Function at 0x140419020
Capabilities:
Query environment variable

Disassembly:
push r12
push r14
push r15
sub rsp, 0x20
mov r14d, r8d
mov r15, rdx
mov r12, rcx
call fcn.140416a00
test eax, eax
je 0x14041904c
mov eax, reloc.WS2_32.dll_setsockopt
add rsp, 0x20
pop r15
pop r14
pop r12
ret
mov qword [rsp + 0x40], rbx
mov ecx, 0x12218
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
call qword [str.PhA_]
mov rbx, rax
test rax, rax
jne 0x14041907c
xor esi, esi
lea eax, [rbx + 0xf]
mov qword [r12], rsi
jmp 0x14041929a
mov qword [rsp + 0x48], rbp
call fcn.14041f8b0
xor esi, esi
mov qword [rbx], 0xffffffffffffffff
mov qword [rbx + 8], 0xffffffffffffffff
mov qword [rbx + 0x10], 0xffffffffffffffff
mov qword [rbx + 0x18], 0xffffffffffffffff
mov dword [rbx + 0x50], 0xffffffff
mov dword [rbx + 0x20], 0xffffffff
mov dword [rbx + 0x98], 0xffffffff
mov dword [rbx + 0x30], 0xffffffff
mov dword [rbx + 0x40], 0xffffffff
mov dword [rbx + 0x1a0], esi
mov qword [rbx + 0x48], rsi
mov qword [rbx + 0x28], rsi
mov qword [rbx + 0x38], rsi
mov qword [rbx + 0x90], rsi
mov qword [rbx + 0x121d0], rsi
mov qword [rbx + 0x121d8], rsi
mov qword [rbx + 0x121e0], rsi
mov qword [rbx + 0x121e8], rsi
mov qword [rbx + 0x121f0], rsi
mov qword [rbx + 0x121f8], rsi
mov qword [rbx + 0x12200], rsi
mov qword [rbx + 0x12208], rsi
mov qword [rbx + 0x12210], rsi
mov dword [rbx + 0x1b0], esi
movsxd rcx, eax
xor eax, eax
mov qword [rbx + 0x1a8], rcx
lea rcx, [rbx + 0x1b8]
mov qword [rbx + 0x54], rax
mov qword [rbx + 0x5c], rax
mov qword [rbx + 0x64], rax
mov qword [rbx + 0x6c], rax
mov dword [rbx + 0x74], esi
mov qword [rbx + 0x78], rax
mov qword [rbx + 0x80], rax
call fcn.14041f530
lea rdi, [rbx + 0x1d0]
mov ebp, 0x800
nop dword [rax]
mov rcx, rdi
call fcn.14041f530
add rdi, 0x18
sub rbp, 1
jne 0x140419170
lea rdi, [rbx + 0xc1d0]
mov ebp, 0x400
nop
mov rcx, rdi
call fcn.14041f530
add rdi, 0x18
sub rbp, 1
jne 0x140419190
mov r8d, r14d
mov rdx, r15
mov rcx, rbx
call fcn.14041a690
mov edi, eax
test eax, eax
jne 0x140419233
lea rcx, str.LOCALDOMAIN
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1404191dd
cmp dword [rbx + 0x30], 0xffffffff
jne 0x1404191dd
mov rdx, rax
mov rcx, rbx
call fcn.14041adc0
test eax, eax
jne 0x140419206
lea rcx, str.RES_OPTIONS
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x1404191fe
mov rdx, rax
mov rcx, rbx
call fcn.14041ac20
test eax, eax
jne 0x140419206
mov rcx, rbx
call fcn.14041a9e0
mov rcx, rbx
call fcn.14041a400
mov edi, eax
test eax, eax
jne 0x140419233
lea ecx, [rax + 0x1f]
lea rbp, [rbx + 0x9e]
call qword [str.PhA_]
mov r14, rax
test rax, rax
jne 0x1404192b4
lea edi, [rax + 0xf]
mov rcx, qword [rbx + 0x90]
test rcx, rcx
je 0x140419245
call qword [str._hA_]
movsxd rax, dword [rbx + 0x30]
cmp eax, 0xffffffff
je 0x14041925a
mov rcx, qword [rbx + 0x28]
mov rdx, rax
call fcn.14041f860
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x140419269
call qword [str._hA_]
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x140419278
call qword [str._hA_]
mov rcx, qword [rbx + 0x12210]
test rcx, rcx
je 0x14041928a
call qword [str._hA_]
mov rcx, rbx
call qword [str._hA_]
mov eax, edi
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
xor eax, eax
mov rcx, rbp
mov qword [r14], rax
mov r15d, 0x100
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], rax
mov dword [r14 + 0x18], eax
mov word [r14 + 0x1c], ax
mov byte [r14 + 0x1e], al
nop word [rax + rax]
mov byte [rcx], al
lea rcx, [rcx + 1]
inc ax
cmp ax, r15w
jl 0x1404192e0
mov rax, qword [0x14069d018]
test rax, rax
je 0x140419309
mov edx, 0x1f
mov rcx, rbp
call rax
test al, al
jne 0x140419332
mov rdi, rsi
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x140419326
dec eax
or eax, 0xffffff00
inc eax
mov byte [rdi + rbp], al
inc rdi
cmp rdi, 0x1f
jl 0x140419310
xor r8b, r8b
mov word [rbp + 0x100], si
xor r10b, r10b
mov r9, rbp
nop dword [rax]
nop word [rax + rax]
movzx edx, byte [r9]
lea r9, [r9 + 1]
movzx eax, r8b
movzx r8d, r8b
inc r8d
movzx ecx, byte [rax + r14]
add cl, dl
add r10b, cl
movzx ecx, r10b
movzx eax, byte [rcx + rbp]
mov byte [r9 - 1], al
mov eax, 0x8421085
mov byte [rcx + rbp], dl
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 4
imul eax, eax, 0x1f
sub r8d, eax
sub r15, 1
jne 0x140419350
mov rcx, r14
call qword [str._hA_]
mov rcx, rbp
call fcn.140416a20
mov word [rbx + 0x9c], ax
test byte [rbx], 2
je 0x1404193cc
cmp dword [rbx + 0x98], 1
jle 0x1404193cc
mov dword [rbx + 0x98], 1
mov ebp, esi
cmp dword [rbx + 0x98], esi
jle 0x140419443
mov r14, rsi
nop dword [rax]
mov rdi, qword [rbx + 0x90]
add rdi, r14
mov qword [rdi + 0x20], 0xffffffffffffffff
lea rcx, [rdi + 0x68]
mov qword [rdi + 0x28], 0xffffffffffffffff
inc dword [rbx + 0x1a0]
mov eax, dword [rbx + 0x1a0]
mov dword [rdi + 0x60], eax
mov qword [rdi + 0x34], rsi
mov dword [rdi + 0x48], esi
mov qword [rdi + 0x40], rsi
mov qword [rdi + 0x50], rsi
mov qword [rdi + 0x58], rsi
call fcn.14041f530
inc ebp
mov qword [rdi + 0x80], rbx
add r14, 0x90
mov dword [rdi + 0x88], esi
cmp ebp, dword [rbx + 0x98]
jl 0x1404193e0
mov qword [r12], rbx
xor eax, eax
jmp 0x140419295