Function at 0x18004d420
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x1800cd230]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov edi, dword [rbp + 0x420]
lea r10, [0x180000000]
mov r13, r9
mov r12, rdx
mov rdx, qword [rbp + 0x428]
xor r9d, r9d
mov r14, r8
mov qword [rsp + 0x68], rdx
mov r8d, dword [rsp + 0x60]
lea r15d, [rdi + 0x326]
mov dword [rsp + 0x60], r8d
mov rsi, rcx
mov ebx, edi
cmp edi, r15d
jae 0x18004d531
lea ecx, [r9 + 0x64]
lea r11d, [r9 + 0x32]
nop dword [rax]
cmp ebx, 0x1a3
ja 0x18004d6a8
je 0x18004d681
lea eax, [rbx - 0xc0]
cmp eax, 0xa5
ja case.default.0x18004d4d3
movzx eax, byte [r10 + rax + 0x4da94]
mov ecx, dword [r10 + rax*4 + 0x4da78]
add rcx, r10
jmp rcx
mov rax, qword [rsi]
lea r8, [rsp + 0x78]
mov qword [rbp - 0x80], rax
lea rcx, [rsp + 0x70]
mov rax, qword [rdx]
mov r9d, 0x20
mov qword [rsp + 0x78], rax
lea rdx, [rbp - 0x80]
mov rax, qword [r13]
mov qword [rsp + 0x70], rax
call fcn.180072020
mov rdx, qword [rsp + 0x68]
xor r9d, r9d
lea r10, [0x180000000]
mov r11d, 0x32
mov ecx, 0x64
mov r8d, dword [rsp + 0x60]
add ebx, 0x3e
cmp ebx, r15d
jb 0x18004d4a0
lea esi, [rdi - 0xc]
cmp edi, esi
jbe 0x18004da49
mov r15, qword [rsp + 0x70]
add edi, 0xffffff42
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x70]
mov r12, qword [rsp + 0x70]
cmp edi, 0x69
ja case.0x18004d573.12
movzx eax, byte [r10 + rdi + 0x4db70]
mov ecx, dword [r10 + rax*4 + 0x4db3c]
add rcx, r10
jmp rcx
mov eax, dword [r14]
mov dword [r14 + 0x34], eax
mov dword [r14 + 0x30], eax
mov qword [r14 + 0x20], r9
cmp dword [r12], 0
jne 0x18004d5a3
lea rcx, str.V765_DeltaFract
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
xor r9d, r9d
mov ecx, r9d
test rax, rax
je 0x18004d5a8
mov ecx, 1
mov rdx, qword [rsp + 0x68]
mov dword [r14 + 0x2c], ecx
movzx eax, byte [rsi]
cmp al, 0x2d
jne 0x18004d5c8
mov dword [r14 + 0x28], 2
inc rsi
jmp 0x18004d50e
mov r8d, dword [rsp + 0x60]
lea r10, [0x180000000]
mov r11d, 0x32
cmp al, 0x2b
jne 0x18004d5ee
mov dword [r14 + 0x28], r9d
lea ecx, [r11 + 0x32]
inc rsi
jmp 0x18004d525
test ecx, ecx
mov eax, r9d
mov ecx, 0x64
sete al
mov dword [r14 + 0x28], eax
jmp 0x18004d525
mov r8d, 3
mov word [rbp + 0x374], 0x69
lea rdx, [0x1800c3af7]
lea rcx, [rbp + 0x375]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
mov byte [rbp + 0x378], 0
jmp 0x18004d506
mov r8d, 1
mov dword [rsp + 0x60], r8d
lea ecx, [r8 + 0x63]
jmp 0x18004d525
mov r8d, 1
lea rdx, str.Set_ArchitectureLargeInt
lea rcx, [rbp + 0x370]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
movzx eax, word [0x1800c3b5e]
mov word [rbp + 0x371], ax
movzx eax, byte [0x1800c3b60]
mov byte [rbp + 0x373], al
jmp 0x18004d506
mov eax, dword [0x1800c3ae3]
mov dword [rbp + 0x378], eax
movzx eax, byte [0x1800c3ae7]
mov byte [rbp + 0x37c], al
mov word [rbp + 0x37d], 0x41
jmp case.default.0x18004d4d3
cmp ebx, 0x29b
ja 0x18004d788
je 0x18004d775
mov eax, ebx
sub eax, 0x1e1
je 0x18004d750
sub eax, 0x3e
je 0x18004d727
cmp eax, 0x3e
jne case.default.0x18004d4d3
movzx eax, word [0x1800bcbec]
lea rdx, [0x1800bb048]
mov word [rbp + 0x360], ax
lea rcx, [rbp + 0x360]
movzx eax, byte [0x1800bcbee]
mov r8d, 1
mov byte [rbp + 0x362], al
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
movzx eax, word [0x1800babcc]
mov word [rbp + 0x363], ax
mov dword [rbp + 0x365], 0x695765
jmp 0x18004d506
mov word [rbp + 0x38a], r11w
mov dword [rbp + 0x38c], 0x64002e
mov dword [rbp + 0x390], 0x6c006c
mov word [rbp + 0x394], r9w
jmp case.default.0x18004d4d3
