Function at 0x180005110
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r14d, dword [0x1800070e0]
mov rdi, rcx
cmp r14d, 0xffffffff
je 0x1800051c0
sub r14d, 1
js 0x180005180
mov r13, qword [0x18000d128]
mov r12, qword [sym.imp.ucrtbase.dll_strcmp]
xor r15d, r15d
lea rbp, [rdi + 1]
nop
lea eax, [r15 + r14]
mov rcx, rbp
mov ebx, eax
shr ebx, 0x1f
add ebx, eax
sar ebx, 1
movsxd rsi, ebx
shl rsi, 4
add rsi, r13
lea rdx, [rsi + 1]
call r12
test eax, eax
je 0x1800051b8
js 0x1800051a0
lea r15d, [rbx + 1]
cmp r15d, r14d
jle 0x180005150
cmp byte [rdi], 0
movzx eax, byte [0x1800070e4]
js 0x1800051b0
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r14d, [rbx - 1]
cmp r14d, r15d
jge 0x180005150
jmp 0x180005180
mov byte [rdi], al
jmp 0x18000518c
movzx eax, byte [rsi]
jmp 0x18000518c
lea rcx, str.WINEDEBUG
call qword [sym.imp.ucrtbase.dll_getenv]
mov dword [0x1800070e0], 0
test rax, rax
je 0x180005180
mov rcx, rax
call qword [sym.imp.ucrtbase.dll__strdup]
test rax, rax
je 0x1800052e5
mov qword [rsp + 0x38], rax
mov qword [rsp + 0xa0], rdi
mov rdi, rax
nop
mov edx, 0x2c
mov rcx, rdi
xor r12d, r12d
call qword [sym.imp.ucrtbase.dll_strchr]
test rax, rax
je 0x18000521d
mov byte [rax], 0
lea r12, [rax + 1]
lea rdx, [0x1800095ea]
mov rcx, rdi
call qword [sym.imp.ucrtbase.dll_strcspn]
lea rcx, [rdi + rax]
movzx edx, byte [rcx]
test dl, dl
je 0x180005280
cmp rdi, rcx
jae 0x180005440
cmp rax, 5
je 0x180005450
cmp rax, 3
je 0x180005475
cmp rax, 4
jne 0x180005270
cmp dword [rdi], 0x6e726177
je 0x1800054b5
nop word [rax + rax]
test r12, r12
je 0x1800052cf
mov rdi, r12
jmp 0x180005200
movzx edx, byte [rdi]
cmp dl, 0x2d
je 0x1800052f8
lea esi, [rdx - 0x2b]
and esi, 0xfd
je 0x180005430
mov r13d, 0xffffffff
xor esi, esi
test dl, dl
je 0x180005270
lea rdx, [0x1800095fd]
mov rcx, rdi
call qword [sym.imp.ucrtbase.dll_strcmp]
test eax, eax
jne 0x180005310
not esi
and sil, byte [0x1800070e4]
or esi, r13d
mov byte [0x1800070e4], sil
test r12, r12
jne 0x180005275
mov rbp, qword [rsp + 0x38]
mov rdi, qword [rsp + 0xa0]
mov rcx, rbp
call qword [sym.imp.ucrtbase.dll_free]
mov r14d, dword [0x1800070e0]
jmp 0x180005134
mov esi, 0xffffffff
xor r13d, r13d
mov rcx, rdi
movzx edx, byte [rcx + 1]
lea rdi, [rcx + 1]
jmp 0x18000529f
mov rcx, rdi
call qword [sym.imp.ucrtbase.dll_strlen]
mov qword [rsp + 0x30], rax
cmp rax, 0xe
ja 0x180005270
mov ebx, dword [0x1800070e0]
mov rax, qword [0x18000d128]
mov r15d, ebx
mov qword [rsp + 0x28], rax
sub r15d, 1
js 0x18000555f
mov dword [rsp + 0x40], ebx
xor ebp, ebp
mov ebx, r15d
lea eax, [rbx + rbp]
mov rcx, qword [rsp + 0x28]
mov r14d, eax
shr r14d, 0x1f
add r14d, eax
sar r14d, 1
movsxd rax, r14d
shl rax, 4
lea r15, [rcx + rax]
mov rcx, rdi
lea rdx, [r15 + 1]
call qword [sym.imp.ucrtbase.dll_strcmp]
test eax, eax
je 0x1800054c9
js 0x180005418
lea ebp, [r14 + 1]
cmp ebx, ebp
jge 0x180005350
movsxd r10, ebp
mov ebx, dword [rsp + 0x40]
