Function at 0x1800bd070
Capabilities:
Query environment variable
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x1800f6ae8]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov r12d, dword [rbp + 0x420]
mov rsi, r9
movzx r11d, byte [rsp + 0x30]
mov r14, rdx
mov ebx, dword [rsp + 0x60]
mov edx, r12d
mov qword [rsp + 0x58], r9
mov r13, r8
mov r10, qword [rsp + 0x58]
lea eax, [r12 - 0xe]
mov qword [rbp - 0x80], rcx
mov r9, rcx
mov ecx, dword [rsp + 0x60]
lea r8, [0x1800e2a1c]
mov dword [rsp + 0x44], edx
mov qword [rsp + 0x50], r10
mov dword [rsp + 0x34], ecx
mov byte [rsp + 0x30], r11b
cmp r12d, eax
jbe 0x1800bd6da
mov rax, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x40]
mov r15d, dword [rsp + 0x68]
mov r12, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x70], rax
lea eax, [rdx - 0x36]
lea rdi, [0x180000000]
cmp eax, 0x31
ja case.default.0x1800bd141
movzx eax, byte [rdi + rax + 0xbdac4]
mov ecx, dword [rdi + rax*4 + 0xbda88]
add rcx, rdi
jmp rcx
test r8d, r8d
je 0x1800bd1fb
nop dword [rax]
mov edi, 0x106
mov eax, edi
sub eax, 0x106
je 0x1800bd1ad
sub eax, 1
je 0x1800bd172
cmp eax, 1
jne 0x1800bd1d5
mov r8d, dword [r14]
mov dword [rsp + 0x40], r8d
jmp 0x1800bd1d5
cmp dword [r14 + 0x14], 0xfee1dead
jne 0x1800bd1d5
mov eax, dword [rsi]
cmp dword [r14 + 4], eax
jb 0x1800bd1d5
mov ecx, 0x96
nop dword [rax]
mov eax, ecx
sub eax, 0x95
je case.0x1800bd141.65
cmp eax, 1
jne 0x1800bd1a1
mov ebx, r8d
dec ecx
cmp ecx, 0x94
ja 0x1800bd190
jmp 0x1800bd1d5
mov dword [rsp + 0x60], r8d
lea r9, [rsp + 0x60]
mov r8, r14
mov rdx, r13
mov ecx, 0x4c
call fcn.1800a93b0
cmp eax, 0xffffffff
je 0x1800bd6c0
mov r8d, dword [rsp + 0x40]
inc edi
cmp edi, 0x109
jb 0x1800bd155
test r8d, r8d
jne 0x1800bd150
mov edx, dword [rsp + 0x44]
mov r10, qword [rsp + 0x50]
movzx r11d, byte [rsp + 0x30]
xor ebx, ebx
jmp case.0x1800bd141.68
mov ecx, 0x9d
mov eax, ecx
sub eax, 0x9d
je 0x1800bd241
cmp eax, 0x44
jne 0x1800bd24b
mov eax, ebx
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.1800d1090
mov rbx, qword [rsp + 0x518]
add rsp, 0x4c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, dword [rsi]
xor ebx, ebx
cmp dword [r14], eax
sete bl
add ecx, 0x44
cmp ecx, 0x125
jb 0x1800bd207
mov edx, 1
mov rcx, r10
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__access]
test eax, eax
je 0x1800bd65f
mov edi, 0x10a
mov eax, edi
sub eax, 0x108
je 0x1800bd566
sub eax, 1
je 0x1800bd2d3
cmp eax, 1
jne 0x1800bd2ac
lea ecx, [rax + 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, qword [rsp + 0x50]
lea rdx, str.Optimus_whitelist_update_merged.