mov eax, 0x75
mov dword [rbp + 0x382], 0x650073
mov word [rbp + 0x380], ax
mov dword [rbp + 0x386], 0x330072
jmp case.default.0x18004d4d3
mov byte [rbp + 0x368], 0x6e
mov word [rbp + 0x369], cx
jmp case.default.0x18004d4d3
mov eax, ebx
sub eax, 0x2d9
je 0x18004d7b8
mov r8d, dword [rsp + 0x60]
cmp eax, 0x3e
jne 0x18004d525
mov dword [rbp + 0x3a2], 0x2e0032
mov dword [rbp + 0x3a6], 0x64
jmp 0x18004d525
movzx eax, word [0x1800bcbdc]
lea rdx, [0x1800bcbe0]
mov word [rbp + 0x36a], ax
lea rcx, [rbp + 0x360]
movzx eax, byte [0x1800bcbde]
mov r8d, 1
mov byte [rbp + 0x36c], al
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat]
movzx eax, word [0x1800c17a4]
movsd xmm0, qword [0x1800c3ab0]
mov word [rbp + 0x36d], ax
movzx eax, byte [0x1800c17a6]
mov byte [rbp + 0x36f], al
movzx eax, word [0x1800c3ab8]
mov word [rbp + 0x3a0], ax
movsd qword [rbp + 0x398], xmm0
jmp 0x18004d506
mov rax, rsi
jmp 0x18004da4e
mov rcx, qword [rbx + 0x10]
mov r8d, ebx
mov edx, 0xffffffeb
mov qword [rbx + 0x78], r9
mov qword [rbx + 0x98], r9
mov qword [rbx + 0x18], r9
mov qword [rbx + 0x30], r9
call r14
jmp 0x18004da24
lea rdx, [rbp - 0x70]
mov ecx, r8d
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
xor r9d, r9d
mov dword [r13 + 0x280], r9d
jmp 0x18004da27
mov qword [rbx + 0x148], r9
mov dword [rbx + 0x138], r9d
mov qword [rbx + 0xa0], r9
mov qword [rbx + 0xa8], 0
mov qword [rbx + 0x58], r9
jmp case.0x18004d573.12
mov dword [rbp + 0x3a8], 0x6c006c
jmp case.0x18004d573.12
mov rcx, qword [r13 + 0x278]
call fcn.1800a7360
jmp 0x18004da24
mov qword [rbx + 0x10], r9
mov dword [rbx + 0xe0], r9d
mov dword [rbx + 0xe4], 2
jmp case.0x18004d573.12
mov qword [rbx + 0x60], r9
jmp case.0x18004d573.12
xor r9d, r9d
mov qword [rsp + 0x70], 0x160
xor edx, edx
lea rcx, [rsp + 0x70]
lea r8d, [r9 + 0x6f]
call fcn.180044e10
mov rcx, qword [r13]
xor r9d, r9d
mov rbx, rax
mov qword [rax + 0x28], rcx
mov qword [rax], r9
mov qword [rax + 8], r9
mov dword [rax + 0x88], r9d
jmp 0x18004da27
mov rcx, qword [r13 + 0x260]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [r13 + 0x268]
call fcn.1800a7360
xor edx, edx
lea rcx, [rbp - 0x6c]
mov r8d, 0x3cc
call sub.VCRUNTIME140.dll_memset
xor r9d, r9d
mov dword [rbp - 0x70], 0x3d0
mov dword [r13 + 0x270], r9d
jmp 0x18004da27
mov word [rbp + 0x3ac], r9w
lea rcx, [rbp + 0x380]
lea r9, [rbp + 0x370]
xor r8d, r8d
mov edx, 0xef
call fcn.180042280
lea r9, [rbp + 0x360]
xor r8d, r8d
mov edx, 0xef
lea rcx, [rbp + 0x398]
mov r14, rax
call fcn.180042280
mov r12, rax
lea r15, str.ideographicfinancialcircle
jmp 0x18004da24
mov qword [rsp + 0x58], r9
lea rdx, str.Solo
mov qword [rbx + 0x68], r9
mov r8, r15
mov dword [rbx + 0x158], 0x3f800000
xor ecx, ecx
mov rax, qword [r13]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r9
mov qword [rsp + 0x40], r9
mov r9d, 0xce0000
mov dword [rsp + 0x38], 0x80000000
mov dword [rsp + 0x30], 0x80000000
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
call r12
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x18004da24
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._12_15r___16_19g
call fcn.1800a7160
xor r9d, r9d
mov r8d, dword [rsp + 0x60]
dec edi
lea eax, [rdi + 0xbe]
cmp eax, esi
jbe 0x18004da49
lea r10, [0x180000000]
jmp 0x18004d556
mov rax, rbx
jmp 0x18004da4e
mov rax, qword [rsp + 0x70]
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.1800a7b10
mov rbx, qword [rsp + 0x508]
add rsp, 0x4c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret