Function at 0x14014facf
Capabilities:
Query environment variable

Disassembly:
push rax
pushf
mov eax, 0x63a63d8d
pushf
not eax
add eax, 0x4129dbfc
xor eax, 0x124fb6a9
rol eax, 0x3a
popf
pushf
not eax
add eax, 0x42ac1428
xor eax, 0x339b5d82
rol eax, 0xf
popf
pushf
not eax
add eax, 0x4012dc79
xor eax, 0xe1ecb72
rol eax, 0x92
popf
pushf
not eax
add eax, 0x7baad4e6
xor eax, 0x196d18a1
rol eax, 0x96
popf
cmp eax, 3
jne 0x14014fb32
popf
pop rax
jmp 0x14014fd66
cmp eax, 0xd
jne 0x14014fb41
popf
pop rax
jmp 0x140150268
cmp eax, 2
jne 0x14014fb50
popf
pop rax
jmp 0x14014fcd2
cmp eax, 6
jne 0x14014fb5f
popf
pop rax
jmp 0x14014fece
cmp eax, 0xa
jne 0x14014fb6e
popf
pop rax
jmp 0x140150112
cmp eax, 8
jne 0x14014fb7d
popf
pop rax
jmp 0x14014fffe
cmp eax, 0xb
jne 0x14014fb8c
popf
pop rax
jmp 0x1401501b2
cmp eax, 0
jne 0x14014fb9b
popf
pop rax
jmp 0x14014fbf5
cmp eax, 1
jne 0x14014fbaa
popf
pop rax
jmp 0x14014fc85
cmp eax, 4
jne 0x14014fbb9
popf
pop rax
jmp 0x14014fd9d
cmp eax, 0xc
jne 0x14014fbc8
popf
pop rax
jmp 0x140150218
cmp eax, 9
jne 0x14014fbd7
popf
pop rax
jmp 0x1401500c0
cmp eax, 5
jne 0x14014fbe6
popf
pop rax
jmp 0x14014fe20
cmp eax, 7
jne 0x14014fbf5
popf
pop rax
jmp 0x14014ff96
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
jmp 0x14014fc0f
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x14014fc52
push rax
pushf
mov eax, 0x3a0810cb
pushf
not eax
add eax, 0x22f4455
xor eax, 0x60c3c01d
rol eax, 0xe
popf
pushf
not eax
add eax, 0x75a81dc9
xor eax, 0x38c2f38b
rol eax, 0x5e
popf
jmp 0x14014fb23
push rax
pushf
mov eax, 0xe9f3d0c6
pushf
not eax
add eax, 0x7ed0ac42
xor eax, 0x6a29addf
rol eax, 0x13
popf
pushf
not eax
add eax, 0x32de1df2
xor eax, 0x75b62646
rol eax, 0xa6
popf
jmp 0x14014fb23
xor eax, eax
jmp 0x140150275
mov rbp, rbx
cmp word [rax], si
je 0x14014fd0d
push rax
pushf
mov eax, 0x1137f3fc
pushf
not eax
add eax, 0x5c5e3fe
xor eax, 0x4cdfcf0f
rol eax, 0xe1
popf
pushf
not eax
add eax, 0x7adb5ae5
xor eax, 0x936dcc7
rol eax, 8
popf
jmp 0x14014fb23
push rax
pushf
mov eax, 0x8a4288ed
pushf
not eax
add eax, 0xef46949
xor eax, 0x639d89db
rol eax, 0xc5
popf
pushf
not eax
add eax, 0x45113a2d
xor eax, 0x51c132d4
rol eax, 0x14
popf
pushf
not eax
add eax, 0x6b7ef283
xor eax, 0x26d38b45
rol eax, 0xe2
popf
pushf
not eax
add eax, 0x475b6fa4
xor eax, 0x5fa599f8
rol eax, 0xf3
popf
jmp 0x14014fb23
or rax, 0xffffffffffffffff
push rax
pushf
mov eax, 0xabbf4384
pushf
not eax
add eax, 0x5e960287
xor eax, 0x52448c91
rol eax, 0xb6
popf
pushf
not eax
add eax, 0x20b2c4a0
xor eax, 0x3bbaa813
rol eax, 0xf7
popf
jmp 0x14014fb23
inc rax
cmp word [rbp + rax*2], si
jne 0x14014fded
push rax
pushf
mov eax, 0x45812d7b
pushf
not eax
add eax, 0x10279e62
xor eax, 0x481086ab
rol eax, 0x92
popf
pushf
not eax
add eax, 0x47281623
xor eax, 0x5d351a70
rol eax, 0x12
popf
pushf
not eax
add eax, 0x4514b647
xor eax, 0x5037f32a
rol eax, 0x24
popf
jmp 0x14014fb23
push rax
pushf
mov eax, 0x1d6e5f03
pushf
not eax
add eax, 0xb6c7dc8
xor eax, 0x551f2c45
rol eax, 0x89
popf
pushf
not eax
add eax, 0x3344d77a
xor eax, 0x72dfd408
rol eax, 0x69
popf
jmp 0x14014fb23
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x14014fe75
push rax
pushf
mov eax, 0x86b96c40
pushf
not eax
add eax, 0x1910af35
xor eax, 0x3ad7372b
rol eax, 0x59
popf
pushf
not eax
add eax, 0x65e3a59c
xor eax, 0x18de55b4
rol eax, 0xa0
popf
pushf
not eax
add eax, 0x3f87160d
xor eax, 0x413a2508
rol eax, 0xe3
popf
jmp 0x14014fb23
push rax
pushf
mov eax, 0x1ea3631d
pushf
not eax
add eax, 0x7c35a9e
xor eax, 0x435fbf30
rol eax, 0xe8
popf
pushf
not eax
add eax, 0x15490d17
xor eax, 0x26547b30
rol eax, 0xd2
popf
pushf
not eax
add eax, 0x5ff1be2b
xor eax, 0x448c92fd
rol eax, 0x25
popf
pushf
not eax
add eax, 0x16692cd2
xor eax, 0x3830e7e1
rol eax, 0xe
popf
jmp 0x14014fb23
mov qword [rsp + 0x38], rsi
push rbx
not rbx
add rbp, rbx
pop rbx
add rbp, 1
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.1401440a9
movsxd r14, eax
test eax, eax
jne 0x14014ff3d
push rax
pushf
mov eax, 0xe92aea81
pushf
not eax
add eax, 0x5215fec0
xor eax, 0x528eb01a
rol eax, 0xc2
popf
pushf
not eax
add eax, 0x2f8d79cb
xor eax, 0x59f6e93a
rol eax, 0x86
popf
jmp 0x14014fb23
push rax
pushf
mov eax, 0x5e610e15
pushf
not eax
add eax, 0x750ad17e
xor eax, 0x42353cb9
rol eax, 0x3e
popf
pushf
not eax
add eax, 0x11857fc7
xor eax, 0x1dbfdc7e
rol eax, 0xe1
popf
pushf
not eax
add eax, 0x489c80e8
xor eax, 0x2cdd3c8c
rol eax, 0x7f
popf
pushf
not eax
add eax, 0x797f993e
xor eax, 0x647cd6bc
rol eax, 0x2b
popf
jmp 0x14014fb23
mov rcx, rbx
jmp 0x14014ff9a
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x14014fc85
mov rcx, r14
call fcn.140129956
mov rdi, rax
test rax, rax
jne 0x140150067
push rax
pushf
mov eax, 0xef4bb5ec
pushf
not eax
add eax, 0x78c5caab
xor eax, 0x3dc99f8c
rol eax, 0x5d
popf
pushf
not eax
add eax, 0x79db03da
xor eax, 0x4f2791ec
rol eax, 0x6c
popf
pushf
not eax
add eax, 0x45d985bf
xor eax, 0x58be4e54
rol eax, 0x96
popf
pushf
not eax
add eax, 0x3dff64f8
xor eax, 0x12ec1c8e
rol eax, 0xe0
popf
jmp 0x14014fb23
push rax
pushf
mov eax, 0x4725b0f9
pushf
not eax
add eax, 0x30fed84e
xor eax, 0x25676409
rol eax, 0xb6
popf
pushf
not eax
add eax, 0x7cd3f666
xor eax, 0x3e3b79e
rol eax, 6
popf
pushf
not eax
add eax, 0x3737d025
xor eax, 0x7baf487
rol eax, 0x4b
popf
pushf
not eax
add eax, 0x7395dbdf
xor eax, 0x6747f745
rol eax, 0
popf
jmp 0x14014fb23
xor ecx, ecx
call fcn.140117085
jmp 0x14014ff96
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.1401440a9
test eax, eax
jne 0x14015017f
push rax
pushf
mov eax, 0x9086e12b
pushf
not eax
add eax, 0x751dbbea
xor eax, 0x6c8df8e0
rol eax, 0xe
popf
pushf
not eax
add eax, 0x1c44b06f
xor eax, 0x7cb9c1a0
rol eax, 0xc2
popf
pushf
not eax
add eax, 0x763b49ee
xor eax, 0x9e80acd
rol eax, 4
popf
jmp 0x14014fb23
push rax
pushf
mov eax, 0x800edd6f
pushf
not eax
add eax, 0x4b32769a
xor eax, 0x5bb0b6f2
rol eax, 0x7b
popf
pushf
not eax
add eax, 0x26c62f2
xor eax, 0x3de7cf73
rol eax, 0xb9
popf
jmp 0x14014fb23
mov rcx, rdi
call fcn.140117085
jmp 0x140150268
xor ecx, ecx
call fcn.140117085
mov rsi, rdi
push rax
pushf
mov eax, 0x806e4986
pushf
not eax
add eax, 0x548cf1d1
xor eax, 0x2eb6f95d
rol eax, 0xa2
popf
pushf
not eax
add eax, 0x2817c9c3
xor eax, 0x11396cf7
rol eax, 0x1a
popf
pushf
not eax
add eax, 0x7d58d6d0
xor eax, 0x2fe79729
rol eax, 0x4a
popf
jmp 0x14014fb23
mov rcx, rbx
jmp 0x14015026c
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret