Function at 0x140166bab
Capabilities:
Query environment variable

Disassembly:
push rax
pushf
mov eax, 0x53160dd2
pushf
not eax
add eax, 0x8fc8478a
xor eax, 0xbe19139e
rol eax, 0x3f
popf
pushf
not eax
add eax, 0x803b3a27
xor eax, 0xbee5a512
rol eax, 0
popf
cmp eax, 4
jne 0x140166be8
popf
pop rax
jmp 0x140166e70
cmp eax, 0
jne 0x140166bf7
popf
pop rax
jmp 0x140166c60
cmp eax, 3
jne 0x140166c06
popf
pop rax
jmp 0x140166dc8
cmp eax, 1
jne 0x140166c15
popf
pop rax
jmp 0x140166d11
cmp eax, 5
jne 0x140166c24
popf
pop rax
jmp 0x140166f1c
cmp eax, 7
jne 0x140166c33
popf
pop rax
jmp 0x140167009
cmp eax, 6
jne 0x140166c42
popf
pop rax
jmp 0x140166fb2
cmp eax, 2
jne 0x140166c51
popf
pop rax
jmp 0x140166d7e
cmp eax, 8
jne 0x140166c60
popf
pop rax
jmp 0x140167063
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
jmp 0x140166c75
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x140166cb8
push rax
pushf
mov eax, 0x34dbca28
pushf
not eax
add eax, 0xdbba8a50
xor eax, 0xb3f7363c
rol eax, 0x6b
popf
pushf
not eax
add eax, 0xf31719ce
xor eax, 0xb3664124
rol eax, 4
popf
jmp 0x140166bd9
push rax
pushf
mov eax, 0x1d95934b
pushf
not eax
add eax, 0xb7477c52
xor eax, 0xa55ee3cc
rol eax, 0x87
popf
pushf
not eax
add eax, 0xd89a2fca
xor eax, 0xb20a82ea
rol eax, 0xdf
popf
pushf
not eax
add eax, 0x87226b6f
xor eax, 0xda064f82
rol eax, 0xf8
popf
pushf
not eax
add eax, 0x9eeb7d55
xor eax, 0xd0a3e84c
rol eax, 0x4a
popf
jmp 0x140166bd9
mov rsi, rbx
cmp word [rax], bp
je 0x140166d4b
push rax
pushf
mov eax, 0x8f32b3a
pushf
not eax
add eax, 0xded9a2e7
xor eax, 0xd5d28283
rol eax, 0x45
popf
pushf
not eax
add eax, 0x9884cb69
xor eax, 0x91e62589
rol eax, 1
popf
jmp 0x140166bd9
push rax
pushf
mov eax, 0xbcfb1f62
pushf
not eax
add eax, 0x83de13ef
xor eax, 0xdd5aece6
rol eax, 0x64
popf
pushf
not eax
add eax, 0xafc6be95
xor eax, 0xf44536b3
rol eax, 0x5a
popf
jmp 0x140166bd9
or rax, 0xffffffffffffffff
push rax
pushf
mov eax, 0x6de3ff1c
pushf
not eax
add eax, 0xa99ea988
xor eax, 0xd237edb5
rol eax, 0x2b
popf
pushf
not eax
add eax, 0xfce05d94
xor eax, 0xd98a8fe1
rol eax, 0x39
popf
pushf
not eax
add eax, 0xcf6f1f74
xor eax, 0x84d8c7a0
rol eax, 7
popf
jmp 0x140166bd9
inc rax
cmp word [rsi + rax*2], bp
jne 0x140166e2a
push rax
pushf
mov eax, 0x8f18c18a
pushf
not eax
add eax, 0x9e844b1a
xor eax, 0x94c35423
rol eax, 0x20
popf
pushf
not eax
add eax, 0xcd1def98
xor eax, 0xa9f1bd34
rol eax, 0x74
popf
pushf
not eax
add eax, 0x85016a96
xor eax, 0xb9411532
rol eax, 0x93
popf
pushf
not eax
add eax, 0xb7986b84
xor eax, 0xfbcff90c
rol eax, 0x3c
popf
jmp 0x140166bd9
push rax
pushf
mov eax, 0x7ecfaf98
pushf
not eax
add eax, 0xf6f83588
xor eax, 0xbc0167f0
rol eax, 0x34
popf
pushf
not eax
add eax, 0xed1b3a88
xor eax, 0xca24ecb3
rol eax, 0x2f
popf
pushf
not eax
add eax, 0x9deb2537
xor eax, 0x903e2495
rol eax, 0xbe
popf
jmp 0x140166bd9
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140166ed6
push rax
pushf
mov eax, 0xe9ba135c
pushf
not eax
add eax, 0x93eccea5
xor eax, 0x9fdf620a
rol eax, 0x64
popf
pushf
not eax
add eax, 0xc0b1f950
xor eax, 0xba8b96a9
rol eax, 0xf4
popf
pushf
not eax
add eax, 0x855c07bf
xor eax, 0x84d29687
rol eax, 0xdb
popf
pushf
not eax
add eax, 0xa684a228
xor eax, 0xe2c33bee
rol eax, 0x89
popf
jmp 0x140166bd9
push rax
pushf
mov eax, 0x3b4f41a4
pushf
not eax
add eax, 0x84e4b07c
xor eax, 0xd76210bb
rol eax, 0xdb
popf
pushf
not eax
add eax, 0xbd5126d4
xor eax, 0x96c453a4
rol eax, 0x65
popf
pushf
not eax
add eax, 0x920a6602
xor eax, 0xbe633d6a
rol eax, 0
popf
jmp 0x140166bd9
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14018cea1
mov rdi, rax
test rax, rax
je 0x140166f7f
push rax
pushf
mov eax, 0xdf7d5772
pushf
not eax
add eax, 0xe98f8576
xor eax, 0xf6be871f
rol eax, 0x93
popf
pushf
not eax
add eax, 0xfe7bd9ee
xor eax, 0xa6bc26fd
rol eax, 0x20
popf
pushf
not eax
add eax, 0xfd401555
xor eax, 0xea105adf
rol eax, 0x56
popf
jmp 0x140166bd9
push rax
pushf
mov eax, 0x842ffe9a
pushf
not eax
add eax, 0xaecac8e6
xor eax, 0xbd85d38f
rol eax, 0x8c
popf
pushf
not eax
add eax, 0xeb8f5636
xor eax, 0xf9f30f44
rol eax, 0xf9
popf
jmp 0x140166bd9
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14001fa00
mov rbp, rdi
push rax
pushf
mov eax, 0xbfaa4257
pushf
not eax
add eax, 0xb2b8cb57
xor eax, 0xff3aab0b
rol eax, 0x8d
popf
pushf
not eax
add eax, 0xb3599024
xor eax, 0xea670de5
rol eax, 0x8b
popf
pushf
not eax
add eax, 0xd5dfa60a
xor eax, 0xf5c3df04
rol eax, 0x3b
popf
jmp 0x140166bd9
xor ecx, ecx
call fcn.1401b1d03
mov rcx, rbx
jmp 0x140167014
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
push rax
pushf
mov eax, 0x8c96bc77
pushf
not eax
add eax, 0xfc5197d8
xor eax, 0xc8a6f6ca
rol eax, 0xfb
popf
pushf
not eax
add eax, 0x96b03d92
xor eax, 0xf0fb9c10
rol eax, 0x10
popf
pushf
not eax
add eax, 0x80844c23
xor eax, 0xc04fba96
rol eax, 0x36
popf
jmp 0x140166bd9
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret