Function at 0x1400046d0
Capabilities:
Query environment variable

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r12, qword [rsp + 0xa8]
xor r13d, r13d
mov rbx, r9
mov r14, qword [rsp + 0xa0]
mov r9, rdx
cmp byte [rsp + 0xb8], r13b
jne 0x14000498e
mov rax, qword [r8]
lea r8, [r11 - 0x30]
mov r10d, dword [rbx]
mov ecx, dword [r9]
lea r9, [r11 - 0x38]
movzx ebp, byte [rsp + 0xc0]
sub ecx, r10d
mov byte [rsp + 0x30], bpl
lea rdx, [rax + r10*8]
lea rax, [0x1405f7840]
mov qword [r11 - 0x50], rax
lea rax, [0x1405f7610]
mov qword [r11 - 0x58], rax
call fcn.140002f50
add dword [rbx], eax
cmp qword [0x1405f7610], r13
jne 0x140004776
lea rcx, str.MYSQL_GROUP_SUFFIX
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov qword [0x1405f7610], rax
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x1400047a7
cmp byte [0x1405f7848], r13b
jne 0x1400047a7
lea rbx, [0x1405f7a50]
mov rdx, rbx
call fcn.140002e10
test eax, eax
jne 0x140004970
mov qword [0x1405f7608], rbx
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400047d8
cmp byte [0x1405f7848], r13b
jne 0x1400047d8
lea rbx, [0x1405f7850]
mov rdx, rbx
call fcn.140002e10
test eax, eax
jne 0x140004970
mov qword [0x1405f7618], rbx
mov byte [0x1405f7848], 1
call fcn.140003290
mov rax, qword [0x1405f7610]
test rax, rax
je 0x140004930
lea rcx, [0x1400072c0]
cmp r14, rcx
jne 0x140004930
mov rbp, 0xffffffffffffffff
mov rsi, rbp
nop
cmp byte [rax + rsi + 1], r13b
lea rsi, [rsi + 1]
jne 0x140004810
mov rcx, qword [r12]
mov r15, qword [r12 + 0x10]
mov r14, qword [rcx + 8]
mov rdx, qword [r15]
mov rax, qword [rcx + 0x10]
shl rdx, 4
sub rax, r14
add rdx, 0xf
and rdx, 0xfffffffffffffff8
cmp rax, rdx
jb 0x14000484d
lea rax, [r14 + rdx]
mov qword [rcx + 8], rax
jmp 0x140004855
call fcn.1400079a0
mov r14, rax
test r14, r14
je 0x140004ad4
mov rax, qword [r15]
mov dword [rsp + 0x40], r13d
test rax, rax
je 0x140004912
nop
mov rax, qword [r15 + 0x10]
mov rbx, rbp
mov rcx, qword [rax + r13*8]
mov qword [r14 + r13*8], rcx
nop
inc rbx
cmp byte [rcx + rbx], 0
jne 0x140004880
mov rcx, qword [r12]
lea rdx, [rsi + 1]
add rdx, rbx
mov edx, edx
add rdx, 7
mov rdi, qword [rcx + 8]
and rdx, 0xfffffffffffffff8
mov rax, qword [rcx + 0x10]
sub rax, rdi
cmp rax, rdx
jb 0x1400048b8
lea rax, [rdi + rdx]
mov qword [rcx + 8], rax
jmp 0x1400048c0
call fcn.1400079a0
mov rdi, rax
test rdi, rdi
je 0x140004ad4
mov r8, qword [r15]
mov rcx, rdi
add r8, r13
mov qword [r14 + r8*8], rdi
mov r8, rbx
mov rdx, qword [r14 + r13*8]
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [0x1405f7610]
lea r8, [rsi + 1]
lea rcx, [rdi + rbx]
call sub.VCRUNTIME140.dll_memcpy
mov edx, dword [rsp + 0x40]
mov rax, qword [r15]
inc edx
mov r13d, edx
mov dword [rsp + 0x40], edx
cmp r13, rax
jb 0x140004870
xor r13d, r13d
add rax, rax
mov qword [r15 + 0x10], r14
mov qword [r15], rax
mov qword [r14 + rax*8], r13
mov r14, qword [rsp + 0xa0]
movzx ebp, byte [rsp + 0xc0]
mov rsi, qword [rsp + 0x80]
mov rcx, rsi
call fcn.140010300
test rax, rax
je 0x140004ade
movzx eax, byte [rsp + 0xb8]
mov r9, rsi
xor r8d, r8d
