Function at 0x14002e900
Capabilities:
Query environment variable

Disassembly:
cmp dword [0x14012fb90], 0
jne case.0x14002e93d.13
mov eax, dword [0x14012fb94]
dec eax
cmp eax, 0xfd
ja case.0x14002e93d.13
lea r8, [0x140000000]
cdqe
movzx eax, byte [r8 + rax + 0x2ea3c]
mov edx, dword [r8 + rax*4 + 0x2ea04]
add rdx, r8
jmp rdx
mov rdx, rcx
lea rcx, [0x14012fb90]
jmp 0x1400339d0
mov rdx, rcx
lea rcx, [0x14012fb90]
jmp 0x140033ab0
mov rdx, rcx
lea rcx, [0x14012fb90]
jmp 0x140033b20
mov rdx, rcx
lea rcx, [0x14012fb90]
jmp 0x140033c00
mov rdx, rcx
lea rcx, [0x14012fb90]
jmp fcn.140033c80
mov rdx, rcx
lea rcx, [0x14012fb90]
jmp 0x140033930
mov rdx, rcx
lea rcx, [0x14012fb90]
jmp method.CBorrowing.virtual_0
mov rdx, rcx
lea rcx, [0x14012fb90]
jmp method.CBorrowing.virtual_0
mov rdx, rcx
lea rcx, [0x14012fb90]
jmp 0x140033b90
mov rdx, rcx
lea rcx, [0x14012fb90]
jmp 0x140033f40
mov rdx, rcx
lea rcx, [0x14012fb90]
jmp 0x140033fd0
mov rdx, rcx
lea rcx, [0x14012fb90]
jmp 0x1400343d0
mov rdx, rcx
lea rcx, [0x14012fb90]
jmp fcn.140033150
ret
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x14012bc80]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
mov rdi, rdx
mov r8, rdx
lea rcx, [rsp + 0x20]
mov edx, 0x22
call fcn.140034ac0
mov rcx, qword [rbx + 8]
mov esi, eax
test eax, eax
jne 0x14002f14a
call fcn.1400108e4
lea rcx, [rsp + 0x20]
mov rdx, rdi
call fcn.14002a950
mov dword [rbx], esi
mov qword [rbx + 8], rax
jmp 0x14002f159
call fcn.1400108e4
mov qword [rbx + 8], 0
mov dword [rbx], esi
mov rdx, rdi
mov rcx, rbx
call fcn.14002f4b0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14000c9f0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
ret 0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov r8, rdx
mov rsi, rcx
lea rdx, [0x140107ec8]
add rcx, 8
call fcn.14002f050
lea rcx, [rsi + 0x18]
lea rdx, [0x140107ec8]
mov r8, rdi
call fcn.14002f050
lea rcx, [rsi + 0x28]
lea rdx, [0x1400fca4c]
mov r8, rdi
call fcn.14002f050
lea rcx, [rsi + 0x38]
mov rdx, rdi
call fcn.14002f190
cmp dword [rsi + 0x38], 0
je 0x1400339a8
lea rcx, [rsi + 0x38]
call fcn.14002ef50
mov dword [rsi + 0x38], 3
mov qword [rsi + 0x40], 0
lea rcx, [rsi + 0x48]
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x14002f0f0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x140033a04
mov rax, qword [rdx + 0x10]
test rax, rax
je 0x140033a04
mov rcx, qword [rbx]
mov r9d, send
lea r8, str.Populating_VMWARE_Attributes....
lea edx, [r9 - 5]
call rax
lea rcx, [rdi + 8]
lea rdx, str.VMWARE
mov r8, rbx
call fcn.14002f050
call fcn.1400387a0
lea rcx, [rdi + 0x18]
mov r8, rbx
dec eax
je 0x140033a3d
dec eax
je 0x140033a34
lea rdx, str.VMWARE
jmp 0x140033a44
lea rdx, str.SERVER
jmp 0x140033a44
lea rdx, str.DESKTOP
call fcn.14002f050
lea rcx, [rdi + 0x28]
lea rdx, [0x1400fca4c]
mov r8, rbx
call fcn.14002f050
lea rcx, [rdi + 0x38]
mov rdx, rbx
call fcn.14002f190
lea rcx, [rdi + 0x48]
mov rdx, rbx
call 0x14002f0f0
test rbx, rbx
je 0x140033a98
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140033a98
mov rcx, qword [rbx]
mov r9d, 0x26
lea r8, str.Attribute_Population_Done
lea edx, [r9 - 0x1d]
call rax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov r8, rdx
mov rbx, rcx
lea rdx, str.MICROSOFT
add rcx, 8
call fcn.14002f050
lea rcx, [rbx + 0x18]
lea rdx, str.HYPERV
mov r8, rdi
call fcn.14002f050
lea rcx, [rbx + 0x28]
lea rdx, [0x1400fca4c]
mov r8, rdi
call fcn.14002f050
lea rcx, [rbx + 0x38]
mov rdx, rdi
call fcn.14002f190
lea rcx, [rbx + 0x48]
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14002f0f0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov r8, rdx
mov rbx, rcx
lea rdx, str.MICROSOFT
add rcx, 8
call fcn.14002f050
lea rcx, [rbx + 0x18]
lea rdx, str.VIRTUALPC
mov r8, rdi
call fcn.14002f050
lea rcx, [rbx + 0x28]
lea rdx, [0x1400fca4c]
mov r8, rdi
call fcn.14002f050
lea rcx, [rbx + 0x38]
mov rdx, rdi
call fcn.14002f190
lea rcx, [rbx + 0x48]
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14002f0f0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov r8, rdx
mov rbx, rcx
lea rdx, str.VIRTUALBOX
add rcx, 8
call fcn.14002f050
lea rcx, [rbx + 0x18]
lea rdx, str.VIRTUALBOX
mov r8, rdi
call fcn.14002f050
lea rcx, [rbx + 0x28]
lea rdx, [0x1400fca4c]
mov r8, rdi
call fcn.14002f050
lea rcx, [rbx + 0x38]
mov rdx, rdi
call fcn.14002f190
lea rcx, [rbx + 0x48]
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14002f0f0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov r8, rdx
mov rbx, rcx
lea rdx, str.EVERRUN
add rcx, 0x18
call fcn.14002f050
lea rcx, [rbx + 8]
lea rdx, str.STRATUS
mov r8, rdi
call fcn.14002f050
lea rcx, [rbx + 0x28]
lea rdx, [0x1400fca4c]
mov r8, rdi
call fcn.14002f050
lea rcx, [rbx + 0x38]
mov rdx, rdi
call fcn.14002f190
lea rcx, [rbx + 0x48]
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14002f0f0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x140033f74
mov rax, qword [rdx + 0x10]
test rax, rax
je 0x140033f74
mov rcx, qword [rbx]
mov r9d, reloc.WS2_32.dll_send
lea r8, str.Populating_QEMU_VM_Attributes
lea edx, [r9 - 0xa]
call rax
lea rcx, [rdi + 8]
lea rdx, str.QEMU
mov r8, rbx
call fcn.14002f050
lea rcx, [rdi + 0x18]
mov rdx, rbx
call fcn.140033d70
lea rcx, [rdi + 0x28]
lea rdx, [0x1400fca4c]
mov r8, rbx
call fcn.14002f050
lea rcx, [rdi + 0x38]
mov rdx, rbx
call fcn.14002f190
lea rcx, [rdi + 0x48]
mov rdx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14002f0f0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
test rdx, rdx
je 0x140034004
mov rax, qword [rdx + 0x10]
test rax, rax
je 0x140034004
mov rcx, qword [rbx]
mov r9d, reloc.WS2_32.dll_inet_ntoa
lea r8, str.Populating_PARALLELS_VM_Attributes
lea edx, [r9 - 3]
call rax
lea rcx, [rdi + 8]
lea rdx, str.PARALLELS
mov r8, rbx
call fcn.14002f050
lea rcx, [rdi + 0x18]
lea rdx, str.PARALLELS
mov r8, rbx
call fcn.14002f050
lea rcx, [rdi + 0x28]
lea rdx, [0x1400fca4c]
mov r8, rbx
call fcn.14002f050
lea rcx, [rdi + 0x38]
mov rdx, rbx
call fcn.14002f190
lea rcx, [rdi + 0x48]
mov rdx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14002f0f0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov r8, rdx
mov rbx, rcx
lea rdx, str.MICROSOFT
add rcx, 8
call fcn.14002f050
lea rcx, [rbx + 0x18]
lea rdx, str.AZURE
mov r8, rdi
call fcn.14002f050
lea rcx, [rbx + 0x28]
lea rdx, [0x1400fca4c]
mov r8, rdi
call fcn.14002f050
lea rcx, [rbx + 0x38]
mov rdx, rdi
call fcn.14002f190
lea rcx, [rbx + 0x48]
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x14002f0f0