mov r8, qword [0x1800fba08]
mov rcx, rax
call fcn.1800d06b0
mov ecx, dword [rsp + 0x34]
dec edi
cmp edi, 0x107
ja 0x1800bd271
mov r8d, dword [rsp + 0x40]
mov edx, dword [rsp + 0x44]
mov r10, qword [rsp + 0x50]
movzx r11d, byte [rsp + 0x30]
jmp case.default.0x1800bd141
mov ecx, 1
mov dword [rsp + 0x34], ecx
jmp 0x1800bd2b0
mov ecx, dword [rsp + 0x34]
xor edi, edi
mov qword [rsp + 0x38], rdi
jmp 0x1800bd6a4
mov edx, dword [r14]
cmp edx, dword [rsi]
jae 0x1800bd697
nop dword [rax]
mov rax, qword [r13]
mov ecx, dword [rax + 0x28]
sub ecx, 0xc
cmp edx, ecx
ja 0x1800bd65f
mov edi, 0x23
mov eax, edi
sub eax, 0x22
je 0x1800bd35c
cmp eax, 1
jne 0x1800bd394
mov r12d, dword [r14]
lea r8, [rsp + 0x68]
mov rax, qword [r13]
lea rcx, [rsp + 0x60]
add r12, r9
mov qword [rsp + 0x60], rax
mov r9, r12
mov edx, 0x17
call fcn.1800623f0
test eax, eax
jne 0x1800bd6c0
mov r15d, dword [rsp + 0x68]
mov r9, qword [rbp - 0x80]
jmp 0x1800bd394
add dword [r14], r15d
cmp r15d, 8
jb 0x1800bd37c
test r15b, 3
jne 0x1800bd37c
movzx eax, word [r12 + 6]
movzx ecx, al
add ecx, 8
cmp ecx, r15d
jbe 0x1800bd394
mov eax, 0x6c
cmp eax, 0x6c
je 0x1800bd6c0
add eax, 0x7e
cmp eax, 0xea
jb 0x1800bd381
dec edi
cmp edi, 0x21
ja 0x1800bd317
mov edx, dword [r14]
cmp edx, dword [rsi]
jb 0x1800bd300
mov ecx, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x40]
mov edx, dword [rsp + 0x44]
mov r10, qword [rsp + 0x50]
movzx r11d, byte [rsp + 0x30]
jmp case.default.0x1800bd141
mov eax, dword [r13 + 0x30]
test eax, eax
jne 0x1800bd472
mov edi, 0x5c
mov eax, edi
sub eax, 0x5b
je 0x1800bd41b
cmp eax, 1
jne 0x1800bd462
lea rcx, str.CK_FORK
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x1800bd462
mov ecx, 0x3e
mov eax, ecx
sub eax, 0x3d
je case.0x1800bd141.65
cmp eax, 1
jne 0x1800bd412
mov ebx, eax
dec ecx
cmp ecx, 0x3c
ja 0x1800bd400
jmp 0x1800bd462
mov rcx, qword [rsp + 0x78]
cmp byte [rcx], 0x6e
jne 0x1800bd435
cmp byte [rcx + 1], 0x6f
jne 0x1800bd435
cmp byte [rcx + 2], 0
je 0x1800bd6d0
mov eax, 0xa0
nop word [rax + rax]
cmp eax, 0xa0
je 0x1800bda70
cmp eax, 0x1860
je case.0x1800bd141.65
add eax, 0x17c0
cmp eax, 0x2f80
jbe 0x1800bd440
dec edi
cmp edi, 0x5a
ja 0x1800bd3d8
jmp 0x1800bd3aa
mov ecx, 0xde
nop word [rax + rax]
cmp ecx, 0xde
je 0x1800bd217
add ecx, 0xde0
cmp ecx, 0xde0
jbe 0x1800bd480
jmp case.0x1800bd141.68
lea rax, str.example
mov qword [0x1800fba08], rax
cmp dword [r13], 2
je case.0x1800bd141.68
mov edi, 0x21
nop dword [rax]
cmp edi, 0x21
je 0x1800bd4d4
cmp edi, 0x4e
je 0x1800bd566
mov ecx, dword [rsp + 0x34]
jmp 0x1800bd4fe
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, qword [0x1800fba08]
lea rdx, str.dias_pour_lISO_si_n
mov rcx, rax
call fcn.1800d06b0
mov ecx, 1
mov dword [rsp + 0x34], ecx
add edi, 0x2d
cmp edi, 0x7b
jb 0x1800bd4c0
mov r8d, dword [rsp + 0x40]
mov edx, dword [rsp + 0x44]
mov r10, qword [rsp + 0x50]
movzx r11d, byte [rsp + 0x30]
jmp case.default.0x1800bd141
xor r10d, r10d
mov qword [rsp + 0x50], r10
jmp case.0x1800bd141.68
lea rdx, [0x1800e0c20]
mov rcx, r10
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov qword [rsp + 0x38], rax
mov rdi, rax
