Function at 0x14000634d
Capabilities:
Query environment variable

Disassembly:
jmp 0x1403778d0
push rsi
push rdi
push rbx
sub rsp, 0x190
mov rsi, rcx
mov rax, qword [0x14056a550]
xor rax, rsp
mov qword [rsp + 0x188], rax
mov rax, qword [rdx + 0x38]
cmp rax, 9
ja case.default.0x140377907
lea rcx, [0x140377ccc]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
or byte [rsi + 0x295], 0x30
jmp 0x1403779ef
lea r8, str.for_open.c
mov ecx, 8
mov edx, 2
mov r9d, 0xc30
call fcn.140004539
jmp case.0x140377907.0
mov byte [rsi + 0x280], 0
and byte [rsi + 0x295], 0xcf
jmp case.0x140377907.0
mov eax, 0xffffcfff
and eax, dword [rsi + 0x294]
or eax, 0x1000
mov dword [rsi + 0x294], eax
mov byte [rsi + 0x280], 2
jmp case.0x140377907.0
mov eax, 0xffffcfff
and eax, dword [rsi + 0x294]
or eax, 0x1000
mov dword [rsi + 0x294], eax
mov byte [rsi + 0x280], 1
jmp case.0x140377907.0
or byte [rsi + 0x295], 0x30
mov byte [rsi + 0x280], 3
jmp case.0x140377907.0
or byte [rsi + 0x295], 0x30
mov byte [rsi + 0x280], 4
jmp case.0x140377907.0
mov eax, 0xffffcfff
and eax, dword [rsi + 0x294]
or eax, 0x1000
mov dword [rsi + 0x294], eax
mov byte [rsi + 0x280], 5
jmp case.0x140377907.0
mov eax, 0xffffcfff
and eax, dword [rsi + 0x294]
or eax, 0x1000
mov dword [rsi + 0x294], eax
mov byte [rsi + 0x280], 6
jmp case.0x140377907.0
and byte [rsi + 0x295], 0xcf
mov byte [rsi + 0x280], 0
mov edi, dword [rsi + 0x1e0]
cmp byte [0x1406eff60], 0
jne 0x140377a0a
call fcn.1400049f8
lea rax, [0x1406eff54]
cmp dword [0x1406eff58], 0
je 0x140377aa5
mov ecx, dword [0x1406eff5c]
test ecx, ecx
jle 0x140377aa5
cmp ecx, 1
jne 0x140377a58
mov edx, ecx
and edx, 0xfffffffe
cmp rdx, rcx
jae 0x140377aa5
lea rcx, [0x1406eff70]
cmp dword [rcx + rdx*4], edi
jg 0x140377aa5
lea rcx, [0x1406f0080]
cmp dword [rcx + rdx*4], edi
jl 0x140377aa5
lea rax, [0x1406eff58]
jmp 0x140377aa5
mov rdx, rcx
shr rdx, 1
xor r8d, r8d
lea r10, [0x1406eff70]
lea r11, [0x1406f0080]
lea r9, [0x1406eff58]
jmp 0x140377a88
inc r8
cmp rdx, r8
je 0x140377a2d
cmp dword [r10 + r8*8], edi
jg 0x140377a94
cmp dword [r11 + r8*8], edi
jge 0x140377aa2
cmp dword [r10 + r8*8 + 4], edi
jg 0x140377a80
cmp dword [r11 + r8*8 + 4], edi
jl 0x140377a80
mov rax, r9
mov eax, dword [rax]
test eax, eax
je 0x140377ad2
cmp eax, 1
jne 0x140377ab9
lea rdx, str.BIG_ENDIAN
jmp 0x140377ac0
lea rdx, str.LITTLE_ENDIAN
mov rcx, rsi
call fcn.140003f5d
mov edi, eax
test eax, eax
jne 0x140377cac
movsx rcx, word [rsi + 0x278]
add rcx, 0xd
lea r8, [rsp + 0x28]
xor edx, edx
call fcn.140003765
mov edi, eax
test eax, eax
jne 0x140377cac
cmp word [rsi + 0x278], 0xfff4
jl 0x140377c42
mov rax, 0xffffffffffffffff
nop dword [rax]
mov rcx, qword [rsp + 0x28]
mov byte [rcx + rax + 1], 0
movsx rcx, word [rsi + 0x278]
lea rdx, [rcx + 0xc]
inc rax
cmp rax, rdx
jl 0x140377b10
movzx ebx, cx
test bx, bx
jle 0x140377c42
movabs rax, 0xffffffff00000000
mov rdi, rbx
shl rdi, 0x20
add rdi, rax
jmp 0x140377b6d
mov rdx, qword [rsp + 0x28]
mov byte [rdx + rbx + 0xb], cl
lea rcx, [rbx - 1]
add rdi, rax
cmp rbx, 1
mov rbx, rcx
jle 0x140377c42
lea ecx, [rbx - 1]
mov rdx, qword [rsi + 0xd0]
movzx ecx, byte [rdx + rcx]
movsx edx, cl
cmp edx, 0x5c
je 0x140377b59
cmp edx, 0x2e
jne 0x140377b50
movsx rdx, word [rsi + 0x278]
mov edx, edx
cmp rbx, rdx
je 0x140377b59
mov rax, qword [rsp + 0x28]
mov byte [rax + rbx + 0xb], cl
mov rax, qword [rsp + 0x28]
sar rdi, 0x20
lea rcx, [rax + rdi]
movabs rdx, 0x4e4f435f54524f46
mov qword [rax + rdi], rdx
mov dword [rax + rdi + 8], 0x54524556
lea rdx, [rsp + 0x30]
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x104
jae 0x140377be6
cmp byte [rsp + 0x30], 0
jne 0x140377c1e
jmp 0x140377beb
mov byte [rsp + 0x30], 0
mov rax, qword [rsp + 0x28]
mov byte [rax + rbx + 0xb], 0x5f
add rdi, qword [rsp + 0x28]
lea rdx, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
dec eax
cmp eax, 0x104
jae 0x140377c3d
cmp byte [rsp + 0x30], 0
je 0x140377c42
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140003f5d
test eax, eax
je 0x140377c42
mov edi, eax
mov rcx, qword [rsp + 0x28]
call fcn.140001b0e
jmp 0x140377cac
mov byte [rsp + 0x30], 0
mov rcx, qword [rsp + 0x28]
call fcn.140001b0e
mov edi, eax
test eax, eax
jne 0x140377cac
mov r8d, dword [rsi + 0x1e0]
lea rdx, str.FORT_CONVERT_d
lea rdi, [rsp + 0x140]
mov rcx, rdi
call fcn.140005b05
lea rdx, [rsp + 0x30]
mov rcx, rdi
mov r8d, 0x105
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
add eax, 0xfffffefb
cmp eax, 0xfffffefc
jb 0x140377caa
cmp byte [rsp + 0x30], 0
je 0x140377caa
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140003f5d
mov edi, eax
test eax, eax
jne 0x140377cac
xor edi, edi
mov rcx, qword [rsp + 0x188]
xor rcx, rsp
call fcn.140003706
mov eax, edi
add rsp, 0x190
pop rbx
pop rdi
pop rsi
ret