Function at 0x1400021c0
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x2d8]
sub rsp, 0x3d8
mov rax, qword [0x140040010]
xor rax, rsp
mov qword [rbp + 0x2c0], rax
mov r15, rdx
mov dword [rsp + 0x40], ecx
xor edx, edx
lea rcx, [0x140035df8]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
mov r14, 0xffffffffffffffff
test eax, eax
je 0x1400022a6
mov eax, 2
mul rsi
cmovo rax, r14
mov rcx, rax
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov r8d, esi
lea rcx, [0x140035df8]
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [rsi - 1]
cmp ecx, eax
jne 0x14000229d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ebx, eax
test eax, eax
je 0x14000229d
mov eax, 2
mul rbx
cmovo rax, r14
mov rcx, rax
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov r8d, ebx
mov rcx, rdi
mov rdx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x140002294
mov rdx, rsi
lea rcx, [0x140035df8]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, rsi
call qword [sym.imp.mozglue.dll_free]
mov rcx, rdi
call qword [sym.imp.mozglue.dll_free]
lea rcx, [0x140035f04]
mov qword [rsp + 0x3d0], r13
call qword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov rcx, qword [r15 + 8]
lea rdi, [r15 + 8]
test rcx, rcx
je 0x1400022ec
mov r14d, 0xfffd
movzx eax, word [rcx]
sub ax, 0x2d
test r14w, ax
je 0x1400028e7
mov rcx, qword [rdi + 8]
add rdi, 8
test rcx, rcx
jne 0x1400022ce
mov eax, dword [rsp + 0x40]
mov rsi, 0xffffffffffffffff
inc eax
movsxd rcx, eax
mov eax, 8
mul rcx
cmovo rax, rsi
mov rcx, rax
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov qword [rsp + 0x48], rax
mov rdi, rax
test rax, rax
je 0x140007858
mov eax, dword [rsp + 0x40]
xor r13d, r13d
mov qword [rsp + 0x420], r12
mov r14d, r13d
test eax, eax
jle 0x1400023d4
mov rbx, rdi
sub r15, rdi
mov r12d, 0xff80
mov rdi, qword [r15 + rbx]
nop dword [rax]
inc rsi
cmp word [rdi + rsi*2], r13w
jne 0x140002350
lea eax, [rsi*2 + 1]
add eax, esi
movsxd rcx, eax
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov r11, rax
test rax, rax
je 0x140007964
mov ecx, esi
mov rdx, rax
lea r9, [rdi + rcx*2]
cmp rdi, r9
jae 0x1400023ae
nop word [rax + rax]
movzx ecx, word [rdi]
mov r8, rdi
test r12w, cx
jne 0x140007862
mov byte [rdx], cl
inc rdx
add rdi, 2
cmp rdi, r9
jb 0x140002390
mov byte [rdx], r13b
inc r14d
mov qword [rbx], r11
mov rsi, 0xffffffffffffffff
mov eax, dword [rsp + 0x40]
add rbx, 8
cmp r14d, eax
jl 0x140002348
mov rdi, qword [rsp + 0x48]
movsxd rcx, eax
mov eax, 8
mov qword [rdi + rcx*8], r13
mov ecx, dword [rsp + 0x40]
inc ecx
movsxd rdx, ecx
mul rdx
cmovo rax, rsi
mov rcx, rax
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov r14, rax
test rax, rax
je 0x140007971
mov edx, r13d
cmp dword [rsp + 0x40], r13d
jle 0x14000242d
mov rcx, rax
sub rdi, rax
mov rax, qword [rdi + rcx]
inc edx
mov qword [rcx], rax
lea rcx, [rcx + 8]
cmp edx, dword [rsp + 0x40]
jl 0x140002415
mov rdi, qword [rsp + 0x48]
lea rcx, str.PATH
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll___p__environ]
movsxd r15, dword [rsp + 0x40]
lea rcx, [rbp - 0x80]
mov dl, 1
mov r12, qword [rax]
call qword [sym.imp.mozglue.dll_private:_static_class_mozilla::TimeStamp___cdecl_mozilla::TimeStamp::Now_bool_]
cmp r15d, 1
jle 0x140002476
mov rax, qword [rdi + 8]
mov rdx, rax
movzx ecx, byte [rax]
cmp cl, 0x2d
je 0x140007987
cmp cl, 0x2f
je 0x1400079ad
mov ecx, dword [0x140042318]
call qword [sym.imp.mozglue.dll_void___cdecl_DllBlocklist_Initialize_unsigned_int_]
cmp byte [0x140040988], r13b
jne 0x1400024af
mov r8d, 0x104
lea rdx, [0x140040780]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x140007c36
mov byte [0x140040988], 1
lea r8, [0x140040780]
mov edx, 0x104
lea rcx, [rbp + 0xb0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
test eax, eax
jne 0x140007c36
mov qword [rsp + 0x38], r13
lea rax, [rbp - 0x60]
mov qword [rsp + 0x30], r13
lea r8, [rbp + 0xb0]
mov dword [rsp + 0x28], 0x104
mov r9d, esi
xor edx, edx
mov qword [rsp + 0x20], rax
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea rcx, [rbp - 0x60]
call qword [sym.imp.mozglue.dll_strdup]
mov rbx, rax
test rax, rax
je 0x140007c39
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400010c0
mov rdi, qword [rax]
mov qword [rax], r13
mov rsi, qword [0x140042250]
mov qword [0x140042250], rdi
test rsi, rsi
jne 0x140007a38
mov rsi, qword [rsp + 0x50]
mov qword [rsp + 0x50], r13
test rsi, rsi
jne 0x140007a59
test rdi, rdi
je 0x140007a7a
mov rax, qword [rdi]
mov rsi, qword [rax + 0x10]
mov rcx, rsi
call qword [fcn.140006330]
mov rcx, rdi
call rsi
mov rcx, rbx
call qword [sym.imp.mozglue.dll_free]
movups xmm0, xmmword [rbp - 0x80]
mov rsi, qword [0x140042250]
movsd xmm1, qword [rbp - 0x70]
movaps xmmword [rsp + 0x60], xmm0
movsd qword [rsp + 0x70], xmm1
mov rax, qword [rsi]
mov rdi, qword [rax + 0x28]
mov rcx, rdi
call qword [fcn.140006330]
lea r8, [rsp + 0x60]
mov edx, 1
mov rcx, rsi
call rdi
mov rsi, qword [0x140042250]
mov rax, qword [rsi]
mov rdi, qword [rax + 0x60]
mov rcx, rdi
call qword [fcn.140006330]
mov rcx, rsi
call rdi
mov rdi, qword [rsp + 0x48]
lea rcx, str.XUL_APP_FILE
mov rbx, rdi
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov rsi, rax
test rax, rax
jne 0x140007a8b
cmp r15d, 1
jle 0x14000263e
mov rdi, qword [rdi + 8]
mov rax, rdi
movzx ecx, byte [rdi]
cmp cl, 0x2d
je 0x140007a99
cmp cl, 0x2f
je 0x140007abf
mov rdi, rbx
cmp r15d, 1
jle 0x14000263e
mov rax, qword [rdi + 8]
add rdi, 8
mov rdx, rax
movzx ecx, byte [rax]
cmp cl, 0x2d
je 0x140007b52
cmp cl, 0x2f
je 0x140007b78
test rsi, rsi
jne 0x140007be6
lea rax, str.Mozilla
mov qword [rsp + 0x70], rax
lea rax, str.browser
mov qword [rsp + 0x78], rax
mov rax, qword gs:[0x58]
mov edx, 4
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x1400422fc], eax
jle 0x1400027f9
lea rcx, [0x1400422fc]
call fcn.140005f28
cmp dword [0x1400422fc], 0xffffffff
jne 0x1400027f9
lea rcx, str.MOZ_ENABLE_HANDLE_VERIFIER
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x140007bfe
mov rcx, qword [0x1400421c0]
test rcx, rcx
jne 0x1400026c6
call fcn.140002bd0
mov rcx, qword [0x1400421c0]
mov rax, qword [rcx]
call qword [rax + 0x18]
cmp qword [sym.firefox.exe_g_shared_section], r13
jne 0x140007c18
mov rdi, qword [0x1400421c8]
test rdi, rdi
jne 0x1400027ab
mov ecx, 0x80
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov rdi, rax
test rax, rax
je 0x140007c10
lea rax, [0x140035e08]
mov ecx, 0x18
mov qword [rdi], rax
mov qword [rdi + 8], r13
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], r13
mov qword [rdi + 0x48], r13
mov qword [rdi + 0x50], r13
mov qword [rdi + 0x58], r13
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov ecx, 0x30
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rdi + 0x50], rax
mov qword [rdi + 0x60], r13
mov qword [rdi + 0x68], r13
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov ecx, 0x20
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rdi + 0x60], rax
mov qword [rdi + 0x70], r13
mov qword [rdi + 0x78], r13
call qword [sym.imp.mozglue.dll_moz_xmalloc]
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rdi + 0x70], rax
lea rcx, [0x140002920]
mov qword [0x1400421c8], rdi
call fcn.140005ce8
mov rdi, qword [0x1400421c8]
test rdi, rdi
je 0x140007c18
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
test eax, eax
jne 0x140007c18
mov rax, qword [rdi]
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [rax + 8]
mov rcx, qword [rsp + 0x50]
mov dl, 1
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400027e6
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [0x1400422fc]
mov qword [0x140042230], rdi
call fcn.140005ec8
mov rdi, qword [0x140042230]
call fcn.140004610
test rdi, rdi
je 0x140007c20
mov rsi, qword [0x140042250]
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], rax
mov rax, qword [rsi]
mov rdi, qword [rax + 0x30]
mov rcx, rdi
call qword [fcn.140006330]
lea r9, [rsp + 0x60]
mov r8, rbx
mov edx, r15d
mov rcx, rsi
call rdi
mov ebx, eax
mov rsi, qword [0x140042250]
mov rax, qword [rsi]
mov rdi, qword [rax + 0x18]
mov rcx, rdi
call qword [fcn.140006330]
mov rcx, rsi
call rdi
mov rsi, qword [0x140042250]
mov qword [0x140042250], r13
test rsi, rsi
je 0x140002885
mov rax, qword [rsi]
mov rdi, qword [rax + 8]
mov rcx, rdi
call qword [fcn.140006330]
mov rcx, rsi
call rdi
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.mozglue.dll_free]
movsxd rdi, dword [rsp + 0x40]
test rdi, rdi
je 0x1400028ad
mov rcx, qword [r14 + rdi*8 - 8]
dec rdi
call qword [sym.imp.mozglue.dll_free]
test rdi, rdi
jne 0x14000289a
mov rcx, r14
call qword [sym.imp.mozglue.dll_free]
mov eax, ebx
mov r12, qword [rsp + 0x420]
mov r13, qword [rsp + 0x3d0]
mov rcx, qword [rbp + 0x2c0]
xor rcx, rsp
call fcn.140005a70
add rsp, 0x3d8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
cmp word [rcx + 2], 0x2d
lea rsi, [rcx + 2]
je 0x140002919
lea rbx, str.launcher
movzx ecx, word [rsi]
test cx, cx
je 0x1400022df
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_towlower]
cmp ax, word [rbx]
jne 0x1400022df
jmp 0x1400077fa
add rsi, 2
jmp 0x1400028f2
add rbx, 2
add rsi, 2
cmp word [rbx], 0
jne 0x1400028f9
cmp word [rsi], 0
jne 0x1400022df
mov rcx, qword [rdi + 8]
mov qword [rdi], rcx
lea rdi, [rdi + 8]
test rcx, rcx
jne 0x140007816
dec dword [rsp + 0x40]
lea r8, str.osint
xor r13d, r13d
lea rcx, [rsp + 0x40]
mov rdx, r15
mov dword [rsp + 0x20], r13d
call fcn.140009ab4
mov ecx, dword [rsp + 0x40]
mov rdx, r15
call fcn.14000cb68
nop
jmp 0x1400028c0
mov eax, 0x7f
jmp 0x1400028c0
mov eax, 0xf800
test ax, cx
jne 0x140007889
movzx eax, cx
and cl, 0x3f
shr ax, 6
or cl, 0x80
or al, 0xc0
mov byte [rdx], al
mov byte [rdx + 1], cl
add rdx, 2
jmp 0x1400023a5
movzx r10d, cx
mov eax, r10d
and eax, 0xfffff800
cmp eax, 0xd800
je 0x1400078c3
movzx eax, cx
shr ax, 0xc
or al, 0xe0
mov byte [rdx], al
movzx eax, cx
shr ax, 6
and cl, 0x3f
and al, 0x3f
or al, 0x80
or cl, 0x80
mov byte [rdx + 1], al
mov byte [rdx + 2], cl
jmp 0x140007949
mov eax, r10d
and eax, 0xfffffc00
cmp eax, 0xd800
jne 0x140007940
add rdi, 2
cmp rdi, r9
je 0x140007952
movzx ecx, word [rdi]
mov eax, ecx
and eax, 0xfffffc00
cmp eax, 0xdc00
jne 0x14000793d
and r10d, 0x3ff
and ecx, 0x3ff
add r10d, 0x40
shl r10d, 0xa
add r10d, ecx
mov eax, r10d
shr eax, 0x12
or al, 0xf0
mov byte [rdx], al
mov eax, r10d
shr eax, 0xc
and al, 0x3f
or al, 0x80
mov byte [rdx + 1], al
mov eax, r10d
shr eax, 6
and r10b, 0x3f
and al, 0x3f
or r10b, 0x80
or al, 0x80
mov byte [rdx + 2], al
mov byte [rdx + 3], r10b
add rdx, 4
jmp 0x1400023a5
mov rdi, r8
mov word [rdx], 0xbfef
mov byte [rdx + 2], 0xbd
add rdx, 3
jmp 0x1400023a5
mov word [rdx], 0xbfef
mov byte [rdx + 2], 0xbd
add rdx, 3
jmp 0x1400023ae
mov qword [rbx], r13
mov eax, 0x7f
jmp 0x1400028b8
mov ecx, dword [rsp + 0x40]
mov rdx, rdi
call fcn.1400095f0
mov eax, 0x7f
jmp 0x1400028b8
cmp byte [rax + 1], 0x2d
mov rcx, r13
sete cl
inc rdx
add rcx, rdx
lea rdx, str.contentproc
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1400079c6
jmp 0x140002476
lea rcx, [rax + 1]
lea rdx, str.contentproc
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140002476
mov ecx, 1
call qword [sym.imp.mozglue.dll_void___cdecl_DllBlocklist_Initialize_unsigned_int_]
cmp qword [sym.firefox.exe_g_shared_section], r13
je 0x1400079f5
call fcn.140033a0c
test rax, rax
jne 0x1400079f5
lea rcx, str.Failed_to_initialize_the_sandbox_target_services.
