Function at 0x140011b70
Capabilities:
Query environment variable

Disassembly:
push rsi
mov eax, 0x3090
call fcn.1400abe60
sub rsp, rax
mov qword [rsp + 0x30a0], rbx
mov rsi, rcx
mov qword [rsp + 0x3088], rbp
mov r8d, 0x1000
mov qword [rsp + 0x3080], rdi
mov rbp, rdx
mov qword [rsp + 0x3070], r13
lea rdx, [rsp + 0x1060]
xor r13d, r13d
mov qword [rsp + 0x3068], r14
xor ecx, ecx
mov qword [rsp + 0x3060], r15
mov edi, r13d
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r14d, eax
test eax, eax
je 0x140011c8f
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], r13
lea r8, [rsp + 0x1060]
mov dword [rsp + 0x28], 0x1000
mov r9d, r14d
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov byte [rsp + r14 + 0x60], dil
lea rdi, [rsp + 0x60]
lea r14, [rsi + 0x18]
mov rdx, rdi
mov rcx, rsi
call fcn.140024540
mov rdx, qword [rsi + 0x10]
mov qword [rdx], rax
movzx ecx, byte [rax + 8]
or ecx, 0x40
mov dword [rdx + 8], ecx
mov rcx, qword [r14]
add qword [rsi + 0x10], 0x10
mov r15, qword [rsp + 0x3060]
mov r14, qword [rsp + 0x3068]
cmp qword [rcx + 0x18], 0
mov r13, qword [rsp + 0x3070]
mov rdi, qword [rsp + 0x3080]
mov rbp, qword [rsp + 0x3088]
mov rbx, qword [rsp + 0x30a0]
jle 0x140011c81
mov rcx, rsi
call fcn.140021c00
mov eax, 1
add rsp, 0x3090
pop rsi
ret
mov rax, qword [rsi + 0x10]
lea rcx, [0x14000cf50]
mov qword [rsp + 0x3078], r12
mov qword [rax], rcx
mov dword [rax + 8], socket
mov rax, qword [rsi + 0x10]
add rax, 0x10
mov qword [rsi + 0x10], rax
test rbp, rbp
jne 0x140011cc3
mov dword [rax + 8], r13d
jmp 0x140011cdf
mov rdx, rbp
mov rcx, rsi
call fcn.140024540
mov rcx, qword [rsi + 0x10]
mov qword [rcx], rax
movzx eax, byte [rax + 8]
or eax, 0x40
mov dword [rcx + 8], eax
mov rax, qword [rsi + 0x18]
lea r14, [rsi + 0x18]
add qword [rsi + 0x10], 0x10
cmp qword [rax + 0x18], rdi
jle 0x140011cfa
mov rcx, rsi
call fcn.140021c00
lea rcx, str.PATH
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x140011d16
mov rax, qword [rsi + 0x10]
mov dword [rax + 8], r13d
jmp 0x140011d32
mov rdx, rax
mov rcx, rsi
call fcn.140024540
mov rcx, qword [rsi + 0x10]
mov qword [rcx], rax
movzx eax, byte [rax + 8]
or eax, 0x40
mov dword [rcx + 8], eax
mov rax, qword [r14]
add qword [rsi + 0x10], 0x10
cmp qword [rax + 0x18], rdi
jle 0x140011d48
mov rcx, rsi
call fcn.140021c00
mov rax, qword [rsi + 0x20]
lea r8, [rsp + 0x48]
mov r12, qword [rsi + 0x10]
lea rdx, [0x140017390]
mov r15, qword [rsi + 0xb0]
add r12, 0xffffffffffffffd0
mov qword [rsp + 0x40], rax
mov rcx, rsi
movzx eax, byte [rsi + 0xcc]
