Function at 0x14005dc60
Capabilities:
Query environment variable

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x410]
sub rsp, 0x510
mov rax, qword [0x1401b5030]
xor rax, rsp
mov qword [rbp + 0x400], rax
mov rdi, qword [rbp + 0x470]
mov r12, rdx
mov r15, rcx
mov edx, 0x104
add rcx, 0xb98
mov rbx, r9
call fcn.14012209c
mov r8, rbx
lea rcx, [r15 + 0xc9c]
mov edx, 0x38
call fcn.14012209c
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [r15 + rax + 0xb98], 0
jne 0x14005dcd0
test rax, rax
je 0x14005dd03
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [r15 + rax + 0xc9c], 0
jne 0x14005dcf0
test rax, rax
jne 0x14005dd5b
lea r8, [r15 + 0xb98]
mov edx, 0x104
lea rcx, [r15 + 0xb98]
call fcn.14012209c
lea r8, [r15 + 0xc9c]
mov edx, 0x38
lea rcx, [r15 + 0xc9c]
call fcn.14012209c
mov rcx, qword [0x1402bb178]
lea r9, [0x14005e270]
xor r8d, r8d
mov qword [rsp + 0x20], r15
mov edx, 0xd8
mov rcx, qword [rcx + 0xb98]
call qword [sym.imp.USER32.dll_DialogBoxParamA]
lea r8, [r15 + 0xb98]
mov edx, 0x104
lea rcx, [rbp - 0x80]
call fcn.14012209c
lea r8, [0x1401987b4]
mov edx, 0x104
lea rcx, [rbp - 0x80]
call fcn.1401220fc
lea r8, [r15 + 0xc9c]
mov edx, 0x104
lea rcx, [rbp - 0x80]
call fcn.1401220fc
lea rcx, [rsp + 0x40]
call fcn.14012a5f8
lea rcx, [rsp + 0x40]
call fcn.14012f4a8
mov r9, rax
lea r8, str._d__m__Y__H__M__S
mov edx, 0x50
lea rcx, [rbp + 0x90]
call fcn.14012f174
lea r8, [0x14019a094]
mov edx, 0x104
lea rcx, [rbp - 0x80]
call fcn.1401220fc
lea r8, [rbp + 0x90]
mov edx, 0x104
lea rcx, [rbp - 0x80]
call fcn.1401220fc
mov r8, rdi
lea rcx, [rbp - 0x80]
mov edx, 0x104
call fcn.1401220fc
mov r8d, 0x104
lea rdx, [rbp + 0xe0]
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor ebx, ebx
mov dword [rsp + 0x50], 1
xor r8d, r8d
mov qword [rsp + 0x58], rbx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x60], rbx
lea rcx, [rsp + 0x48]
call qword [sym.imp.gdiplus.dll_GdiplusStartup]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x38], rbx
xor edx, edx
mov rcx, r12
call qword [sym.imp.gdiplus.dll_GdipCreateBitmapFromHBITMAP]
mov rsi, qword [rsp + 0x38]
lea rdx, str..jpeg
mov ecx, ebx
movzx eax, byte [rdi + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x14005df2a
cmp rcx, 6
jne 0x14005de65
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x34], ebx
lea rcx, [rsp + 0x34]
mov dword [rsp + 0x30], ebx
call qword [sym.imp.gdiplus.dll_GdipGetImageEncodersSize]
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x14005dfff
mov ecx, eax
call fcn.14012d1e8
mov rdi, rax
test rax, rax
je 0x14005dfff
mov edx, dword [rsp + 0x30]
mov r8, rax
mov ecx, dword [rsp + 0x34]
call qword [sym.imp.gdiplus.dll_GdipGetImageEncoders]
mov r9d, dword [rsp + 0x34]
test r9d, r9d
je 0x14005dff7
lea r10, [0x14019a098]
nop dword [rax]
mov r8d, ebx
imul rax, r8, 0x68
mov rdx, qword [rax + rdi + 0x40]
mov rax, 0xffffffffffffffff
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [r10 + rax*2 + 2]
jne 0x14005df15
add rax, 2
cmp rax, 0xb
je 0x14005df21
movzx ecx, word [rdx + rax*2]
cmp cx, word [r10 + rax*2]
je 0x14005def3
inc ebx
cmp ebx, r9d
jb 0x14005dee0
jmp 0x14005dff7
imul rax, r8, 0x68
jmp 0x14005dfee
mov rcx, rbx
lea rdx, str..png
movzx eax, byte [rdi + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x14005e073
cmp rcx, 5
jne 0x14005df34
lea rdx, [rsp + 0x34]
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x34], ebx
call qword [sym.imp.gdiplus.dll_GdipGetImageEncodersSize]
