ecded
pushf
not eax
add eax, 0xdf5b6f37
xor eax, 0xe67e61cd
rol eax, 0xb0
popf
pushf
not eax
add eax, 0xf5566cfa
xor eax, 0x8b1a7c65
rol eax, 0x2b
popf
pushf
not eax
add eax, 0xfccbd2d2
xor eax, 0x80593cd3
rol eax, 0xc5
popf
jmp 0x1401bfa9d
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x1401bfe3b
push rax
pushf
mov eax, 0x80dd0e2b
pushf
not eax
add eax, 0xa9f5def5
xor eax, 0xa356f110
rol eax, 0xc
popf
pushf
not eax
add eax, 0x99a93c4a
xor eax, 0x8e04d1bb
rol eax, 0xf8
popf
pushf
not eax
add eax, 0xbb43b945
xor eax, 0xad95b929
rol eax, 0xb9
popf
pushf
not eax
add eax, 0xaeea8b55
xor eax, 0xb8894db3
rol eax, 0x3a
popf
jmp 0x1401bfa9d
push rax
pushf
mov eax, 0xcabfe35c
pushf
not eax
add eax, 0xcfde416d
xor eax, 0xa2628c2b
rol eax, 0x20
popf
pushf
not eax
add eax, 0xaf5b6923
xor eax, 0x8c128f1c
rol eax, 0x70
popf
pushf
not eax
add eax, 0xa0fdf46f
xor eax, 0x870268a4
rol eax, 0xbf
popf
jmp 0x1401bfa9d
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1401e9a12
movsxd r14, eax
test eax, eax
jne 0x1401bfee7
push rax
pushf
mov eax, 0x79ec66fc
pushf
not eax
add eax, 0xc5c6c90e
xor eax, 0x879669b7
rol eax, 0x3b
popf
pushf
not eax
add eax, 0xc5b54c07
xor eax, 0x8f52eba7
rol eax, 0x7f
popf
jmp 0x1401bfa9d
push rax
pushf
mov eax, 0x141c6a00
pushf
not eax
add eax, 0x9eddb5ea
xor eax, 0xa58e966e
rol eax, 0x16
popf
pushf
not eax
add eax, 0xe45e72ff
xor eax, 0x82d29f07
rol eax, 0xed
popf
jmp 0x1401bfa9d
mov rcx, rbx
jmp 0x1401bff1e
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x1401bfc12
mov rcx, r14
call fcn.14018cb5f
mov rdi, rax
test rax, rax
jne 0x1401bffc5
push rax
pushf
mov eax, 0x854c9d09
pushf
not eax
add eax, 0x83d3940f
xor eax, 0x92899105
rol eax, 0x1b
popf
pushf
not eax
add eax, 0xcb95c1ca
xor eax, 0xc83544d9
rol eax, 0xfa
popf
jmp 0x1401bfa9d
push rax
pushf
mov eax, 0x168118ca
pushf
not eax
add eax, 0x8900b452
xor eax, 0x910ce243
rol eax, 0x71
popf
pushf
not eax
add eax, 0xdc174755
xor eax, 0xed8d806e
rol eax, 0x69
popf
jmp 0x1401bfa9d
xor ecx, ecx
call fcn.1401db1bf
jmp 0x1401bff1a
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1401e9a12
test eax, eax
jne 0x1401c00b1
mov rcx, rdi
call fcn.1401db1bf
jmp 0x1401c00ee
xor ecx, ecx
call fcn.1401db1bf
mov rsi, rdi
push rax
pushf
mov eax, 0x36c444e5
pushf
not eax
add eax, 0xe0753b18
xor eax, 0xccd7a993
rol eax, 0xb9
popf
pushf
not eax
add eax, 0xdf7b8b33
xor eax, 0x9cb0bdd3
rol eax, 0x7b
popf
jmp 0x1401bfa9d
mov rcx, rbx
jmp 0x1401c00f2
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret