Function at 0x4e7160
Capabilities:
Query environment variable

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x148
cmp byte [rdx + 0x18], 0
je 0x4e7195
mov qword [rsp + 0xc8], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0xd8], xmm0
mov rbx, qword [rdx + 0x10]
jmp 0x4e731a
mov rbx, qword [rdx + 0x10]
test rbx, rbx
je 0x4e76c7
mov qword [rsp + 0x118], rdx
mov qword [rsp + 0xc8], rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0xd8], xmm0
call sub.kernel32.dll_GetEnvironmentStringsW
test rax, rax
je 0x4e773c
mov qword [rsp + 0xe8], rax
mov qword [rsp + 0xf0], rax
lea r13, [rsp + 0xb0]
lea r14, [rsp + 0xe8]
lea r15, [rsp + 0xf8]
lea r12, [rsp + 0x28]
lea rbp, [rsp + 0x90]
lea rcx, [rsp + 0x48]
mov rdx, r14
call fcn.004d8b70
cmp byte [rsp + 0x60], 2
je 0x4e7305
movups xmm0, xmmword [rsp + 0x48]
movups xmm1, xmmword [rsp + 0x58]
movaps xmmword [rsp + 0x130], xmm1
movaps xmmword [rsp + 0x120], xmm0
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rax, qword [rsp + 0x128]
mov rcx, qword [rsp + 0x130]
add rcx, rax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x30], rax
mov word [rsp + 0x38], 0
mov rcx, r15
mov rdx, r12
call fcn.004ed2f0
movups xmm0, xmmword [rsp + 0x48]
movups xmm1, xmmword [rsp + 0x58]
movaps xmmword [rsp + 0x90], xmm0
movaps xmmword [rsp + 0xa0], xmm1
mov rax, qword [rsp + 0x108]
mov qword [r13 + 0x10], rax
movups xmm0, xmmword [rsp + 0xf8]
movups xmmword [r13], xmm0
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rsi
lea rax, [rsp + 0x78]
movups xmm0, xmmword [rax]
lea rax, [rsp + 0x38]
movups xmmword [rax], xmm0
mov rcx, r15
lea rdx, [rsp + 0xd0]
mov r8, rbp
mov r9, r12
call fcn.004d3970
cmp byte [rsp + 0x110], 2
je 0x4e7200
mov rdx, qword [rsp + 0xf8]
test rdx, rdx
je 0x4e7200
mov rcx, qword [rsp + 0x100]
mov r8d, 1
call fcn.00442170
jmp 0x4e7200
mov rcx, qword [rsp + 0xe8]
call sub.kernel32.dll_FreeEnvironmentStringsW
mov rdx, qword [rsp + 0x118]
mov rax, qword [rdx]
mov rcx, qword [rdx + 8]
xor edx, edx
test rcx, rcx
sete dl
add rdx, rdx
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rcx
test rcx, rcx
je 0x4e7689
test rbx, rbx
je 0x4e7689
lea rsi, [rsp + 0x50]
lea rdi, [rsp + 0x90]
lea r14, [rsp + 0xd0]
jmp 0x4e739c
mov r8d, 1
call fcn.00442170
mov rbx, qword [rsp + 0x88]
test rbx, rbx
je 0x4e7689
dec rbx
mov qword [rsp + 0x88], rbx
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x4e73c0
cmp eax, 2
jne 0x4e745e
jmp 0x4e76d0
mov rcx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x58]
test rcx, rcx
je 0x4e743e
mov rdx, rcx
and rdx, 7
je 0x4e7561
xor r8d, r8d
nop
mov rax, qword [rax + 0x3d8]
inc r8
cmp rdx, r8
jne 0x4e73e0
mov rdx, rcx
sub rdx, r8
cmp rcx, 8
jb 0x4e743e
nop dword [rax + rax]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
mov rax, qword [rax + 0x3d8]
add rdx, 0xfffffffffffffff8
jne 0x4e7400
mov qword [rsp + 0x48], 1
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 0
mov rcx, rsi
call fcn.00509af0
mov r12, rax
test rax, rax
je 0x4e7689
mov r13, rdx
cmp byte [rdx + 0x18], 2
jne 0x4e74c0
mov rcx, rdi
mov rdx, r14
mov r8, r12
call fcn.004d3b90
cmp byte [rsp + 0xa8], 2
je 0x4e738b
mov rdx, qword [rsp + 0x90]
test rdx, rdx
je 0x4e738b
mov rcx, qword [rsp + 0x98]
jmp 0x4e7380
mov rsi, qword [r12 + 8]
mov rbp, qword [r12 + 0x10]
test rbp, rbp
je 0x4e74ef
js 0x4e76ed
mov edx, 1
mov rcx, rbp
call fcn.00442160
mov r15, rax
test rax, rax
jne 0x4e74f5
jmp 0x4e76f7
mov r15d, 1
mov rcx, r15
mov rdx, rsi
mov r8, rbp
call sub.msvcrt.dll_memcpy
movzx esi, byte [r12 + 0x18]
mov rdx, qword [r12 + 0x28]
mov rdi, qword [r12 + 0x30]
test rdi, rdi
je 0x4e7556
xor ebx, ebx
mov rax, rdi
shr rax, 0x3e
sete al
jne 0x4e7709
lea r12, [rdi + rdi]
mov bl, al
add rbx, rbx
test r12, r12
je 0x4e7573
mov rcx, r12
mov r14, rdx
mov rdx, rbx
call fcn.00442160
mov rdx, r14
mov r14, rax
test r14, r14
jne 0x4e757f
jmp 0x4e7713
mov r14d, 2
xor r12d, r12d
jmp 0x4e757f
mov rdx, rcx
cmp rcx, 8
jae 0x4e7400
jmp 0x4e743e
mov r14, rbx
test r14, r14
je 0x4e7713
mov rcx, r14
mov r8, r12
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x98], r15
mov qword [rsp + 0xa0], rbp
mov byte [rsp + 0xa8], sil
mov eax, dword [rsp + 0x28]
mov ecx, dword [rsp + 0x2b]
lea rdx, [rsp + 0xa9]
mov dword [rdx], eax
mov dword [rdx + 3], ecx
mov qword [rsp + 0xb0], rdi
mov qword [rsp + 0xb8], r14
mov qword [rsp + 0xc0], rdi
mov rbx, qword [r13 + 8]
mov rsi, qword [r13 + 0x10]
test rsi, rsi
je 0x4e7604
js 0x4e7723
mov edx, 1
mov rcx, rsi
call fcn.00442160
mov r14, rax
test rax, rax
jne 0x4e760a
jmp 0x4e772d
mov r14d, 1
mov rcx, r14
mov rdx, rbx
mov r8, rsi
call sub.msvcrt.dll_memcpy
movzx eax, byte [r13 + 0x18]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], rsi
mov byte [rsp + 0x40], al
lea rcx, [rsp + 0xf8]
lea r14, [rsp + 0xd0]
mov rdx, r14
lea rdi, [rsp + 0x90]
mov r8, rdi
lea r9, [rsp + 0x28]
call fcn.004d3970
cmp byte [rsp + 0x110], 2
lea rsi, [rsp + 0x50]
je 0x4e738b
mov rdx, qword [rsp + 0xf8]
test rdx, rdx
je 0x4e738b
mov rcx, qword [rsp + 0x100]
jmp 0x4e7380
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xc8]
mov qword [rcx + 0x18], rax
movups xmm0, xmmword [rsp + 0xd0]
movups xmmword [rcx + 8], xmm0
mov qword [rcx], 1
mov rax, rcx
add rsp, 0x148
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rcx], 0
jmp 0x4e76b0
lea rcx, [0x006831e0]
lea r8, [0x00683268]
mov edx, 0x2b
call fcn.00552640
jmp 0x4e77af
call fcn.0052e5b0
jmp 0x4e77af
mov edx, 1
mov rcx, rbp
call fcn.0052ffb0
jmp 0x4e77af
call fcn.0052e5b0
jmp 0x4e77af
mov rcx, r12
mov rdx, rbx
call fcn.0052ffb0
jmp 0x4e77af
call fcn.0052e5b0
jmp 0x4e77af
mov edx, 1
mov rcx, rsi
call fcn.0052ffb0
jmp 0x4e77af
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x28]
mov qword [rsp + 0x90], rax
lea rax, [0x004dc9b0]
mov qword [rsp + 0x98], rax
lea rax, str.failure_getting_env_string_from_OS:
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 1
mov qword [rsp + 0x48], 0
lea rax, [rsp + 0x90]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 1
lea rdx, str.library_std_src_sys_windows_os.rs
lea rcx, [rsp + 0x48]
call fcn.005525c0
ud2