mov byte [rsp + 0x20], al
mov rdx, r12
mov rcx, r14
call fcn.1400054b0
test eax, eax
js 0x140004be6
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp qword [0x1405f7840], r13
je 0x140004928
lea rcx, [0x1400072c0]
cmp r14, rcx
jne 0x140004928
mov rcx, qword [r12]
mov rbx, qword [r12 + 0x10]
mov r14, qword [rcx + 8]
mov rax, qword [rbx]
lea rdx, [rax*8 + 0x1f]
mov rax, qword [rcx + 0x10]
sub rax, r14
and rdx, 0xfffffffffffffff8
cmp rax, rdx
jb 0x1400049d5
lea rax, [r14 + rdx]
mov qword [rcx + 8], rax
jmp 0x1400049dd
call fcn.1400079a0
mov r14, rax
test r14, r14
je 0x140004ad4
mov edi, r13d
cmp qword [rbx], rdi
jbe 0x140004a15
mov rdx, r13
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
inc edi
mov rcx, qword [rax + rdx*8]
mov qword [r14 + rdx*8], rcx
mov edx, edi
cmp rdx, qword [rbx]
jb 0x140004a00
mov rcx, qword [0x1405f7840]
mov eax, edi
lea r13, [r14 + rax*8]
mov qword [r13], rcx
mov rax, qword [0x1405f7610]
test rax, rax
je 0x140004ac2
mov rbp, 0xffffffffffffffff
mov rsi, rbp
inc rsi
cmp byte [rax + rsi], 0
jne 0x140004a40
nop dword [rax]
inc rbp
cmp byte [rcx + rbp], 0
jne 0x140004a50
mov rcx, qword [r12]
lea rdx, [rbp + 1]
add rdx, rsi
mov edx, edx
add rdx, 7
mov r15, qword [rcx + 8]
and rdx, 0xfffffffffffffff8
mov rax, qword [rcx + 0x10]
sub rax, r15
cmp rax, rdx
jb 0x140004a88
lea rax, [r15 + rdx]
mov qword [rcx + 8], rax
jmp 0x140004a90
call fcn.1400079a0
mov r15, rax
test r15, r15
je 0x140004ad4
mov rdx, qword [r13]
lea ecx, [rdi + 1]
mov qword [r14 + rcx*8], r15
mov r8, rbp
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov rdx, qword [0x1405f7610]
lea r8, [rsi + 1]
lea rcx, [r15 + rbp]
call sub.VCRUNTIME140.dll_memcpy
inc qword [rbx]
inc qword [rbx]
mov rax, qword [rbx]
xor r13d, r13d
mov qword [rbx + 0x10], r14
jmp 0x14000491c
mov eax, 2
jmp 0x140004970
mov rax, qword [0x1405f7618]
test rax, rax
je 0x140004b39
movzx edi, byte [rsp + 0xb8]
lea r9, [0x140054ff8]
mov byte [rsp + 0x38], 0
lea r8, [0x140054ff8]
mov byte [rsp + 0x30], dil
mov rdx, r12
mov dword [rsp + 0x28], r13d
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.140005580
test eax, eax
js 0x140004be6
jle 0x14000496e
mov r8, qword [0x1405f7618]
jmp 0x140004bd9
test bpl, bpl
jne 0x14000496e
mov rbx, qword [rsp + 0xb0]
mov rax, qword [rbx]
test rax, rax
je 0x14000496e
movzx edi, byte [rsp + 0xb8]
nop
cmp byte [rax], 0
je 0x140004b81
mov r9, rsi
mov byte [rsp + 0x20], dil
mov r8, rax
mov rdx, r12
mov rcx, r14
call fcn.1400054b0
test eax, eax
js 0x140004be6
jmp 0x140004bc0
mov rax, qword [0x1405f7608]
test rax, rax
je 0x140004bc0
mov byte [rsp + 0x38], 0
lea r9, [0x140054ff8]
mov byte [rsp + 0x30], dil
lea r8, [0x140054ff8]
mov dword [rsp + 0x28], r13d
mov rdx, r12
mov rcx, r14
mov qword [rsp + 0x20], rax
call fcn.140005580
test eax, eax
js 0x140004be6
jg 0x140004bd2
mov rax, qword [rbx + 8]
add rbx, 8
test rax, rax
jne 0x140004b60
jmp 0x14000496e
mov r8, qword [0x1405f7608]
mov edx, 0x2f
lea ecx, [rdx - 0x2e]
call fcn.14000fee0
mov edx, 0x30
lea ecx, [rdx - 0x2f]
call fcn.14000fee0
mov eax, 1
jmp 0x140004970