Function at 0x140004880
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r14, rcx
mov esi, edx
mov ecx, 0x18
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
xor ebp, ebp
mov rbx, rax
test rax, rax
jne 0x1400048b2
mov ebx, ebp
jmp 0x1400048ef
mov ecx, 0x8000
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400048ca
mov rbx, rbp
jmp 0x1400048ef
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call fcn.140021acb
mov qword [rbx], rdi
mov qword [rbx + 8], rdi
mov dword [rbx + 0x10], 0x8000
mov dword [rbx + 0x14], 0x8000
mov ecx, dword [rbx + 0x10]
cmp ecx, 0x2000
jge 0x140004910
mov r15, rbp
mov qword [rsp + 0x60], rbp
mov r13, rbp
mov r12, rbp
mov rdi, rbp
jmp 0x1400049c1
mov rdx, qword [rbx + 8]
lea r8d, [rcx - 0x2000]
mov dword [rbx + 0x10], r8d
mov r15, rdx
lea rax, [rdx + 0x2000]
mov qword [rbx + 8], rax
cmp r8d, 0x2000
jge 0x140004946
mov qword [rsp + 0x60], rbp
mov r13, rbp
mov r12, rbp
mov rdi, rbp
jmp 0x1400049c1
mov rcx, rax
add r8d, 0xffffe000
add rax, 0x2000
mov dword [rbx + 0x10], r8d
mov qword [rbx + 8], rax
mov qword [rsp + 0x60], rcx
cmp r8d, 0x2000
jge 0x140004977
mov r13, rbp
mov r12, rcx
mov rdi, rbp
jmp 0x1400049c1
add r8d, 0xffffe000
mov qword [rsp + 0x60], rcx
mov r13, rax
mov dword [rbx + 0x10], r8d
add rax, 0x2000
mov r12, rcx
mov qword [rbx + 8], rax
cmp r8d, 0x2000
jge 0x1400049a5
mov rdi, rbp
jmp 0x1400049c1
mov rdi, rax
mov qword [rsp + 0x60], rcx
add rax, 0x2000
mov qword [rbx + 8], rax
lea eax, [r8 - 0x2000]
mov dword [rbx + 0x10], eax
cmp esi, 4
jb 0x140004a60
mov ecx, dword [r14]
call qword [sym.imp.WS2_32.dll_ntohl]
lea rdx, [r14 + 4]
lea r8d, [rsi - 4]
mov r14, rdx
mov esi, r8d
test eax, eax
je 0x140004a18
cmp eax, 0x2000
jge 0x140004a18
cmp r8d, eax
jl 0x140004a18
movsxd rcx, eax
sub esi, eax
mov qword [rsp + 0x70], rcx
lea r14, [rcx + rdx]
test rdx, rdx
je 0x140004a18
mov r8, rcx
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x70]
mov byte [rax + r15], bpl
cmp esi, 4
jb 0x140004a60
mov ecx, dword [r14]
call qword [sym.imp.WS2_32.dll_ntohl]
add r14, 4
sub esi, 4
test eax, eax
je 0x140004a60
cmp eax, 0x2000
jge 0x140004a60
cmp esi, eax
jl 0x140004a60
mov rdx, r14
movsxd r12, eax
add r14, r12
sub esi, eax
test rdx, rdx
je 0x140004a5b
mov r8, r12
mov rcx, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [r12 + r13], bpl
mov r12, qword [rsp + 0x60]
cmp esi, 2
jb 0x140004a72
movzx ecx, word [r14]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx ebp, ax
xor r8d, r8d
movsx ebp, bp
xor edx, edx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov esi, eax
test eax, eax
je 0x140004ab3
lea ecx, [rax + 1]
cmp ecx, 0x2000
jae 0x140004ab3
xor edx, edx
mov r8d, 0x2000
mov rcx, r12
call fcn.140021acb
mov r8d, esi
mov rdx, r12
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov r9d, 0x2000
mov r8, r12
mov edx, r9d
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat_s]
mov r9d, 0x2000
mov r8, r13
mov edx, r9d
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strncat_s]
test bpl, 1
je 0x140004b18
lea rcx, [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_Wow64DisableWow64FsRedirection]
mov rax, 0xffffffffffffffff
cmp byte [rdi + rax + 1], 0
lea rax, [rax + 1]
jne 0x140004af5
lea edx, [rax + 1]
mov rcx, rdi
call fcn.1400046a0
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.KERNEL32.dll_Wow64RevertWow64FsRedirection]
jmp 0x140004b36
mov rax, 0xffffffffffffffff
nop
cmp byte [rdi + rax + 1], 0
lea rax, [rax + 1]
jne 0x140004b20
lea edx, [rax + 1]
mov rcx, rdi
call fcn.1400046a0
movsxd r8, dword [rbx + 0x14]
xor edx, edx
mov rcx, qword [rbx]
call fcn.140021acb
mov rcx, qword [rbx]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret