Function at 0x1400f88d4
Capabilities:
Query environment variable

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
lea rbp, [rsp - 0x4b0]
sub rsp, 0x5b0
mov rax, qword [0x1401f5698]
xor rax, rsp
mov qword [rbp + 0x4a0], rax
xor r13d, r13d
mov r12, r9
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
je 0x1400f8919
cmp word [rdx], r13w
jne 0x1400f8920
lea rbx, str._TEMP_ConEmu
test r8, r8
je 0x1400f892b
cmp word [r8], r13w
jne 0x1400f8932
lea rdi, str.ConEmu.tmp
mov edx, 0x25
mov rcx, rbx
call fcn.14012cc40
mov r8d, 0x104
test rax, rax
je 0x1400f8982
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x102
jbe 0x1400f898f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea rdx, str.CreateTempFile.ExpandEnvironmentStrings__s__failed__code_u
mov r8, rbx
mov rcx, rsi
call fcn.1400fafbc
xor eax, eax
jmp 0x1400f8c6f
mov rdx, rbx
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov r14d, 0x3a
lea rcx, [rbp - 0x80]
mov edx, r14d
call fcn.14012cc40
test rax, rax
je 0x1400f89c7
mov edx, r14d
lea rcx, [rax + 2]
call fcn.14012cc40
test rax, rax
je 0x1400f89c7
xor r9d, r9d
lea r8, [rbp - 0x80]
lea rdx, str.Invalid_download_path____TEMP___variable___n_s
jmp 0x1400f8973
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rdx, eax
test eax, eax
jg 0x1400f89e4
xor r9d, r9d
lea rdx, str.CreateTempFile.asDir__s__failed__path_is_null
jmp 0x1400f8970
lfence
lea eax, [rdx - 1]
mov r8d, 0x5c
movsxd rcx, eax
cmp word [rbp + rcx*2 - 0x80], r8w
je 0x1400f8a1b
mov word [rbp + rdx*2 - 0x80], r8w
inc edx
movsxd rax, edx
add rax, rax
cmp rax, 0x414
jae 0x1400f8c90
mov word [rbp + rax - 0x80], r13w
movsxd rax, edx
lea rcx, [rbp - 0x80]
xor edx, edx
lea rcx, [rcx + rax*2]
mov qword [rsp + 0x40], rcx
lea rcx, [rbp - 0x80]
call fcn.1401145e0
mov rcx, rdi
mov qword [rsp + 0x48], rax
call fcn.140118eac
mov rdi, rax
mov r14d, 0x2e
test rax, rax
je 0x1400f8a5d
cmp word [rax], r13w
je 0x1400f8a5d
cmp word [rax], r14w
jne 0x1400f8a64
lea rdi, [0x140178678]
mov rcx, rdi
call fcn.140118e88
test rax, rax
lea rcx, str..tmp
mov r8d, 0x70
mov rdx, rdi
cmovne rcx, rax
mov qword [rsp + 0x50], rcx
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.KERNEL32.dll_lstrcpynW]
mov edx, r14d
lea rcx, [rbp + 0x3a0]
call fcn.14012dd3c
test rax, rax
je 0x1400f8aad
mov word [rax], r13w
mov r8, qword [rsp + 0x40]
lea r9, [rbp + 0x3a0]
xor r10d, r10d
mov r14, r13
sub r9, r8
mov edi, r10d
mov qword [rsp + 0x58], r9
mov edx, 0x104
mov rcx, r8
lea rax, [rdx + 0x7ffffefa]
test rax, rax
je 0x1400f8af5
movzx eax, word [r9 + rcx]
test ax, ax
je 0x1400f8af5
mov word [rcx], ax
add rcx, 2
sub rdx, 1
jne 0x1400f8ad2
test rdx, rdx
lea rax, [rcx - 2]
cmovne rax, rcx
mov word [rax], r10w
test edi, edi
je 0x1400f8b2e
or rax, 0xffffffffffffffff
inc rax
cmp word [r8 + rax*2], r10w
jne 0x1400f8b0c
lea rcx, [r8 + rax*2]
mov r9d, edi
lea r8, str.__u_
mov edx, 0x10
call fcn.1401145a0
mov r8, qword [rsp + 0x50]
mov edx, 0x104
mov rcx, qword [rsp + 0x40]
call fcn.140001e48
and qword [rsp + 0x30], r14
lea r9, [rsp + 0x60]
and qword [rsp + 0x68], r14
lea rcx, [rbp - 0x80]
mov dword [rsp + 0x28], 0x180
mov edx, 0x40000000
mov r8d, 1
mov dword [rsp + 0x20], 1
mov dword [rsp + 0x60], 0x18
mov dword [rsp + 0x70], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [r12], rax
inc rax
test rax, 0xfffffffffffffffe
jne 0x1400f8bd5
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor r10d, r10d
mov r13d, eax
cmp eax, 3
jne 0x1400f8bd8
test edi, edi
jne 0x1400f8bd8
mov rcx, qword [rsp + 0x48]
call fcn.140123a38
xor r10d, r10d
test al, al
jne 0x1400f8bd8
xor r9d, r9d
lea rdx, str.CreateTempFile.asDir__s__failed
mov r8, rbx
mov rcx, rsi
call fcn.1400fafbc
jmp 0x1400f8c5a
xor r10d, r10d
mov rcx, qword [r12]
inc rcx
test rcx, 0xfffffffffffffffe
jne 0x1400f8c1d
inc edi
cmp edi, 0x270f
ja 0x1400f8c01
mov r8, qword [rsp + 0x40]
mov r9, qword [rsp + 0x58]
jmp 0x1400f8aca
mov r9d, r13d
lea r8, [rbp - 0x80]
lea rdx, str.Cant_create_temp_file__s___code_u
mov rcx, rsi
call fcn.1400fafbc
and qword [r12], r14
jmp 0x1400f8c5a
xor edx, edx
lea rcx, [rbp - 0x80]
call fcn.1401145e0
mov r14, rax
test rax, rax
jne 0x1400f8c5a
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [r12], r14
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, str.Cant_allocate_memory___i_bytes_
mov rcx, rsi
mov r8d, eax
call fcn.1400fb068
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x1400f8c6c
mov rcx, rax
call fcn.140113e18
mov rax, r14
mov rcx, qword [rbp + 0x4a0]
xor rcx, rsp
call fcn.14012bda0
add rsp, 0x5b0
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.14012c3e0
int3