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x14005dfff
mov ecx, eax
call fcn.14012d1e8
mov rdi, rax
test rax, rax
je 0x14005dfff
mov edx, dword [rsp + 0x34]
mov r8, rax
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.gdiplus.dll_GdipGetImageEncoders]
mov r10d, dword [rsp + 0x30]
mov r8d, ebx
test r10d, r10d
je 0x14005dff7
lea r11, str.image_png
nop word [rax + rax]
mov r9d, r8d
mov rcx, rbx
imul rax, r9, 0x68
mov rdx, qword [rax + rdi + 0x40]
nop
movzx eax, word [rdx + rcx*2]
cmp ax, word [r11 + rcx*2]
jne 0x14005e065
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r11 + rcx*2 + 2]
jne 0x14005e065
add rcx, 2
cmp rcx, 0xa
jne 0x14005dfc0
imul rax, r9, 0x68
movups xmm0, xmmword [rax + rdi]
movups xmmword [rsp + 0x68], xmm0
mov rcx, rdi
call fcn.140122088
mov r8d, 0x104
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x1f0]
call fcn.14012c7bc
xor r9d, r9d
lea r8, [rsp + 0x68]
lea rdx, [rbp + 0x1f0]
mov rcx, rsi
call qword [sym.imp.gdiplus.dll_GdipSaveImageToFile]
mov rcx, rsi
call qword [sym.imp.gdiplus.dll_GdipDisposeImage]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.gdiplus.dll_GdiplusShutdown]
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.14011b0c0
add rsp, 0x510
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
inc r8d
cmp r8d, r10d
jb 0x14005dfb0
jmp 0x14005dff7
mov rcx, rbx
lea rdx, str..gif
nop dword [rax]
movzx eax, byte [rdi + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x14005e144
cmp rcx, 5
jne 0x14005e080
lea rdx, [rsp + 0x34]
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x34], ebx
call qword [sym.imp.gdiplus.dll_GdipGetImageEncodersSize]
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x14005dfff
mov ecx, eax
call fcn.14012d1e8
mov rdi, rax
test rax, rax
je 0x14005dfff
mov edx, dword [rsp + 0x34]
mov r8, rax
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.gdiplus.dll_GdipGetImageEncoders]
mov r10d, dword [rsp + 0x30]
mov r8d, ebx
test r10d, r10d
je 0x14005dff7
lea r11, str.image_gif
nop word [rax + rax]
mov r9d, r8d
mov rcx, rbx
imul rax, r9, 0x68
mov rdx, qword [rax + rdi + 0x40]
nop
movzx eax, word [rdx + rcx*2]
cmp ax, word [r11 + rcx*2]
jne 0x14005e137
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r11 + rcx*2 + 2]
jne 0x14005e137
add rcx, 2
cmp rcx, 0xa
jne 0x14005e110
jmp 0x14005dfea
inc r8d
cmp r8d, r10d
jb 0x14005e100
jmp 0x14005dff7
mov rcx, rbx
lea rdx, str..bmp
nop
movzx eax, byte [rdi + rcx]
inc rcx
cmp al, byte [rdx + rcx - 1]
jne 0x14005dfff
cmp rcx, 5
jne 0x14005e150
lea rdx, [rsp + 0x34]
mov dword [rsp + 0x30], ebx
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x34], ebx
call qword [sym.imp.gdiplus.dll_GdipGetImageEncodersSize]
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x14005dfff
mov ecx, eax
call fcn.14012d1e8
mov rdi, rax
test rax, rax
je 0x14005dfff
mov edx, dword [rsp + 0x34]
mov r8, rax
mov ecx, dword [rsp + 0x30]
call qword [sym.imp.gdiplus.dll_GdipGetImageEncoders]
mov r10d, dword [rsp + 0x30]
mov r8d, ebx
test r10d, r10d
je 0x14005dff7
lea r11, str.image_bmp
nop word [rax + rax]
mov r9d, r8d
mov rcx, rbx
imul rax, r9, 0x68
mov rdx, qword [rax + rdi + 0x40]
nop
movzx eax, word [rdx + rcx*2]
cmp ax, word [r11 + rcx*2]
jne 0x14005e207
movzx eax, word [rdx + rcx*2 + 2]
cmp ax, word [r11 + rcx*2 + 2]
jne 0x14005e207
add rcx, 2
cmp rcx, 0xa
jne 0x14005e1e0
jmp 0x14005dfea
inc r8d
cmp r8d, r10d
jb 0x14005e1d0
jmp 0x14005dff7