mov byte [rsp + 0x30b0], al
movzx eax, word [rsi + 0xc4]
mov qword [rsp + 0x48], r12
sub r12, qword [rsi + 0x38]
mov word [rsp + 0x30b8], ax
mov dword [rsp + 0x50], 1
mov qword [rsi + 0xb0], r13
call fcn.14001a490
lea r9, [0x1400ad488]
mov r13d, eax
mov r8d, 0x2f
test eax, eax
je 0x140011e1f
mov rdi, qword [rsi + 0x38]
mov rcx, rsi
add rdi, r12
mov rdx, rdi
call fcn.140024000
mov r8, rdi
mov edx, r13d
mov rcx, rsi
call fcn.14001a340
mov rax, qword [rsp + 0x40]
mov rcx, rsi
mov qword [rsi + 0x20], rax
movzx eax, byte [rsp + 0x30b0]
mov byte [rsi + 0xcc], al
movzx eax, word [rsp + 0x30b8]
mov word [rsi + 0xc4], ax
call fcn.14001a6e0
add qword [rsi + 0x10], 0xfffffffffffffff0
mov qword [rsi + 0xb0], r15
xor r15d, r15d
jmp 0x140011f9b
mov rax, qword [rsi + 0x10]
lea rcx, [0x140142280]
sub rax, 0x10
mov qword [rsi + 0xb0], r15
cmp rax, rcx
je 0x140011e44
test byte [rax + 8], 0xf
je 0x140011f8a
mov eax, 0x3521cfb3
mov edi, r9d
mul r9d
mov eax, r9d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
imul eax, eax, 0x35
sub edi, eax
shl rdi, 4
add rdi, qword [r14]
xor r15d, r15d
mov eax, r15d
nop dword [rax]
mov rdx, qword [rdi + rax*8 + 0x1e8]
cmp r8b, byte [rdx + 0x18]
jne 0x140011e84
cmp r15b, byte [rdx + 0x19]
je 0x140011eb6
inc rax
cmp rax, 2
jl 0x140011e70
mov rax, qword [rdi + 0x1e8]
mov r8d, 1
mov rdx, r9
mov qword [rdi + 0x1f0], rax
mov rcx, rsi
call fcn.140024340
mov rdx, rax
mov qword [rdi + 0x1e8], rax
mov rcx, qword [rsi + 0x10]
mov qword [rcx], rdx
movzx eax, byte [rdx + 8]
or eax, 0x40
mov dword [rcx + 8], eax
add qword [rsi + 0x10], 0x10
mov rax, qword [r14]
mov rcx, qword [rsi + 0x10]
cmp qword [rax + 0x18], r15
jle 0x140011ee5
mov rcx, rsi
call fcn.140021c00
mov rcx, qword [rsi + 0x10]
test rbp, rbp
jne 0x140011ef0
mov dword [rcx + 8], r15d
jmp 0x140011f0c
mov rdx, rbp
mov rcx, rsi
call fcn.140024540
mov rcx, qword [rsi + 0x10]
mov qword [rcx], rax
movzx eax, byte [rax + 8]
or eax, 0x40
mov dword [rcx + 8], eax
mov rax, qword [r14]
add qword [rsi + 0x10], 0x10
cmp qword [rax + 0x18], r15
jle 0x140011f22
mov rcx, rsi
call fcn.140021c00
mov edx, 3
mov rcx, rsi
call fcn.14001ca70
mov rax, qword [r14]
cmp qword [rax + 0x18], r15
jle 0x140011f40
mov rcx, rsi
call fcn.140021c00
mov rdi, qword [rsi + 0x10]
sub rdi, 0x10
mov eax, dword [rdi + 8]
and eax, 0xf
cmp eax, 4
je 0x140011f81
cmp eax, 3
je 0x140011f5d
mov rdi, r15
jmp 0x140011f8d
mov rdx, rdi
mov rcx, rsi
call fcn.140023850
mov rax, qword [r14]
cmp qword [rax + 0x18], r15
jle 0x140011f79
mov rcx, rsi
call fcn.140021c00
