Function at 0x140031da0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x138
mov rsi, rcx
lea rcx, str.RMAN_ARCHITECTURE
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
jne 0x140031df0
lea r8, str._architecture__s
lea r9, str.windows_x86_64
lea rdi, [rsp + 0x30]
mov edx, 0x100
mov rcx, rdi
call fcn.140031660
mov rcx, rdi
call fcn.14001ed20
test rax, rax
lea rdi, str.windows_x86_64
cmovne rdi, rax
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
movzx r15d, byte [rsi]
cmp rax, 4
jb 0x140031f30
mov rbx, rax
cmp r15b, 0x2f
jne 0x140031e4f
movsx ebp, byte [rsi + 1]
cmp ebp, 0x2f
jne 0x140031e5e
movsx r14d, byte [rsi + 2]
mov ecx, r14d
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalpha]
test eax, eax
je 0x140031e5e
cmp byte [rsi + 3], 0x2f
jne 0x140031e5e
lea rdx, str._c:_
lea rcx, [rsp + 0x30]
mov r8d, r14d
jmp 0x140031e85
cmp rbx, 4
ja 0x140031edb
jmp 0x140031f4d
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalpha]
test eax, eax
je 0x140031e93
cmp byte [rsi + 2], 0x7c
jne 0x140031e93
cmp byte [rsi + 3], 0x2f
jne 0x140031e93
lea rdx, str._c:_
lea rcx, [rsp + 0x30]
mov r8d, ebp
call fcn.140004730
add rsi, 4
jmp 0x140031f52
mov al, 0x2f
cmp rbx, 4
jbe 0x140031f33
cmp bpl, 0x2f
jne 0x140031edb
movsx ebp, byte [rsi + 2]
mov ecx, ebp
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalpha]
test eax, eax
je 0x140031edb
cmp byte [rsi + 3], 0x7c
jne 0x140031edb
cmp byte [rsi + 4], 0x2f
jne 0x140031edb
lea rdx, str._c:_
lea rcx, [rsp + 0x30]
mov r8d, ebp
call fcn.140004730
add rsi, 5
jmp 0x140031f52
cmp rbx, 6
jb 0x140031f30
cmp r15b, 0x2f
jne 0x140031f4d
movzx ebp, byte [rsi + 1]
cmp bpl, 0x2f
jne 0x140031f3b
mov bpl, 0x2f
cmp byte [rsi + 2], 0x2f
jne 0x140031f3b
movsx ebx, byte [rsi + 3]
mov ecx, ebx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalpha]
test eax, eax
je 0x140031f3b
cmp byte [rsi + 4], 0x7c
jne 0x140031f3b
cmp byte [rsi + 5], 0x2f
jne 0x140031f3b
lea rdx, str._c:_
lea rcx, [rsp + 0x30]
mov r8d, ebx
call fcn.140004730
add rsi, 6
jmp 0x140031f52
mov eax, r15d
cmp al, 0x2f
jne 0x140031f4d
movzx ebp, byte [rsi + 1]
cmp bpl, 0x2f
jne 0x140031f4d
inc rsi
mov word [rsp + 0x30], 0x2f
jmp 0x140031f52
mov byte [rsp + 0x30], 0
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov r15, rax
add r15d, 0xfffffffb
mov rcx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov r14, rax
lea rcx, [rsp + 0x30]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rbx, rax
lea eax, [r14 + rax + 1]
movsxd r14, eax
movsxd rbp, r15d
lea r15, [0x1401247aa]
lea r12, str._ARCH
mov r13, rsi
jmp 0x140031faa
add rax, 5
add r14, rbp
mov r13, rax
mov rcx, r13
mov rdx, r15
call sub.VCRUNTIME140.dll_strstr
test rax, rax
jne 0x140031fa0
mov rcx, r13
mov rdx, r12
call sub.VCRUNTIME140.dll_strstr
test rax, rax
jne 0x140031fa0
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
mov r14, rax
lea rdx, [rsp + 0x30]
mov rcx, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
mov qword [rsp + 0x28], r14
add rbx, r14
lea r15, [0x1401247aa]
lea r12, str._ARCH
mov r14, qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncpy]
jmp 0x140032044
mov eax, r13d
sub eax, esi
movsxd rbp, eax
mov rcx, rbx
mov rdx, rsi
mov r8, rbp
call r14
add rbx, rbp
mov rcx, rbx
mov rdx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add rbx, rax
add r13, 5
mov rsi, r13
mov rcx, rsi
mov rdx, r15
call sub.VCRUNTIME140.dll_strstr
mov r13, rax
test rax, rax
jne 0x140032010
mov rcx, rsi
mov rdx, r12
call sub.VCRUNTIME140.dll_strstr
mov r13, rax
test rax, rax
jne 0x140032010
mov rcx, rbx
mov rdx, rsi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
mov rax, qword [rsp + 0x28]
add rsp, 0x138
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret