Function at 0x4056e0
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rax, qword [0x004ee2f8]
mov rdx, qword [0x004ee300]
sub rdx, rax
cmp rdx, 0x13
jbe 0x405bb5
movabs rcx, 0x5f5443454c4c4f43
mov dword [rax + 0x10], 0x3d534e4f
mov r9d, dword [0x004ee164]
mov qword [rax], rcx
movabs rcx, 0x4954504f5f434347
mov qword [rax + 8], rcx
mov rax, qword [0x004ee2f8]
add rax, 0x14
test r9d, r9d
mov qword [0x004ee2f8], rax
jg 0x4057dd
cmp qword [0x004ee300], rax
je 0x405bde
mov byte [rax], 0
mov rax, qword [0x004ee2f8]
mov rdx, qword [0x004ee2f0]
add rax, 1
cmp rax, rdx
je 0x405bd2
mov rcx, qword [0x004ee310]
mov r8, qword [0x004ee2e8]
add rax, rcx
not rcx
and rax, rcx
mov rcx, qword [0x004ee300]
mov r9, rax
mov qword [0x004ee2f8], rax
sub r9, r8
mov rdi, rcx
sub rdi, r8
cmp r9, rdi
jbe 0x4057ba
mov qword [0x004ee2f8], rcx
mov rax, rcx
lea rcx, [0x004ee400]
mov qword [0x004ee2f0], rax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
jmp fcn.00405460
lea rbp, [0x004ee2e0]
xor r14d, r14d
xor r13d, r13d
mov rcx, r14
add rcx, qword [0x004ee168]
mov edx, dword [rcx + 0x10]
and edx, 0x14
cmp edx, 4
je 0x405956
mov rdx, qword [0x004ee300]
sub rdx, rax
cmp rdx, 1
jbe 0x405b79
mov r8d, 0x2d27
mov word [rax], r8w
mov rax, qword [0x004ee2f8]
mov rdi, qword [rcx]
lea rsi, [rax + 2]
mov qword [0x004ee2f8], rsi
jmp 0x405889
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_memcpy
add rbx, qword [0x004ee2f8]
mov rax, qword [0x004ee300]
sub rax, rbx
mov qword [0x004ee2f8], rbx
cmp rax, 3
jbe 0x4058d0
mov dword [rbx], 0x27275c27
mov rax, qword [0x004ee2f8]
lea rdi, [r12 + 1]
lea rsi, [rax + 4]
mov qword [0x004ee2f8], rsi
mov edx, 0x27
mov rcx, rdi
call sub.msvcrt.dll_strchr
test rax, rax
mov r12, rax
je 0x405992
mov rbx, rax
mov rax, qword [0x004ee300]
sub rbx, rdi
sub rax, rsi
cmp rbx, rax
jbe 0x405840
mov rdx, rbx
mov rcx, rbp
call fcn.004682f0
mov rsi, qword [0x004ee2f8]
jmp 0x405840
mov edx, 4
mov rcx, rbp
call fcn.004682f0
mov rbx, qword [0x004ee2f8]
jmp 0x40586c
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov rbx, rax
mov rax, qword [0x004ee300]
sub rax, rsi
cmp rbx, rax
ja 0x405af0
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_memcpy
add rbx, qword [0x004ee2f8]
cmp qword [0x004ee300], rbx
mov qword [0x004ee2f8], rbx
je 0x405b10
mov byte [rbx], 0x27
mov rax, qword [0x004ee2f8]
add rax, 1
add r12, 8
mov qword [0x004ee2f8], rax
jne 0x405a03
add r13d, 1
cmp r13d, dword [0x004ee164]
jge 0x40574f
cmp qword [0x004ee300], rax
je 0x405b9c
mov byte [rax], 0x20
mov rax, qword [0x004ee2f8]
add r14, 0x18
add rax, 1
mov qword [0x004ee2f8], rax
jmp 0x4057ea
mov rcx, rdi
call sub.msvcrt.dll_strlen
mov rbx, rax
mov rax, qword [0x004ee300]
sub rax, rsi
cmp rbx, rax
ja 0x405b49
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_memcpy
add rbx, qword [0x004ee2f8]
cmp qword [0x004ee300], rbx
mov qword [0x004ee2f8], rbx
je 0x405b60
mov rdx, qword [0x004ee168]
mov byte [rbx], 0x27
mov rax, qword [0x004ee2f8]
mov r12, qword [rdx + r14 + 8]
add rax, 1
mov qword [0x004ee2f8], rax
test r12, r12
je 0x405956
cmp qword [r12], 0
je 0x405956
mov rdx, qword [0x004ee300]
sub rdx, rax
cmp rdx, 1
jbe 0x405b30
mov edx, 0x2720
mov word [rax], dx
mov rax, qword [0x004ee2f8]
lea rsi, [rax + 2]
mov qword [0x004ee2f8], rsi
mov rdi, qword [r12]
jmp 0x405a8a
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_memcpy
add rbx, qword [0x004ee2f8]
mov rax, qword [0x004ee300]
sub rax, rbx
mov qword [0x004ee2f8], rbx
cmp rax, 3
jbe 0x405ad0
mov dword [rbx], 0x27275c27
mov rax, qword [0x004ee2f8]
lea rdi, [r15 + 1]
lea rsi, [rax + 4]
mov qword [0x004ee2f8], rsi
mov edx, 0x27
mov rcx, rdi
call sub.msvcrt.dll_strchr
test rax, rax
mov r15, rax
je 0x4058f0
mov rbx, rax
mov rax, qword [0x004ee300]
sub rbx, rdi
sub rax, rsi
cmp rbx, rax
jbe 0x405a42
mov rdx, rbx
mov rcx, rbp
call fcn.004682f0
mov rsi, qword [0x004ee2f8]
jmp 0x405a42
mov edx, 4
mov rcx, rbp
call fcn.004682f0
mov rbx, qword [0x004ee2f8]
jmp 0x405a6e
mov rdx, rbx
mov rcx, rbp
call fcn.004682f0
mov rsi, qword [0x004ee2f8]
jmp 0x40590e
mov edx, 1
mov rcx, rbp
call fcn.004682f0
mov rbx, qword [0x004ee2f8]
jmp 0x405937
mov edx, 2
mov rcx, rbp
call fcn.004682f0
mov rax, qword [0x004ee2f8]
jmp 0x405a22
mov rdx, rbx
mov rcx, rbp
call fcn.004682f0
mov rsi, qword [0x004ee2f8]
jmp 0x4059b0
mov edx, 1
mov rcx, rbp
call fcn.004682f0
mov rbx, qword [0x004ee2f8]
jmp 0x4059d9
mov rcx, rbp
mov edx, 2
call fcn.004682f0
mov rcx, r14
mov rax, qword [0x004ee2f8]
add rcx, qword [0x004ee168]
jmp 0x405817
mov edx, 1
mov rcx, rbp
call fcn.004682f0
mov rax, qword [0x004ee2f8]
jmp 0x405974
lea rcx, [0x004ee2e0]
mov edx, 0x14
call fcn.004682f0
mov rax, qword [0x004ee2f8]
jmp 0x40570b
or byte [0x004ee330], 2
jmp 0x40577a
lea rcx, [0x004ee2e0]
mov edx, 1
call fcn.004682f0
mov rax, qword [0x004ee2f8]
jmp 0x40575c