Function at 0x1400012f0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2a0
movaps xmmword [rsp + 0x290], xmm6
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [0x140007098]
test rcx, rcx
je 0x140001651
lea rdx, str.FDICreate
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rbx
mov qword [0x140007080], rax
mov rcx, qword [0x140007098]
lea rdx, str.FDIDestroy
call rbx
mov qword [0x140007090], rax
mov rcx, qword [0x140007098]
lea rdx, str.FDICopy
call rbx
mov rcx, rax
mov qword [0x140007088], rax
xor eax, eax
cmp qword [0x140007080], 0
je 0x140001605
cmp qword [0x140007090], 0
je 0x140001605
test rcx, rcx
je 0x140001605
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cdqe
lea r14, [rdi + rax*2]
test eax, eax
jle 0x1400013b1
cmp word [r14], 0x5c
je 0x1400013b1
add r14, 0xfffffffffffffffe
cmp r14, rdi
ja 0x1400013a1
cmp r14, rdi
je 0x1400015df
add r14, 2
xorps xmm6, xmm6
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor ebx, ebx
mov ecx, 0xfde9
xor edx, edx
mov r8, r14
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x140001440
mov ebp, eax
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor ebx, ebx
mov rcx, rax
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140001440
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, r14
mov r9d, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rbx, r15
sub r14, rdi
shr r14, 1
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov ecx, 0xfde9
xor edx, edx
mov r8, rdi
mov r9d, r14d
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
je 0x1400015e3
mov r12d, eax
xor eax, eax
cmp r14d, 0xffffffff
setne al
add r12d, eax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1400015e3
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
xor edx, edx
mov r8, rdi
mov r9d, r14d
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp r14d, 0xffffffff
je 0x1400014da
movsxd rax, r12d
mov byte [r15 + rax - 1], 0
test rbx, rbx
je 0x14000161f
lea rcx, [rsp + 0x50]
mov dword [rcx + 8], 0
mov qword [rcx], 0
mov rax, qword [0x140007080]
mov qword [rsp + 0x40], rcx
lea rcx, [0x140001770]
mov qword [rsp + 0x30], rcx
lea rcx, [0x140001780]
mov qword [rsp + 0x28], rcx
lea rcx, [0x1400017a0]
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x38], 0xffffffff
lea rcx, [0x140001980]
lea rdx, [0x140001950]
lea r8, [0x140001820]
lea r9, [0x1400017e0]
call qword [0x1400058d8]
test rax, rax
je 0x14000161f
mov r14, rax
lea rdi, [rsp + 0x68]
mov qword [rdi - 8], rsi
mov rcx, rdi
call fcn.140001d50
mov byte [rdi + 0x218], 0
mov rax, qword [0x140007088]
lea rsi, [rsp + 0x60]
mov qword [rsp + 0x30], rsi
lea rcx, [0x1400019b0]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], 0
mov rcx, r14
mov rdx, rbx
mov r8, r15
xor r9d, r9d
call qword [0x1400058d8]
mov rax, qword [0x140007090]
mov rcx, r14
call qword [0x1400058d8]
mov sil, byte [rsi + 0x220]
mov rcx, rdi
cmp sil, 1
je 0x140001639
call fcn.140001e50
test al, al
je 0x140001647
mov rcx, rdi
call fcn.140001e60
jmp 0x140001647
xor eax, eax
jmp 0x140001605
xor esi, esi
mov eax, 0
test rbx, rbx
je 0x140001605
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
movaps xmm6, xmmword [rsp + 0x290]
add rsp, 0x2a0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, esi
jmp 0x1400015ea
call fcn.140001f20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rdi
call fcn.140001d70
jmp 0x140001621
lea rbx, [rsp + 0x60]
mov r8d, 0x208
mov rcx, rbx
xor edx, edx
call fcn.140003d90
lea rcx, str._WINDIR__system32cabinet.dll
mov rdx, rbx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x104
jb 0x14000168e
mov rcx, qword [0x140007098]
jmp 0x1400016ab
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
mov qword [0x140007098], rax
test rcx, rcx
jne 0x14000131f
lea rdx, [rsp + 0x60]
mov word [rdx], 0
lea rcx, str._SYSTEMROOT__system32cabinet.dll
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x104
jb 0x1400016e3
mov rcx, qword [0x140007098]
jmp 0x140001700
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
mov qword [0x140007098], rax
test rcx, rcx
jne 0x14000131f
lea rdx, [rsp + 0x60]
mov word [rdx], 0
lea rcx, str.C:Windows_system32cabinet.dll
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec eax
cmp eax, 0x104
jb 0x140001738
mov rcx, qword [0x140007098]
jmp 0x140001755
lea rcx, [rsp + 0x60]
xor edx, edx
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rcx, rax
mov qword [0x140007098], rax
test rcx, rcx
jne 0x14000131f
mov rcx, qword [0x140007088]
jmp 0x140001367