mov eax, dword [0x18000d130]
mov r11, r10
shl r11, 4
cmp ebx, eax
jge 0x180005571
mov rax, qword [rsp + 0x28]
lea rdx, [rax + r11]
cmp ebp, ebx
jl 0x18000552f
mov r14, qword [rsp + 0x30]
lea rax, [rdx + 1]
add r14, 1
cmp r14d, 8
jae 0x1800054db
test r14b, 4
jne 0x180005606
test r14d, r14d
je 0x1800053f5
movzx ecx, byte [rdi]
mov byte [rax], cl
test r14b, 2
jne 0x18000561c
mov eax, esi
add ebx, 1
not eax
and al, byte [0x1800070e4]
mov dword [0x1800070e0], ebx
or eax, r13d
mov byte [rdx], al
jmp 0x180005270
lea ebx, [r14 - 1]
cmp ebp, ebx
jle 0x180005350
jmp 0x180005393
mov rcx, rdi
mov r13d, 0xffffffff
jmp 0x180005303
mov rdi, rcx
jmp 0x180005283
cmp dword [rdi], 0x6d786966
je 0x1800054bc
cmp dword [rdi], 0x63617274
jne 0x180005270
cmp byte [rdi + 4], 0x65
mov esi, 8
jne 0x180005270
jmp 0x18000548f
cmp word [rdi], 0x7265
jne 0x180005270
cmp byte [rdi + 2], 0x72
mov esi, 2
jne 0x180005270
cmp dl, 0x2b
je 0x1800055e0
sub edx, 0x2b
and edx, 0xfd
mov r13d, edx
je 0x180005303
mov rdi, rcx
xor r13d, r13d
jmp 0x1800052a3
mov esi, 4
jmp 0x18000548f
cmp byte [rdi + 4], 0x65
mov esi, 1
jne 0x180005458
jmp 0x18000548f
mov edx, esi
not edx
and dl, byte [r15]
or edx, r13d
mov byte [r15], dl
jmp 0x180005270
mov rcx, qword [rdi]
mov qword [rdx + 1], rcx
mov ecx, r14d
mov r8, qword [rdi + rcx - 8]
mov qword [rax + rcx - 8], r8
lea rcx, [rdx + 9]
and rcx, 0xfffffffffffffff8
sub rax, rcx
add r14d, eax
sub rdi, rax
and r14d, 0xfffffff8
mov r10, rdi
cmp r14d, 8
jb 0x1800053f5
and r14d, 0xfffffff8
xor eax, eax
mov r8d, eax
add eax, 8
mov r9, qword [r10 + r8]
mov qword [rcx + r8], r9
cmp eax, r14d
jb 0x180005517
jmp 0x1800053f5
mov r8d, ebx
lea rcx, [r10 + 1]
mov qword [rsp + 0x28], rdx
shl rcx, 4
sub r8d, ebp
movsxd r8, r8d
add rax, rcx
mov rcx, rax
shl r8, 4
call qword [sym.imp.ucrtbase.dll_memmove]
mov rdx, qword [rsp + 0x28]
jmp 0x1800053c0
mov eax, dword [0x18000d130]
cmp ebx, eax
jl 0x180005555
xor r11d, r11d
xor r10d, r10d
xor ebp, ebp
add eax, eax
mov edx, 0x10
mov qword [rsp + 0x48], r11
cmp eax, edx
mov qword [rsp + 0x40], r10
cmovl eax, edx
mov dword [0x18000d130], eax
cdqe
shl rax, 4
mov r8, rax
mov rax, qword gs:[0x30]
mov rax, qword [rax + 0x60]
cmp qword [rsp + 0x28], 0
mov rcx, qword [rax + 0x30]
je 0x1800055ed
mov r9, r8
xor edx, edx
mov r8, qword [rsp + 0x28]
call qword [sym.imp.kernel32.dll_HeapReAlloc]
mov r11, qword [rsp + 0x48]
mov r10, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov qword [0x18000d128], rax
mov ebx, dword [0x1800070e0]
jmp 0x1800053af
mov r13d, esi
mov rdi, rcx
xor esi, esi
jmp 0x180005300
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov r10, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
jmp 0x1800055ce
mov ecx, dword [rdi]
mov r14d, r14d
mov dword [rax], ecx
mov ecx, dword [rdi + r14 - 4]
mov dword [rax + r14 - 4], ecx
jmp 0x1800053f5
mov r14d, r14d
movzx ecx, word [rdi + r14 - 2]
mov word [rax + r14 - 2], cx
jmp 0x1800053f5