test rax, rax
jne 0x1800bd664
mov esi, 0xcd
mov ecx, esi
sub ecx, 0xcd
je 0x1800bd589
sub ecx, 1
je 0x1800bd57e
cmp ecx, 1
jne 0x1800bd5c5
mov r14, qword [rsp + 0x58]
lea r13, [0x1800e2a18]
mov r12d, dword [rbp + 0x420]
jmp 0x1800bd94c
mov ecx, 1
mov dword [rsp + 0x34], ecx
jmp 0x1800bd5c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_strerror]
mov ecx, 2
mov rdi, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r9, qword [rsp + 0x50]
lea rdx, str.IDS_CERT_ERROR_NOT_YET_VALID_DETAILS
mov r8, qword [0x1800fba08]
mov rcx, rax
mov qword [rsp + 0x20], rdi
call fcn.1800d06b0
mov ecx, dword [rsp + 0x34]
inc esi
cmp esi, 0xd0
jb 0x1800bd552
mov rsi, qword [rsp + 0x58]
mov r8d, dword [rsp + 0x40]
mov edx, dword [rsp + 0x44]
mov r10, qword [rsp + 0x50]
movzx r11d, byte [rsp + 0x30]
jmp case.default.0x1800bd141
mov r10, qword [r9 + 8]
mov qword [rsp + 0x50], r10
jmp case.0x1800bd141.68
mov eax, dword [r9]
lea r8, [rsp + 0x60]
xor edx, edx
lea r9, [rsp + 0x40]
div dword [r13 + 0x60]
mov rcx, r13
lea edx, [rdx*4 + 0xac]
mov dword [rsp + 0x60], edx
mov edx, 0x10c
call fcn.1800bea70
cmp eax, 0xffffffff
jne 0x1800bd65f
mov eax, 0xc0
cmp eax, 0xc0
je 0x1800bd64c
cmp eax, 0x2100
je case.0x1800bd141.65
jmp 0x1800bd64e
xor ebx, ebx
add eax, 0x2040
cmp eax, 0x4080
jbe 0x1800bd638
jmp 0x1800bd3aa
mov rdi, qword [rsp + 0x38]
mov r8d, dword [rsp + 0x40]
mov edx, dword [rsp + 0x44]
mov r10, qword [rsp + 0x50]
mov ecx, dword [rsp + 0x34]
movzx r11d, byte [rsp + 0x30]
jmp 0x1800bd6a4
xor eax, eax
mov r11b, 9
mov qword [rsp + 0x70], rax
mov byte [rsp + 0x30], r11b
jmp case.0x1800bd141.68
xor ecx, ecx
mov dword [rsp + 0x34], ecx
jmp case.default.0x1800bd141
mov edx, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x34]
mov rdi, qword [rsp + 0x38]
mov eax, dword [rbp + 0x420]
dec edx
add eax, 0xfffffff2
mov dword [rsp + 0x44], edx
cmp edx, eax
jbe 0x1800bd6f0
mov r9, qword [rbp - 0x80]
jmp 0x1800bd11c
xor eax, eax
jmp 0x1800bd217
mov eax, 2
jmp 0x1800bd217
mov rdi, qword [rsp + 0x58]
mov r15, qword [rsp + 0x58]
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x70], r15
jmp 0x1800bd703
mov r15, qword [rsp + 0x70]
lea r8, [0x1800e2a1c]
mov r12d, dword [rbp + 0x420]
mov r14, qword [rsp + 0x58]
lea r13, [0x1800e2a18]
mov esi, r12d
imul eax, r12d, 0x3c6
cmp esi, eax
ja case.0x1800bd141.65
cmp esi, 0x7354
ja 0x1800bd90f
je 0x1800bd8f6
cmp esi, 0x3190
ja 0x1800bd7bd
je 0x1800bd7aa
cmp esi, 0x3d
je 0x1800bd794
cmp esi, 0x10ae
je 0x1800bd78b
cmp esi, 0x211f
jne 0x1800bd777
mov ecx, 1
mov qword [rbp - 0x68], 0
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov qword [rbp - 0x58], rax
movzx r11d, byte [rsp + 0x30]
mov ecx, dword [rsp + 0x34]
mov r10, qword [rsp + 0x50]
lea r8, [0x1800e2a1c]
imul eax, r12d, 0x45
add esi, eax
jmp 0x1800bd712
mov dword [rbp - 0x6c], 0
jmp 0x1800bd777
xorps xmm0, xmm0
mov qword [rbp - 0x78], r10
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm0
movdqu xmmword [rbp - 0x60], xmm1
jmp 0x1800bd777
mov r14, 0xffffffffffffffff
inc r14
cmp byte [r10 + r14], 0
jne 0x1800bd7b1
jmp 0x1800bd777
cmp esi, 0x4201
je 0x1800bd883
cmp esi, 0x5272
je 0x1800bd832
cmp esi, 0x62e3
jne 0x1800bd777
test r15, r15
jne 0x1800bd777
mov edi, 0x8d
mov eax, edi
sub eax, 0x8c
je 0x1800bd824
cmp eax, 1
jne 0x1800bd810
lea ecx, [rax + 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov r8, qword [0x1800fba08]
lea rdx, str.Argonaut_Games_Creature_Shock
mov rcx, rax
call fcn.1800d06b0
dec edi
cmp edi, 0x8b
ja 0x1800bd7e3
mov rdi, qword [rsp + 0x38]
jmp 0x1800bd76d
mov ecx, 1
mov dword [rsp + 0x34], ecx
jmp 0x1800bd950
movsx eax, r11b
lea r9, [rbp - 0x78]
mov dword [rbp - 0x70], eax
lea rdx, [rsp + 0x78]
lea rax, [0x1800b6900]
mov byte [rsp + 0x48], r11b
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x48]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x58], 0
mov r8d, 0xea
mov qword [rsp + 0x20], rax
call fcn.180059e30
mov r15, rax
mov qword [rsp + 0x70], rax
jmp 0x1800bd76d
cmp r14, 4
jbe 0x1800bd777
lea rdx, [r14 + r10]
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + rcx - 3]
inc rcx
cmp al, byte [rcx + r13 - 1]
jne 0x1800bd8c2
cmp rcx, 4
jne 0x1800bd8a0
mov r11b, 0x2c
mov byte [rsp + 0x30], r11b
jmp 0x1800bd773
xor ecx, ecx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx + rcx - 3]
inc rcx
cmp al, byte [r8 + rcx - 1]
jne 0x1800bd773
cmp rcx, 4
jne 0x1800bd8d0
mov r11b, 9
mov byte [rsp + 0x30], r11b
jmp 0x1800bd773
lea r8, [0x1800b6930]
mov edx, 6
mov rcx, r15
call fcn.1800b8b50
jmp 0x1800bd76d
cmp esi, 0xb518
ja 0x1800bda12
je 0x1800bd9e8
cmp esi, 0x83c5
je 0x1800bd97f
cmp esi, 0x9436
je 0x1800bd96a
cmp esi, 0xa4a7
jne 0x1800bd777
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x1800bd94c
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ecx, dword [rsp + 0x34]
mov rdi, qword [rsp + 0x38]
mov esi, 0xa4a7
mov r15, qword [rsp + 0x70]
movzx r11d, byte [rsp + 0x30]
jmp 0x1800bd777
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor edi, edi
mov qword [rsp + 0x38], rdi
jmp 0x1800bd76d
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
test eax, eax
jne 0x1800bd9de
nop dword [rax]
mov r9, rdi
lea rcx, [rbp - 0x50]
mov edx, 1
mov r8d, 0x400
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x28], r15
xor r8d, r8d
mov qword [rsp + 0x58], rax
xor edx, edx
mov dword [rsp + 0x20], 0x35
lea rcx, [rbp - 0x50]
call fcn.180050440
test eax, eax
jne 0x1800bd9de
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_feof]
test eax, eax
je 0x1800bd990
mov esi, 0x83c5
jmp 0x1800bd76d
test r15, r15
je 0x1800bd777
mov r9d, 0x74
mov qword [rsp + 0x20], 0
xor r8d, r8d
mov rdx, r15
xor ecx, ecx
call fcn.1800b6960
jmp 0x1800bd76d
cmp esi, 0xc589
je 0x1800bda2b
cmp esi, 0xd5fa
je case.0x1800bd141.65
jmp 0x1800bd777
test rdi, rdi
je 0x1800bda69
mov ebx, 0x96
mov eax, ebx
sub eax, 0x95
je 0x1800bda4e
cmp eax, 1
jne 0x1800bda50
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
jmp 0x1800bda50
xor edi, edi
dec ebx
cmp ebx, 0x94
ja 0x1800bda35
mov ecx, dword [rsp + 0x34]
movzx r11d, byte [rsp + 0x30]
mov qword [rsp + 0x38], rdi
mov ebx, ecx
jmp 0x1800bd777
xor r8d, r8d
lea rdx, [0x1800d9468]
lea rcx, str.Unrecognized_INPUT_SECTION_FLAG__s
call fcn.180045fd0
int3