mov rdi, qword [rsi + 0x10]
sub rdi, 0x10
mov rdi, qword [rdi]
add rdi, 0x18
jmp 0x140011f8d
xor r15d, r15d
add qword [rsi + 0x10], 0xfffffffffffffff0
test rdi, rdi
jne 0x14001214a
mov rcx, rsi
call fcn.14000a5b0
lea r9, [0x1400ad488]
mov eax, 0x3521cfb3
mul r9d
mov eax, r9d
mov edi, r9d
sub eax, edx
mov ecx, 0x2f
shr eax, 1
add eax, edx
shr eax, 5
imul eax, eax, 0x35
sub edi, eax
mov rax, r15
shl rdi, 4
add rdi, qword [r14]
nop word [rax + rax]
mov rdx, qword [rdi + rax*8 + 0x1e8]
cmp cl, byte [rdx + 0x18]
jne 0x140011ff3
cmp r15b, byte [rdx + 0x19]
je 0x140012025
inc rax
cmp rax, 2
jl 0x140011fe0
mov rax, qword [rdi + 0x1e8]
mov r8d, 1
mov rdx, r9
mov qword [rdi + 0x1f0], rax
mov rcx, rsi
call fcn.1400244d0
mov rdx, rax
mov qword [rdi + 0x1e8], rax
mov rcx, qword [rsi + 0x10]
mov qword [rcx], rdx
movzx eax, byte [rdx + 8]
or eax, 0x40
mov dword [rcx + 8], eax
add qword [rsi + 0x10], 0x10
mov rax, qword [r14]
mov rcx, qword [rsi + 0x10]
cmp qword [rax + 0x18], 0
jle 0x140012055
mov rcx, rsi
call fcn.140021c00
mov rcx, qword [rsi + 0x10]
test rbp, rbp
jne 0x140012060
mov dword [rcx + 8], r15d
jmp 0x14001207c
mov rdx, rbp
mov rcx, rsi
call fcn.140024540
mov rcx, qword [rsi + 0x10]
mov qword [rcx], rax
movzx eax, byte [rax + 8]
or eax, 0x40
mov dword [rcx + 8], eax
mov rax, qword [r14]
add qword [rsi + 0x10], 0x10
cmp qword [rax + 0x18], 0
jle 0x140012093
mov rcx, rsi
call fcn.140021c00
mov rcx, rbp
call fcn.14000f2f0
cmp eax, 1
je 0x1400120af
mov edx, 3
mov rcx, rsi
call fcn.14001ca70
jmp 0x1400120e7
mov rax, qword [rsi + 0x10]
add rax, 0xffffffffffffffd0
mov qword [rsi + 0x10], rax
test rbp, rbp
jne 0x1400120c6
mov dword [rax + 8], r15d
jmp 0x1400120e2
mov rdx, rbp
mov rcx, rsi
call fcn.140024540
mov rcx, qword [rsi + 0x10]
mov qword [rcx], rax
movzx eax, byte [rax + 8]
or eax, 0x40
mov dword [rcx + 8], eax
add qword [rsi + 0x10], 0x10
mov rax, qword [r14]
cmp qword [rax + 0x18], 0
jle 0x1400120f9
mov rcx, rsi
call fcn.140021c00
mov rax, qword [rsi + 0x10]
mov ecx, dword [rax - 8]
lea rdi, [rax - 0x10]
and ecx, 0xf
cmp ecx, 4
je 0x14001213b
cmp ecx, 3
je 0x140012116
mov rdi, r15
jmp 0x140012142
mov rdx, rdi
mov rcx, rsi
call fcn.140023850
mov rax, qword [r14]
cmp qword [rax + 0x18], 0
jle 0x140012133
mov rcx, rsi
call fcn.140021c00
mov rax, qword [rsi + 0x10]
lea rdi, [rax - 0x10]
mov rdi, qword [rdi]
add rdi, 0x18
add rax, 0xfffffffffffffff0
mov qword [rsi + 0x10], rax
mov r12, qword [rsp + 0x3078]
test rdi, rdi
jne 0x140011c1e
mov rax, qword [rsi + 0x10]
mov dword [rax + 8], r15d
jmp 0x140011c3a