call fcn.140009824
jmp 0x140007c53
call fcn.1400096fc
test eax, eax
js 0x140007c53
mov rcx, qword [0x140042250]
mov r8, rdi
mov edx, r15d
call fcn.140009930
mov rsi, qword [0x140042250]
mov ebx, eax
mov rax, qword [rsi]
mov rdi, qword [rax + 0x18]
mov rcx, rdi
call qword [fcn.140006330]
mov rcx, rsi
call rdi
nop
jmp 0x140002885
mov rax, qword [rsi]
mov rdi, qword [rax + 8]
mov rcx, rdi
call qword [fcn.140006330]
mov rcx, rsi
call rdi
mov rdi, qword [0x140042250]
jmp 0x140002542
mov rax, qword [rsi]
mov rdi, qword [rax + 8]
mov rcx, rdi
call qword [fcn.140006330]
mov rcx, rsi
call rdi
mov rdi, qword [0x140042250]
jmp 0x140002555
lea rcx, str.Couldnt_load_XPCOM._n
call fcn.140009824
jmp 0x140007c4a
cmp byte [rax], r13b
jne 0x140002618
jmp 0x1400025f3
cmp byte [rdi + 1], 0x2d
lea rdx, [0x1400369b8]
mov rcx, r13
sete cl
inc rax
add rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140007ad8
jmp 0x140002615
lea rcx, [rdi + 1]
lea rdx, [0x1400369b8]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140002615
cmp r15d, 2
jne 0x140007af4
lea rcx, str.Incorrect_number_of_arguments_passed_to__app
call fcn.140009824
mov ebx, 0xff
jmp 0x140002841
mov rsi, qword [rbx + 0x10]
lea rdx, str.XUL_APP_FILE_s
mov rdi, rbx
lea rcx, [rbp - 0x60]
add rbx, 0x10
mov r8, rsi
call fcn.140009590
lea rcx, [rbp - 0x60]
call qword [sym.imp.mozglue.dll_strdup]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__putenv]
test eax, eax
je 0x140007b43
lea rdx, [rbp - 0x60]
lea rcx, str.Couldnt_set__s._n
call fcn.140009824
mov ebx, 0xff
jmp 0x140002841
mov rax, qword [rdi]
add r15d, 0xfffffffe
mov qword [rbx], rax
jmp 0x14000263e
cmp byte [rax + 1], 0x2d
mov rcx, r13
sete cl
inc rdx
add rcx, rdx
lea rdx, str.xpcshell
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140007b91
jmp 0x14000263e
lea rcx, [rax + 1]
lea rdx, str.xpcshell
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x14000263e
mov rcx, r15
cmp r15, 1
jle 0x140007ba4
lea rsi, [rbx + 0x10]
dec rcx
rep movsq qword [rdi], qword [rsi]
call fcn.1400339b0
mov rbx, qword [0x140042250]
mov qword [rsp + 0x50], rax
mov rax, qword [rbx]
mov rsi, qword [rax + 0x40]
mov rcx, rsi
call qword [fcn.140006330]
mov r8, qword [rsp + 0x48]
lea rax, [rsp + 0x50]
mov r9, r12
mov qword [rsp + 0x20], rax
lea edx, [r15 - 1]
mov rcx, rbx
call rsi
nop
jmp 0x14000283f
cmp byte [rsi], r13b
je 0x140002647
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x78], rsi
jmp 0x14000265f
call fcn.140033870
test al, al
jne 0x1400026cc
jmp 0x1400026ae
mov rdi, r13
jmp 0x140002788
mov rdi, r13
jmp 0x1400027e6
lea rcx, str.Couldnt_initialize_the_broker_services._n
call fcn.140009824
mov ebx, 0xff
jmp 0x140002841
mov rbx, r13
lea rcx, str.Couldnt_find_the_application_directory._n
call fcn.140009824
test rbx, rbx
je 0x140007c53
mov rcx, rbx
call qword [sym.imp.mozglue.dll_free]
mov ebx, 0xff
jmp 0x140002885