Function at 0x405630
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [0x005de2f8]
mov rdx, qword [0x005de300]
sub rdx, rax
cmp rdx, 0x13
jbe 0x405b12
movabs rcx, 0x5f5443454c4c4f43
mov dword [rax + 0x10], 0x3d534e4f
mov r8d, dword [0x005de164]
xor r13d, r13d
mov qword [rax], rcx
lea rbp, [0x005de2e0]
movabs rcx, 0x4954504f5f434347
mov qword [rax + 8], rcx
mov rax, qword [0x005de2f8]
mov qword [rsp + 0x28], 0
mov rdx, qword [0x005de300]
add rax, 0x14
test r8d, r8d
mov qword [0x005de2f8], rax
jle 0x405a55
nop dword [rax]
mov r8, qword [rsp + 0x28]
add r8, qword [0x005de168]
mov rdx, qword [0x005de300]
mov ecx, dword [r8 + 0x10]
and ecx, 0x14
cmp ecx, 4
je 0x405823
sub rdx, rax
cmp rdx, 1
jbe 0x405a30
mov ecx, 0x2d27
mov word [rax], cx
mov rax, qword [0x005de2f8]
mov rdi, qword [r8]
lea rsi, [rax + 2]
mov qword [0x005de2f8], rsi
jmp 0x405759
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_memcpy
add rbx, qword [0x005de2f8]
mov rax, qword [0x005de300]
mov qword [0x005de2f8], rbx
sub rax, rbx
cmp rax, 3
jbe 0x4057a0
mov dword [rbx], 0x27275c27
mov rax, qword [0x005de2f8]
lea rdi, [r12 + 1]
lea rsi, [rax + 4]
mov qword [0x005de2f8], rsi
mov edx, 0x27
mov rcx, rdi
call sub.msvcrt.dll_strchr
mov r15, qword [0x005de300]
mov r12, rax
sub r15, rsi
test rax, rax
je 0x405860
mov rbx, rax
sub rbx, rdi
cmp rbx, r15
jbe 0x405710
mov rdx, rbx
mov rcx, rbp
call fcn.0047ffa0
mov rsi, qword [0x005de2f8]
jmp 0x405710
mov edx, 4
mov rcx, rbp
call fcn.0047ffa0
mov rbx, qword [0x005de2f8]
jmp 0x40573c
mov rcx, r15
call sub.msvcrt.dll_strlen
cmp rax, r14
mov rbx, rax
ja 0x4059c0
mov r8, rbx
mov rdx, r15
mov rcx, rsi
call sub.msvcrt.dll_memcpy
add rbx, qword [0x005de2f8]
cmp rbx, qword [0x005de300]
mov qword [0x005de2f8], rbx
je 0x405a00
mov byte [rbx], 0x27
mov rax, qword [0x005de2f8]
mov rdx, qword [0x005de300]
add rax, 1
add r12, 8
mov qword [0x005de2f8], rax
jne 0x4058d3
add r13d, 1
cmp r13d, dword [0x005de164]
jge 0x405a55
cmp rdx, rax
je 0x405af9
add qword [rsp + 0x28], 0x18
mov byte [rax], 0x20
mov rax, qword [0x005de2f8]
add rax, 1
mov qword [0x005de2f8], rax
jmp 0x4056c0
mov rcx, rdi
call sub.msvcrt.dll_strlen
cmp rax, r15
mov rbx, rax
ja 0x405a19
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_memcpy
add rbx, qword [0x005de2f8]
cmp rbx, qword [0x005de300]
mov qword [0x005de2f8], rbx
je 0x405ae0
mov rdx, qword [0x005de168]
mov byte [rbx], 0x27
mov rcx, qword [rsp + 0x28]
mov rax, qword [0x005de2f8]
mov r12, qword [rdx + rcx + 8]
add rax, 1
mov rdx, qword [0x005de300]
mov qword [0x005de2f8], rax
test r12, r12
je 0x405823
cmp qword [r12], 0
je 0x405823
sub rdx, rax
cmp rdx, 1
jbe 0x4059e0
mov edx, 0x2720
mov word [rax], dx
mov rax, qword [0x005de2f8]
lea rsi, [rax + 2]
mov qword [0x005de2f8], rsi
mov r15, qword [r12]
jmp 0x405958
mov r8, rbx
mov rdx, r15
mov rcx, rsi
call sub.msvcrt.dll_memcpy
add rbx, qword [0x005de2f8]
mov rax, qword [0x005de300]
mov qword [0x005de2f8], rbx
sub rax, rbx
cmp rax, 3
jbe 0x4059a0
mov dword [rbx], 0x27275c27
mov rax, qword [0x005de2f8]
lea r15, [rdi + 1]
lea rsi, [rax + 4]
mov qword [0x005de2f8], rsi
mov edx, 0x27
mov rcx, r15
call sub.msvcrt.dll_strchr
mov r14, qword [0x005de300]
mov rdi, rax
sub r14, rsi
test rax, rax
je 0x4057c0
mov rbx, rax
sub rbx, r15
cmp rbx, r14
jbe 0x405910
mov rdx, rbx
mov rcx, rbp
call fcn.0047ffa0
mov rsi, qword [0x005de2f8]
jmp 0x405910
mov edx, 4
mov rcx, rbp
call fcn.0047ffa0
mov rbx, qword [0x005de2f8]
jmp 0x40593c
mov rdx, rax
mov rcx, rbp
call fcn.0047ffa0
mov rsi, qword [0x005de2f8]
jmp 0x4057d4
mov edx, 2
mov rcx, rbp
call fcn.0047ffa0
mov rax, qword [0x005de2f8]
jmp 0x4058eb
mov edx, 1
mov rcx, rbp
call fcn.0047ffa0
mov rbx, qword [0x005de2f8]
jmp 0x4057fd
mov rdx, rax
mov rcx, rbp
call fcn.0047ffa0
mov rsi, qword [0x005de2f8]
jmp 0x405874
mov edx, 2
mov rcx, rbp
call fcn.0047ffa0
mov r8, qword [rsp + 0x28]
mov rax, qword [0x005de2f8]
add r8, qword [0x005de168]
jmp 0x4056f0
cmp rdx, rax
je 0x405b3b
mov byte [rax], 0
mov rax, qword [0x005de2f8]
mov rdx, qword [0x005de2f0]
lea rcx, [rax + 1]
cmp rcx, rdx
je 0x405b2f
mov r8, qword [0x005de310]
lea rax, [rcx + r8]
not r8
mov rcx, qword [0x005de300]
and rax, r8
mov r8, qword [0x005de2e8]
mov r9, rax
mov qword [0x005de2f8], rax
mov rdi, rcx
sub r9, r8
sub rdi, r8
cmp r9, rdi
jbe 0x405abd
mov qword [0x005de2f8], rcx
mov rax, rcx
lea rcx, [0x005de400]
mov qword [0x005de2f0], rax
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.004053b0
mov edx, 1
mov rcx, rbp
call fcn.0047ffa0
mov rbx, qword [0x005de2f8]
jmp 0x40589d
mov edx, 1
mov rcx, rbp
call fcn.0047ffa0
mov rax, qword [0x005de2f8]
jmp 0x40583d
lea rcx, [0x005de2e0]
mov edx, 0x14
call fcn.0047ffa0
mov rax, qword [0x005de2f8]
jmp 0x40565b
or byte [0x005de330], 2
jmp 0x405a7c
lea rcx, [0x005de2e0]
mov edx, 1
call fcn.0047ffa0
mov rax, qword [0x005de2f8]
jmp 0x405a5e